f214dd44d0ba62e17eec2d22c2b4bf840941f0dd0d2e35295e85108317689384

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe
Size 1.3MB
Sample260415-rfjvcabs5z
SHA256 f214dd44d0ba62e17eec2d22c2b4bf840941f0dd0d2e35295e85108317689384
MD5 2ad2091af0a87bd224befab99ed07b31
SHA1 d6a99b4e281b5c07a2bf3974a2b0e34e251ac7a7
SHA512 5e6c989a7a46bf82fdcb35122171a9d40e11ffb1dbc02b9446cd07b35371a9e477db5939d7e64de2924885accad773d9bf62cf3dcc921c0f342a925b02d21d43
SSDEEP 12288:+VfhxbitwzLq34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilY:YbAwhSnnrFb4PM4MYgLxEVyGL6
TLSH
T16F5502AF77B454F6C56AC1B0C4AAA7A4E772FC55AC21A30F2750A31F2F376946C24321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
4036	alg.exe
2368	DiagnosticsHub.StandardCollector.Service.exe
4908	elevation_service.exe
3784	elevation_service.exe
3916	maintenanceservice.exe
5616	OSE.EXE
4588	msdtc.exe
4020	PerceptionSimulationService.exe
2020	perfhost.exe
2872	locator.exe
1792	SensorDataService.exe
5212	snmptrap.exe
4852	spectrum.exe
3304	ssh-agent.exe
396	TieringEngineService.exe
1028	AgentService.exe
908	vds.exe
3084	vssvc.exe
904	wbengine.exe
5676	WmiApSrv.exe
756	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\299b4891da180f68.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_172312\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003779bdeae1ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7882debe1ccdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc4b32ebe1ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004901e6eae1ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a29fc4eae1ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2368	DiagnosticsHub.StandardCollector.Service.exe
2368	DiagnosticsHub.StandardCollector.Service.exe
2368	DiagnosticsHub.StandardCollector.Service.exe
2368	DiagnosticsHub.StandardCollector.Service.exe
2368	DiagnosticsHub.StandardCollector.Service.exe
2368	DiagnosticsHub.StandardCollector.Service.exe
4908	elevation_service.exe
4908	elevation_service.exe
4908	elevation_service.exe
4908	elevation_service.exe
4908	elevation_service.exe
4908	elevation_service.exe
4908	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	436	2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe
Token: SeDebugPrivilege	2368	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4908	elevation_service.exe
Token: SeRestorePrivilege	396	TieringEngineService.exe
Token: SeManageVolumePrivilege	396	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1028	AgentService.exe
Token: SeBackupPrivilege	3084	vssvc.exe
Token: SeRestorePrivilege	3084	vssvc.exe
Token: SeAuditPrivilege	3084	vssvc.exe
Token: SeBackupPrivilege	904	wbengine.exe
Token: SeRestorePrivilege	904	wbengine.exe
Token: SeSecurityPrivilege	904	wbengine.exe
Token: 33	756	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	756	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	756	SearchIndexer.exe
Token: SeDebugPrivilege	4908	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 4512	756	SearchIndexer.exe	105
PID 756 wrote to memory of 3280	756	SearchIndexer.exe	106
PID 756 wrote to memory of 3240	756	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_2ad2091af0a87bd224befab99ed07b31_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:436

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4036

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3784

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3916

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5616

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4588

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4020

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2020

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2872

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1792

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5212

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4852

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3304

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1452

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1028

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:908

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3084

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5676

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4512
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2856 2640 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3280
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2884 2880 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bbc3a33b743acf73af46bec06782d9649ebbba70a8ece480a80b595b58883151
MD5 d43fdd30aa2b59a1c6ffdd323e5889cc
SHA1 6d87011b9f4084e634fe89cbcc43cb782836c590
SHA512 a31d9cb1b8003043b875a87c1e409335a822d628b7baccaead3835e4d4cb0f6f82f7bfad769f7f9140d2c78969f104a7bf28e5884bde560b19c49004669d0b1a
SSDEEP 49152:Eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnHj4MYPVyGLC:+3q6HjBPVe
TLSH
T133D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 c0437333badfa07ab917a66384a725c4d0f9b2f7770cef53057258e03a69e78f
MD5 b3aee6d96c006a8b992b8859ada44ff6
SHA1 7f0c01d526d35ddb2bde4faec26a654fa0c66d29
SHA512 768ed153fab985db6ccb38c9328c15aace3f9a59734eb445333a611b0a5523f899a88a952e7f5e4cb2603fe46900c263e22027ae975655f53158b34d140395f4
SSDEEP 12288:e1XLsswWkxy2lRq2czAS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9P:sXYfDtczAhSnnrFb4PM4MYgLxEVyGLl
TLSH
T1A465F12977E408F9DD6B8278C9A28545E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c45f47d233a82efa1c9e3210cf5f705f72c764ecc598d09df6114530f6f3ea53
MD5 be9282418c60dccb955e61eaf8a0731d
SHA1 601aca27fc304c1d1c8d9468ccae9b0ab54765e5
SHA512 16765d0df85e8952649afd1fa0526b31d9f36e5fb1b5dc0117fcc65d5e3d78f59e25b9a6a4cda6c65f48b4196c0543d949ec7e3bca9721c36906671ccfb71d59
SSDEEP 24576:R0Le5ji0hmxirM8SnnrFb4PM4MYgLxEVyGLM:RPji0AcEj4MYPVyGLM
TLSH
T183859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b9f79fa7c7782f776d8552c4f3c23db97035a341810b4209c112f87d36664ea0
MD5 2101d4a545e6e905f54a93298ebcbf66
SHA1 4ad43fec8fa488a96bb218bf01a88fa7320ffaee
SHA512 aa2a969f7ac8825a901d0176cf21c6e1e84e47d115ae9ea378684d13564a38e9735b184c32db7fe9358bbd0acd45fbc640e61a68d8ddc6862585c57627730185
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWE6q8wyuySnnrFb4PM4MYgLxEVyGLR:J/ezSC6vUzPvxHjyAj4MYPVyGLR
TLSH
T111755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 28d268daf292f342d5c97f3dceca34e0107c64769fa240172a5548bc0c765c74
MD5 89f6b3c1884baefdc99c7421027aba8f
SHA1 e8266b185c85317a6732e8403e83ac33fa3b4796
SHA512 b95077e78e0012cb5baa9771bd3a241e4bf567140f3bfe1d39e38e19635c8b9ad64889c9a66e552da23d0f390324c0a989ffea9be9edf6960e4a0c59ffddd63f
SSDEEP 24576:7VbqPb88hv/l+6lSnnrFb4PM4MYgLxEVyGLA:7VO88hXl+rj4MYPVyGLA
TLSH
T1A5559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 791444a270708c2f0b74e51ec56d6c3291a5f7ff491706859b4cba8a988967e8
MD5 544ee5963f06b0baa7e3ae4ee25427fa
SHA1 fe81539a4bd18bb894eaf5cca65300c628bff859
SHA512 457e011acb9ef03a0f8d2748075648fab127df35efff294b749a5e73227bdc81afe04b9926b75a2436d2027a01c3e3b6dfcd4235f54b1b919184188c047e1184
SSDEEP 12288:GRv34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilZ:GRwSnnrFb4PM4MYgLxEVyGLf
TLSH
T1A74523A76BDC10EACFAE15B0D1F96AC8E605BC61F875B20B6750785B363B20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 575a694840b7671b675075040eaf8faf7658ef6ae82ef2f0f12fa0df1bb0b2a9
MD5 4d6e7e9189a070e1a204f4cbe6bdef69
SHA1 8ba851d2eef336af25307315af648df8fd3670d9
SHA512 6b7f49df0dbd29886423fd88f9097e34c9ee865bbc32df56b4fa53647e2fb7e109c3c4afcd2597f30a57c52ae16c243dddecbcbcb17b766e67b19a709e4c577a
SSDEEP 12288:KeBNUbTVO86UW34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:KJIUNSnnrFb4PM4MYgLxEVyGLk
TLSH
T13465D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2395614476eae3ecefe343d6ced113943767c853fa08d01df115dc2d01c7bbb3
MD5 7f8264123e9fdfe573974321d1dc0ce9
SHA1 6bfaee75142d2be0253cf297568259005f1eb290
SHA512 1bfa38d824453418e83a714b1d212150b6f6777b4a0c4b674c883761de2abf331fee6965b3ec797ca074f328b99ba5e5cce11ff8717d025d68f7a7e2f5aa5783
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH1:RQvGAdlCEL8c/yRNw5CGV/
TLSH
T193267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c188ae64f9aa2f1782851f448973587688ec6d2a33bd77775046a224704b2586
MD5 71385e99e2da22dc51c5798179d8e088
SHA1 20fa3510f8659f4c93a8fd7e82c97c9f8a666bf6
SHA512 72d0a3b67e67dc7c77a9cadb0cbfe24489869324357e6e17bcaf1d95affb878603f794ff9576f46fe55aab46ec0ae0325f5d553fcb1d9225388d539b3d68f313
SSDEEP 12288:5AwSfxL/2Dc34DLLmt0LDQewsAj434XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAZ:qdewsAjLSnnrFb4PM4MYgLxEVyGLG
TLSH
T1FD75E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c0213902be813e0cbc10c2fc5511471df7f25d52e3285d3d2cbf12f6ef32826f
MD5 d2e809bff97d30713d43148bdc5f7d7a
SHA1 c3e474bf9ca1f9164e3e506d13889db973303cdd
SHA512 e59edd15cdd3bcaaf712bca0a7a54b7491d9a23dc551bdee68c0f54c7ee3256ee4e71098ee6d2d5ee9002d295c16abef7623cf286ef47ffbef0e709c7b6cde16
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:mUEtQevvqc2W1cpV2EI32
TLSH
T144474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4677e0bd179b429f72012a254e620891cf6ad0a7938ca7f78bc9a68399267f50
MD5 2bc455e3a7c0564aea71412680d5c2eb
SHA1 0f29b53c2d5d601de2e290ef2ca44d349ed90aed
SHA512 3762534232bc78535c68b3efd514b619ce155d2f437a1d90d84f0eb090bab5a75e73e8b62f2c209e7fc3a6ac946567c926d9a30a5524fa30a49db11cbd0a3ae4
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/z0j4MYPVyGL1:KoqtVjnmyVx
TLSH
T143D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 70ca61f5e9d05c4b312f0807fdc0c5b1b451a216e0e98c8656ae2dc94fbc681f
MD5 08072af74861fc1d7549b5288295c355
SHA1 317b758d8f0e9ddddf795424ab05d06786e00486
SHA512 ce0c3a0cfdd8a30d46e11eb24720236e24d161471995d0184acc506c677e4bf0735b289c6f301690e5ffd0047ca925017e6574c1637823ae9a7b425ccba53d9d
SSDEEP 24576:eAhGLJIFoiwtA5l7S53uSnnrFb4PM4MYgLxEVyGL1:eAMyFoiq55j4MYPVyGL1
TLSH
T1DE35AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 dd8c4fd027bed0289a42a6803b239303adfc72ed90a255382e6e5b4c8a53cee2
MD5 95e71ee5b172b610ef47a2eea01ca2ef
SHA1 cdf6b32b898d5882f0ff69d7f82ab6268dcf940c
SHA512 3c9899e7e3f7db2ce4d2373ec9419bbb33deeb1438cef5eaaaedc3f4f58d5bbf63756a1d6ceb617e7f2fa85896b190b87f36d9e8916d415a108ed423963baa5a
SSDEEP 12288:Omw5HEjsChNVBFgl0WDm+CV34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyq8:HwuoOWnSnnrFb4PM4MYgLxEVyGLq
TLSH
T14765F14637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b92115ad5d83a71a828fcf2f304f27348728ddba7929c5d5d31cb80a800ab4b2
MD5 7a6b12cb045e7cf28524f1df8e59bd0c
SHA1 89ea704285607141e18d83a45946693aa38e79ff
SHA512 99ffe2ef4019d387cfb5eced53a405e4f8e3405c73cf8ce45931c4954e6f9e6cb7940dcaaf88e3984c1c83f72fee6979778ea59e267cc5d9f64271ec5e71e5e7
SSDEEP 12288:2BZ1IyI34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilw:AZukSnnrFb4PM4MYgLxEVyGLm
TLSH
T1485512AA37E820FACAAB4274C4F55688E3327862B77293CF1650555A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2e743a271a10565ce743c6fd78ad969c0e25114b98a0b843f39e2bc5e45d5ca6
MD5 019e2bc003d5f32c5d0309e964dde9f1
SHA1 89b71711de7063f926dc2cbe046211d5c91bdeee
SHA512 0fd1cd099b0af738fa166b10521c2e931942c3220bd1e2b8923ef2c495890f5cf717f97862a9095586ab7b2a1817872f31cb6d29451a360194ce56b2c718313b
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:nQRQyi36YOcPQLvw2gAf+PN3TVI
TLSH
T1EA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 33e374d4842c66c3bac757f4c63874354da36350374b36014314b742df7ea05c
MD5 755b7e503eb84876b5e628e551669686
SHA1 3e4383e2efc5c2963af93ed822d71f6391c96184
SHA512 545991cc2356cafcee301c70752e5347cdf853da6f3878633a8d1c6fe2ad361a5b5480f89c5caf4f1ba0ae43df9a1d4c7eae3f1073b25bc3652ca56847eaa1b9
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ut:jQRQyi36YOcPQLvw2gAf+PN3TVz
TLSH
T10E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c5da5217f66347d8089aa7f3090444573e38793df6e7f697a8edca6e9276e077
MD5 062b9880051a8670fc967cbfe0957fa8
SHA1 c172c2c4c4e9340d0add0dda50813b0336bb810c
SHA512 6302e3a8510492b22eda57b09d1c0350d43916603db1957915ef8fbd42f3bb182e9b00c83e16914bce915b1632596e908b54cfd802b78b39aa8d33999c1d700c
SSDEEP 24576:JwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0USnnrFb4PM4MYg5:V68Qg55nhheWu7PNU3/Ej4MYPVyGLK
TLSH
T191B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1f582ab3b8898975efff45b879ee2a288cef487f32e370ca1fc643061aaef53e
MD5 302e090a9bb87d514814d24f9a8442b0
SHA1 fc59363ec1711f9b6f618f27d873be324b455249
SHA512 0e062bd11a1bc751f3d605021464a999112de0522f9bcf6616157f9de89d5eafedb9fa79b8f41054cdf5d13468e0df5fb39b957a5c744adcaca21074bf16c426
SSDEEP 49152:43aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99C:1y5112gYy5azzVvL69nLKnhZQVq
TLSH
T1D9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 85e8f92b5c41673da256e962769d8d9a523e38ff3f8130a82c11e4e6546aa1f0
MD5 9f1a2061001fafc37d054c3bf62efd5d
SHA1 307568700cfca60ef7884e2f8a56cb3dd9654127
SHA512 1230abef6250cd28c765a50520dd579d9776b2c99b9ad44d13ea192c7debbb134353b87bf0835bead28999b1ac797f55579cf215a8ce0a6836e4e003479bc1ef
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKj4MYPVyGLK:Pu6JmVxd2drVW
TLSH
T1DED59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c036794a83a8beb227768fd4d1d7085a85def7b9c605f61cdf535dfebd616d1f
MD5 2822197bebd287d6805a42b63fec4a45
SHA1 64344bb5c61ec3ae17fe3771a8c630af3b2d3b15
SHA512 4048a16fea5488da513c0b14bfb0bb947a4700bb528c8de13551ff5446d3937564247e66721aa26ddfb8c1ba2c23d2b2be27198dc7564c4bd34cdb38259f75b0
SSDEEP 49152:c1hpsNoJpF1A6UU44CwH7R4xGj4MYPVyGLb:cmifPbRyVP
TLSH
T15AB5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cc4f18cfaeb72206cd1d5b8a96d1deb92fa5b3a55456e4456a01f47755c8ab4f
MD5 56dfa29c3ea8705a6c04cc57db24e489
SHA1 52134e73aa41edb8f9580476f828087466dff250
SHA512 068177c86a0a397348456d83860fbc16005dab74c31296a2925552d3b1db22eca65ac670970b0bb31b3f7ce55dd7a745765d6bb6b221b9b0e869a3174de20e03
SSDEEP 49152:pSuZQIY0Be2KRRVtOnks6NMHqXj4MYPVyGLg:n5dKTi61kVE
TLSH
T14DC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 aaddb804a76d89ac90a3cbe79f56e9c92c3eaa928685b17bc5f95d24da9d40ec
MD5 aabb416b417941831592a2f6a254d600
SHA1 3b165e76e740b63f7bfefc8dcfdd418b42d14984
SHA512 e118c29b841e78b53f168da59c2f676881c4a7c32e9dbfbdff65180f4235d21c051c4141024021d44cec7c93ffa7923558e38aa11f973f9a929cbc8d272ef431
SSDEEP 49152:3htSn8EApI0figngiDn0AP5waj4MYPVyGLN:mX2iyphOVx
TLSH
T1FB95BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1bace3652167856839277d6029866957e0114078d8d0e954b7b1f1e7fc841a20
MD5 598179dddc65bee61f93d3f55c6e7866
SHA1 24da5ab83e818996bc37ccf621a3dace79995c0a
SHA512 f7944eaac8db91b5fd9c013e3ba41a84294fe1d4a4196b58b946669a36621c07014b80a4fbb52567eec54e65824c5dc0a792e70567509383a53a4de7b390a039
SSDEEP 12288:aX34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilK:aYSnnrFb4PM4MYgLxEVyGLs
TLSH
T14A4523A62EDD10EFCF5D16F0C1A966C8E2097C62F976B20F7B4574173B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 95abc40cfcdda08dc7728f9e380408fe8b327abe56c51a29d47f70ed59ed290f
MD5 a8d3be62229f18a201c1de51a14a88e3
SHA1 605a2d6e061268b54346da1a0195b2a53a00e08e
SHA512 9842989925dbfc6ab7262d2eeb9e68aae58ee86ed754544f66fedb91f078513c8ba0bdd1273b388eb1f1761f05c027b6a884f40efac135a185c603c324b1e599
SSDEEP 12288:w034XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilX:w/SnnrFb4PM4MYgLxEVyGLp
TLSH
T1524523A62EDD10EFCF5D56B0C1A966C8E2097C63F976B20F7B4474073B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 62e663236cc234969aa9564fc4e4c8d67bd15295cf57fcb02ca85a54a538166a
MD5 223abacf3ae5ab95131f54f64d46f47d
SHA1 c69db20928270b8bda2ba4e55b15a2b0961a7749
SHA512 dae88eb2c55917ce5c099e89817b8a9ad404319abcc4397975f9bdc1812fb71f5dca7b456bb94663be6f4d537405d76782999042ff84ad48d42eab88361447f8
SSDEEP 12288:he34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilX:hVSnnrFb4PM4MYgLxEVyGLp
TLSH
T1BE4523A62EDD10EFCF5D16F0C1A966C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d96dd4504a344b9e06498452d19a2fae9a5da56e8b41d92c8ec1f9b726b62baa
MD5 0a8732b87bf1949bfaeafc02ad87d8c2
SHA1 35d25ecab29dde5c86766a3bfb8de5129f907708
SHA512 1dc649cefbc6b0fee28c531dbd6fe229e4cf8a958480dce6eea9bb5ec4f8edbe462268fa75b1dac0da31c7ababd5476b725b9922d5ed28a0e0b5c6e7359a331a
SSDEEP 12288:3VJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:YSnnrFb4PM4MYgLxEVyGLW
TLSH
T12A4523662BDD10DACE6A96B0C1B556C8E225BC62FA72B35F6740381B3F373489C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 16b416e6f405e859b61a8c9dd233121c37bcd2a5dc6ea0d765a69ee5d32fd539
MD5 df47d799090a7085bbe13b32f8aa506e
SHA1 edd03be5f58537dbbe5b376e740a324dbff22159
SHA512 2f660c28820dd07682788bba7121688617380138cf950e0eb1ff55d6160b113398db0ffa12da9a078eb4298173f7b2df0a7d92ab01f0c0521af864fb198da7ec
SSDEEP 12288:WB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilB:WGSnnrFb4PM4MYgLxEVyGL/
TLSH
T1604523A62EDD10EECF5D16F0C1A966C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 83f99d126d6be2a04237c25c4bfacea65fe5850e7d4369a4d0f8a6c9697ce60f
MD5 be01bfc2c102a395326c0977e6d06ca0
SHA1 61d2ad220f4546ed91a86a32cdbcdb8ce9cea6aa
SHA512 4637b630d7195f742fa0ab1d229856b2c0714c61d267170244949d5a253e3b5916760c13e23c01150761ff02587dd37014618122c706989de4f9195ecc16ae67
SSDEEP 12288:Bg34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilW:BzSnnrFb4PM4MYgLxEVyGLE
TLSH
T1B54523A62EDD10EFCF6D16B0C1A566C8E2097C63F976B20F7B4574073B3B60D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 554d25423f48f293a660555a01d6021a4bacaba62ea89b643379d804f5314967
MD5 4dd9c14b5a5e9973a84b00051ba75e08
SHA1 2951e025461f781316b57b609d5436637af51438
SHA512 8695bc3b984ec45aada49b2ce110ae96e5cfb9275867b8a79709c5cae56b34f02e3ede5a40ae6cb4aff1d3708068db385e26772a1a338205e7f93d499a76db91
SSDEEP 12288:2M34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:2XSnnrFb4PM4MYgLxEVyGLc
TLSH
T1B44523A62EDD10EFCF5D16F0C1A966C8E2097C62F976B20F7B4574073B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 60e432ef3438af4ded0ea4774b11cb317389fef2ee6d2a76571146de859d83b6
MD5 63ea399929d7197badab6d7f1d8b83ad
SHA1 7269345e7c1335294a73d4062c2914d954a42b1d
SHA512 50ae1adc7e82277fde8ff90fd51b94564ff5bbcbbb4d6518311d65b01b94409a08b69ee1e5b4cf294c1e574f6c28b0287973f9698a0e60d8026242321e4553a0
SSDEEP 12288:giZwb6zzFEoS2cPvyU34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2w:jZMSzFVSOfSnnrFb4PM4MYgLxEVyGLl
TLSH
T1CB6502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 be7640aaf372e7519fe16958d536a796fe1d018803f1e088b830af680c6bf4da
MD5 8dd9031d6952284882c73f5a887ba8d2
SHA1 506fc80e9d3c379655029ee513886135e6db9709
SHA512 48a30553b477f9dc39ea929ce0ca6c5c7754e96c58c86f2ee54876c6300cf7326ec5345bcacd6cc0ffde0a70a43d1d8ed4fde438ae11675eb069c2063716c03a
SSDEEP 12288:7734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilU:70SnnrFb4PM4MYgLxEVyGL2
TLSH
T1FD4523A62EDD10EECF5D16F0C1A966C8E2097C63F976B20F7B4574073B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 fbfe624e933ea8a96e7c2a195271c760b2a669a7506893d7829aef89cc808757
MD5 253e84f0e686834994dd5683abb8acb8
SHA1 269defe581e8fdddc227f997f647a51fdfece071
SHA512 975c6041023553eb8765f34c4f883121bd40656e3e0365fc0b8e5fb05ae6343676997e02b0b2b66f2319a1f07ead20f065714941adee0eaea5c1ba3afc6aea85
SSDEEP 12288:Z/34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilE:ZASnnrFb4PM4MYgLxEVyGLu
TLSH
T1374523A63EDC10EECF5D16F0C1A966C8E2097C63F976B20B7B4574173B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0d9e692f00571077ff644d0cdabc4cce5bf684ae6b9a71bb9ac3bcfcb9d6e7c4
MD5 bdbba3f6ca6d7e86b5bd297331e921e5
SHA1 de942e6875f959b98dd4da35cf1f3ccb13735cae
SHA512 62dbe4649c762ea28cb7298d4cf4f00c25d5a78c80a24f9c8469ea286d31023333aa6de32490be639f1e6f43f459a072045858817e0866271e4655a525da278e
SSDEEP 12288:GyPz5L8I34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:7zybSnnrFb4PM4MYgLxEVyGLw
TLSH
T17B55025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 517a32ce90f92707ca672fdd638c712dafc2c43850eba3076bc75a26f47bef2a
MD5 3d6ed3f7995936c4c820166669b8f29f
SHA1 84132498d1424f2454fd5385d799ce86685ed5f8
SHA512 862759b3fa71b24e467e43ccb6720219f4c7db0205d8331d08167eed36487827f15f69dfe23bfbf56ceb09e679f9040219edc7d9bc2f129e0172050f2b82fff8
SSDEEP 12288:q734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilM:q0SnnrFb4PM4MYgLxEVyGL6
TLSH
T1344523A62EDC10EECF5D16F0C1A966C8E2097C63F976B20B7B4574173B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c6982d13ce896b00663438770f2beb4cfd1e7ef2c47b67fda4db3474e3c192bd
MD5 a0d023c1c40c67ef27158ecf551698da
SHA1 7d331a148432949bff529f0099716c4c19411375
SHA512 ae6dceeeaca067985d739ad5c6293d33485db9e93af556a9d8d4269abd4ac507371fc2918d29af5ecf5c86d1d53b72176d6a770650b186c42bba7b593648302d
SSDEEP 12288:9734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilb:90SnnrFb4PM4MYgLxEVyGLx
TLSH
T1D44523A63EDC10EECF5D16F0C1A966C8E2097C63F976B20B7B4574073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 87bb192f0ff4c54366103557147ac05ad06d995d4c8a1383e51abc4c0c204432
MD5 088c9f4e1a569536fa4d0ae6d2e49def
SHA1 af64d6d23ad369289c391e2f74700f56f9cdc5d4
SHA512 ae0ed1802bd2ba08c67b6a33854ab2a845e674fdf0c3cd67fcc6b7a2a899e1a6f8bcdd9319aa7487e9212cfa08da113939b26b6692aac30ca2d350a6e05bcfe0
SSDEEP 12288:QyPz5L8I34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:hzybSnnrFb4PM4MYgLxEVyGLn
TLSH
T1E955025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 ceb3b953f4dd5234fb94c9f013eff7f01691e333487b1420b793864d841adb5b
MD5 42821c73d27acc223160ec4e8ba5a39f
SHA1 ec92ef8c610027664ae7dd1001500b8acc054527
SHA512 11224410eec2564b7dce025d33ccef19566336ff1e3da0af87f29d3d12e449c142004b872bc955c1f79f547f390c2e8debb9bb844b13a425a064a6334d2a6876
SSDEEP 24576:OTHaLl3z0zDFSnnrFb4PM4MYgLxEVyGL7:OT6Lljtj4MYPVyGL7
TLSH
T11B6502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 06579976069e73a3baeb8856ef3b3c7e25b5bdd34870a89ca7d655aef4f9455e
MD5 c57e65e056dcbdf6fe9b13ef170b8def
SHA1 ac6eb5ea3301574b39f8a7d6a6c80a7314bd28ad
SHA512 9ddfb358d0eafcc1eaf33d6aa901bbcacbf8a36789f2e45b72953cec0a039ae00e354ce350906003c38706ccaf8c5e3703bbec0197abaad6ad2c493829535e3e
SSDEEP 24576:837d9CHKy7GZJSnnrFb4PM4MYgLxEVyGLN:m7d9CHKyaMj4MYPVyGLN
TLSH
T10675DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9c61428b686ff8062d2f27286bc0a558517811ffdf12ff95816dac5c2a02dc1b
MD5 b09c63b0debb9fe16a1039050281deef
SHA1 82aba28c995b6264a6c4e175b202e601621cba89
SHA512 bc61fab47130151e86d986c68cdc8a2d003e6c9b32c799706a729480a57d03776435fa0cb25d12ff1776554c05438af30f0883107b72364616686b489228bc3a
SSDEEP 12288:J+34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ile:J1SnnrFb4PM4MYgLxEVyGLA
TLSH
T1C94523A62EDD10EECF5D16F0C1A966C8E2097C63F976B20F7B4574073B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 490bf68d5c4ffa2a51cd131debb1c2758ed4e78b26cda6bdf53cdec36ce904f9
MD5 3954cc058f7242a07768227e2ee85f69
SHA1 305eff2ed73e127c0f0ca3a1b48a7499087f5f0a
SHA512 8f312b599cb5cbd1b170b870c260bc30820d6c4666b62860c4af7af9d08b1a4ebd1323bf71efe0b15b63b7e83a95ccafd1a6e949552417d0f878c7a36fa8d7cc
SSDEEP 12288:Eo34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilW:E7SnnrFb4PM4MYgLxEVyGL4
TLSH
T1254523B62EDC10EFCF6D16F0C1A956C8E2097C62F976B20B7B4574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f30ede7333c5121a1756b6cc80d222f37a2c385790139a1372692a0ff530efe7
MD5 37010044c8ac54fcbe8dca9ad90bb4d0
SHA1 309b464bf566bbda715af63a11b9a14b04afb540
SHA512 65522147795141fa5472c5e7a91889249d45a5141340f403c4dcb58096c9fd83d7069fdf4418809c5de3b5e963f9f7563b7f7e4c922c08d30f35d2eda6f88a43
SSDEEP 12288:6Nsfr34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ile:zkSnnrFb4PM4MYgLxEVyGLI
TLSH
T1EE55F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dd1de7666270040d8f0cde76d3745b83463bc269c6cfaed03d76fea65f05bec3
MD5 e2f19dc85ce6e963390c5ce6ff3f041f
SHA1 61e4e3de893c5449d950ca9228fce3193a5a48e7
SHA512 57a6e7ea5f44dece67b3e1d5f49a986ca9856e61929af4b63a846148a2b383b3daf3c8c69a80a723d0579fff2b4e171fc53f8f4ff261b6cee1ce4cb065220235
SSDEEP 12288:kt34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il+:kqSnnrFb4PM4MYgLxEVyGLc
TLSH
T15A4523626BDC14DACEBD16B080B99698E20D7871FF71F18BB740744A363A6C99CB1713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 fe14b96a231b58161d5eb1098bf4c9e25e4a5f4795bd9ebd1c97def6ca7c3c47
MD5 6e423d15ff9a156bd4e247e1cba31f0d
SHA1 265fd68fd910e2270870a029d34a7910d7d1d444
SHA512 e61ffb6d7d1eceac6b08b2f90197c26d70c2ea6a667dc6bb6aec318ae99c1087f028f053e89c6168dff87004c855054e7bb97adf3cd9cd80ce1ee8297ca8c32e
SSDEEP 24576:78RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCESnnrFb4PM4MYgLxEVyGLT:YRZwQCyiHiQEaaPnMEj4MYPVyGLT
TLSH
T11585B01E63DC46A5E0BAD278CD674407E6B278165731A3CF1290C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 33618410c1df42cdc5b1d487bee03704496813a097e0c255b83f112b43e77128
MD5 064bcaecbacb9e9dd9748e10efc3cdd3
SHA1 7448b11ece1a2e6ef482ce6a72d52d1e89204224
SHA512 0f968cab318b33d03b2f4c086aafcb27e0301a8aafcbb16bfccebe460d7adb3f9a5b071d76857bcfc848cd9b5136528f5d04023763b0fe27bdb9dcbc386339d5
SSDEEP 12288:rbxA1U7KZ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilx:rbxA1UGeSnnrFb4PM4MYgLxEVyGLn
TLSH
T11855127E26EC14E5E67A9178C5E68245D331BC22A731A3DF21C0913E2F3BAD85C35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 03d2f847ba31cf5f022e79b29ac63e42b3cdf3bf21919c3a211f53ae3b3602b1
MD5 bf9cd947ef89012e5ef3e9fcefcf69a6
SHA1 5461530a42c368516226f0768fcdae65250e0340
SHA512 ff48bc3147ebf96bc02a6c15eb1e08d0ad6e735acc94865a9d4d026c486de32ce472f506243cf98c32c8002fb751c1e411d3da2de9d5ba088573694f7e6ab45f
SSDEEP 12288:hD34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilA:hcSnnrFb4PM4MYgLxEVyGLS
TLSH
T1714523A62ADC10EECF6D56F0C1A556C8E2057C22FB76728B764074173B3B68D9CB1712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 26eb40826b280d9fc6c97e95ed2606b1ddffb96023aa4f5ed54d8a4bab6e8b6f
MD5 8bc52457b126cd1a8e7329e9dcd880da
SHA1 b56adb1c0c94b127d936c29e8d3c463b77223003
SHA512 3e8863499d69c00b6d0c922228f4734ee69829aabb4b95c4f732e254314945a8b8cd22e24bdea96944093b6eaf7558594b6b1d19551616b42e6fe97f84f94773
SSDEEP 12288:ROb9A4LWO+vAYFTZ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:GpLBUTeSnnrFb4PM4MYgLxEVyGLw
TLSH
T14A750155F7E800F9DD7B8138C5A28A16E272B85D1764E3DF03A84A662F233E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 056ac63b70389ddfe14ca62483291c53f29a98bfbd17e03cc62be01ee6f93372
MD5 6f1a6cd374a642d98991c7c7387beea0
SHA1 f5762cdf1046cec3efb70585c50c34533ba401ef
SHA512 7267a8c41b6ab98432e3ff70e93150bee626810973f1b80035586d979056642130fe3bcdaae1a06f1572e35a5f632f5a32b93ac5a7b648d25c1841f3dc3c4b6c
SSDEEP 12288:Q70VmvIYNvUyBp034XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilD:NrYNH9SnnrFb4PM4MYgLxEVyGLF
TLSH
T16B65F12F66AC18E5D67F9179CAC38249F27278625711A3CF05A0827A1F17EDCBC3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f52d89ab52d7a7ceccad65cfc6dc77f99cf4d33073a68049941f824fec7af489
MD5 35da61fc09aa46faa155a19aa73fc356
SHA1 13592b97051700b9f7b28be6aaf48051f761f779
SHA512 4e0392ff892bc993d97f53bacb3df8d55bef6ef2f9e3f8af9c2ba6851d4dbb779469d4071a5b2b8410742dac812e842a9b5f0639c1b62231e0ab1b51f2655c5d
SSDEEP 24576:XnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKL:XnXoJJYH84VVS6AmEcJas+cHBjSSKHP7
TLSH
T1D965BFAEA3BC04E8D5BBD17DC5C24506F5B178621331D6CF026182BA3F27AE56E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 77848a46195d76ec12b2704e6284e03c51e520b64164c13abac9aa5c6aabd420
MD5 c3ca689bf00564601fddcd6e0def0903
SHA1 36672606083ec35d3ca1881f5c4e5d17127e8003
SHA512 88b8e9c0e12ef4253747bec12a098076a01aca056554abc323becc63f1081cde466fd628c1f946eb3e02acd355a8ac9b3f34e2d5552bd057ca52b0603bc1e876
SSDEEP 24576:Pv7Xbxd9Tuycf8M/TYlSuxwr2PC3SnnrFb4PM4MYgLxEVyGLW:PDLL9TuJ0M/TYW2Pvj4MYPVyGLW
TLSH
T188858D5EA2EC42D8E47BD6BD85B79146FAB2B855273081CF0250856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 00a539e004089267e29e0d3397a8b05afd8f84debb4ef1cd95025a6b3b89bf72
MD5 8c0fdb368a0618e17d1c30483fa36373
SHA1 b5d2373d1301a065e2998474ee85b8cb1e41107f
SHA512 59959de6f6e426575827f3e80427c71eb6dafb03bbf472fd7bd6755484e54e5ddd4d48df212659b044261566be2b62eaadc90a3cefe8b383895ff92a5774f0b3
SSDEEP 24576:RegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10weSnnrFb4PM4MYgLxEVyGLi:RngOJOmPOHh5j4MYPVyGLi
TLSH
T11355CF3FA7BC15D5D03EC17D8A968906F6B1782213356ACF0560827E1F1BEE46E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 18573349dd5d49d0f87705c85efd43e3dd18871bbea00a6ede2c55050f78e71f
MD5 c9c50dc8b22cde4416e7136cd399310a
SHA1 4d95d0c5ff82c6fd0b56568b13a9cc68b449c604
SHA512 1b181f3a14aae2fe863d727bfd43e3c2e6d7a05d44198b69f2660aa906c401a354de31a0ea4a2395edd778f3951366fff2884de703c6b273977afa457e3b1534
SSDEEP 24576:3LJnJiTk3R3waE4JrO8SnnrFb4PM4MYgLxEVyGLq:3LJnJK8R304lCj4MYPVyGLq
TLSH
T15A75D03DD2A810E8D4B7C2B4815A1B96FF31346D2B2169CB69B4D4313F12FD0AA79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7282256e42dce27ad8632ecbe692f45a898f9a3dcbcb41b91768aae51030dcdf
MD5 50c255d651a501865bf8d82cd389f2d0
SHA1 7c92e34556c7bf9bb23698dfbfd8292445293242
SHA512 a3399512c4530ac7ae74d63d9afa61f7f67bbc440efd5e53ab67307ba131e8a999f582e94fcfa704ba76bdec1e731e4f1cd4d110beb58c70785bd87fcd37d7e1
SSDEEP 49152:M9GqCzDScAZmlvTcFg8Ph6bj4MYPVyGLt:2HVJ
TLSH
T14D955C05F7EB5298E8B3CAF1C96294159B327C509B34F7EF0A80C96A1E32BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 4969640de7bbf56916610fd785b7a7378aea6ea227b13b072214900466300890
MD5 a54123bbef428eec53a0cd86bc79ac51
SHA1 b0ceea34e74efdf5e7684e86298bbd1615759dcb
SHA512 a27a767d4011c47358c7e73100b76ee147a45ad0997ca851faa866a7bc2e5bf58ab0481d47d7d3796732e812f47be916aa4c7567d90da1e456683feab7fad021
SSDEEP 24576:slYJeXm5jUuECSnnrFb4PM4MYgLxEVyGLt:slYJeXmRUuE9j4MYPVyGLt
TLSH
T1EF55126E3ADC30E9D66E8174C1A24A84E331F472A71273EF52D0D07A1F27AC96D35B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 43e6fe8074777e1d6a328bf7fe691a0e8bab5c15cce41c91be7b97a2446ecc3d
MD5 3e10f5a92159f8014f763f745a95721f
SHA1 bd023a88b5fb8791cf41a1fb92763bf0fa37f9e6
SHA512 cc7d796e19693d97c73a35ad193eb12f172765da8192ea76bfbe9f4c99e19a069c5f7f0450272ac260000ea73db1148273b318bf75827e6fa11b3a17f0138dd3
SSDEEP 12288:Awu6kyq34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilM:AVtyZSnnrFb4PM4MYgLxEVyGLO
TLSH
T10555125527D820E9DAB90670C5A242D4DA25BC21AF21A3DF6690F53F3F377C8AC71B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 d1212b6a1fbe77f073b6991ed24b9b763b69afb25c0c8d79bd715aebdefaf22a
MD5 57441b03f7fff0303ddeb158e4df072a
SHA1 95a4376f3188369473dee8daf044ae2411e4e0d6
SHA512 d0f789922f3b11def7620ba7545ecc224eb0de94545c11e1546884619d205edb6cd33f22c7283082e4f1cc32acfe9fada42069bdb8ef879db2a91e21e2e35ced
SSDEEP 12288:GPZ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilI:CeSnnrFb4PM4MYgLxEVyGLS
TLSH
T1A84523AA2BDC20EECF6915B0C17556C8E2157831FB71716F76D0B4363B3B28998B1B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 80a5423cce03850953acc720255bc8a1230c4d497d7e39aa3e55a2b4e4a011ee
MD5 a6481ec9bb0af032c1b0b26de18eae19
SHA1 125f4a43f64021cbd7d41db4296dabe4531b9955
SHA512 bcb6352cbc8e90f60b68a2c0804d647fed466ade7c58f3fa18f70b24d33fd821fa1084a196ac19393eca059b9cee37a985acb256968706e83f41dfe4707ac3c1
SSDEEP 24576:lC+TyQIu93VAumZr7jmzSnnrFb4PM4MYgLxEVyGLd:l/TfIq+Y8j4MYPVyGLd
TLSH
T136558D1DA7E91DCAE276C675C8A34493E633B872137196CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 ea335158bff06fc6af0da09f6da039b0023fe1e953fb93943b35592e7518162d
MD5 7d69cdeecd2d7ef791b33eb22e3feeaa
SHA1 ab482d6c6911b574aceaaf79f0a9e0614ad32ad8
SHA512 5880136fd4eeb976e5d645cc7205d0033eb91dc99b802daebd88c8b64434c58d7896ef3ea8612c879ad6481aa88bdfd6dac2fe9949f24ea02f261bdf8eebf930
SSDEEP 12288:JcyrWOstaa3kcsl34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilR:MLQikZiSnnrFb4PM4MYgLxEVyGL/
TLSH
T12265F10FB7AE00E6D5AB8278C4954245F6737431A72263DF0290C77A1F6B6E9BD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c36bd1ef4cd9a2cd7a34375d459b9e8eb5bc32016497169cf2f424892be36c8a
MD5 dbcdd3ba33a8226cac09776bdbed068a
SHA1 c8ee6c36fc561027f05c5e70ad83e07592069e50
SHA512 e71168f17a67f830c8dad7d1f0901afdb3bd94ecdf896092c32bb5e68524c90fc3a4b9b68823c80ad4e1450e3cc431382b341b30a85a12517dda270217b15efd
SSDEEP 49152:ipJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPSj4MYPVyGN:fpC7b4+80GTkwV1
TLSH
T1ECA57C3DE2F810ADD9AA8375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 48ee5a494a62dc5f00fb9b1b7ab6f19bc3799358bd5f344269f20435733c2a8d
MD5 65230941c05c39a112749c05198361aa
SHA1 962c2489a143e4ca7e2785d21793f38accc7bf5c
SHA512 d4272331a71ccc09052eae783ac35b94c410565ff76e53359e2c49ed5df883662d7a7894cd23e359c1c731d5f72fe34c9fe426a76a886df9887e15cbf41b3128
SSDEEP 24576:hSAwJPE1IDAo+4Kt+l44135UQdSnnrFb4PM4MYgLxEVyGLB:hqPCIo4Kol4/Q2j4MYPVyGLB
TLSH
T18A55B02AA7F946E5E17AC7B4C663C601FB727822133163CF5290813E1F16AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 b8304e2dadbbd4c32f3bbb53debda4e92440e2144e7533bde85be0cc7461fc71
MD5 9c6162b4d61531143585e12ddb4a1e0e
SHA1 8a184eea3244aa39ac75dcd6cc482f2d23a317db
SHA512 63c4e109cff288b84bc4c5f683fa0c81ebd0812ce87b6ea63a2622aabfdf29bacfb07bde0fe59e9564c7eb9db0e14aa07b419dc95f5f136167c418ab7fa58237
SSDEEP 24576:cjsmP0yHaqrVqHra44KDzMsrnFSnnrFb4PM4MYgLxEVyGLz:cjRP0yHfVqzlAsrnej4MYPVyGLz
TLSH
T12C45BF2EF2B910F9D8AAD172454107B5FB71742D1F209ACB0170C635AF0AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-303-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/396-418-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/436-8-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/436-41-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/436-9-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/436-0-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/756-411-0x000000000A1A0000-0x000000000A1A8000-memory.dmp

Download

memory/756-395-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/756-379-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/756-338-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/756-332-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/756-425-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/756-341-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/904-324-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/904-423-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/908-312-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/908-419-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1028-306-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1028-308-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1792-340-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1792-273-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1792-420-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2020-261-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/2020-421-0x00000000014E0000-0x0000000001544000-memory.dmp

Download

memory/2020-266-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/2020-260-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2020-323-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2368-26-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2368-25-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2368-17-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2872-327-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2872-270-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3084-317-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3084-422-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3280-447-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-448-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-468-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-467-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-464-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-465-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-466-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-463-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-454-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-461-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-462-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-455-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-459-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-460-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-458-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-457-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-456-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-453-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-452-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-451-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-449-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-450-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-446-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-445-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-438-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-439-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-441-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-443-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-444-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-442-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-440-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-435-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-437-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-436-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-433-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-434-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-432-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-429-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-430-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3280-431-0x0000022FEA200000-0x0000022FEA210000-memory.dmp

Download

memory/3304-417-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3304-300-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3304-298-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/3304-292-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/3784-233-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3784-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3784-55-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3784-46-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3916-69-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/3916-66-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3916-71-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3916-64-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/3916-58-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/4020-246-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/4020-316-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/4020-247-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4020-253-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4036-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4036-201-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4588-311-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4588-242-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4852-286-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/4852-416-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4852-289-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4852-280-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/4908-34-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4908-232-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4908-40-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4908-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5212-278-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5212-413-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5616-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5616-80-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5616-79-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5616-234-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5676-328-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/5676-424-0x0000000140000000-0x0000000140201000-memory.dmp

Download