1c3fcae975767fb1d0cf8010c450d8e7d5234d89ee9cc19f809cdc5b5f53a656

Analysis

max time kernel
117s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c3fcae975767fb1d0cf8010c450d8e7d5234d89ee9cc19f809cdc5b5f53a656.exe
Size

677KB
MD5

cb4e247d9ddf2a5f8e6af812b5442cc6
SHA1

5ff2e7e0d8bac321064bd919533bdc565a406591
SHA256

1c3fcae975767fb1d0cf8010c450d8e7d5234d89ee9cc19f809cdc5b5f53a656
SHA512

cecede94dd870227b03da134b95c12a48b2bae02e762e40a5b46f1c944be29b2a7a161ed31bb4a8bcdbf1dd3124dd3be44ac082d899bd182eb565a638f3e7170
SSDEEP

12288:uvXk1fU5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:Sk15wH/BYcCAwQEKesf/NmLeiTd

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 14 IoCs

Processes:

alg.exeDiagnosticsHub.StandardCollector.Service.exefxssvc.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEmsdtc.exePerceptionSimulationService.exeperfhost.exelocator.exeSensorDataService.exesnmptrap.exespectrum.exe

pid	process
2236	alg.exe
2012	DiagnosticsHub.StandardCollector.Service.exe
2688	fxssvc.exe
1584	elevation_service.exe
1004	elevation_service.exe
4560	maintenanceservice.exe
2588	OSE.EXE
1072	msdtc.exe
1640	PerceptionSimulationService.exe
2168	perfhost.exe
572	locator.exe
5008	SensorDataService.exe
4444	snmptrap.exe
2872	spectrum.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 21 IoCs

Processes:

DiagnosticsHub.StandardCollector.Service.exeelevation_service.exemsdtc.exe1c3fcae975767fb1d0cf8010c450d8e7d5234d89ee9cc19f809cdc5b5f53a656.exe

description	ioc	process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	1c3fcae975767fb1d0cf8010c450d8e7d5234d89ee9cc19f809cdc5b5f53a656.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	1c3fcae975767fb1d0cf8010c450d8e7d5234d89ee9cc19f809cdc5b5f53a656.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cfe6de43b3e2edcd.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	1c3fcae975767fb1d0cf8010c450d8e7d5234d89ee9cc19f809cdc5b5f53a656.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	1c3fcae975767fb1d0cf8010c450d8e7d5234d89ee9cc19f809cdc5b5f53a656.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	1c3fcae975767fb1d0cf8010c450d8e7d5234d89ee9cc19f809cdc5b5f53a656.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

Processes:

DiagnosticsHub.StandardCollector.Service.exeelevation_service.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

Processes:

elevation_service.exemsdtc.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

SensorDataService.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

fxssvc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

DiagnosticsHub.StandardCollector.Service.exe

pid	process
2012	DiagnosticsHub.StandardCollector.Service.exe
2012	DiagnosticsHub.StandardCollector.Service.exe
2012	DiagnosticsHub.StandardCollector.Service.exe
2012	DiagnosticsHub.StandardCollector.Service.exe
2012	DiagnosticsHub.StandardCollector.Service.exe
2012	DiagnosticsHub.StandardCollector.Service.exe
2012	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

660
660

pid	process
660
660

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

1c3fcae975767fb1d0cf8010c450d8e7d5234d89ee9cc19f809cdc5b5f53a656.exefxssvc.exeDiagnosticsHub.StandardCollector.Service.exeelevation_service.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1516	1c3fcae975767fb1d0cf8010c450d8e7d5234d89ee9cc19f809cdc5b5f53a656.exe
Token: SeAuditPrivilege	2688	fxssvc.exe
Token: SeDebugPrivilege	2012	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1584	elevation_service.exe

C:\Users\Admin\AppData\Local\Temp\1c3fcae975767fb1d0cf8010c450d8e7d5234d89ee9cc19f809cdc5b5f53a656.exe
"C:\Users\Admin\AppData\Local\Temp\1c3fcae975767fb1d0cf8010c450d8e7d5234d89ee9cc19f809cdc5b5f53a656.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2236

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:732

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1004

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4560

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4388

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1072

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1640

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2168

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:572

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5008

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4444

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
PID:2872

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:4520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1012

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:2228

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4352

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:3776

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1420

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:3948

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4884

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:3036
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe

Filesize
2.2MB

MD5
d2293ec704e5c577eb123bf1d2f75bfd

SHA1
7b94c68a8511f43df0263570d1fa2074de4358e7

SHA256
606d8f97d75ae242429d10a3c76a2333cdcb99b20b51da41c31316224caf1664

SHA512
393952e769f33d877331f2e5b62db17c730ebea9a8e29091834298565cfddbe42964741a46da4239e327c7c96b4f014b33be1502c18ebbbc8ce0a152fa3722a8

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
781KB

MD5
768ebdd3b0bb626d625c037fcf6eb170

SHA1
c039980258d44d12301f3432aa35b66dc5669b7e

SHA256
76b2c89ab5ccc8472a36ee60734f4fc480950911e659aaee028a457425c98c8d

SHA512
4c044a49a7408e9763d8377be57c75b01b58842ac6cb498ae844951e17685bb3926993d4de141b05a46775045c523d4bd992ea4f7ffc5d6cc49d627ffd0ff03a

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.1MB

MD5
c14c29fe507b80c87dc77d6b6340b3c2

SHA1
13d2f49ba34c180d901fcf56f47f62b205863d5c

SHA256
3806e4fb95e047bf453535926cd66a5863b8782c9ce9b622c553fdbb78407c41

SHA512
da448e767ab2c354d6beef4e524c1540e216d0ca48135e64031093b6a67ba996c1e5b8ab895d3af0ac2082be4887388149989fc38eff593e8152af915ff26e73

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
b5c91cae7d35603b368e6a37702bd853

SHA1
1797722d4ed97be51d115606b207c55951d32169

SHA256
0674ad7652e25d273fb995c2a030221f44d0750b1f37b2ad6ab5655114d19e14

SHA512
9900758686c509455a9b32e35df820875ac0a54d78ef9ccbb80976664a17246ad1c969a4bc87b36e1bac711835eaae1c6e23230eee4fdd8c909a1139329c87b6

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
c4af1816f2820031362c843a57ce931c

SHA1
5f0538ebad217f468866d40b4d5441865bd0a371

SHA256
639e7ffbe2c55d69aed24adf286422387c3eb62e18bba148dc8b7c8103712e1a

SHA512
6d0a09d3485ac289122dcc9a4ae33c930eac0e6d16cf12287305be190b7f7cc1d9f6646fad597ff4fde2d016b9a4fbb81114545b397c231a80325aad1fbf61a0

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
582KB

MD5
2c33f7b5738e04a1e807b93588a2111d

SHA1
0260db133c81f58888e334de8d9343aaddad154d

SHA256
7e5909dbe38b3c8bfe1f13ecc5826d7ea448ccf5611f1a1619b9bfb0b59b942d

SHA512
6b2ec444b7305e20d45513b9e569bf3b1d6f15edb44a85e2e36768a196fb2f4a2aaf4d9c09a413dae3cf57abdd9b1071ec85f9d487b66246ee4d60dd209e6612

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
840KB

MD5
8e31036a306f1b002fe95b89e6c06bb8

SHA1
bfe5fecafb8b257bdc13435474bb8fa6f85ae780

SHA256
69b8c3bbac5b278e5b8d4b47c2ba26e42c245a4b211ccd8423eef95a42a75286

SHA512
cd084e546458529c578370d6fddf8138f90c97e626d5f7bb4449c9acc75e6a18c0de21230510a95d2a016844b03669026e43098816a06dde726082a3e5ab7b2e

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
255e372ddebc4677db6c4052acf92089

SHA1
789007944538eb2944c97d35d50721c058926230

SHA256
9f30b1b061877cb1cde3407e6dd3f0ec3f7704e1877c3ae433473e2afb2f38f4

SHA512
8f5c6f7ad8678cc4c902dba0efd6b1b1e8d114200992eb29de40dda4b58fe066287de12e69eb47748d34383e5b901eabc814aa86aa3a9beeef9e2f13af2a5995

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
910KB

MD5
a1667bf161ca6ea5807f8233be15be28

SHA1
b06dfffc202ab6cd84dfdf9f453a5d7a7ab22507

SHA256
835e159e4fc808144d01ee552d03d9bc31037d873c21ea581246a9a6f98ac3af

SHA512
bd4b03d3415b340aca706d8a2f3e4504631079be7a99037f98321281b1507787560b1d766c57744c044829ff77a53e1afe58889711068b509e01f086678ac2e8

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
fdb0ae6bd241f3643725c5da11b77916

SHA1
3e73807007252c256628e2c93236ee9213264970

SHA256
792d404d5a46360a8cd2d3d73973e2b1e92d0506a065a5e3f8f09f0663620e66

SHA512
226466cb287fbb58fd2e01d8109804471cfbd7cbb0a10429d009927f48a6be83fcfb94206bed30517b98cef40b0244c21309980e4e93730c8ee383c5ba8a2376

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
f355a60279a75404de28cb8e5ed6ed85

SHA1
5b17dac1a45601d0b12da6f38ec1a7342975c446

SHA256
70ceab78e49e7a2f9d3de2aa3e17cf1636ab3fe1e2596cf61b07eb761514cdb9

SHA512
36bfe00c9fec8e52dac04007cb130a440e7095f9c95d58a98160bcca21957525886a058c994d13921a2de142b23a0ae1ab23a2d972570bb868b1ec2015f06420

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
b350b829b1d2ba6bbfb028a0faf4e789

SHA1
cb488d0fd6985a0612f2e000d2544d242827deb5

SHA256
9c816dd91b885ad8b9cec1ed61a186658d7ab1a28c24e32a820cc095e7d18ce0

SHA512
f92fb7400f06d06305d6a19bfbadedbc80fcfa060247a95ff72b5ecc64e1c42d74ff7db7682b90548109541867fb91280e8ae0ef45b7a451b6706528a168e359

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
805KB

MD5
317c1a49179fdb282be94a54fc761fa4

SHA1
31984716362c6808273acb59a28177fdb3574702

SHA256
69e242555519506885e2c8b62074f45069ab609a4a00dd66123bf923417e0a3f

SHA512
ff937423aa6469dec04223c5c172b1fa6ffb7765845784bfa6421b946c88ec405f188f18608a2650abbb204ffa345e542bd3204a2541f910ef1851e4b25c3991

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
656KB

MD5
0dfa4bd1dbd3a05cf305b0a9b8434f0a

SHA1
b5f08175c3264d97cb7c8feb5912d0ffe8dbf4f5

SHA256
b7b518f33b8314e2e974a9d34b8876d694328138638183f007186b51e8eea283

SHA512
dcd40247a85cb09a9209def4558a30c63a173ce7ff02f5142b918eb87498dbf796df0867f3198faa31ea8b8c9dbe3e09d01821676f10c44420a38e1fab4b4b3a

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
4.8MB

MD5
cbdb2f22461f56595cc311695e3621e1

SHA1
6ed0586e28c34785d51b3597d6a9793d5d54dd84

SHA256
fd86ad618051cc89b017147075d7bab1cda9fc37d3cca366dbc5c20e004e2ffa

SHA512
0979c17643425eb77702a3271df848c90653b479190ad287a2e506b0e7f77d96ce3e6f755cf913be57e439188095a5d90e1e66ee772eecf47c4bcac39da3f8cc

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
4.8MB

MD5
fc77602959c305755c8f601e8dca276e

SHA1
950beb3bf3438d07dc948b80a178ee83c8b64910

SHA256
7245090e5b7b34be53335ae991e6cdaec8aeb2e07483dc4bb12844894123de4a

SHA512
8f5a870b63fe16eff28c9a78ebf72dd7438830082dbcfdc5ebcbdf7ee3a7490309fdbaeec2364df4e6db85262ee54d9d2812c65fb84d1593b0bc6ac339eb5956

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
2.2MB

MD5
8a41584dd9029b898e77c503c7031810

SHA1
98e18cf8b938160c38dffc7041420c1510b265f5

SHA256
9f4470fce27a17ab71b4ba34338ebc51b14998b5d66de894a8c1917139b84f48

SHA512
046d1d69f4bb8f9c39ad4e4d2c9e2949549fed535f7acf1fdc7e9462ae7adccbad5b57eac46b74dd1dd5d5c18ab70bd4f802f6333c9a8df3211140550a63cccd

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
9332fec433a9c57322c0c359e18a5a83

SHA1
7115fe909b60a8d7080b7aee4ff46bdeba168c1f

SHA256
d0d04fd0aee1a0bb931bc5a6556be3cf23c315f3ac2471940e2e5076d6abdced

SHA512
336824ebb1954987ce5f9961f0bb02aaa25e236f77161a72939fd26d7781ce7bdcbbe59c72511742abe0bf8a435421e7c02b47706a2a1fe0647f24ccf5be9161

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
1.8MB

MD5
416cddb3ea7d5d62ce3aeff68c335563

SHA1
46a2170283c4f1af0e58234b836c5a9ffa2b23d2

SHA256
adba0c510e8ad7d3216572bce496363e70e5132243a756c766ca719e7fb02adb

SHA512
f739b37452b69078b276e15bcd52cc60ff343f769701e9ba8336842a4f88d2e735ca2e5bcd323e81d292f701d901ec71f7d99bab09ed252c352a50f3125f9aa9

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.5MB

MD5
d6f57689ab8a39e517d18267442e4b25

SHA1
c02469ced3cef071ef5ecc87123738e4c9707647

SHA256
13f01181cf5b86f8579d05abdcfa8cef7d34cb0a340b00d641f0bc1a34625868

SHA512
9cdfd9788ef04dc0b1944440c210aa2bbef4080af777ade5c2e9dda017b9675116f5af42a198c23e7ca1715afd648443cbe3b90bef3e20b1fa9b2f83a4168883

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
581KB

MD5
6923a2f09adcaca1c838d2fdf67d1e3e

SHA1
0e6a1589d3ceec25736e15874db92d5e83c50680

SHA256
c9e325029758318332c113eb70eacaa812c1cef946e6b2aca568c0cbe9349b34

SHA512
9ff5d0aa5ce34f5a6f558d5a8487787f23f1992ef76fb2d58c8bd10269d2d0e64005a64a9845b7f522f7de335a2b60bb7592fface2ddf4d5dcf9c8655d20edfe

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
581KB

MD5
bc641bac69d664ab0d403c5121320300

SHA1
f76b07250512f69e774ab53ba80df7a473eadb51

SHA256
62aeb2469c6196f2eeb0a8f04126534b5667b850fbb9c7e74aa8fa5e7b5d810f

SHA512
bbbc2044804512d8b35a266cbe6dd6ea9467aa9ea6bc187b690939ffd913fb679e33406420141a8ac39949c3183f915ecff1d80422daf912c12360437352b3b0

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe

Filesize
581KB

MD5
49f809a3fd21111f383063b0bae97bcf

SHA1
c88b8e9c8e4661a5608815f43fb3af5cea246f90

SHA256
53bb0717b62c04379f94fdb10ce66e7f2ed40d7fbd7b2fb04bf3262ac49a3107

SHA512
a8483d02020335b73a2870b8665f146bee855b7442fb2b3a1ddb33481ddc8554e6487503a3c1220e294518c206121e38f3dd5a858f89c6726c3f67c9884310ad

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
601KB

MD5
24f2d9fbea41a3d0395788fc29d4a581

SHA1
46d872c9e16b5974de4bc6959059203a5b8e7196

SHA256
4e1f28cbd700e883ba6800263766f5926fc36d490cfee9b5bedf2ac5cb305bc7

SHA512
da30694f282937597a94f1a2367f2fc0ac4304abc443ff91e4629b538cb8c9d02ce80fe7c03725785fbcd34405d4c4212b563ee2a2e25cdeb13c458172a13925

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
581KB

MD5
f94c26ef86b34a4ff4a57d67644c1d00

SHA1
bd66e3b1198386588f29378f356d9cdbca8cff8a

SHA256
895ff4b6611d2406dbdbbaf5ae9917c1f455e43f561e36a84baa50a442f408b1

SHA512
8c46eb413540c95f0a8eb5371af42409de210bc67006922c97dd29c9e41358fdc8a6ae81333a8df448b84973af862168cef9ba1033fe971746665a8021f487f1

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

Filesize
581KB

MD5
9ed7750b97eb0b92fba433c1e0816c7e

SHA1
8a22f482f36010bc55c419f5e163bd8d37b8f5e1

SHA256
e0497b5d6a33aaf9fd560f8e6745d8e2a2ea5cddfa253b4c40dd5d0c58b0be9a

SHA512
972539bfd452d50b159d14ee1d92f87d0b4d275e36aa52333c8e86cee10f0373e01dc945793979e1de3edc98b839b2c379ea34af379e3f661b5e8f93026c379e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

Filesize
581KB

MD5
f88deec46c0e5c1a8c125792f7ecca85

SHA1
99277eab2235767c691fffbda3767fb2c5a4e065

SHA256
fda125c872db780cb4bf309f7a471cd8fe9e2e091937d504158cac8461dff7a3

SHA512
b0736744757f4629020826192536a689370363afde080402b24fdff13b216b3699a2e16659c42fd92fd62fa2c29d50446860918368f4cecd73a3341410a4c3c3

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe

Filesize
841KB

MD5
edb64edbd873358fda56baf871735cf2

SHA1
cc65d676298f91b6cda4b841c90734d867c5563e

SHA256
5b4df897702ce54e4c9e076c4c9c97f79a3073d542553e1cda346e56ede8e39d

SHA512
27710a65c4cdcd4a99827a688d03fbe6f4c7cf0bd23f05f085e5eb3ccc258d2876e4a6f3e1241e4cf09f5bbfe0c13e8261c29a4880240f02ec4e61c6a48c5970

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe

Filesize
581KB

MD5
2643a91f5f53e522484caca26021ffe5

SHA1
eaf60880e3f840838923fa0162dc03a107685f76

SHA256
bda7aaf0627091b1b0be3054b3bf3e86365ac92a3bf42fd4a1734adfd24aa102

SHA512
1dee48fe5ae7aed6d3f0a80c420c2606a59bc49d1755ff0cdc597130f8f71fd76f4439234a32e70c6a192f0dbfce0316a75859456207bca4cad89191cbf6a88d

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

Filesize
581KB

MD5
948caf986211924f58be50c5694b990d

SHA1
033fd9c6daacb64e5a0f688fbc5963db9c47659b

SHA256
d9973fc16f8e2616ac522a4b3556a40a70cf6edc571a597a496e7bd58a0855c3

SHA512
554ce6ae687ee08d67379e4c36008949a02fad4ca11cdc04836bac4dc79eed34f62e033cf1a9f9f1dfb4f9764ddf7d12054332b4c749b374ed9aa95ca6d1a315

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

Filesize
717KB

MD5
577a5fc9387a88f20b5f13e3cecb1c62

SHA1
ea8d13cab35a277f539f031ea42d50945fbdd805

SHA256
156cfd2a222a565bb72563a9a1460e980f94aed34f5f72f34585e16d7b22e00f

SHA512
b41fbcbd7050942c3f9e81bde821c72a8a628f7dd6ad74a72ca4ec754424ef87269ac59f61426f6ce7bd2bbbe4b873c898b7ff482e0a2e9dcb4c5cdd9812fe9a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe

Filesize
581KB

MD5
f3cabcdec500a0af4fafc9334c8d3ee8

SHA1
8b4c9b86c2d9b65929fcb08520fc68d478d4d93f

SHA256
722f1a93d418aee3b76f0436efb7cd50cba573b20cee51b1b93076f1541d40c6

SHA512
7418567111f8d1e8d3735e3380a908ba7070fea3835fcc4baa9440522dfec566ffd84f90c2019ea37d8a7192663c547bb446a8d21c5a21de28c00035d8c3cb19

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe

Filesize
581KB

MD5
186d412c7ab919018bbef5aabd2a52f6

SHA1
78182942c14f913aec6f40d151a612c2c9536a45

SHA256
dde9e078e6e5cae98a6a56790e103f592ab96654f1f3a617469464d412d0e6ea

SHA512
217cb42375c5ee98ebc13b217e07d0e8bc994b1391098c0ee98e06892b5ae4062da4198b059dadf522129779446548e449ded03978d3a41e37e4eb4d22259834

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

Filesize
717KB

MD5
99ad8409e7781d97ba67e666ee20afad

SHA1
99add0068f6ff40985fabc1058745159a4452c61

SHA256
e6057d78adf536ec517a11b7a2fc5d44372bd9fea1d1dda02d97c80073913795

SHA512
1ff98b7e719eb0f5303d3549b04657a2260165d205e40cdee2954663365706ba5c6e919b8149d0cfd31102274d39f338a0a1768448fcabf106e24b6dbf2ff2cc

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe

Filesize
841KB

MD5
8a77cd8b71d1d522f1092f35d1fafd46

SHA1
a2a529b9b91ed6593c3df48184e60e6e1f3b8c9c

SHA256
578101c36e2572b04d21e3ff1854b858830eeb6916dfb5e02968405cbc5c0370

SHA512
e9b80aae722a148501e6218108f1a3c9e9bb31a1c1475b4277827b260fccbcb6d73ddb38dc84c1ac5263cb895a927f92b7d4ab65effbe0ef00065acadd14901a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe

Filesize
1020KB

MD5
dfdd51859d9a30c2b694bca2bf975d74

SHA1
2c4252958c08c727634e11e4f23135706667a11d

SHA256
75760382d5a4381f9983bd4fc8f513dc5eea0752bd5673213bf1932c622cced2

SHA512
aa869791b1e3da4db4c848769c4b4dac33a2001ef331832646b04a2072c111d0f7a3721a811e7beb966258abdbd3a2586f1271cf3ff46f3ebf01c364194ec37a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

Filesize
581KB

MD5
8d76cc6322992dfd9f8b5e4956889a3f

SHA1
1c104e38f3df5ee4749083829b74aeab64045f39

SHA256
60b5a7d1b07dc30595ad752aac65873273b0281f7915a1b9d0a4798631c5b3a7

SHA512
04a2e7a1b1affb17ec26b5180028fc6cc9a347f9303dfd9efa3fedddded052fc606fdaa77736143a4c8da1fd675ffe05e87d20ba2ca4a4e19299eb8028871339

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

Filesize
581KB

MD5
370b908df8347294cf942a8cb9b4ea5d

SHA1
51fbe419cbd00d7a7684f424cbd6837ce3da594f

SHA256
de10cb83ad9c7e98fb55905be2d33367c1dee50f746803511bea194249fcfe60

SHA512
e59378f3bce5bb690e4c413dbc0d1b7f051c179005f86ea5330b7f75c3eae6012bb45f151acddaa5d22a51ebd024c8efd2e1f11ffe6aa03f75f5537e6b794922

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdb.exe

Filesize
581KB

MD5
cb6081c4ed0b1a393d14631bf41857c9

SHA1
81246541f0cbf8b7413d94018ca00af8cd08926c

SHA256
a2160fbe4662b7cfca6d0421cfa778b5ef791c046fda613a795b1e3563ce9ad4

SHA512
f43ef9a4dab3f3f41b5c2994ff7ca3a2a3ae2ef58d0c5c369dd31b376400ed678e8bfb7056544e3ea502882a63bdd7c31242621631d311a3f1888755da188c7e

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
696KB

MD5
e852cde40c3dd947511b2d837e3cca87

SHA1
7a70f3509706130b146579bca8cb132db64c9070

SHA256
54dc07ef5f3f853f2e711350cc25a9d1df37d5610388fc8837552556e21ea849

SHA512
ed14f2c3e3dc7df2a5839381d6bc0956b8fd2ce14935535b3be34176e2781de483e2eadba62fd578065c6506fd61c6738efd7a8d162673b039efe075d35476cd

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
588KB

MD5
4c0d9c0b37a74aaef28cc6f204ed7021

SHA1
13ca25367f9b2a7f3e39c65bbd13f637995c7339

SHA256
0dd4619fb01f512c8358d6bbd80c3f4f41b65c41518cef28b32a66ad352953df

SHA512
3ebee4a7d73b7049d2121be941c652090cfe0a50eb451511a10b4440b6cd5451f5842acad20892d3a57c4c58c5db7f2f177c1e5b138ba91036ae1492545bf058

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
5efee75e9778c85338e335cb1cd51f78

SHA1
e13cfd2dbf3ccbb153691b2f8fa51c25bde442ac

SHA256
f0d0f40c0e9becf999e3df9c9c4e0a5bed0a2e22491af446a328e40398eca9fb

SHA512
4ce9c0de40cae42eea7f0054cd4ac5fdbee1d19d2846d9e3e6dc9288f61f68f735f84f4bb0414aaaaae31d11d8a1890471866887ab0f6fc5187503b09bd57013

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
659KB

MD5
1e2e19398823f7462dd848d321b5a69b

SHA1
a08662abf0083289e68900143e994c1d9d43302e

SHA256
c51a928cb6627a3388464574678fc8cf11fe25c0e5a1453eb1c6ee474fa22595

SHA512
f61a03f99cfcdd3bfe2d3976b2fae23b06f0c708ed0977a5db636611c3bf858013beebd45f81cbe4e10ac6f5e82ba4b40412c6c7847436d2b197d7fc55da9844

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
0ece9ce91bcb63ed790467049d5970aa

SHA1
80dfb0a4cc4898bcdacd07b976fac7761e6b1216

SHA256
dd785c999d6fabc40acd719ec2071db39c1e037048a9fb07c2b89f2b291000a7

SHA512
a4c07f31a4a2855f49352c2e0c451f024bf88bbf519abcc203c00837cdd6de62b385ea308a2015077379e95fa27aee4da83d8cdad8757f64188f05ec3b96dff7

Download Submit
C:\Windows\System32\Locator.exe

Filesize
578KB

MD5
a3d309c13c24a14bd7345a900ae4252c

SHA1
fedb2abb163f0024b90e1cd619fbbf2b35d31043

SHA256
47208a2f7cb9379a06fb20b8f1cdf5e228b61c62810f9581c773f8531bce36e1

SHA512
d0265a23f0473273c759cd1c2bba694a93857d698f6944a131a5bb6e9bb489929e28a373be5da2f6846773a078fb4640c849555bfe0353a0dddc8a90dd7bf007

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
940KB

MD5
b5d6c7299ca140977da4adf7ee60ab5a

SHA1
080efcf64b842bf0b96e50b8f358f6f3211907bd

SHA256
14db153494359b78c1a685da3f347771c69bea2adf74c801f2b383ff33138d20

SHA512
1499f420c3057cf484b773a33e1a9d5dcc610e3e92a816057cd26c4b02981b1da92069395532ccdb943cfb397e8631ee3168847bb1452ae6e60b05801cc6a74e

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
671KB

MD5
4546bb327167313ad3cc2fc28605d706

SHA1
3c0f399aefc171af8db4cd9c00b15ee901af97f7

SHA256
b86cd5b6ddf90d9331a756a9f3b202188bd35531d6553a776c13e0db7c282c97

SHA512
db010281731bec2de7292616078c2ec301de28717adea1471411f101b3df3d4d3c1c0a703d08abfdc0d6525ca8ebbb0f83235b1e48ebbbd74abb8249c5e9e836

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
0e7351b532db6a48536766f8cac494db

SHA1
5dcaa1250a40b0541cd349005a6179382b1a2dad

SHA256
aa153019292054d383f0ff1af9757b743619bbba31a33b2682f65deb23fe77e2

SHA512
24979c110623986a35d935fa1fadd593b15df36b5ce9965a6ae899ba07669c3a131623e40c139b534dfdcb7c49b67084f9b81bb28c58c9a3d36c99297435e7b1

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
286d651efc8d0a6e784e6bad8b698e2d

SHA1
499e5b71fbaea74b50dccf304b47780502d0e791

SHA256
6218b3541436d329468c1db085152981339ec05cb9e1e97a9ec95456f89f6b68

SHA512
a46938a687cf660d1c66760e1865fc82ccd63f81b796bc639110cacaa4f1b7f0bd6a7d0c7edb311de7467bdfec750317c50dcbbc85fdae9efd9e7cfcb12d82ba

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
df71743be670de4804805f0ea0b6558a

SHA1
98125262e6ab9c2afffd9d473978472f0c55cd35

SHA256
06aca3f8d40004a01613dd189da2e5c870e3afe8a2613b35fa81ee2fd05952b0

SHA512
fc2ee69aa885e52c5adb9f7a3d43bf79844ad61848c0f50aa3933b209d6363a91fe57d0fd4c42741c35f6cd38aeaca4a1c83533934de1184f2fbf86211b54ac8

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
885KB

MD5
e9894ac3c002131372377bd1edd67ab3

SHA1
f00448bd855643a7d92323d5b9d25dde56da3c8f

SHA256
e8d69dbac0f1ce916d8dfbcb75f3c5451c7c24f7cef38ef60c148cd8779ae5db

SHA512
0e9f9de660269b0981ecd95ffdaec92c83165f8b9cf5f9291dfe840d0a28c2a3d464835d70af4dc0a53a0feb419edd1ab9ae9ff4477d738c963e1542be8bb21b

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
a64ecab170c8bf1665997d34b7568508

SHA1
3161c13d4fbf4eca2501184e7493abd292ceb701

SHA256
a14ec1bc7f4787ce133386e8e172c3f3076d882c24d0d61898f2a7fbb941cdb6

SHA512
15fcd9a296b4d53e23d99c1748e4d2086f54f8f81cd60ead3ce374b7c426340df152a11afff93b6aea45a94da4913df655ec36ee39b3959a2e2c0ea6d6acb2a7

Download Submit
C:\Windows\System32\alg.exe

Filesize
661KB

MD5
5d78c89377e8eee0b244f89a688b0f92

SHA1
4e82f60588fb2cfa40674906a0396c46dc61f73b

SHA256
527b60b7bff916de6763b7e7ba29969dc35b329c8ecf09cb71fc8880c88da6da

SHA512
35dc97257227ca0d76e39eeb430d5a8dd6668854f16325d3c475cc8f3ace553dd214b4aaa124af6abbc1633e58c99035ea80c792e56b07bf5cb9b359b4c32fae

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
712KB

MD5
d0040a165b97034ab74a8ece59b23b59

SHA1
0c6b1e288060a4da083c7bccc35c05a2304ab521

SHA256
5af70fdbc6a2486d154f43fab73b418081c892fef54c09d4486b2fa5bd10311e

SHA512
5596a00145a4a4935d2cc5084deb03825bce892bf855fc2dfc55cc040a10a2dfbb34f744875f1755d14e71d7681e1dd2631a535a687cd9cc8529c2e40a54cc62

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
584KB

MD5
8eef0836ac4de68f9ba18241d2c78bfe

SHA1
dd69758e2edab25c3338990801b57503e67335ea

SHA256
736b88ae36351f63556544e52e920db76f8714b1c77e2662a33114d6a5955578

SHA512
859e7d8586df33745e8783fb01f03b1ca4fb981c1a01204472b4daa9d160c9544c3e3f02c47f99f935a179a5a51c8fe915c4b271578c99688d9137a2249ae488

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
d20c81dbb70c33d5d529631dcc5d680a

SHA1
468f37526281ce8f27647c10337ffc3899928209

SHA256
21860cd1a81f5f434ae93929aff6bbcacb3ddc879dfcbfc5575a37c1a4e56323

SHA512
2552a6adf041c48d690538ae74dd20744789946ddad154f30891a984d40aff21578499f30310d9c94a742c8cfae7d8f0c489dfa408d0503494ccd2e5e6961a8b

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
772KB

MD5
038d1c734601b22da97bb65c8a47917e

SHA1
6fb87caba192babe16f6f52402d9575a4261c984

SHA256
27c2756c740f0b019788de1714945a9ebbbd20526d7628c5f2da47f401d11330

SHA512
57b81c25c295b098aecd2c851d361dc577f23f2a0938cae41fd13fae5b0a88a27bb4eb7826f6a35eb543dbb1ae586adb2b64013df854e8b3b36075df632b3529

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
7e10103a449dc950bf1193edcf951824

SHA1
ec01798ce633dfc745bbef29b73f3ce26e3c976d

SHA256
a4c9481d53f5c75113c833b0e1721db0730338f24ae1e4da2b96ad965fcc369c

SHA512
68538ca359f78e539d88b5533f70999702cf4dd860bd01deedddd62b15d04a452739883adfbd72800c079c8e6dade20df1ca56094a9d0e0e4d72d0e7798db83b

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
36398e70bd9c874fc08ac306c49ac57e

SHA1
2111caeaa4fae7be9101a8ac3811deb89186120c

SHA256
4e939c47c8710432199b368bbca1b7ee5bceaadd0991b9e1295ce56e61510390

SHA512
5ad950c6ecfbc11e8bd81e0fab52ef4981fe31701c6e531701d80a24ea0b25939c1e5905609917ed9c0b3d4bd2b8596a3b7e08501d6fb1db1b7aab543720df43

Download Submit
C:\odt\office2016setup.exe

Filesize
5.6MB

MD5
9b7fa08d7a49cd157d22059ae4884564

SHA1
e92f2b35063f69eca231c0b965f159ae90bd0918

SHA256
8a20c4a143b490f85f441c68baf79116b6a845ae34b3402aa2697f8eb9206fe1

SHA512
b914dd348f76d5e0283a9c90eaaa9aa9903c0139c279b2c6080de90a86cecae061b9ebe2fb7c0ed0d8553cc4fdfc935b4adc5b42899bb2ba741f17e5109db6e1

Download Submit
memory/572-283-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/572-335-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/1004-245-0x0000000140000000-0x0000000140245000-memory.dmp

Filesize
2.3MB

Download
memory/1004-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/1004-56-0x0000000140000000-0x0000000140245000-memory.dmp

Filesize
2.3MB

Download
memory/1004-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/1072-255-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/1072-323-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/1420-328-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/1516-1-0x0000000002390000-0x00000000023F7000-memory.dmp

Filesize
412KB

Download
memory/1516-6-0x0000000002390000-0x00000000023F7000-memory.dmp

Filesize
412KB

Download
memory/1516-7-0x0000000002390000-0x00000000023F7000-memory.dmp

Filesize
412KB

Download
memory/1516-36-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1516-0-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1584-241-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1584-43-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Filesize
384KB

Download
memory/1584-45-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1584-37-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Filesize
384KB

Download
memory/1640-259-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/1640-260-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/1640-266-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/1640-327-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/2012-218-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/2012-17-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/2012-25-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/2012-16-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/2168-274-0x0000000000650000-0x00000000006B7000-memory.dmp

Filesize
412KB

Download
memory/2168-331-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2168-273-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2228-316-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/2236-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/2236-215-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/2588-81-0x00000000007B0000-0x0000000000810000-memory.dmp

Filesize
384KB

Download
memory/2588-74-0x00000000007B0000-0x0000000000810000-memory.dmp

Filesize
384KB

Download
memory/2588-246-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2588-75-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2688-34-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2688-32-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2872-293-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3036-341-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/3776-324-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3948-332-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/4352-321-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4352-319-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4444-291-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/4520-305-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/4560-60-0x0000000001DE0000-0x0000000001E40000-memory.dmp

Filesize
384KB

Download
memory/4560-71-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/4560-59-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/4560-66-0x0000000001DE0000-0x0000000001E40000-memory.dmp

Filesize
384KB

Download
memory/4560-69-0x0000000001DE0000-0x0000000001E40000-memory.dmp

Filesize
384KB

Download
memory/4884-336-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/5008-286-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/5008-340-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/5008-413-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download