78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2023, 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
Size

1.8MB
MD5

2e44a0605f61ead10fd05c924a344d3a
SHA1

62055dd8cbcc83e7bf36c0c44f5ef0bd09883769
SHA256

78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f
SHA512

2bd89a51b4b53a41752c3afd3982da4f89491c65fee55e95ab7317ca3a095e9845916fa9280ca99d9bd883d3b0d1cc59973b855d9db108cc87d85733b156b74a
SSDEEP

49152:Fx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WAmDmg27RnWGj:FvbjVkjjCAzJzD527BWG

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
1412	alg.exe
3012	DiagnosticsHub.StandardCollector.Service.exe
652	fxssvc.exe
500	elevation_service.exe
4924	elevation_service.exe
3216	maintenanceservice.exe
1616	msdtc.exe
2472	OSE.EXE
1564	PerceptionSimulationService.exe
4064	perfhost.exe
3324	locator.exe
2520	snmptrap.exe
3884	spectrum.exe
2692	ssh-agent.exe
664	TieringEngineService.exe
4628	AgentService.exe
4876	vds.exe
3260	vssvc.exe
3500	wbengine.exe
4352	WmiApSrv.exe
3980	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Windows\system32\msiexec.exe	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Windows\System32\msdtc.exe	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\12772fa86b2b65a2.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_123859\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMC4D6.tmp\goopdateres_ml.dll	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMC4D6.tmp\goopdateres_hr.dll	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMC4D6.tmp\goopdateres_th.dll	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMC4D6.tmp\goopdateres_ar.dll	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMC4D6.tmp\goopdate.dll	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUMC4D6.tmp\GoogleUpdateSetup.exe	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMC4D6.tmp\goopdateres_da.dll	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File created	C:\Program Files (x86)\Google\Temp\GUMC4D6.tmp\goopdateres_pt-PT.dll	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMC4D6.tmp\goopdateres_fr.dll	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMC4D6.tmp\goopdateres_de.dll	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009aeab023f91eda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003423ea23f91eda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5dfe322f91eda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3012	DiagnosticsHub.StandardCollector.Service.exe
3012	DiagnosticsHub.StandardCollector.Service.exe
3012	DiagnosticsHub.StandardCollector.Service.exe
3012	DiagnosticsHub.StandardCollector.Service.exe
3012	DiagnosticsHub.StandardCollector.Service.exe
3012	DiagnosticsHub.StandardCollector.Service.exe
3012	DiagnosticsHub.StandardCollector.Service.exe
500	elevation_service.exe
500	elevation_service.exe
500	elevation_service.exe
500	elevation_service.exe
500	elevation_service.exe
500	elevation_service.exe
500	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5004	78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
Token: SeAuditPrivilege	652	fxssvc.exe
Token: SeDebugPrivilege	3012	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	500	elevation_service.exe
Token: SeRestorePrivilege	664	TieringEngineService.exe
Token: SeManageVolumePrivilege	664	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4628	AgentService.exe
Token: SeBackupPrivilege	3260	vssvc.exe
Token: SeRestorePrivilege	3260	vssvc.exe
Token: SeAuditPrivilege	3260	vssvc.exe
Token: SeBackupPrivilege	3500	wbengine.exe
Token: SeRestorePrivilege	3500	wbengine.exe
Token: SeSecurityPrivilege	3500	wbengine.exe
Token: 33	3980	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeDebugPrivilege	500	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4504	3980	SearchIndexer.exe	118
PID 3980 wrote to memory of 4504	3980	SearchIndexer.exe	118
PID 3980 wrote to memory of 3940	3980	SearchIndexer.exe	119
PID 3980 wrote to memory of 3940	3980	SearchIndexer.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe
"C:\Users\Admin\AppData\Local\Temp\78375734256ec0496d502d83f423be349d98bdc68f8022eb2dc537c607785e8f.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1412

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:216

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:652

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:500

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4924

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3216

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1616

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2472

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1564

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4064

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3324

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2520

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3884

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3752

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:664

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4876

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3260

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4352

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4504
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
43d912df2adc3d54266654a80a42880c

SHA1
8e3ba27bd0352ea85076e55df74750e98c0dc7b7

SHA256
a49340130754ca930a685dbb642eca9830eeedf3c1cdb2b4a9dff24e31194a12

SHA512
b4027205d89e54b03cb884faf82fbda47d0222bff921930a0b3915a691542037886731f414d1909cebb3e1dc11ba585902b8b8ef2dfd92f55d7cb0ffddb18d97

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
1975b830cdd710c128180057446c20df

SHA1
e5cc3bc905ca4f4bb725b691d23d1dff41a3f7a4

SHA256
17ff6f25b7ebd149cbf80f9bb20ee473ab48d209cc63218463e083933d89e396

SHA512
d269b9c930213c1b19af47b679828264750b919bdfb95ce7bfe1415cc8af692cc7c65ba5c93dc8cd4a13c3a0769dc530f7e6d9d4cbfe396c1ab328da284cf36e

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
1975b830cdd710c128180057446c20df

SHA1
e5cc3bc905ca4f4bb725b691d23d1dff41a3f7a4

SHA256
17ff6f25b7ebd149cbf80f9bb20ee473ab48d209cc63218463e083933d89e396

SHA512
d269b9c930213c1b19af47b679828264750b919bdfb95ce7bfe1415cc8af692cc7c65ba5c93dc8cd4a13c3a0769dc530f7e6d9d4cbfe396c1ab328da284cf36e

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.6MB

MD5
36205af3a0a477bd67068381ed344da5

SHA1
bb4be30ff997376f4f0f9270c620220251124527

SHA256
4a19f1ba913a7ca6fc30c13edbc397897d88705f740c0b6d05f48f84a408a0d7

SHA512
3880766b24e97c8b4cc60c73a7addc2a924a8e95f70a60ea6786862d949ff4e0ada2d25647b5facfc480ef7ee783789a01b974ca68767b13d10daf82ab636cd4

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.4MB

MD5
32038efb28755e1848b656022c09d217

SHA1
ac1b58db483b88768ba0d7caec909c158cbd6a49

SHA256
bce9bcc6f2936ab7a6dbd6174ddc972f8c36cc01f3a47a24421906a8acf04ddc

SHA512
76df92c3304597ddaff004b25809b797f684822c9abd8a45a94aef4ac43212ee8ff042b6b8bdd5c5ca4a712b3b2efaf522655c690490d27ceaf5469a3c16800e

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.1MB

MD5
7bf9d4071fa60e9a989d1271530bc416

SHA1
d6e2e305fd44959550fb685d4d9543f0b0d86087

SHA256
095e619607b6d38c1d586dac77ca927b42ce2547ad01a53802cf946a9ae8ddbf

SHA512
0d7811fbb2bbd703baf35c6daf986357540fcbbdd5486f68a3936bcabdc271e0d14475864917ea05a8806313f5b08e9eec438cbb0139cb710fcced8647f4cc18

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
1.2MB

MD5
b1c9fc48779cb75d55f847fcc3d261c0

SHA1
371a9adb5147e4ce70267230a9023f2810c98cdf

SHA256
2f406ae068bfccc21f1ae4d303ff0cfb6d7e1216acf682260200f590bf82661f

SHA512
aebfac80caca24d581d478b86ad55fe81edffd9025e42d5d5810e44e6d33905fedddb9ae0e6ef62696b8a270cfba1902a3c8cc424ecaa8e8c8fbcc905367ea03

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
1.4MB

MD5
87d80c30d658fcdfa666e2b59e0bf7ab

SHA1
1f03d89dfb6e7c972c9f5f6a6649a9c586a97c2a

SHA256
284de16cbc8ca7ec3cfa82b28ccf479a428ec20471705bdcd8515237fd84721a

SHA512
92cc19d4ca2482a415aa43a5382305c0278551681c79ba0b87f23bb542838ee6633d6473ba98510a30e980cf0200d7fd2d8ffd3647e6da5a8e659f1ab506d08c

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
6b5036a373b434c5d627e079a092f761

SHA1
776bd9e847c249c7c12efd01b5057a5695f8e4a0

SHA256
0c376bd9e15ce90c111961dc1230198cb07083b4b109bd70146db4113892111c

SHA512
2882a26f6cfbbad91b0de725242dac01a9addf33968e0c517c96386518989188c16c28bf55dc39313548b1609fe8caa091fa7c524b66cff013bb2fc29a220d4e

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
1.5MB

MD5
b74cde5ab14a7072dc377b5af0de46bf

SHA1
91eef291faf502ed6c9f2eb802534ccdba8c5eab

SHA256
9c90ecb2aa32e6011f2e837f764793bb33988e020f350dfbcec6d3df8ed712da

SHA512
9fb5c2dd883dd5a75c9468a73160f9cb02b235ab58c6f80b7132a8c463467e23f6ab4dd0e081f0ca3dbdf599833a1a059ef206b835e3a1d91898282b1e645c0a

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
ef9dd386f0e34f166a0f09a39b7afe0d

SHA1
6f61185de02e86d7c5e002d3bb1243601b8ff064

SHA256
e3d30e5eafad079b6ab419fd5200a1aa3fa85decadfbd3faa6acc60668b8a0dc

SHA512
f85ab73fc35dce0279886f356c38cc68d822760784335c48a7167ef9d733e07105d9d80cbd927fdccd9f0c80b022f92a4f6e28c33f80c8842dad80b1526f42f8

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
ac782ea735f609ab61a8a53a88296942

SHA1
edf8372be11f9a027cf34f8a71aa54e93630899c

SHA256
28d41ce426f593b649b6c0b1812ac64f74ba46d022605b582def801ee9801076

SHA512
ccfba0249467e071fbe708066395e8feda87883c9d603ea6e8ccb3f6be9a881b66d3d131c0b0cf21f89cdce9aa37d7b8d257d1c0da1a848e57557770ffa00dcf

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
56c4f04dfef9e89293f370e9548ae5a2

SHA1
1c5d77b543681a335c7cf4b63298ebf8fd427595

SHA256
d63b71f22a37c086451d1ca818761aa786d71da3415625a4787a12e3dc8989fd

SHA512
f7797cc8a786eeadc2f6ebbe01cbfd060cf3db8bdc0fbf3ec44ffee72c88ac51ec26e878cc9aa4b5c19808a499a63a6c7ca21f67db0eaa801505ad913b6a4d24

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.4MB

MD5
6aac2a605a2e27924d55d750a3c22715

SHA1
a16909f7cbfa82d69704c3d26d87d50b3aaf56c4

SHA256
0e5ea90e4b7a6bab6ce969b5cd76aad37d49c621875045bf4cb7c1319ff21a18

SHA512
4199425d5e5910637e47e75be60854adb1359fbdffe2b728a90a616f6e2b5b82a169407a187f6e48c2990438b2c4e54b6610e6b7aac55cac9caf18a9d5b6d4f8

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
1.3MB

MD5
23e833e942179803f928b840dbf41474

SHA1
68da2a59e730fef9c8861f35806db4e3b31e5a1f

SHA256
f36009bd8cd087c4275d024e7c5e235cf9663357e82d58029399823660b70478

SHA512
d3f1c577a0ebfa8de3d0209345895f769d46982283846b7b1c9efef3b9ddb00587aa16555614ed17ee157233f66b8da1f6dc6e68ab0564a4c05c36d7d6153825

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
4.8MB

MD5
510665275a7eaa445ca91a401425e6ea

SHA1
7d5f4a66633bca992b29140a0e3025c1d8d09266

SHA256
251d588faa3657684aa62dde0212f0ff18a22e1b2d29de3ba9abed0f5165d168

SHA512
30bd0c30be6d828fb38956134bb4f39a556b722baa05d7b5fe7e533cd993eac4b7e150837946e11ec2f525d998430ea184e3329bc5586030ea31f0a5860999d3

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
4.8MB

MD5
41a5d30c9ca5461b6e7286274ecafea3

SHA1
6e0b100f465a60d2f63ae9ff0ade19b5998c9557

SHA256
0798109821bb997544af5fd6ce97b94d52270c5843dd7c291c5de0b9bcae1143

SHA512
48ad5a0b74a0374b4587dfef278a09e69d474424931f5010ad32706c1159f7f3dc2b69367abff33db76869f44fc04280e9e52384549a6d31c1e62c26672cf484

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
2.2MB

MD5
b497dad3be6faf70834ddb23219d4229

SHA1
7de6eaa023fb6099c35f36b89faf7a51d2a009d9

SHA256
557b27b55393cc501a04dab4afb8953e6b97f1829c9c3573e591695041501a01

SHA512
f0190ddeff3f0d3c71e0585d65c615338c19044db0949060aa7e2b61053f0fbbc1280e9ebb8e1041150765b1f8c34739b273c54afa1251dc9346b0395e5fe889

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
b5edc283cf47d84c7daa90100808c428

SHA1
1492b6456d3e25d9524b73cc2a9952a5f0d7441e

SHA256
37e8754afca484ee8d14c556d4750f719b63e883d794cb6842501d36ddbc9d2a

SHA512
d44a35a61c9f1ee2fe55764f0a60351d298084f29981ff07341d6741ceb61ad924d98a042e59fdd9d11a6f99b88090c916040eafa163e447778f82498ee17bbe

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
1.8MB

MD5
ec45350bfc003ba2770a054d19173cf1

SHA1
f936e8c6b87962b2dddb82bb0f493d93c71f1dfa

SHA256
7f199590c22ddbc5040417707ded099f441d9a87712b5707a61ac3ec4363d494

SHA512
bde5519f0df9e7dfcb1d30c02199e50ad1c518dd8b721a897cdc00d7e4613974b41a40f97a8f8b793c0224bf1ef0e813fd3ab6a34f2f22665f16814712429a2d

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.5MB

MD5
612a2ddb62aaaa4d4d507df17296e0c2

SHA1
f4e7ce112c90d09c45fd3e0eb99f81ea2ab3e1c7

SHA256
f5d6102d7ba538e970305ed3e8154dc0b5a25a1eb2853be85cde16aac6b43a7b

SHA512
2170e4c2b50267306cc6fae1ac9fddd8c3e1a225c884a3d489996b22b0455ef12852b552ce356845fed2b88aea3f75205a9991f14a69e1d744c411d56603cae6

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
1.2MB

MD5
60162a9092582ccd10b7ad5d3cbf50d8

SHA1
d332df4f09be4dad5e5ae98779ccf1b3b4d36cc1

SHA256
51435d62d941bfe38b0842318c72e429dad3ecfa648cfbec5190b583c8d58944

SHA512
9c240d15fd6ca09353f73431c04b34c02d86e665ca55d28bde3e9694ab07f7e0e3d0e282f595a961b8ea6e2aabe3bc3ea5dc2453a2ac862bce445d3c2bb331ac

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
1.2MB

MD5
77f596551b56fd5da675c5a592302dd8

SHA1
d735516ece4338c8a9b8583e6398fcb212c05212

SHA256
42050a68b500508d4df6e0799a9bcd75af305b7c17c74ff6a1b597af3e065d4b

SHA512
63d3df0626967ca15b7b163efaa5b76c8b7fd6764f501a812603da1a17d5453835d7b1cc28deec537ccb998ea074fc9683a37aad1312e584d857e62d7cd24996

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe

Filesize
1.2MB

MD5
6de46c702dd647f584964584d24e5e5d

SHA1
2384b4c87bf3f11fdf5faf1dd76185c7f5789756

SHA256
efd60fe45cd7de65c938c30cf44bf6600fbe7540778c96023712468c2b24f2c3

SHA512
bbf5bbbdd441097f5df7b6dd5df4ca4ecbb1e11507d6640759c6294ba947e16358890a2cb9ff44fa938ba45a15ce0ed54d19b76634bd577fad83826935c2f089

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
1.2MB

MD5
2b6220c8136575e46ad2ec292b2026da

SHA1
bec930badb29cc50bdfb02be37d061079928a3a4

SHA256
874794c6b1fa7bb0f4409977b7004ab92745be466f46f04ab4d66f9b1722c16a

SHA512
f2f0590573d573d8ea913c1ee6cce548a869224575b66538199349af7de950b8bf2882bf3eb9fb347637247b407430f76b0ddd92d8e159e4f8b9bf450879117c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
1.2MB

MD5
f4d9d1483dd188842f98cb5813229cc2

SHA1
9a0c6a39b0d1a02247c268d1de4b80bf7283506f

SHA256
fa107e5e04b3e2f0ff4933bb97fc3c540dd2cd88d0bc30126ac93a079e284de6

SHA512
2a4d323ff85cf00fefcf3a9501759def7fc6ec0efec758ed342c6fd211c221edfb8e0e834509ec0a5e7a152e3540d43e0674242a7f45a1280c439bb9b158d4c6

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

Filesize
1.2MB

MD5
46d815035efaaa8397bd55d4d73f5d62

SHA1
6cb50aadada1d228e6d89aeea9f8110fbb0b1f05

SHA256
621526bfa4a89770d9f01fada8414182bc85a08967baf4f1439fff65f52ebc54

SHA512
d540fae2f1028b580ea45ea47fe2c09a1a4e3254658ce68f3b5d1a8c25bc219590546758d3eeb5b34272d9ed4801e60b5fc1dcf4f3730f3b61e741b6d1c7957f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

Filesize
1.2MB

MD5
d329e17dbb0ebf04071efbd4a0af3d43

SHA1
334ab6cb140e0684905e257f250b38ba2e0fc874

SHA256
7b1582a00d460a28ba0e3df4042880c3e05b3cd075bcae38fcc09b942ea8878c

SHA512
06474716e2eab32461c3088ff351ffa0c3f6ac34e49a2eb1a267c191c9dc0e3aa6b6fd770bd6b247b9e3c43fa01b62015042dbcd0edf9ee0fe6489ff06721fee

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe

Filesize
1.4MB

MD5
408c6cec23312cd435941bb063ef84c1

SHA1
7766d0989146848e7c1b516362a8c1cd026756c5

SHA256
38a3e612467ff42ab13958847c0f802bc1ad5d47207b921f48346abceb4b57b4

SHA512
3f559b12425a1a24fa1298873c54ac70131e3ee92d82c2e92c29fd334c3c1951b9a17585d1873a76ceef85a658f9aedfcb950ab063f9a416903ec6f9e17651a5

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe

Filesize
1.2MB

MD5
210c29c99c0b583a0572e95736c37069

SHA1
3e1facb6fcdc09d861ae7751a7966190dedf2fc6

SHA256
5cd9f013741e0034cad4e23d95a4c35ede5bfa76e77b30ae0d1f43272a04acec

SHA512
6b1a7c766195df87a960070380c271f07fe2de1fa082bdbecbd4452038a968881e0057640c3481be39c2df0696ffabea5949be30d27f0553e2efaf44ad350fc5

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

Filesize
1.2MB

MD5
ce1997345ef2cc63618c499f85c38936

SHA1
e6ea0fb5f2f8ea96a29ef558d3f2bbb11e8409cb

SHA256
e2c85b3d47a2bebf0e396640839c77eb76abd275305adce3b0feae0845914f77

SHA512
352b8010f5fda80eab04d8f96b64bf9e8a6ef257b06065b294070563c392c04a5f79eefaeac1b76e0ca6019c7db8e0e3299bdb05976524ec141d9274423ca288

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

Filesize
1.3MB

MD5
64a90d1319b0d62278633c6d287e5ebc

SHA1
2d9359b64951f5f2b21a5b821ad9394411d0b17b

SHA256
86a6ace8fef49033798487360e0b4a83c03f203e13d40ea0383a7adb72cfd087

SHA512
4293854e467d9405bedcbac0e4d9985ce93305fe06f1d61e49eb2157df352a7a3f4c67d078e5e0e6422f77719f4796b7c4340ce34504123fe34c6f953b2c6229

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe

Filesize
1.2MB

MD5
2ac55b0392ec268dd971ef57e0e0d899

SHA1
0582f17c8f5374383f9e8b3453bc80af97f812d1

SHA256
2f0d07862f971432a49ce64b06ad696590861e015f56d2c0549f43d919643d4f

SHA512
856db3f2497018be5c8b67788924e513e50d85289655b3f30f9222a4daeda027231cea1ba63536ad435df67139b2c1df16f8b2488caa6d0a402a6398f5172a48

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe

Filesize
1.2MB

MD5
50ec6361a4ee60a5399708a639388870

SHA1
5f53e79914b35ccf487fec78ff2bc138e1b474ee

SHA256
5f26ee58c2dcb461b487a4af2d5596027bef5cb8a0c2f788552e89ece9c2f78e

SHA512
fe4615d70039b9d8349e510a0bbe21195885ea8c0895a04b0b63a61056db1bd9b93c99ae12dd836495278e582caf5da93efecd9eb8c0b223e0cfacf888960acc

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

Filesize
1.3MB

MD5
38c83d22785cb1ac4c5d43cc40c60512

SHA1
f77d44f89a93c895f330e743a5892d6adce782be

SHA256
d3d1489f2ebe8008f9ffe3b86e7ba615189d275fd7abc74f5d5e500698e59db8

SHA512
e7b8097def265f0b5d6660c8dc9a3b785de406fb8e893b1e5bdc2ff13fcf4d96ceed3112a066c97891d88c4c3159d75730882ee5b91baaf57d5b3d3e2af95ff0

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe

Filesize
1.4MB

MD5
a493fb9ae68d5f8f4f4b3976fff085bf

SHA1
14ccfaeed529bf5dea58c0dcca17d6f58c6804b4

SHA256
62985887712fbc0f3304b2b59605d589dcbf6a5fbf92c40b01407c0d7e21c17e

SHA512
cea4d840746b92f1eba792a9becd3028f4308cc629e9b77af8c917744e9f1b65e5436a1ce920bb389fdb4c3414e389c67af481dc6dd07305298c505eb5955612

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe

Filesize
1.6MB

MD5
3c19db5615c42bba3efe5dae05b352d7

SHA1
72eab2beba5ee3466ed7682009370288882cb6c2

SHA256
2f7b57ae88e8995fef6fb9f306c6e5bc4a40eee1ce4ef8ae4005cb0fda306cf1

SHA512
b00c1ce7581ee2b49fba8da269154e06e8b83979cce629467e9d6ff503bd22052f246ef9ee3bd499e11afcf52385239ab9ebef97ced0e2e95c27ae72b70facc5

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

Filesize
1.2MB

MD5
5f7eb83c698739f81852977374f92b6b

SHA1
7d53ef8b9a5a1b2140b95b1efd434518eaac2c06

SHA256
d05e6c85b3abbf73772dce39b0979b4f4e81f70fcb575790f4c6e100cbfad938

SHA512
2d0ee2820c2ec27f7ae17b75f7dceaa83a5fdc575f35e5f8308c5c88dcf4debeff8dca2daee6e8ee4d6981114a8ada6204ea767330e922b3eec94246d94f6283

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

Filesize
1.2MB

MD5
ed0c780f92491e517a722d8b32dabe89

SHA1
71f9676f4e7f57955f13188b38d6f0ac4e543f60

SHA256
bca64c64afd61608c997e25b59b7cfd1164f0ae376d3251c12d39b2929f1967c

SHA512
8e9b0ff5b704c07af3b9270d461b6465a19a1eb08fbedd5a88b5e87b403ff171a5a9433fbf8b63f6aed8a86819c94997e4f85894202304c264c8c0eb91c5840e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdb.exe

Filesize
1.2MB

MD5
79e7ffd6c8c39d18aa13cda015911e28

SHA1
5152e539b6d19f8a343dfdb241f2794d89bf327e

SHA256
fcd469d83464dc525842f122307b4734bf62808571fd0adc19bc264cded41f18

SHA512
da877cf13ff53dafe05a135459831cb4d02583d984af548d4d334808b38b973ed96cdeea77053d90a6a50be293cdd1cd633260ecb16fc141537f5e0c0ac447a0

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

Filesize
1.2MB

MD5
2e4d5ba9fa5f0678dfe8c03b24e8cbf0

SHA1
630328812098c395d52209995fe34c8e44e6e405

SHA256
2ccfb8bdf82481a7a89dcec8ff08e32cdbf9782c4a40a7d2fbe312f5432b162a

SHA512
d344f6d1306e3a76d7bb728e48daca9eb1abf468c0b91d91d865b484fc6a2d1530f1ef21eb9e8e639119b145a08a0ff88a1fb04c15ebde77612a202c3cf3cea9

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.2MB

MD5
da1a20ac0a1d1bf2f2c4c060fa901b21

SHA1
dd587fbf286bb984f3e1223892f83938f3a86e9f

SHA256
05541d74b9c10283d5aafae4b877727911b2c6c0e55e29b04aeca7b2eb2c97df

SHA512
0590f9a6f97c1a66996ff43fdfff2d1501888c1fc800053058b0975acbd84fc8153aef9afa17db4808ad93aef2e7bc9b168b0685fbd08189e0701dc9c1f0f739

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
27b79aa4e81274a55ea83eb99d567939

SHA1
6168195edb35226d0acaf47a8470125bb33ea61d

SHA256
97db90093ec83de9b1d278b0aec68607c8177735f69fe3db57715cf80dc5a7a3

SHA512
84e44b5ce63a6974297dd5a6d5c0760a4e4cfef8f6a3782ce924fdeb32eb51d0aa1a86ad4391048b93aa7c13e79c7158582e11dca17f49659af4e3541d67d74e

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
1.3MB

MD5
ee0d8924bb365c95175551c3522c60f9

SHA1
2a334a899ed3ee51d230960a2d83d7ceb6ac1877

SHA256
af6af2b207e32a9960cc628b3c9e89c9ff73e9e8ff456b25902b5b8c0b682ed2

SHA512
fa1e0daffd1494dbd339ecce83c0141cb47de8eb89ae05909195b10913dd4015f4f731a7a58a314f2997c0acd320cf1adafda189fbfb3905c0c15f2a0899430d

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
63e90dd282a522c4f1135a46cbd498b9

SHA1
65483320f8431418feb7b2afe8e4f6158321a171

SHA256
8992f5b909927d16134c4fe6a8486e543c16f87faf76f8d10cabfa810fbb8728

SHA512
b15368b9042e27444e59345d82e75645081931f720da92bbc9c0700c41fe773ae7804bd6a6e1d792fe557da252b49372889ab73d297f30bc64bb526f0678c456

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
1659ae42e65e8d5ddd0a50d6c0c55026

SHA1
b9f2c190d0b6192dea9623c895267d6a72cb24dc

SHA256
eec8faa129864548e1abbcf611676394a6ca947808e361f4317c4762a3eceb5a

SHA512
f6d622e5b4a4f37cad0f1a1987da952f79406911ad008099fc073ca4b4e9fd5c0b62410cfd27604fa6cc665c437b09411332f2c47230c1c265409718bc7cf215

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.5MB

MD5
67ae53294200e1b842db7c22ffab3546

SHA1
ad9d47e06a91b3169a1f14e507fd28c277e5b25a

SHA256
da96541b0c26f8bf1e919424f590efbcf502defa1b330774a3ff66d7dee996fd

SHA512
a4ea4242cd5e239b1b9fe587a54c958d996ef061ba43f9ab1321ffcdfe3257b010ee4efe9da0fd04060a28a67f25c492be4862055289488086e28c83884f44c0

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.5MB

MD5
67ae53294200e1b842db7c22ffab3546

SHA1
ad9d47e06a91b3169a1f14e507fd28c277e5b25a

SHA256
da96541b0c26f8bf1e919424f590efbcf502defa1b330774a3ff66d7dee996fd

SHA512
a4ea4242cd5e239b1b9fe587a54c958d996ef061ba43f9ab1321ffcdfe3257b010ee4efe9da0fd04060a28a67f25c492be4862055289488086e28c83884f44c0

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
1.3MB

MD5
4551ca88818b3b0e89d904aab0f920e6

SHA1
99899f3ecf35044f4a75374f4d4f8f8c0ff9a156

SHA256
40d078ec56e465082d4aba0dc4affba6a7fde5b3627ffd102452c4e2bebe83a5

SHA512
2166b5f47965d43708c8a98f21f0c102c3624a1af6cbd8f7bf3bc33db1888566c9564da20757f6b0e40fc10d499f29a36f80055d71ad26efda253ba26ee65cd6

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
fd259cf3e34355867d7c5bf189acda31

SHA1
408fe61e81952711a2bd4d615d4253325a7eff82

SHA256
f026c906d89afc7a10ef70ae2bfe9cc790dbe71629174f0f1b4ffdbc267132b0

SHA512
ccfb0787931fd7166e6b0ea2fc1d58680e84a26d6a2b8ee91b6ba71ce2111ff6a954c97cf30ad25917e29cad5f80a553162c5b379a582076d94ea5d40c9c818f

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
ec94dbf1341a217845e260d0f59ec265

SHA1
561e37b757f9b934ca8100e6c93cf84c73351e15

SHA256
310cf3022b0396ffa5c298ce0913ed74cdb1b3d5d553f19164501e19524b6b53

SHA512
51931dbfc7842218302141a53a3564f2cd5edfefde396c64cc4212bb29302e1c42559f85274fe286a195377b8b7cc09f67ee7b5be1e0c60dbc93b064fb57b367

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
7766387ecdfa3436982377a19e730577

SHA1
0bf3306aa90bd66015b475109e5b2026920f2383

SHA256
b0a58518de69c1dc2f20fd3f9df8266bd95e60da662d78e9e76f181305d610ac

SHA512
caca8341ffcd3edb364846db112932aa9f00d6ae31e55a07c96ec20abba3193367e6b5ee90b0a46f8804d4c2086b20cd6ff818d4a044cdcebb3090777a322b6d

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
1.5MB

MD5
6894f46ac4cf4eedf02bd3af17fd5020

SHA1
f3a5e0a1590166930b1c1decb32f30f8078cfc7a

SHA256
d8363c8a2cd1c24e2835406ee4a121cdb1ea6f2b3807753579cc1932c5937969

SHA512
0ee64a2f29b1c00f9fc51f49b35431ca152f35943d2f06923e0c44e893ce87855fd3cf94121587f87d244ec414bc1a177f9100181b4d06d05195ac3ae0602b73

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
85509435cadc4dce6ed8f261c4430fd6

SHA1
15bef352909dd965bb7dda54f506490f4c0845e5

SHA256
33b3f2d7c454029152d68d2cbebe9e8e2b7a74999a2733b5cc8ac0dad5421db0

SHA512
f4539d03c4f734448430a14b024e67120b15acb1443896fff10ff967366fc63661745de4bf972a6ab3cc9820e5f70495cae34087c59e487422fd14a5bab6cebd

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
c22f05063a508c6ca673f2177cfcf017

SHA1
f27b60868604cacb39395562050b9e01dcbe16e2

SHA256
f108e0b1d8300e19cf42a3fa69a0417b50db8f0aed2b0d1d1c480358e98da2d0

SHA512
3fadd990e350d8c612ce4c68aac5e92c19f894222ea0170d9f3a790d8485782aaf292481c33ec3adc58b09970a046459d753a232faad861459d41a3f6c441dcb

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.3MB

MD5
1c79e30cd28273a591778cade41ead37

SHA1
fc7f480d252cd828bae7d433b9753a977ac5c8e9

SHA256
80396a770c3f8b54f70a8cf6f42c8ee5a526f1bd0f771d861a8e2a67dec776ff

SHA512
9d9462bf26ace604c1dea084e36f98252c31ac58ddb33850ea72cea7eee99171b624e24a39ccd65e81293471290d86605d1dc988e0f2e31eb7d84126ca9a4934

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
b038684f47e04f3e49fcedd26627a54e

SHA1
a76662ca2ff514446b5bac111e85c24ee7ef701c

SHA256
9ea694bfbbb8c4058eff958fa03b4d03d00bd6b68bce60212c3c5d54b17578ea

SHA512
18a55070c6e898e27671e078e71e75a9f6308f4f445c24863182c479403aff8794eba896381846bef25411b00c97c01c3b2de92de80f23ff7b6908ada4ab8c38

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
47b702ecb3c7b1413dd504e2c1573e47

SHA1
5b0df23240ebc799d97b3942cbc2a9bb0420e084

SHA256
0f1fb8defb722499e5ef61485232a0da8f8d7de8bc56d5aef86390cfe72d2b11

SHA512
765ddb8544b6ed211ba2bad23d8573121e0bb6a9e08043eb64c489580fd02c65f1e1497a2b6125379abd0c33180b28bb9d088f72ee157ec4eb860779fde9534d

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
088b568903aed25049621d9960ad4b03

SHA1
b48cf6a908a6a0060c5e9ffa8bc9155b9e991a18

SHA256
7de2e678f217396f751401e8572c8f9a95a981cf5de970061c06b2cfb85675ef

SHA512
46a75c2002fbdfcb889b666026ce55e441c4e00845c9a7991b0cfaa4f72dd0103e2b212290fe910d37977253417ef0946408e79e96377439d1fe60c6559ae1c6

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
58621ac2bad88086f892bf1b7f4b2d66

SHA1
c63d984baf6c1658ada46f263f9ca9ccd359f237

SHA256
0338695ac6ec375ef99e752773871c6a5539802af2d8e8c3b2b05017ca4f452e

SHA512
55072c356187afdf2cedac9e091000713018e9d27ea999153a381790f9b5f5d3ad12caaccdd8950709cbbf5fb615e0ca4c3d274a9e2beca94bcc2977d440467d

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
bc89a72ff8c9b33eacfde675f67202b0

SHA1
34c0865db312add62d42d258d2a3692c28434565

SHA256
485e6bef6629b6c26013d03ba4e0369c19bbf6432f4101ab4789ce629a26d3e5

SHA512
c5e0d6ec801621f8836841d2c9b65c4cceb7f04a3e978a5a38659b2227059d0d0799e9c517bafb50e9b9c13932a53e45f2c5295f12a347185aa9965a78221f21

Download Submit
C:\Windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
63e90dd282a522c4f1135a46cbd498b9

SHA1
65483320f8431418feb7b2afe8e4f6158321a171

SHA256
8992f5b909927d16134c4fe6a8486e543c16f87faf76f8d10cabfa810fbb8728

SHA512
b15368b9042e27444e59345d82e75645081931f720da92bbc9c0700c41fe773ae7804bd6a6e1d792fe557da252b49372889ab73d297f30bc64bb526f0678c456

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
1.2MB

MD5
e028bf20593197324f5861b2fe045e53

SHA1
1caf0c22778c1cb63b2c8d2fec191603f6b48fd2

SHA256
e96885ecd49397fa8837afb7577e9a2e04bbf21181ee8e1e3c4f2e52a5e320bc

SHA512
0ce3f60af1d58ed250de27c56987a7e3407c0b95fb09439a6384ed16542d61d34c5c6c3af3f1e70060e2d686a75b2647a2fe9812151ce141e3ca5a667d26232f

Download Submit
C:\odt\office2016setup.exe

Filesize
5.6MB

MD5
87d47b13ce70097292863871dca481f4

SHA1
71a7fa21bca4fd28af3e4750c588331a0ead750e

SHA256
b2a6b1fe3cf7088316fe132ca9535e46c889c26fc59c7c5cce0f030d1acda8a1

SHA512
ffa4d86af6f3f3bb21dce45584c7a9dd37d213004744a6509eb87717287e71756c4bd94ecc5d60b1e570d65932bfb5f10cf2f216f73885fb84e1b816603c4b11

Download Submit
memory/500-100-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/500-167-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/500-107-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Filesize
384KB

Download
memory/500-99-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Filesize
384KB

Download
memory/652-105-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/652-96-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/664-458-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/664-565-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/1412-138-0x0000000140000000-0x00000001401E9000-memory.dmp

Filesize
1.9MB

Download
memory/1412-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Filesize
1.9MB

Download
memory/1564-420-0x0000000140000000-0x00000001401EA000-memory.dmp

Filesize
1.9MB

Download
memory/1564-160-0x0000000140000000-0x00000001401EA000-memory.dmp

Filesize
1.9MB

Download
memory/1564-159-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Filesize
384KB

Download
memory/1564-166-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Filesize
384KB

Download
memory/1616-139-0x0000000140000000-0x00000001401F8000-memory.dmp

Filesize
2.0MB

Download
memory/1616-415-0x0000000140000000-0x00000001401F8000-memory.dmp

Filesize
2.0MB

Download
memory/2472-147-0x0000000140000000-0x000000014020E000-memory.dmp

Filesize
2.1MB

Download
memory/2472-155-0x00000000008D0000-0x0000000000930000-memory.dmp

Filesize
384KB

Download
memory/2472-419-0x0000000140000000-0x000000014020E000-memory.dmp

Filesize
2.1MB

Download
memory/2472-148-0x00000000008D0000-0x0000000000930000-memory.dmp

Filesize
384KB

Download
memory/2472-154-0x00000000008D0000-0x0000000000930000-memory.dmp

Filesize
384KB

Download
memory/2520-476-0x0000000140000000-0x00000001401D5000-memory.dmp

Filesize
1.8MB

Download
memory/2520-430-0x0000000140000000-0x00000001401D5000-memory.dmp

Filesize
1.8MB

Download
memory/2692-554-0x0000000140000000-0x0000000140241000-memory.dmp

Filesize
2.3MB

Download
memory/2692-447-0x0000000140000000-0x0000000140241000-memory.dmp

Filesize
2.3MB

Download
memory/2692-455-0x0000000000930000-0x0000000000990000-memory.dmp

Filesize
384KB

Download
memory/3012-146-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/3012-16-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/3012-91-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download
memory/3012-15-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download
memory/3216-126-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/3216-136-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/3216-133-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/3216-130-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/3216-123-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/3260-587-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/3260-469-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/3324-252-0x0000000140000000-0x00000001401D4000-memory.dmp

Filesize
1.8MB

Download
memory/3500-471-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/3500-598-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/3884-482-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3884-441-0x00000000007E0000-0x0000000000840000-memory.dmp

Filesize
384KB

Download
memory/3884-433-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3940-568-0x00000203FA830000-0x00000203FA840000-memory.dmp

Filesize
64KB

Download
memory/3940-579-0x00000203FA810000-0x00000203FA820000-memory.dmp

Filesize
64KB

Download
memory/3940-606-0x00000203FA830000-0x00000203FA840000-memory.dmp

Filesize
64KB

Download
memory/3940-566-0x00000203FA810000-0x00000203FA820000-memory.dmp

Filesize
64KB

Download
memory/3940-559-0x00000203FA810000-0x00000203FA820000-memory.dmp

Filesize
64KB

Download
memory/3940-602-0x00000203FA810000-0x00000203FA820000-memory.dmp

Filesize
64KB

Download
memory/3940-560-0x00000203FA820000-0x00000203FA830000-memory.dmp

Filesize
64KB

Download
memory/3940-599-0x00000203FA810000-0x00000203FA820000-memory.dmp

Filesize
64KB

Download
memory/3940-586-0x00000203FA810000-0x00000203FA820000-memory.dmp

Filesize
64KB

Download
memory/3940-578-0x00000203FA830000-0x00000203FA831000-memory.dmp

Filesize
4KB

Download
memory/3980-603-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/3980-479-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/4064-172-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/4064-421-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/4064-171-0x00000000007D0000-0x0000000000837000-memory.dmp

Filesize
412KB

Download
memory/4064-177-0x00000000007D0000-0x0000000000837000-memory.dmp

Filesize
412KB

Download
memory/4352-601-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/4352-478-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/4628-463-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4628-461-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4876-585-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/4876-466-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/4924-112-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4924-118-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/4924-111-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/4924-179-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/5004-1-0x0000000002470000-0x00000000024D7000-memory.dmp

Filesize
412KB

Download
memory/5004-6-0x0000000002470000-0x00000000024D7000-memory.dmp

Filesize
412KB

Download
memory/5004-0-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/5004-122-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/5004-260-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download