f214dd44d0ba62e17eec2d22c2b4bf840941f0dd0d2e35295e85108317689384

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe
Size 1.3MB
Sample260415-rfjvcabs5z
SHA256 f214dd44d0ba62e17eec2d22c2b4bf840941f0dd0d2e35295e85108317689384
MD5 2ad2091af0a87bd224befab99ed07b31
SHA1 d6a99b4e281b5c07a2bf3974a2b0e34e251ac7a7
SHA512 5e6c989a7a46bf82fdcb35122171a9d40e11ffb1dbc02b9446cd07b35371a9e477db5939d7e64de2924885accad773d9bf62cf3dcc921c0f342a925b02d21d43
SSDEEP 12288:+VfhxbitwzLq34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilY:YbAwhSnnrFb4PM4MYgLxEVyGL6
TLSH
T16F5502AF77B454F6C56AC1B0C4AAA7A4E772FC55AC21A30F2750A31F2F376946C24321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2696	alg.exe
4484	DiagnosticsHub.StandardCollector.Service.exe
4628	fxssvc.exe
6104	elevation_service.exe
1040	elevation_service.exe
6004	maintenanceservice.exe
3208	OSE.EXE
3688	msdtc.exe
6064	PerceptionSimulationService.exe
1796	perfhost.exe
5296	locator.exe
1852	SensorDataService.exe
1552	snmptrap.exe
6008	spectrum.exe
2480	ssh-agent.exe
6036	TieringEngineService.exe
5828	AgentService.exe
5320	vds.exe
3532	vssvc.exe
4720	wbengine.exe
2884	WmiApSrv.exe
1292	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1decc56f958e99e9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83296\javaws.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83296\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000308082cde1ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013f0f4cde1ccdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf5416cee1ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ede3a3cde1ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a41e4cde1ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000617bdfcde1ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000955d8cde1ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4484	DiagnosticsHub.StandardCollector.Service.exe
4484	DiagnosticsHub.StandardCollector.Service.exe
4484	DiagnosticsHub.StandardCollector.Service.exe
4484	DiagnosticsHub.StandardCollector.Service.exe
4484	DiagnosticsHub.StandardCollector.Service.exe
4484	DiagnosticsHub.StandardCollector.Service.exe
6104	elevation_service.exe
6104	elevation_service.exe
6104	elevation_service.exe
6104	elevation_service.exe
6104	elevation_service.exe
6104	elevation_service.exe
6104	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4388	2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe
Token: SeAuditPrivilege	4628	fxssvc.exe
Token: SeDebugPrivilege	4484	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	6104	elevation_service.exe
Token: SeRestorePrivilege	6036	TieringEngineService.exe
Token: SeManageVolumePrivilege	6036	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5828	AgentService.exe
Token: SeBackupPrivilege	3532	vssvc.exe
Token: SeRestorePrivilege	3532	vssvc.exe
Token: SeAuditPrivilege	3532	vssvc.exe
Token: SeBackupPrivilege	4720	wbengine.exe
Token: SeRestorePrivilege	4720	wbengine.exe
Token: SeSecurityPrivilege	4720	wbengine.exe
Token: 33	1292	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1292	SearchIndexer.exe
Token: SeDebugPrivilege	6104	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 5952	1292	SearchIndexer.exe	123
PID 1292 wrote to memory of 1728	1292	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2696

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5660

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1040

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6004

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3208

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3688

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6064

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1796

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5296

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1852

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1552

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:6008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3392

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2480

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6036

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5828

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5320

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3532

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2884

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5952
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e8b752e75af36618fd43f7831cf15d9959bbda26382e4db993294f29d07c53bb
MD5 700e2fb18632be7b2e689920dcecc9d9
SHA1 65a0201c79108b065b7d3c911d57c03ef355b574
SHA512 3a8dbf1b4cec391d700684add70e02995904bfd2220c9d245e5a80bc0f3c9999fefd892b63a7f7a0674349050b51143063f6a954ad0775672dabbc44bce82618
SSDEEP 49152:2b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnXj4MYPVyGLU:o3q6HjBDVA
TLSH
T13ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 a8d6b142ff2b08fec3c3c3ebafc005172db740b3efdad2a50bc12b24969f8fd7
MD5 aa00bf9d9898e2d36b81702f2de6421a
SHA1 b2d2abb33bd4954b84591b1f6b524ba94aea05f5
SHA512 7117f5ff61c9dfdd3ae2f56fd6ada590ecab4742d4550306b9a3bf62d7859856c734c415441a7a573c8241474e4d7650e3faabea2bcc39984a84693e242a91ff
SSDEEP 24576:aXYfDtczA7hSnnrFb4PM4MYgLxEVyGLe:Btc1j4MYPVyGLe
TLSH
T1B565F12977E408F9DD6B8278C8A28555E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 0872925d748b6d63cbab00842b64b983d51774c8b3c6e4984727e811a8e0cde1
MD5 4e3565f939395fbeaae3e27309f7eaa4
SHA1 da496a6c1d5b077447eb430afeb50faa701adc66
SHA512 b3eef57f330fbcbdf1be12e5d521fef9ce072b463a85c06ee58d0dbb0d710f46e3db5602fadaf098e1aae2423c3385a278d696a9808d3b94eb49dd4e73d805bf
SSDEEP 24576:Q0Le5ji0hmxirMOhSnnrFb4PM4MYgLxEVyGLL:QPji0Ac4j4MYPVyGLL
TLSH
T1F4859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b10d2a0694cced88833d4c9fb59d1550a811d868dae0c07d7fccb321995732e4
MD5 e259a90f89e0e555d10114d02f5f1bc6
SHA1 35a71e43a437ccd64c2d94f252a94a0bb4c0e465
SHA512 59d858387456c534899a0f5b6d8db058c56a68af64f19bc9b151694635b9e7f8d8a8796ad14a1bb3340f8fe5575794406d0ba6a92b979eb114ddae4cf688403e
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWE6q8wyuMhSnnrFb4PM4MYgLxEVyGL5:g/ezSC6vUzPvxHjy8j4MYPVyGL5
TLSH
T171755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6cbe439a1a67268e410b54016f60922e544752a51c23ef4e5dd18e5b603b3f48
MD5 2c544158431456a79bed2c4dc12166df
SHA1 17ef333fa31367d69104623068a41264dc0de69b
SHA512 672a95793d4164eb983f63eac0b0d95f51fbc9dfa14bf442283ff5ff583854072e743df4494cef37033d60348f7d7649479184541365658323d38838d998c556
SSDEEP 24576:rVbqPb88hv/l+6/hSnnrFb4PM4MYgLxEVyGLR:rVO88hXl+Tj4MYPVyGLR
TLSH
T131559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7920f4bb61525c07f62d50ee9fe4646c60f4fe2d631a6e53e561273eef62b7b6
MD5 30b5fc4eea6f6b083b192e98523a26a3
SHA1 ed7d48fab814c9653897d0111ca379b3ff86c44b
SHA512 28c48179bc7b6ee841ea5fe6e2047cfd9e91bcfbdc3905a03d4c6a3a273567f968b74e9a917b6815a25def6c645fc7b2ca471d88df684e18e13f90ec5742eada
SSDEEP 12288:xRiS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ily:xRihSnnrFb4PM4MYgLxEVyGLE
TLSH
T1944523A76BDC10EACFAE15B0D1B96AC8E2057C61F875B20B6751785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3b1e3af571904d071636f6a065838c09033fdc270f48d54c63718ae86489c381
MD5 8e2cf3c3778e41ead3418415d09fac09
SHA1 2e24ce062fe0efa6e74fa81b72e6021ad073edb8
SHA512 d3868954999900a04bcd42f37c6dff92bfaefe4242312d656b6fe93026e503fa1d97222e1ef8a41bf9f3d58964ba2b096e2ed05a2f32d64518191963358dd72e
SSDEEP 12288:IeBNUbTVO86UHS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilO:IJIUHhSnnrFb4PM4MYgLxEVyGLg
TLSH
T10065D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 63430c9af195cd5d8b9acd58d54ec6d9b55f18d631d2c28bd6a99212e6898060
MD5 488c9ee263113e41ab34aa0768e26bfb
SHA1 0690763ffdff65353db45cf50b24207a680f4de3
SHA512 e35dd7667fb14d365a301c7b56c4e371ae3a7ca708883e1e909aa80b61adb63e5e5cd7af7c3361689b54c5addb6fb30ba5eb500185dd6dabaef579b70595a40a
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THG:DQvGAdlCEL8c/yRNw5COVs
TLSH
T147267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 53247671788cb39f50529e61c94be68e3982fafa3073be7c5f4aff4288bb669a
MD5 0cf38f27f540cc435ec9e0532e75eab0
SHA1 39a6b2eb7f5331efe5ca1f25e1e4d601277d2971
SHA512 f1b7f5e203d4bc71f06555be544f0e49e61dfd95842a6bfce69d5d0eec28f92dabbdcd734e7b4202a5a1c1d80edd8505543c81f153d517c7e29d0acfb805c7dd
SSDEEP 12288:vAwSfxL/2Dc34DLLmt0LDQewsAj1S34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLew:4dewsAj1hSnnrFb4PM4MYgLxEVyGLy
TLSH
T1D875E031FE74E036C7BF0DB21B36D716542DB9204B612AC3E3A89D9E59342C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 dc3ac5444f70248beeb43aade2ffce3d6d51753e09666dd563ed4636762e77ac
MD5 6b4c33eff16980265c78e3a343845968
SHA1 951ff67920ac6c08fdab960ca684fc3a74e45b4b
SHA512 15e503775b17fb036c0b4e51a2e4749288c6b245461bba0c468180ae0e663875490bc1fe6e19da92789cd3ee8a3cd8b97ad4931cf6fbdbc08dd2917a0bcb880f
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:iUEtQevvqc2W1cpV2EI32
TLSH
T1BE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 284235d1eefb0c6ef70ed3a95123023989b0ff31b68e565296d7618b4743fccd
MD5 45ac95c4b41242012e94508b9e299c1f
SHA1 c5056705963cf8668ebd78c0601b1f2d5994e558
SHA512 7069a44ba3b0cdd3792119a3e068a6383246e673cdae8734579c9bba177257a493636e092b64d039e14193fa20e19863e617bf5ec2d6afad76f85bc079600dc1
SSDEEP 49152:lCbRquA/m2yL5zQfFiV+XenmE3/zIj4MYPVyGLh:yoqtVjnmyVV
TLSH
T133D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1dffe4836ba8c11537e1e040dc1aa8beba0bb4d4c9c762568b19a50b6160408b
MD5 051e31422c2abd49b3a1569eadb9bdfc
SHA1 e7496854b18f41c4b3711c996c6cee1a1b143edd
SHA512 1c156abfcfd50b66a39941a8b89f8605810a83c4a0dbfb02ef067b7ed3897c5e2344a347af1b81a9b6dbe224e27e4edb5d42fe177fcfdec55e87454f8610c332
SSDEEP 24576:ZAhGLJIFoiwtA5l7S53ohSnnrFb4PM4MYgLxEVyGLN:ZAMyFoiq5Zj4MYPVyGLN
TLSH
T13835AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 28fd7721eef01a5e9f6cc6d6ab251efaa48371e53a3708b1e7981021f73b98d6
MD5 3491b24bcdf391b0d73b2bae1e5ddac1
SHA1 e561bb09c8818c8163185eeaf657baf480a8031d
SHA512 bbb200dc01e292a6f13ba54183728c867e2fe89fbc038e1bff97cdae2001f341224e25a477fefedd44e025d992bbd1e4ef7d4afc320b48b65b961925fa70a6bb
SSDEEP 12288:mmw5HEjsChNVBFgl0WDm+CsS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyC:/wuoOWxhSnnrFb4PM4MYgLxEVyGLL
TLSH
T10765F14637E81CF9EAA74238C597C535F7B2B8122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 639b9de4056059a0dae8ec8271be0544234956b167f13749ec2ada8f44796baf
MD5 46870eab38f20229f1d727aafdb222a4
SHA1 38f31b7d7900fc673d9e020652399ee72e956223
SHA512 05e2de3429bbc2b4300864768ce16fd78ceec8a21a8398ac99a0b2531a0e9a6f3774d81c46580918a8bdaeb365ab805b19fc17579222f9d173f2b9784d43526f
SSDEEP 12288:XBZ1IyFS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il9:xZu2hSnnrFb4PM4MYgLxEVyGLP
TLSH
T17E55129A37E820FACAAB4274C4F55688E3327862B77293CF1650655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 035a01dc97894900c18d19791a4901c4bf6cee3bc9296fcde98cb2ce37e1e3ba
MD5 5d093363d2d9c7385b3339500b415345
SHA1 4682e9dfaf47da3e7cd359b3225db2fd44bf9b85
SHA512 d69533808ef3a075a7f365b16c0266aa2a320bfd97ece965144363e33714ca50e57f86820675d2e50e176f9102229145cd81d287603519ed9db3f77e4b7c1351
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UU:lQRQyi36YOcPQLvw2gAf+PN3PVm
TLSH
T106667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7f99b1a0012b4c17ec8047cefdc5b1e631d95da7e83b1f704ce163919a6ca505
MD5 2a62992cbb512eee012c283961616f9e
SHA1 48b03273bd0f2daa56823f7891090e329fc21570
SHA512 dbb1fb3fd36f2f8a615c2f86e84ae57ddae74c1b6d0e730d7288498d5dbfbc817b81f14fd0e82a835bf37f123cd4ea3077a5731ca4e951a7b0bf7c4200fc99b1
SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:PQRQyi36YOcPQLvw2gAf+PN3PVb
TLSH
T169667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5fe82aadaf237dc0ed00bda686eedfb8cae2bd99e60e39b7fe19b3709219b03f
MD5 aca2cccb966e6ec93f33f9539d96dff7
SHA1 2a6d3212db0ad427254b71b03fe24adee9728547
SHA512 da34acb3c471adb09c393bc3764912faadeb1221c738e75c9af40a207b6f4b68ce6cb555eb7071e58c7447c583724640c4cbe4ad48435836f25017ba31ec6dc4
SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0mhSnnrFb4PM4MY7:E68Qg55nhheWu7PNU3/4j4MYPVyGLX
TLSH
T1D9B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7b4cae3cce1f52eddc3db8c90f2f4a658543fd7cff13f48c885eec88a527ab53
MD5 97bd56e39cc876b8532de572ea289634
SHA1 8eda783ee740b3cbba79b22f8388ad2626d6f97b
SHA512 60f4ab01be51c0ddbd8b568bdc15a3b4d22e3b3647779677728afab0b36272ba7a72cdbea8b12d7d04fa37223e76617dcba271557502ffacfebee514dab3dcd5
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99c:Cy5112gYy5azzVvL69nLKnhZYVw
TLSH
T131167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 431258d85fadb246cb817f23b0fe63d01addd3766cabae3f652ca252109011cb
MD5 5c1175b1d8d91bfeda8a2dbfbfe7abd2
SHA1 8df88c92fd63f1366fc873e9c82f7f5bc5b1a8d8
SHA512 6a8c011d50e4b2ee06ea6a59dd5f1661917b4ee535003770200b37796c7687e2fc404cd320f647d00d954498bc477559be508868f06e53600947ac0b69d406a7
SSDEEP 49152:xB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glZj4MYPVyGLm:nu6JmVxd2dCVK
TLSH
T156D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6ff007c952862c38e3322565e2969a989f3c0023f2f71c34048f1eb7baf29a5a
MD5 ccc84d7c0c3f51b88326e86214a738ac
SHA1 8f86c4a368f3721455527523a4f22000bf6ec1b7
SHA512 c17580ce64e6f8e7477de11ed09be752b9d150aef4de3e396810ff51b7f28c903d217fd7505391fe3e1a2422ec0c9ce806fed9cc8c124a3702bf2eb720bef313
SSDEEP 49152:P1hpsNoJpF1A6UU44CwH7R4xaj4MYPVyGLx:PmifPbRyV1
TLSH
T1D2B5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 88c398d099118b114e482f142284e3f4d521ffab851cb5aec1c8322f1765df6e
MD5 5b8a0ef44981a8301c886d4bf737dde0
SHA1 96673e83eb8dc403b4af7d47e5fcb88b23fa27ac
SHA512 963e782beda140a23c92b4fd008987eba7898efaa96c60ab507dddcda12c25f18dff43b290833639d3a72885d7239e20714dd10051653c5c0311ebfcc9c45230
SSDEEP 49152:2SuZQIY0Be2KRRVtOnks6NMHqHj4MYPVyGLI:Y5dKTi610VE
TLSH
T174C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d9139f1bebc83cb00b2041ee0c9987922b0fc0f376a250e28a30180fbc1ac958
MD5 e750b2299d6b29fec1f761820069fbfe
SHA1 20d29ab51aa2cd56c96b1abfc015f084c0fc7147
SHA512 2f05cf484bffb0b58971bd20d62918e334c775d2880f66d28c36d7e3510588c4a5a7fe90064d6fda2cb069ef0f89bd48f611a57e13514bab6b7b11c253d22eac
SSDEEP 49152:ohtSn8EApI0figngiDn0AP5w2j4MYPVyGL6:5X2iyphmV+
TLSH
T11995BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 eccbd49fad9c82421e09afbbe4d67f639aa1d091627b43bed27d9d46565a9907
MD5 82ab1b0250d1d356d2a55c3c09cabe0d
SHA1 71ab6da1dda1fdc50923113192910dbf524cc037
SHA512 b04a78e8937d6cadc8cb4fcd664502b1c7661f8414bb1ab0a77c0a09a5e87d8c790e398135dba954557f6f6a319500a703b37351b102147f959815e2c282d5c3
SSDEEP 12288:hqS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il3:hqhSnnrFb4PM4MYgLxEVyGLR
TLSH
T1A14523A62EDC10EECF5D16F0C1A566C8E2097C62F976B20F7B4574173B3B20D5892722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3bb11ad8a4ed44ccaef82a631a36a2cc3f963907e0fc8b5bcebd2d3ce6a46275
MD5 e8aacc2b6b666a5ae7e865d262e1e412
SHA1 b63cf29bd0a4294a5c65995f88cc7fda37155085
SHA512 03e94e4028929bfe72e89b54b0ad47cf69d4ab55282f31fb3961ce399b209adc5f5c725128fdaa6c2b2df858c709eb4379a18af5f7b9f78498c8306f0f5e0e08
SSDEEP 12288:oJS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il1:oJhSnnrFb4PM4MYgLxEVyGLb
TLSH
T1164523A62EDD10EFCF5D16F0C1A566C8E2097C63F976B20B7B4574073B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c29d57c20936eabb6efeb27304d418fd23fa223e0afe445ff497b444f1a8cf0e
MD5 6cbbe963f709e2b3dd90b28eee12a0ba
SHA1 15bc050eedd3ec4cb6efe308aab43ffbd65e3fde
SHA512 cc7ce16ba16f25e44fc8f7decff28039d0cec3d737c469ee32d412005dfcceb96dd16b25b112f02116fdab29628bc427eef0a3aef3448a73951dc06112b6a58e
SSDEEP 12288:BvS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il1:BvhSnnrFb4PM4MYgLxEVyGLb
TLSH
T1764523A62EDD10EFCF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 3dccef7678a757088a358c679bba97ce50483ae016ceeca108eef47224085129
MD5 55ca6971027fc8ab609e337f06e7aa92
SHA1 b59741e314cf7c3b5babfb5dc7234d527d9764bc
SHA512 43a16e5db3433f1747bf3769f5e5516123549cbfe88298e3da389d7806da1486b7051e85dcdb5104a5571263af42b5d3bab2d78ce56cd830a535619156d2f745
SSDEEP 12288:eVIS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il6:lhSnnrFb4PM4MYgLxEVyGLw
TLSH
T14C4523662BDD10DACE6A96B0C1B556C8E225BC61FA72B35F6740381B3F37348AC71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e3231a4086a083e007656674e85661e5d8eabc0eb1be3f9ae5cfdeda25cdd4f9
MD5 f3246fe53b18c86e39082e506f82a9c6
SHA1 4a7fb97c5654f8b67a91b68835f916c2e5f05510
SHA512 f72940e6d48cb0fefd38fb5816d665986dea274cb6c2d5ed8eb8fd02e5a7e45c722c6076f3d94be7c744fd178efefb2c8b19dda7787aaf447b8b14db7babb741
SSDEEP 12288:ogS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il1:oghSnnrFb4PM4MYgLxEVyGLb
TLSH
T1A04523A62EDD10EFCF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8bba4ccb8a55e5aaa0f20f1ee914f00f53afa91f3e800a45df8523e325f8b93b
MD5 291284c9278ff40c7d341e0c0cc3195f
SHA1 6e50bfb9f38ac6d24dc3b3748baf3f42933f00d7
SHA512 11f933bd95d59dc7538c833d2617e95db016649cf51b28f8f92e5d9d8892095478806c9845ef705f1d71ef385431a3ed271cb884bb5f5efe2309e231eb9737a9
SSDEEP 12288:1dS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:1dhSnnrFb4PM4MYgLxEVyGLA
TLSH
T10A4523A62EDC10EECF6D16F0C1A566C8E2097C63F976B20F7B4574173B3B60D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 911e009b355fbd4b4cbb4c5119dbab258399f89298e8d85350811605f07e601b
MD5 fe0a79cbd01bccca64264abaacece447
SHA1 26768632f61d673f712ede4d14cbf812d22cf566
SHA512 61f97bc3b443a0f77c49974556ee9693e2230ad3561aba9f20812cb11c0b8105af2e515ca7404a852737bf55bcd598f789dae3197e818fcdf816f0e4ef8930b2
SSDEEP 12288:0hS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ila:0hhSnnrFb4PM4MYgLxEVyGLo
TLSH
T1964523A62EDD10EECF6D06F0C1A566C8E2097C62F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 b3f21d9749b66f003316f7daffc7eddd06cead0f64045eee151a4e2bcb11202a
MD5 a2112694a86ead25307a980e8e6cff5f
SHA1 4051c1a08b567497fd7f91f6afb7e19cee409fd0
SHA512 7353aa62deb15aa80622cf66a6f875b50ac59e6fa43e8545c3f51ce7950e96684fd3d2a50c32db48ddd56e14e7a0813c4ee760e52f4d73fba92ad85b44845dc0
SSDEEP 24576:KZMSzFVSOphSnnrFb4PM4MYgLxEVyGLy:KZMSzfwj4MYPVyGLy
TLSH
T1336502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ec79bf9e8e1aec4944a51b2594488af734ce2d0dbbda1e31a0d5798b2f60196d
MD5 c3e6b16175f9e645a201e28384ee575f
SHA1 1dd92cb90495e7a9396653f1613fc6591f92dd80
SHA512 04706c3a4d54d9c401ea2b4648a2afa40d3204cafc47564275407dc9e6f569f4706f583c5e2108c43c7cf57ec59e7b9e92610070d0928cffbb6377956eadf6f7
SSDEEP 12288:8GS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iln:8GhSnnrFb4PM4MYgLxEVyGLV
TLSH
T1654523A63EDC10EECF5D06F0C1A567C8E2097C63F976B20BBB4574063B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 63c541827337f57244018a7178852c384c777a7d5cfa5590eebefe3119a223d2
MD5 4ed6bf49ffd1b1903e00a5d2fc944d88
SHA1 31294b670f1a8a62d865b0616be9a809f16c1edb
SHA512 7ffce5e58f6f52cedc73f620234a3214dd72b5a94301b2c34c715d121c134d1e0fb7b1a066cab113d69d5319e33b87a1d66836c3b85899cef3d77a27ed4bbac4
SSDEEP 12288:6yS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iln:6yhSnnrFb4PM4MYgLxEVyGLV
TLSH
T12B4523A63EDC10EECF6D16F0C1A566C8E2097C63F976B20B7B4578173B3B60D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 432b6428f86cc83590ce0899ae58006fcfcc3434f1756109e6660207cd71f00f
MD5 62092f7d55ebc0124077926bd067be1f
SHA1 16c71848daaafb090d13673481a7471d68c972f3
SHA512 ca0f74d8d5c0e7abc2de4f3c46192fee8deefce81745e711860f3131aef87375a5ffdd91d71907bd112c754f0b331be35567908f1d9d5f3e53db2752e55046d3
SSDEEP 12288:8GS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:8GhSnnrFb4PM4MYgLxEVyGLg
TLSH
T1974523A62EDC10EECF5D16F0C1A567C8E2097C63F976B20FBB4574163B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 73f6d1d6a6a18b18a84240793dcd9250c089cd9ac2ef6a112f205efb3061f558
MD5 c760a21e25c1c3e10a1a639a4d8fd3da
SHA1 4aec27fc1f1496e855b4b5a90b6c48f80a9b35db
SHA512 c4ef18f451a45dc70d47920b6dad87209e87459c53e1ec31ccb20e32de8d76f598df7d614d53ed5ab3c8de020f0c5beb17e5b725206a3881358b68f8a1073c52
SSDEEP 12288:kGS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:kGhSnnrFb4PM4MYgLxEVyGLg
TLSH
T1A04523A63EDC10EECF6D16F0C1A566C8E2097C63F976B20FBB4574063B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 08f9a0ca29a005541d0fa31453bdd0a2b9b5252ec8fa478862c015d92e5dd780
MD5 2c1f6644f67d9ed5bdf2c90004565de9
SHA1 0103b4abc1fd6d71d07c32ba5772fd77e96159cf
SHA512 2589278964ef2b20300e75d51052b90e1bb9605b3750b09b577145759667d8488b12bb087dd655654dedef4cc4343215a90b91ef670e6d78439a621c194800f0
SSDEEP 12288:ZyPz5L8FS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il0:YzyFhSnnrFb4PM4MYgLxEVyGLy
TLSH
T18755025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 24142427475a7512ad86a1085dc319bc3e5d0f5ac1bc4385a528063044ac54fd
MD5 6ac2b886d95f15cfaf51a30ef951fa94
SHA1 f4031eb07c7a2912ee128b9be1f40f37085f00ac
SHA512 8a178d08d643d799d4ec95efd3dd6f07b3a5260df85dce382432ca151be6fc7cc9bc44f95ab0fdcf7065d7d151902be493038ae36253ea6f21b77823dc022bb8
SSDEEP 24576:RTHaLl3z0zDfhSnnrFb4PM4MYgLxEVyGLz:RT6Lljlj4MYPVyGLz
TLSH
T1E36502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 c6a5c3388a33dae5bf97c9e703af1940da36750e394ca77d7766105119eddd16
MD5 5b5a84e38b57e1f2a22c9d87b7a9341a
SHA1 849578080442e9939fe62c107db745542ce43196
SHA512 88915c2e7a9e99b249af89da65402eac33b1de9498f452f66aae5ada13380fce528e9da8b806843e48d112e90abd0c98966aa992fced5ea8abfd8ca256ca1719
SSDEEP 24576:u37d9CHKy7GZjhSnnrFb4PM4MYgLxEVyGLB:w7d9CHKyawj4MYPVyGLB
TLSH
T14675DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1738862c908e1169508b62693c7237950c447d1caa27a3467211e314e1d4174f
MD5 2c2c838254f78d914ac63c5a8492d88b
SHA1 4c0c353a77da98f3a3dcd37b904f6806f08cc82a
SHA512 cb38d314f8cc89a143f67ee4cc9e2fe307547a72c9292f94fd50fcfca2bca7d6cb2ec1ab5d21c5d0b92877b0898204b7477233ed6bd1a03409bd4212a6899218
SSDEEP 12288:dPS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilO:dPhSnnrFb4PM4MYgLxEVyGLQ
TLSH
T1A54523A62EDD10EECF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B20D5892762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 99aa32caa376fb20398ca3ef8c957c4ad929cd4820384bf57fd2a5ee2d1e6e5e
MD5 b15e91ee983d8ce55a41bd0e0eb63f73
SHA1 c6dda7d6710699a8bc3d29c0d868f64a4a41c828
SHA512 6dda91ab67d2342ff7445e00011f5c157954297499778e60d04183a8774dfd23e709cc11829da57554efbffc45476415cd0007a589bf3abb7ad9f3a3914e5bac
SSDEEP 12288:ZlS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilW:ZlhSnnrFb4PM4MYgLxEVyGLo
TLSH
T1934523A62EDC10EFCF6D16F0C1A957C8E2097C62F976B20B7B4574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 bfd66c920b08ad38f415509d08ff41850b03ca34e09d54c8a46ac245f641a6e7
MD5 7851dc2fb535623436837d910b51e32a
SHA1 d349d5d19cffe913b1582367010fa21f7dc6af0f
SHA512 e1a3fb288d66eba4bb90d942cf6c0ff7375ebde22e068fca274fd69b64352a4f82249e8fd6d53425a1413be3a03e8f6db1ba83ceffeb744c296700a02966d85b
SSDEEP 12288:eNsf2S34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilR:H2hSnnrFb4PM4MYgLxEVyGLH
TLSH
T1EC55F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 81810ff38fbb720c3c43431745913732a9ae798a58d53ebacead9f694f0e360a
MD5 a12537efdc50bbddf1b4e1c216ac7c0d
SHA1 6f290e22f831bc7e3a02e26aac9aed9297e22a62
SHA512 b729caa1f98de18c93d2aac01d219c4c97787d2747c21be17bca04965436b0d709c71e1a321db2cc91d3231e1dcf4714dccfd1ffc96e49421a3a36a2d59025c4
SSDEEP 12288:gz34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilj:gMSnnrFb4PM4MYgLxEVyGLt
TLSH
T1734523666BDC14EFCFBD16B081A996D8B2097831FE71F10FB740741A3A3A6499CA1713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 b50d3f7efd2ee236603c863c01b502d1dd6563b0fa8aa559944409d8b207093c
MD5 fadd638e0bc2744f0186b68fef88395e
SHA1 f454217252d34ef388178aead943af8221624cc2
SHA512 02b6fad4b061761e79fc435d3f9e6f738cf5dc1fa25278659e4830d38753c1ff3e17009732dd6272b627ba9d0fe52e11b38a752d14d8db464364a38451d4bc89
SSDEEP 49152:Ka0h2GEkuAe73q3pp46zwwQFj4MYPVyGL5:Ka0hNYG4JwJV1
TLSH
T1FA85AF1E67EC82B5D0BAD278C9A6814BE6B2B4221B3156CF1151853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 2c2a986bcdccf845d83138351b422cb96d6a3c56fa9cf9216fe46bfc9efd72f9
MD5 f1b11816fcd2a3057488150af90b2266
SHA1 d516f9386e9609804e4ee57502a78b89c8495d74
SHA512 43f6ec713b71b427b5ac82a2db79467e31b03c31a9775183e89daf62026bb52d714713e977b492e8ad8525f2a87ec53854169fcce6e9051d8127b6dfad452656
SSDEEP 12288:6hbHjfX734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il1:6hbHjP0SnnrFb4PM4MYgLxEVyGLP
TLSH
T10A55127E27EC20D9E675A2B8C1954649D331BC226721A3DF23C1917E2F3BAC85C35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 5bc19ac8554e18c1094f761fe5874f747bd2e715340731d2c2883e51ea972019
MD5 f74a30c3d036858d470fe11f8e3cfc58
SHA1 a7f78418e2abde49627f261ef3d3561f169565b2
SHA512 f26eee34c509d1fc07ffcd61d215867dbddc277263fa5a8f3ffbb22b6e08e032866a8efc9f1df4ec34b5847d42cfc05c5e519e4b880e30cdf294c1f9ad5ce6e5
SSDEEP 24576:n3YgnJcRTk4yti+R5dBR/8SnnrFb4PM4MYgLxEVyGLx:nIgnaTk46pBR/vj4MYPVyGLx
TLSH
T1CC45BF2EF2B910F9C8AAD236854147B5FB71782D1F2096CB0170C538AF1AED85E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 98cdebaf89a85c9952df24f8787f49f7e37c6b5cef23671972a56b68f9641261
MD5 a96fd217e393e76f944784186ea98117
SHA1 16ffbc014e999ad3da3816478c917e38ac4272d8
SHA512 5b0c3a520713a4da089152d2e6d6422cf3fd95ceaa4a560a5812c4fa2174999d80d80678d5ede870e0e7c342f7ccb46868528a3bbddffd478c1e8bb048dd0590
SSDEEP 12288:kX34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilb:kYSnnrFb4PM4MYgLxEVyGLt
TLSH
T1554523A62ADC10EECF6D56F0C1A656C8E2047D22FB76728B7640741B373B68D9CB1312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 5adb8d9b2933cf56232793a5eb6f042c1d872dfa10e83ea71110563245653063
MD5 8965a448c189728b383bf5dacac14293
SHA1 1a3fd04b61e4499f6bae8da498b00f825440fd75
SHA512 3072b132b2bdfe2377758ef08399bb317823de0479057708b3cd52ff46a7f55c014bcc5b1736f94f82a103644475db211abab60a48f61927da06b07f51640718
SSDEEP 12288:oOb9A4LWOsvAYFTO34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilI:FpL3UTFSnnrFb4PM4MYgLxEVyGLG
TLSH
T1B2750155F7E800F9DD7B8138C5A28A16E272B85D1764E3DF03A84A662F233E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 e91be5a96adbe213cad3cd4a10bc1a0b3f7cc009c1fc2b4ef2b4932b1a744ca5
MD5 9a57956cb3ece6f20e17190827b7df65
SHA1 334c3a4bcf417c1918741c8ee75ef4ccb58f264d
SHA512 3dcddef44346bbe7ed95d48cc6a068d5e232fc69904afa9fa5b9547905429660ac87ebc4ee0f210b5e8b9765f7507b22d15e9363d343b00a89b00cec70ac3303
SSDEEP 12288:DpFtpOi34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilM:fOxSnnrFb4PM4MYgLxEVyGL6
TLSH
T1BF55026A37EC10E9D579A1788592834CD331B8625B2263DF07D0907E2F77BE86C36B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 409410fd4c34913ab182018e1dd7ce53c710d742ca4673e8ae5c5e83702cd1c2
MD5 9e75e4d55ada21fe840d44135df4f286
SHA1 cd5f6779cdf0328a0f5f884e5ffd1dfd4c716ba3
SHA512 789d817edc9cd371c6c3dc9427d0f53cbe5999d6eef243a0a68a5c308b240faf864d557573904fd0f46f665eba6f1fc5559c60e1a8a45ac1e71f424eb3b4fd1b
SSDEEP 24576:77NM9YqZqmWMUkPjZM48Mv6bEhscSnnrFb4PM4MYgLxEVyGLc:77cBWMpPjN8DbEhYj4MYPVyGLc
TLSH
T104659E2E6BEC81E5D576D13DC9A28245F2B2B4611B318ACF1252833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 a0d73c45115b8532890dba44a1ea58842da25b0354f7d9401e89a4963426aa72
MD5 857645cbc2db02a70c51c1acb9285db5
SHA1 ff76edaa6636d8c536d6272915d22196455fa4d9
SHA512 c5cc0c98a70856867878790cb714792100948fcb405f0637376bf105caf3f14367135fc24ed4eb2411093a393b54ce7267fe6676f334b82ed876307aea3ec157
SSDEEP 24576:/W6BApg2YuyuNDYTabvcdvNYf8km1+SnnrFb4PM4MYgLxEVyGLK:/F2YuHNETovAvNYf8kmvj4MYPVyGLK
TLSH
T180857E6927ED80E4E0BBD27D45B6D286FAB2B8511B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 eb1f4371448e936a8636f8817653ae0395f2dd2551a9adc366541a3437fb88f3
MD5 2576c1bdc8a45e5aca3bff1ac98b07a9
SHA1 96f75877595c49bfd94199f579d25bd4f7bd8a6c
SHA512 1674c94d25c1e09a2bf83ebd8729f9f59487f69c0fd99c3210e8c45c4ddbaa9c9651926b10b7199172e4081c5f7f02cd03de92ca425fed617d90c61555bac4cb
SSDEEP 24576:wAFs06+Omlf3NXEbToNSnnrFb4PM4MYgLxEVyGLY:FFs060lVXulj4MYPVyGLY
TLSH
T12765AF2F66EC00D5D07ED17D8997C91AF2B1746307256ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 b301188147a7439becf007ec377dd20029b79f9e19af8a5370c971d00ff1e936
MD5 820de9a14e6f657feb57c875316c4693
SHA1 d3b14fe956d2340d1fbc1c08233d73290ef88a94
SHA512 094eb8e5a974ab6664f8e632fd5d163f213fc15a08924e9448deb29122ac5148483fa9818f75406a83e366ab02773149a8cf62815047092e1c58aa1feee1ebe1
SSDEEP 12288:QCJnJ5D3VkrDzxj34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilc:lJnJ5D3WXqSnnrFb4PM4MYgLxEVyGL6
TLSH
T18675D02DD2A810E9D4B7C2B4819A1795FF72383D2F226ACB28B4D4353F12ED09979F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 003e5a16896f8920a531915c9c588562dec3de07b4171faa01fbbe3b23bac10c
MD5 fd8abca2f9ddbe848f1ac373d468bfd2
SHA1 9602884d5d8a0361cdb804195445114a38feabd7
SHA512 24bfb0a58d34f4235ce187f65dfe9500beb6c00afe9a87ddc019e01e95dc2a52a8dab6e2488df80109d81ef2874848b95642b2074750fb7f64ba9d31113ba694
SSDEEP 24576:lEPghm6/7IIXdwcXrif7qQncjlP65i3Vu3SnnrFb4PM4MYgLxEVyGLg:yg06DIKdwc+eQnSt65aVzj4MYPVyGLg
TLSH
T180956C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 e02ac3131283e79e063971be85e67422ff5149c7b68758b11e5fdcfee97e2076
MD5 6a501d8c82c39b26e3ebafe907d2606f
SHA1 6734364bbaca66b74ac7ae7bc90685fe3214b029
SHA512 6b2cdb2616af8fba2e2de910506dbd213d1f5c290bb7fc545581f7a7d5afe5e3192a47d8718022dde46694db4f68f27aca0b65182fe6c11c8b08e6087a0aa1cb
SSDEEP 12288:jEP3Rn634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilL:onpSnnrFb4PM4MYgLxEVyGLp
TLSH
T1F055126E2BDC20E9C66A917881A18688D332F0717B6273EF16D0D13E1F37AD95D39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 a12af08e0a4280684f34ca23a30867a16629b1dcc3aa87f68687aeb9ccb4f460
MD5 fff9d77fa069260fc93ef4dd8daf6a13
SHA1 35c4e18f2b6fa983dfab089040bf836b10e14689
SHA512 8bc9005285793fccff0afeb824ca5f550b9c64448776cb19f74c7f6ccac2019049b1a92b6dff100cb7817be1927e093148cecc0808d8eb61c445d85e66be6add
SSDEEP 12288:zjkyE34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilx:zIyPSnnrFb4PM4MYgLxEVyGLv
TLSH
T18755125527D860D9DAB90674C5A682D49A35BC21AF21A3DF6280F53F3F377C8AC31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 62ca5b6565fab43b57628645474a97aa0469e706039d8ea4217331ffc0d48977
MD5 73fc038d8a5d8bc4fa931345bf90c9dd
SHA1 d6aee54a783f1be5d8ecbd2dcb43ec7fa8c98fcc
SHA512 f66246a939760c0097119df5ed40845041dd7d00e58535f0b171f0cf86e3a9ae334eca21d426192dda03bf3541a9f30d6ad83941d73e85f798d0b40d9223d98c
SSDEEP 12288:9yS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:chSnnrFb4PM4MYgLxEVyGLV
TLSH
T18B4523692BDC20EECF6906B0C1B55BC8E2157831FB75719F76C0B4363B3B68958B1A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0db6ed8d86f936bae859a179c46ac6115abcbb318e89412c9436a3911ce0084e
MD5 aa99b6ea14eee4210e7e0983311fa320
SHA1 a28ec3626c2806a9fd6ea848deca62eafa80f2b0
SHA512 71f4eaf9d6c3df9a69aec8d0d806ff17c7a0d8b634f841cfbd49bfe69b01539f0c718992f7bb083493515dc909d6557291d4dc73ad9b25069d7eb6eeace39238
SSDEEP 24576:cQ9MxZKdcz9dw3kSnnrFb4PM4MYgLxEVyGL+:cVKZXj4MYPVyGL+
TLSH
T108557B2DABE905DAE177D27594A250C3A633B4311B31D6CF2448D03D4E7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 82c694352289b7ce68f9cd087b84928f301889f3c24ca9d7cc98cdf5d32263d4
MD5 dd4bc9f9f5ae666a8c877ec1b662e950
SHA1 233b6dc9f6ee94cb2dd4aadd55960c032d66acfd
SHA512 2eed4a6715cb488343090109989270efe7ab9909d58bce833d96a29ac4b5a979732e88d47d99452e1d56e4b101dfaed4925571fea2e3da69924a8e05991dc517
SSDEEP 12288:WyoKo2JRple9po34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilK:WyocDAp7SnnrFb4PM4MYgLxEVyGLY
TLSH
T13E65E01F7BAD40E2D176813889858785E773B0306B6263CB6691C33E5F27AE9BD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9a415e46cfe17e148e3bc046a1d83dd5c0c6303dd74dfca4dd454e10fb3443db
MD5 c0d7c14a7e4e437726709d1f540d6011
SHA1 bcc6b7eae3c566d6db0754efdfd6085cb7fed43c
SHA512 dd05bdebc032d88bd2be3295585e067ddd3051c8f41c19e661b1bd3f66c4a7ca75cf125f071a9224a78d87aeeee7d301bbb3c5f2b39aa40e873cedd12f4e8ad5
SSDEEP 49152:EWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKEj4MYPVyGLo:u0zuNIfVM
TLSH
T176A57B3DA2EC00A9D9AAC375C14513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d9019004200c25795c87b09bda57472cb805faf0f0b55727df787823e77f259c
MD5 dd58593abfe44afdf2361c6e8e076fa7
SHA1 85831d50d9968bd94b5ea1e5640d0e166a9199f3
SHA512 d8709b10c0f498978a3c3ee7f42fcb6fed9500085f086ff877b8f2c8e3e8467ac8dc193826657cb97302abfef9359b36130fb6e2f2413256e078c2c371650d75
SSDEEP 24576:t1QT7EcpfxR+N5AWAz3ooiYtjMqbpSnnrFb4PM4MYgLxEVyGLw:YTDxR+N5YzTfjMdj4MYPVyGLw
TLSH
T16B55B02EA7F815E9D1BE85788A23C506FA727821133193CF42A0C17E1F6B5D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1040-239-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1040-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1040-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1040-57-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1292-388-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1292-334-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1292-372-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1292-404-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1292-517-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1292-410-0x000000000C090000-0x000000000C098000-memory.dmp

Download

memory/1552-283-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1552-406-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1728-449-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-443-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-433-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-434-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-416-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-435-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-417-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-418-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-421-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-420-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-419-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-422-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-436-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-431-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-437-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-438-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-439-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-430-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-429-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-428-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-427-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-426-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-424-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-425-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-423-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-453-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-452-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-451-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-450-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-448-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-447-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-446-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-445-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-444-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-440-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-442-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1728-441-0x00000295DAFD0000-0x00000295DAFE0000-memory.dmp

Download

memory/1796-266-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/1796-271-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/1796-274-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1796-325-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1796-413-0x00000000013D0000-0x000000000142F000-memory.dmp

Download

memory/1852-333-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1852-279-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1852-415-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2480-412-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2480-298-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2480-299-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/2480-305-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/2696-222-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2696-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2884-330-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2884-516-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3208-85-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3208-240-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3208-78-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3208-84-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3532-466-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3532-322-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3688-317-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3688-248-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4388-46-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/4388-1-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4388-5-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/4388-9-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4484-223-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4484-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4484-26-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4484-25-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4628-31-0x00000000006E0000-0x0000000000E1F000-memory.dmp

Download

memory/4628-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4628-32-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4720-329-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4720-467-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5296-277-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/5320-432-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5320-318-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5828-314-0x00000000006B0000-0x0000000000DEF000-memory.dmp

Download

memory/5828-312-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5828-315-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/6004-73-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6004-62-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6004-70-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6004-68-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6004-75-0x0000000001690000-0x0000000001DCF000-memory.dmp

Download

memory/6004-76-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6008-286-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/6008-409-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/6008-287-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/6008-293-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/6036-309-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/6036-414-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/6064-253-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/6064-261-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/6064-321-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/6064-252-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/6104-41-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/6104-238-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6104-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6104-35-0x0000000000440000-0x00000000004A0000-memory.dmp

Download