bd2e1205ca87afdf0a52cf20879b6eb160f8ee66c75abc76dac06c55a451fcb1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-24_cb0586308b876f56d471a3d8e3da64c1_avoslocker.exe
Size

1.3MB
MD5

cb0586308b876f56d471a3d8e3da64c1
SHA1

c54dafddc09107932a619488c730315bfcec5d9f
SHA256

bd2e1205ca87afdf0a52cf20879b6eb160f8ee66c75abc76dac06c55a451fcb1
SHA512

8f81d6f0ce6198872eff88862b4f109bdaa81ff7519ec3d242e57ca2b204c06469fb2e5f2ffcf5e570871c9908eaf240bba5e9528579ff69ce18ef873c028ee6
SSDEEP

24576:v2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgedfSRQ5UOOU62FBnO+E222YJbNX:vPtjtQiIhUyQd1SkFdV5UbU62FAQ228T

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

Processes:

alg.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEDiagnosticsHub.StandardCollector.Service.exefxssvc.exemsdtc.exePerceptionSimulationService.exeperfhost.exelocator.exeSensorDataService.exesnmptrap.exespectrum.exessh-agent.exeTieringEngineService.exeAgentService.exevds.exevssvc.exewbengine.exeWmiApSrv.exeSearchIndexer.exe

pid	process
3984	alg.exe
4552	elevation_service.exe
4460	elevation_service.exe
3608	maintenanceservice.exe
3624	OSE.EXE
4004	DiagnosticsHub.StandardCollector.Service.exe
3160	fxssvc.exe
468	msdtc.exe
4392	PerceptionSimulationService.exe
1884	perfhost.exe
5016	locator.exe
624	SensorDataService.exe
1532	snmptrap.exe
3092	spectrum.exe
4348	ssh-agent.exe
4536	TieringEngineService.exe
4108	AgentService.exe
4356	vds.exe
1156	vssvc.exe
1940	wbengine.exe
3428	WmiApSrv.exe
4944	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

Processes:

elevation_service.exe2024-05-24_cb0586308b876f56d471a3d8e3da64c1_avoslocker.exealg.exemsdtc.exe

description	ioc	process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-05-24_cb0586308b876f56d471a3d8e3da64c1_avoslocker.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ea7ddea0b4b1389a.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

Processes:

alg.exeelevation_service.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{28C8484C-303E-4CB2-A704-E3FF47E10F7C}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe

Drops file in Windows directory 2 IoCs

Processes:

elevation_service.exemsdtc.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

spectrum.exeSensorDataService.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TieringEngineService.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

SearchIndexer.exeSearchProtocolHost.exeSearchFilterHost.exefxssvc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb4bacede7adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c498d9ede7adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044eb8aede7adda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea2586ede7adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004722e3ede7adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095688ceee7adda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad7494ede7adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9ec6bede7adda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

elevation_service.exe

pid	process
4552	elevation_service.exe
4552	elevation_service.exe
4552	elevation_service.exe
4552	elevation_service.exe
4552	elevation_service.exe
4552	elevation_service.exe
4552	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

672
672

pid	process
672
672

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

2024-05-24_cb0586308b876f56d471a3d8e3da64c1_avoslocker.exealg.exeelevation_service.exefxssvc.exeTieringEngineService.exeAgentService.exevssvc.exewbengine.exeSearchIndexer.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	3492	2024-05-24_cb0586308b876f56d471a3d8e3da64c1_avoslocker.exe
Token: SeDebugPrivilege	3984	alg.exe
Token: SeDebugPrivilege	3984	alg.exe
Token: SeDebugPrivilege	3984	alg.exe
Token: SeTakeOwnershipPrivilege	4552	elevation_service.exe
Token: SeAuditPrivilege	3160	fxssvc.exe
Token: SeRestorePrivilege	4536	TieringEngineService.exe
Token: SeManageVolumePrivilege	4536	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4108	AgentService.exe
Token: SeBackupPrivilege	1156	vssvc.exe
Token: SeRestorePrivilege	1156	vssvc.exe
Token: SeAuditPrivilege	1156	vssvc.exe
Token: SeBackupPrivilege	1940	wbengine.exe
Token: SeRestorePrivilege	1940	wbengine.exe
Token: SeSecurityPrivilege	1940	wbengine.exe
Token: 33	4944	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeDebugPrivilege	4552	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SearchIndexer.exe

description	pid	process	target process
PID 4944 wrote to memory of 1124	4944	SearchIndexer.exe	SearchProtocolHost.exe
PID 4944 wrote to memory of 1124	4944	SearchIndexer.exe	SearchProtocolHost.exe
PID 4944 wrote to memory of 2648	4944	SearchIndexer.exe	SearchFilterHost.exe
PID 4944 wrote to memory of 2648	4944	SearchIndexer.exe	SearchFilterHost.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-05-24_cb0586308b876f56d471a3d8e3da64c1_avoslocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_cb0586308b876f56d471a3d8e3da64c1_avoslocker.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3984

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4460

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3608

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3624

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4720

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3160

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:468

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4392

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1884

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5016

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:624

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1532

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3092

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:880

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1940

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3428

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944

C:\Windows\system32\SearchProtocolHost.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
2⤵
- Modifies data under HKEY_USERS
PID:1124

C:\Windows\system32\SearchFilterHost.exe
"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
2⤵
- Modifies data under HKEY_USERS
PID:2648

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Filesize
2.1MB

MD5
6805e8466830a1c79b5d593d345c36df

SHA1
96a4b8d97f7a00e0b4827158b9addcdcca85653a

SHA256
b44e040b910c3a830089f5b217b652f4f4a8ccdb421b95238ea3aa4fb136d4c9

SHA512
4713bd00b9daf54ffc6da327ff081a53944f36e261868a31a4e347c5bc2ca1bc3d935c4c6d28890a0f2caabe1cad7c417e4a9d5c43b1aa39c103271abd8ac53d

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Filesize
1.4MB

MD5
499573f0e87aedb4b068a4f8c8fd2b20

SHA1
8ae84530ad756f5811e1807abd8c7dc21629d8d3

SHA256
cce1f04f154c77bd2c69bf22aa3ff28efe09f43bcb9c35d59132624bda812e9f

SHA512
d44d39c25786f68ca3fbbf75707f21a746f6b3b805ed1244a6d2ccf8fcbc269ee2cb56f246deeaf9e139cc2131498776934db81be2d1b30de30c12f169b23ae5

Download Submit
C:\Program Files\7-Zip\7z.exe
Filesize
1.7MB

MD5
5ffbc298db3358a354aa8427e9ac1836

SHA1
904d3e673482e37d5afd4c4325a13f86d9afcffc

SHA256
e57a6f49eaf4200b8245b234d96dd5290057cb06299ec1bea437c7e7a0e639be

SHA512
892371ac720e895f67213e5fb81216a83753227f50cd395c9ac094ac91b7325680bb5ce47b20e202aecc43aea807fe0a0f02c30735d3ef75fd03171746968118

Download Submit
C:\Program Files\7-Zip\7zFM.exe
Filesize
1.5MB

MD5
498b952da5a6f24d1fda2e1d1dd9ba6f

SHA1
f63102758c7ff47f80cb28f707f9689d8e1f5d6e

SHA256
4bfd27a6557fe866e6d3f4cd9afbd918748a53eb93f7fa9f1b2441a824f54623

SHA512
0f644420a52f716f99c3601427ab17e2aa7dfce7e604441145408b552a611377f3288d2bdeb1e759570347985ce3e01b49a28da7af04fe7a4d566ddc9f267439

Download Submit
C:\Program Files\7-Zip\7zG.exe
Filesize
1.2MB

MD5
d1e30a85e7fd974d6190ecbcfdca820a

SHA1
ff059f899e0125a6a0ad72ed3450713bb321b21b

SHA256
516a146885daa5647a170d245d666ada01cc6f0a18d068c9a722362b0da5ae34

SHA512
99789a35d97a6b7dae2ebe924680cadd00f1c4e78652717a2d9b2e3fb496aa2762f18ccb066145cfd756b8948c133484ec431cf92fc167d4bbdc3ff9b4120d76

Download Submit
C:\Program Files\7-Zip\Uninstall.exe
Filesize
1.2MB

MD5
bfde24ed12b48a9e32c7c2b70f0d46c0

SHA1
331c26692e715bd4bc815ae232abf41748304336

SHA256
5ae4ecdc8a90476fa7480a7e34a1d266113095d50bc6a4a8e9701c17ab107a47

SHA512
e8c8e875f7579bc071579522978773b769d76ee3fbc41c39f4848d5fb3aa0689abb582f57449f6af66f3d7ea057a234491dd253b6aceea35ee42a5b5e6cbf7b7

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Filesize
1.4MB

MD5
2afa73ecae07766c61b35af26a82b69c

SHA1
09b5077e398f59d1d56217776618c052df19152b

SHA256
4be062ecee1c3e2c7392e4727dbdb8dae7e22462c3c1983c0c038df1e5e557e5

SHA512
9e354cfdaa70abda44370879f7241a97e019f2d8652c1a3cc19b4b14c2c1f5396dc033a6a7483446be41d54d5c65530c21e7ba8bc194d79471328c7c5d70f8fb

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Filesize
4.6MB

MD5
51ef049c0f6c9437b3720bc385572fac

SHA1
329e0700c1e41a5fc11d3afaa0c920bb2451858d

SHA256
7068ffa6b3523e472d2e62a7af19b2999bd1c9f8d480ba5053a3d94c4d0d288e

SHA512
4bf5cdaa2e0ff54f2f87ca9b506c2d6df5e54d605ac9691d9e1d40151257eea5847d71b76e22835b2afb996ec0f6847204e36f7ef52b4194fd1e2920bbfb551b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Filesize
1.5MB

MD5
c18ea2771247d98925aac3b501f5ae4c

SHA1
d687980172e2d0c3b5abe6aa5f5f62c60ad67be2

SHA256
50b900ac879e9d6ed382d211295fd613846a9679970f7f96265294ad3bbe5930

SHA512
03bc8d900fd9eb7a04dbaa93e0435a1159708369acb0442a4b3f2c959721f25922cde7dfe51c474ba1424e8e94340e85e4af10ebffe86f1b05843ca238c4b9ca

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Filesize
24.0MB

MD5
6b845b2bbcd5b26e707d906db79258b3

SHA1
b10da78322fc265c1dc15dd565d6dd3a6cb678ea

SHA256
d95cda71ad0ff42365fc77c5ec138249a44a211faca2d1c0467487acf8ed8105

SHA512
0231ad5bea5fb08b1c55e6086ef0301fbe554acf6c5e426712555fc801150bd24d0fb284ac5860ef47834df46111ba522a6d4d06c5dd095e9b2f68a4418205de

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Filesize
2.7MB

MD5
0e4d59016f016ac74393490cf9257302

SHA1
da0755f61e59f79ac2dd358f02261ffee99f2ac7

SHA256
e02371a5426b47eeaccfa92f3472221af3ca25af7c274d81ddf3937492f82365

SHA512
3579357045a31dac7ead05ce015bdabb8daa8df6113c5f1bfac8f32b69f4c2a2619666b507f5b5cf6433df5328c19840aa266aad098ffb97e313692b63906c67

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Filesize
1.1MB

MD5
5404403373687ce1c0fd7300090ff04e

SHA1
3ca4a0e39fe06e50980de8b516387e12918f7ac5

SHA256
1693b895f70d37383b1a3185746ae81aa7d942971cfe9666f571aab6e5019b33

SHA512
c70ee88e6d25bb4d6288bdeec941d891b93fa18e76efb53fbe28d2db28296acfdde320b663a953f8c681fbd8a25a7b8f1110fa8c7f8a481d7cb532949b1ec887

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Filesize
1.4MB

MD5
812caaed2864c40a4615c84ea02196e0

SHA1
c2dd7c381c7b562d06d32f6eed51e29c0fe2c81a

SHA256
05a444c08f47b07a14b5683b2628ecfb31a802cd4c57576fa552ed5efe7c7095

SHA512
05984ef59c81dc99eb1f308258f4b2e4f442fef3278fb6cd2b75235bd7e23e917ef467f9205fcb063ab3d1f3e24bcc9f9a3bb07ec5d9e86a39eaca4209634665

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Filesize
1.3MB

MD5
de1fbbb6c7262b0167bbbb00e81b99cf

SHA1
96a7348239054eeda81db2a92265e92cf486f8a0

SHA256
f977da9843da17559a66c8b6d0d4a762622eabf3f40f3863080df5d1729d6048

SHA512
73ef3f7f38579d1f01629ec9375cd15ba9f6086c6b540e40928cba423a84e7f573e3449b4e37df058384f6810103c93f93f53ecfb39bdf73c1aa3bd7e199f006

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Filesize
5.4MB

MD5
3634ca360781a838a02cc1c0788a42ad

SHA1
bc7e69572895b8eeb7613cbc1ba9c42851ab1ed5

SHA256
31148f5a607477672254d0029ffe94da89674ace1d6667854f52b6959c5c64d7

SHA512
f1c1eaceb306ee3bc1aa3d1bb440406b3b96cc511341e57fabb26270c232f285e471d7b4056eab7da695aae0d4c376583f0e396130898c0ad78f285ce0eebb5c

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Filesize
5.4MB

MD5
a499ffb824a3fd9fa3a7a1e9d168294c

SHA1
7b530ee8221a07bb32e6c7c7a814a36b694ab985

SHA256
f45d65b1033c8e98b7426e1308674ec89f6ebbdefaedde6f484859ce72442afb

SHA512
a71c0ac57e59e525c628bc7831e09417b6da538c7c362bbf7efe3ecc02a9c804b0f9c29a432efa9bfa9e4f4cec13421c6371fa8482139a6ce4773620aeda191e

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Filesize
2.0MB

MD5
a863f2c711eaa510cfad5074663cb33c

SHA1
af516a752acf08948a28d32beaa75db30cd0c0ef

SHA256
a7441892a737221acb109b8316591f68f2c57c5516993793fdf4448ff0e05201

SHA512
bc22e7186bd9e54318d070ed6a8371b7c03f3965f1be2d4b1d5825b05d6db6dff95e3684363f15466564eb80f53f8a3ce62085eaa4d428eb385f3a5a382e5bda

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Filesize
2.2MB

MD5
94574fa8d480a1a4547719f239501a16

SHA1
7dbd25c36da67a391755a81fda0a6a42e99239ac

SHA256
c4719b241044a5f2a745608824120352576c6f6db3e141f923f071f0559267b7

SHA512
bd5860f3298851063eeaa64e44b0ccbeb0a7e982f4d4de6e305560f8fd6795c272fb7400e33b79872888af2dd2b4577097c91520e0c267269a2f4ce2bb502fe7

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Filesize
1.8MB

MD5
8839b5ccfbad5503cdaed99d0c6d2c1c

SHA1
ada2a8f0b88fea05416e3831787d81dd8e56736c

SHA256
ce5ad1a2f497ec3bb454cac53c35850f3fab514400534b63fe917a6dbdd4efee

SHA512
4993c5128feb84b1883331fdda11d50e933d9dc78f49d3d6d7766cc77a1aa0c5116edc3788cf4d11946ff571ffcde71ff51d2b3b9214ac1ded903be37394dea7

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Filesize
1.7MB

MD5
0a8531fdd08b9347e1ffea099ed73960

SHA1
9bd1ebe0f13408776916a84500f29c7c31242545

SHA256
c627717397b80238be139aba5aa70b631b895e216cbe86110c74cb56f0d885a0

SHA512
512dd734f1887e36fc171d1815f9cf0339adfc2fa2008899326c24ea7a96ba4de7bae1477ecb8e28bad8e15885f82af649103a94f11f8f6a6c682f782520be16

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Filesize
1.2MB

MD5
a134676475f8f60acad7b893e97d90ea

SHA1
d8c414a9a55d464099876fe3746a996c17bab4d4

SHA256
d590f7bfea6fa2e60577e0847e122334b39e434498b633e280d72d5e8f131bb7

SHA512
c07b40f9d9532e0b084b472fd3ec7822bfcf4f627a044c7cfdb2ad673643d032bda1f45f88dbde11eb8c45757cadd8d83a1f18c2ddbc46f150645c8b5f22118e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Filesize
1.2MB

MD5
41ba2759bb7e1d3d60c8b0bb23819b96

SHA1
cc8bb02fa71bcefbbd953d73ff302ade8d885590

SHA256
e185c8e56d747bc682b13a94de652f7ec9f6b5d1e0cea5e2fef4fe1778483735

SHA512
ad9a2090204970a0c6bb0420616baa74ebd802047ac07c1aa7788599cc06c8f9b7ff46cd2aa53b1448081994db6e91b06b19acaab39164c2f7085926e44325b9

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Filesize
1.2MB

MD5
1ba128cc7c622fdb891b116c164c6ab2

SHA1
f49cee0b88ee596768e96cd979adcd4a933c1b27

SHA256
052845a64f18710336d490584743774080c1387bca4502e37c2ed60b58924d29

SHA512
ebe881e29c176cdd5dc820398f7f11f3eb75e0f31986261b572023f370ad89d38ada43cebf1249a8367d975cbee79f401b7b031c4bb6d82a5e3ced0b191c14a0

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Filesize
1.2MB

MD5
5351819ae08cd78d135c18a1d426c3e6

SHA1
12c27664150d53a1dac7cee6328b124a1ad6b90f

SHA256
0bdea86e11a36258d16b3b71faba5bf7bd4e82b25e8a9ee463791d544b3ddad1

SHA512
9f63c77224ec10a3ba03458da59c34ebf043a7919a4c94fb607c2af4c787c0c6f9a969f8988d988a1ff881140b6646b8b5a0cbd2db9d8a9b101a5c210d1624ee

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe
Filesize
1.2MB

MD5
75b994801bf841b5ae759a53a4508d7d

SHA1
b75646cbc6d294ef97b4424a858343cf6c2abdf2

SHA256
e5187767f3afbc2086494a06a062fb1d3bc74c62e0dc72b1ac74b1ead0e13b5c

SHA512
b7bbe1b9842be3773f13a2a8d1f219f51825d1a0bc5986cdccb3d19a83508e5bdac276ae55b8e15fbe1c3b962f7e9d31ed1909d61be6ae0037cd7561782dd19a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Filesize
1.2MB

MD5
17c839cf3d55aab1f234d8e2219e1f41

SHA1
1cc48d5ec3e6ccbd3f6db45f589ef557ca71b191

SHA256
f8d31135e99ea2734e9e8af3ab14d764902fa255814b22f76d4be2b783a15b25

SHA512
9025f92fb37388c29d45d19ec071fc9988865d1022d4fd4244a28cad5f75670457b8a887c0d0edede2cdd5c04e7acbf3ee948f43ad9f9a00c84e1887b2d49cce

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Filesize
1.2MB

MD5
0e7313c9c9635fa6e8bb56d314977899

SHA1
275e70f4970d31b62090de0609d8e775a55595b3

SHA256
4cd6081846acd726ad5926a07c1accb2ff7452e758905df7ac58cb00b0acb016

SHA512
634c2661ef99941943bc72cb5f5461cb30d4035d443d1cdf88f2e957de2e315d08bc45813c42f9cf6ebd275c77ca5ecdadb2f0f98e5fe4b5d5735d7ddd96523e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe
Filesize
1.5MB

MD5
cbc838876761ff1194a67c795fdebe7f

SHA1
29fc7ccdaef129def5388f831b8ddf092d504c45

SHA256
bb45d7bd6976dc2f9c01c9a12e4ad56527af9f72c075026912302cb915ae6a16

SHA512
2b6663f94964799f87a1532714c18ba539c95a86b4e80b3ad6ea1bdc347aa50d26587ee09b3780415b31fa4cb6b1663f4d36ffc720b7d44b895b9d917cde9a68

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe
Filesize
1.2MB

MD5
36c94d425acbcbcee14b79b5201a4256

SHA1
755c190387f2db6d205ecec02c5f68830dfd34e5

SHA256
9ceebef535503406e30154cb65961492bdfc0043c158be35180e11312a6ece9d

SHA512
2021c9f877e28dd1a56dc733c31a2c76881585614a1f65da4a185673d33608f2eb9422d6403e104f241512d700e562793c5f8453ad9acb4e1fdd6af833307566

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Filesize
1.2MB

MD5
dcc7a731e30315b3595b577a91253cd8

SHA1
c6cd37103184d57aef6879dbaa87846f941e96c9

SHA256
b784005870f663c8ea75066821529c97b6fdd6ad6368d3ab3c7b32fe04db8295

SHA512
00238cf56bcdc18bb10ab11cb1fae0c0f6c969f046507cd052988a45dd030053743b46457445d8ac03ef9342b11ca4bf3dd25fc7099f7fc38da7f2b3e4aa638d

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Filesize
1.3MB

MD5
bd079cd7e1f1237acf2ebb2d5e1a01e9

SHA1
ab19a85d3994713ad165370137a069e1c17d35a9

SHA256
d0401afdbb1d128f7231b0cec98c3bba00770ab0d11ac18383054ed7c8a0aa95

SHA512
f7d0dcca4fb22d9c70db635a24843f2e7931e6231bff804c2611673343bf90c8487b5d7c600150112d16e0d46cd87a53c0da5372547992e7cab847c93b75b269

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe
Filesize
1.2MB

MD5
98da3acc5ff94bff7237b95e99675070

SHA1
167d056e3f5708370dba0e2b4005b64bd74ea353

SHA256
652b9aaf7320e410167857c67437b9ca719fea690a3b61f13fa431dfed443b30

SHA512
fc3f688c317941cef7768d308307a42228687a9192628f7117d3351ea740f44afe224519f873893ac69e0dc4507766de12416e16d243e87d61edd52c388de6c4

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe
Filesize
1.2MB

MD5
c6da681b8098f5554bf529ae8c736b87

SHA1
7ff2587a62b8572be86964f23707e5590c6f70b4

SHA256
2e17e5b8de1fd637e51be7f5086f0a06cd51c4a9534695b2365e6a71b72fb420

SHA512
81a02a69698cb04975f19d734a83c678039ff22242ec16b44363bae83ee26882e7a1221a2daa9cc09c58891c48c4a5aba6f44db5ab5daa988dcb29888269d805

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Filesize
1.3MB

MD5
59bbf937854ef119c97bab626ad77b83

SHA1
306446ad8116e8d461c929ee272b5fb1a5949c7b

SHA256
47153ba0e6d58fbfe21db276f6bf61356e79ba4812fdf1fd64ff7a5ff80d9887

SHA512
b30166ff2a470d219bd1e533636b2068b3f90df2fcfb33f31a00fe6aeab7d207d821ae3b1c5e8cf146a0cae40a03545d360b4b909dc0a28c0bfa1b90bf68ee17

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Filesize
1.5MB

MD5
8d5c2b1da0fcdacefa6020061a631729

SHA1
a22a75779bb6d05fe6cdeea6e91f6e58f273f011

SHA256
eaf8ce5eaadb31859926ef80ecce9490a2bd62a8c3377dce986ef500f2a72b05

SHA512
f1d2bb466535557840f6c4d7db7cf2d714715496244a6defaafd0481b5b62a45fae3ac43f4da6477fadcdef574b3bd1caed3ea3dacf6e94e365bed63eb459726

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Filesize
1.6MB

MD5
05f2aa667d3a4abf39bc66c08a022a1f

SHA1
d03899ccd254b84d39cc693c6fa4af2dc0a6a24b

SHA256
2dffc04dbbbeedf8886351f7274cc1b5d694853c8abb12d07f17a9589b6d772e

SHA512
32ecf167fb3cc907d813b3549ff997c6a26945b5ef7efb14fff6e7d204511233fd0455ce250d8f06a214ff3bbec7f3fa1969c5e2666507833f33cc7f6fbec706

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Filesize
1.2MB

MD5
507f6d92d6b7a935c82aebf2603051cc

SHA1
1bac00b3d31639d5f999ca5589686cb6e75639e3

SHA256
dc368d7e0651866c5d1b40f0a5255f08141abcfb5694eb2528b86f310635f03f

SHA512
fa6bda957d5c6cc0afa26651933909663234d711f829cb827d6f91775f61f8156d294c417ac19cd8c4c06eb5b206468aa43af6a65a4200641b8c7c8137d4cb24

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Filesize
1.2MB

MD5
bf74c65b51f33fdee90aaff2d8d975fd

SHA1
7cd922c2795fabaa9c23b8782057419bc9460f9f

SHA256
2da55869d501bf7c6d25fab47ebf1d1b73dcad8898c31efa92252f96cf319e2d

SHA512
fe856ab77b385d6781c0959d34873dc922074573fae71137e06c9cd9740e90ae93b7242041807fe56907d1db4fe12c89b27b155eabfe450f142a226d9c05be81

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Filesize
1.2MB

MD5
3e546d822c0b305a6a1f1ff7104fcba3

SHA1
7653673d9d4018c6d1dfd035cbc48795df423fee

SHA256
09ecabd30fd6dddfb97354ac06e6b2a5c1ff9b37db288ef27c3f656d45a8aed4

SHA512
4948167a4aecb227552bc60931c2b1c37d55f26e3294b2c8991796bb68a3b04294f8a2d916a84596ae1467425537cce611ad58d25362d54c651e3a141e4ded2f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Filesize
1.2MB

MD5
cda6069c2d3c3a2743a342e702a2a549

SHA1
1de46e91ade004644994c64e64fa01f5fb66192c

SHA256
d6fb28a73dfb942b5b8206637e7c372a809ea3497e7e856f2e36c8f9ec81f50b

SHA512
69b66f74d2cb4fdf8f0b6031035901bd42d2304bab64e439a1896e67b3c2fc306a834122fc996090babec8af8832522cadf4d21ea12a1f0d0a22da798455c44b

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Filesize
1.2MB

MD5
3b6a641db0e9e7b3623bf578d1cebaad

SHA1
de0f048b176421df5fbfe76b6a0f14248deb0b7d

SHA256
1375e6cac57b612ca4c081e160cd2d3157a49836a601fb0ddd7c8a190275c5ce

SHA512
2802711d211ddf36475701e3733731a0f05350ae9d15886815e041cbb6d837168a9f615c52842f87e72c2fd30c6f2880894319299b4f221f3e8125ba056ee097

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Filesize
1.2MB

MD5
869d2c5c2a2540b1eb8c20e9cc3bf187

SHA1
dadbb48bae1dc656e66369c48ffb313eb3a2746d

SHA256
8cebb92ea7186736c69ca3a0c9359fa27ab028864d4b898abd711fea8f9cff68

SHA512
b93e2c000ce1f4d385007e8e6cbb526569fbbf60b1803aa607c9db9bce623712979b6503ead8c40368038cb9597c2aa814e2e33e57ab1f1bc51ed41a4f22a68d

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Filesize
1.2MB

MD5
c17632e00a6350bcccf81afea7d60691

SHA1
a3135b83f857ab128263a609f401230f20edc2a1

SHA256
fc03682dc9daeb05cafea628956c307283ddf3ba31da3d0472921f8ae99bf50a

SHA512
a87d2f58010b3df7f3a3c8732ccee250e99e8567971cbce3b67b7078000b967e8830249fc4cc0c92c9386bdfa9dd9a787b4d47ee81df54ef6a7f0e550bfc2a62

Download Submit
C:\Program Files\dotnet\dotnet.exe
Filesize
1.3MB

MD5
e07947bee86ed523a9cbd73cff06fde7

SHA1
484a8650056cbcb2a6c3a4015070d3e7c92e877c

SHA256
963f989b1672a4421a7c4b8b06ce873034753bba3d5b946c87f84750e2d5416e

SHA512
fb0a6b5a31cabbcf84e722fcc601774b2610ebb4df263a954707bc37451b069776e8ed212d79f6e0416945f9870cafdc1ea1a0b9893ed8fe5650a3ccbb17bc0d

Download Submit
C:\Windows\SysWOW64\perfhost.exe
Filesize
1.2MB

MD5
748ffafcf54d7bfad1a0789ff281f74b

SHA1
fc8a99ca2a418a47ae2df6c996e2d5d50a8cc92d

SHA256
d2889b04f71e45bd2a7a5e6d3823fd94d3da7cc794c09115f2c221bbc515cf27

SHA512
b89f23134af4e65c43923765fd425c0913a2095aa3c0781a967aa5ec706e64970f8b049566967e2531d5eef460b517289d0e101959573fe4887e5a27dda3a652

Download Submit
C:\Windows\System32\AgentService.exe
Filesize
1.7MB

MD5
420085142aa014bf7240ffe65ed61d8d

SHA1
47f76b2a734119ea95debbf761332715c32142e1

SHA256
1ed5afec7ce4d6ac171146b78168389bbb194b6da39ce2be95f8dba29601cdd8

SHA512
86943380f067e676cd86c162783db26b1820b49085203d6159c0f957d76f18c2e170a4948386140fec8ca57c3359df18365444e415101e873ccafb4f04cd16c7

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Filesize
1.3MB

MD5
fbf133c4a081b59abde3b586b8f5212f

SHA1
de072d530bb6d26abe1493bb1b2c96a7c396ad1c

SHA256
59fcf9f6b1ac15c650aace24cec687852fdbf9938b5b80ff26f280ef46d5ab4e

SHA512
77551c542de81bd2ce2247d5292c822fb757fe3c7b9ee386a36f17c7a011731c904560a69dcdc841e0d1e86ac6994831905cd7b907ed2bbd31cda7052f693b60

Download Submit
C:\Windows\System32\FXSSVC.exe
Filesize
1.2MB

MD5
f5283fa65e18cb9eb5fffabf8e93e876

SHA1
c7cdbd03843eaedb3e1862c2d46262f3e44d3c12

SHA256
6a5584ecaf32eed5eb52db368d6e094e4c862d2cdf8a79fc2cb1ac85755a796c

SHA512
36e4cfe159aaaa98e1baa8fa4b2382edab302439baf06e07b511481d3c026990685b2389c467e5097be8f7c94afc93b74371534ad9849d89011b09007621c8e0

Download Submit
C:\Windows\System32\Locator.exe
Filesize
1.2MB

MD5
9e07313bf54f0f6cc9a8366be7f5dc64

SHA1
3a9d4cfd7f744ba5f11ce2d97ba1756d2e2074c4

SHA256
8bc1fd7f9be01ba6f4c511e55ce123a37d86f4f52779b3fee488661e3030dcc4

SHA512
45641df579a663970eb2f3b2dd8c7624596eb56bac203bda5944d34e436021600c27f88c67f048900cfc59879edf2d9caacfc42d46906ab45790c3d8d8c09357

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe
Filesize
1.5MB

MD5
aa767e8fcec61acd717dc044c0927e03

SHA1
d0d1d4f65486be990ad14badfb48173be717675e

SHA256
18519a796fb0c83aea5287a6e5afd187d7fb9b2747c09fa62e857d2754beeb34

SHA512
019c1c567e78dcf7820dc91bb258e10df86f67d3fcc83f38a3aacb55c4b2c79b3236696c12df578ebf09e6fffe03cae59a9283bc416c7cc1685697cbf15a23f0

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Filesize
1.3MB

MD5
d245f46777a82158bbbe237a67419b13

SHA1
255df630cdb7a8de047098ff7a17cd8c1366da6a

SHA256
e08e58b303825cfbef331c80ad0fe8c888d1dc4375fb397d47d03044c682534c

SHA512
3b001e239d2c21caae0a19beb68486591c7081d4c05d1be7b81ca513cbe8507712d6771a8d0964d52147f6076ba46fbb95d6d98ded54f7aaa28f45077707dcdb

Download Submit
C:\Windows\System32\SearchIndexer.exe
Filesize
1.4MB

MD5
8c5d7557d6390ae30ef488c6a25f8497

SHA1
b339860e5e54dfb2aa2cad8daa2f13605132adf4

SHA256
35b4cbd3e3f327698d662d270123799954bae7dedd455a1e9112985550e8e26c

SHA512
631579994fc99fe73b26aa952e95dc1c481b0ec66c6733710e4faade67f63b25103746685cf5e7572dba535653af30cded8caba631fa14f020adbd3f4c18d705

Download Submit
C:\Windows\System32\SensorDataService.exe
Filesize
1.8MB

MD5
457e9f33e65e66a37e96ceae288c051c

SHA1
22d863dd8713793e0ef95806223c0f7d8c882c5d

SHA256
98dea390e8287c431bb9744078024efa60e23250accc314e541eb19f7a3fd4de

SHA512
076078894bdae0415385b12566383439ec66ac122a18f32e980fe3451ee68af11cc62bc6d94bd537b913a535d15f56010c857d141ae3917af7dc5f6d16ba5f87

Download Submit
C:\Windows\System32\Spectrum.exe
Filesize
1.4MB

MD5
690e602203a9dbdda953808047e78185

SHA1
8856aeaa264b1fece8739fb54460ed55e31297d9

SHA256
28aa70020143893f4b7ab85ae4c1bd906e9f882bee92b44d48e6eac567c842a0

SHA512
ffee87cf29be7bdfa7b58c8beb154db07588c168ef34caa7dbe4f5f0873c21ea16f42c76d70fb7999bc9dc2f92b1fbf56608746147db78526594af701f41b743

Download Submit
C:\Windows\System32\TieringEngineService.exe
Filesize
1.5MB

MD5
4cb1835a0ede9676c700ef382e5453ad

SHA1
20da867124bd6b154010b90fa1e91be1745efa8d

SHA256
d08d77ec77466a0f3fe2568d837cc13224d8ece6dbe879d5608e5ae2de5f69a8

SHA512
0aa72dd20c75be39eeda26592bc2f7f1bb6460bec12ba70d4d3460d00a19e6a6be338f08edfdbf548173f780ce5815229be3d6e329a149211341bab0c106fea1

Download Submit
C:\Windows\System32\VSSVC.exe
Filesize
2.0MB

MD5
11ec3e883636d29b9f47532362977f16

SHA1
c15b0c6d232484981ca2e00a7c10583826d193d3

SHA256
8bdf1772af5c4dcf09dfb910202b3b7a99713f09ac6257e040d172df4912f1a4

SHA512
891c9cc2c8c98381e0123f3b1881d5487c89157628632cf667286a8931d676a548260ff93c368559a90c917edf1b0e1c6b3c77d11403a16560487e8a0cfaa42d

Download Submit
C:\Windows\System32\alg.exe
Filesize
1.3MB

MD5
559a7d0c8cab9994ad3dee617add3d64

SHA1
8ebf9737598a97415d20002adb6c631320d02e17

SHA256
8c3841bc6a43f4c3ca6c8e938937c889292f47a0d7e7743d572cf09cf2a5c322

SHA512
6f71991a0c878c14a6d2f2fa01fbc11585a278f52dd7bd65ba88d4a145869cbd722e592fd5ef18fbbb15e0298b7af8fd1268078a581a907dc1e33a1fe85deffa

Download Submit
C:\Windows\System32\msdtc.exe
Filesize
1.3MB

MD5
8d8d5358fe54b613507adbc860c770a3

SHA1
320b982a6c3ec53f600e238fff9d9ec5c8e03cae

SHA256
2366941eea024961c427de92098b05f824153d399fc115fcd7a6f2f2481df542

SHA512
c2434b52235efa7dd225354921fc9ec67543476201772b27b2537945d5b2b3a5db9b6a4a5015614a19e528d085bde7796603a461f8bf136eeb4be5aacb814842

Download Submit
C:\Windows\System32\snmptrap.exe
Filesize
1.2MB

MD5
6ac15934af86db5acd265a3b8a015b67

SHA1
b6ceed59da1fa39660aa27018f025f13777b35ba

SHA256
e7db191cd1765e64ab60ec1efa50aeba16f23c580088f0495203a79404c51dc4

SHA512
0da8f1fc0f84bf158e28d42d63df0ea1472644f5e497582be923df1493a0917a9497df4362c975f3507262ff1b385f23571ca4afa936f56226c373248e038297

Download Submit
C:\Windows\System32\vds.exe
Filesize
1.3MB

MD5
ba23d2b8a1b619d1f8dc5cf35d69643f

SHA1
e1604b5ca796391cc8fcd0d68353d206ad12c12a

SHA256
7bb84f9c3d383dcefc7850be79be384d9d5f78cad4d6423571a19216ccc30b63

SHA512
a6f1aaa20e7733baa51d0e6ea109847a3c827662cced047317eab1d526bdd48fbc33294cf12d326bbffe3d812d1f692be6b354903d7551d25ae5baa7debb76f2

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe
Filesize
1.4MB

MD5
9ceb3fb64635f142f17a1b89b26db2be

SHA1
eb6846d86e65ee50617b28d88e1757536fd10246

SHA256
72038f12641101cab5ba4c6982369d3d8882a20d107323c39a155bfacc7488bf

SHA512
f55b2fffdb041e5e31ea1ef0dc0940b56a3f6f704ad5110ccb6f45bc899a4f743c852983d2bcd13e33715a4433e742b1ce5fbb76e56f262a0ee05d8bf1fc4ed5

Download Submit
C:\Windows\System32\wbengine.exe
Filesize
2.1MB

MD5
ef1c17f65ccf9ef9487a2c3746456f24

SHA1
f563cab89768201db18eb58785291b90a2fd15e4

SHA256
b990e839808e9a869363afc57de81af642374131496843aebd26ed6cbb0adbe3

SHA512
aff535cb9e194c70fcaba842e01716f540663bef4a5afcc97d6f236aef8a2c4a781249b76a3daff152a4d9b8829b77c7d4504b69edc436cdf4644b13955ab9f1

Download Submit
memory/468-384-0x0000000140000000-0x0000000140159000-memory.dmp

Filesize
1.3MB

Download
memory/468-272-0x0000000140000000-0x0000000140159000-memory.dmp

Filesize
1.3MB

Download
memory/624-317-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/624-433-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/624-668-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/1156-675-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/1156-397-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/1532-551-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/1532-332-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/1884-408-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1884-299-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1940-676-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/1940-409-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/3092-669-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3092-335-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3160-269-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/3160-258-0x0000000000840000-0x00000000008A0000-memory.dmp

Filesize
384KB

Download
memory/3160-257-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/3428-421-0x0000000140000000-0x0000000140166000-memory.dmp

Filesize
1.4MB

Download
memory/3428-677-0x0000000140000000-0x0000000140166000-memory.dmp

Filesize
1.4MB

Download
memory/3492-3-0x00000000022A0000-0x0000000002307000-memory.dmp

Filesize
412KB

Download
memory/3492-25-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3492-0-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3492-6-0x00000000022A0000-0x0000000002307000-memory.dmp

Filesize
412KB

Download
memory/3608-62-0x0000000140000000-0x0000000140170000-memory.dmp

Filesize
1.4MB

Download
memory/3608-54-0x00000000015E0000-0x0000000001640000-memory.dmp

Filesize
384KB

Download
memory/3608-60-0x00000000015E0000-0x0000000001640000-memory.dmp

Filesize
384KB

Download
memory/3608-65-0x00000000015E0000-0x0000000001640000-memory.dmp

Filesize
384KB

Download
memory/3608-67-0x0000000140000000-0x0000000140170000-memory.dmp

Filesize
1.4MB

Download
memory/3624-75-0x00000000006F0000-0x0000000000750000-memory.dmp

Filesize
384KB

Download
memory/3624-241-0x0000000140000000-0x0000000140170000-memory.dmp

Filesize
1.4MB

Download
memory/3624-77-0x0000000140000000-0x0000000140170000-memory.dmp

Filesize
1.4MB

Download
memory/3984-23-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/3984-24-0x00000000006F0000-0x0000000000750000-memory.dmp

Filesize
384KB

Download
memory/3984-26-0x00000000006F0000-0x0000000000750000-memory.dmp

Filesize
384KB

Download
memory/3984-236-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/3984-15-0x00000000006F0000-0x0000000000750000-memory.dmp

Filesize
384KB

Download
memory/4004-246-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/4004-254-0x0000000140000000-0x0000000140149000-memory.dmp

Filesize
1.3MB

Download
memory/4004-252-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/4004-358-0x0000000140000000-0x0000000140149000-memory.dmp

Filesize
1.3MB

Download
memory/4108-370-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4108-382-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4348-347-0x0000000140000000-0x00000001401A3000-memory.dmp

Filesize
1.6MB

Download
memory/4348-670-0x0000000140000000-0x00000001401A3000-memory.dmp

Filesize
1.6MB

Download
memory/4356-674-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/4356-385-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/4392-293-0x0000000140000000-0x000000014014B000-memory.dmp

Filesize
1.3MB

Download
memory/4392-396-0x0000000140000000-0x000000014014B000-memory.dmp

Filesize
1.3MB

Download
memory/4460-50-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4460-42-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/4460-240-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4460-51-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/4536-359-0x0000000140000000-0x0000000140182000-memory.dmp

Filesize
1.5MB

Download
memory/4536-671-0x0000000140000000-0x0000000140182000-memory.dmp

Filesize
1.5MB

Download
memory/4552-39-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/4552-31-0x0000000000440000-0x00000000004A0000-memory.dmp

Filesize
384KB

Download
memory/4552-37-0x0000000000440000-0x00000000004A0000-memory.dmp

Filesize
384KB

Download
memory/4552-237-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/4944-434-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/4944-678-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/5016-301-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/5016-420-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download