a9ccf40bb6eda05ec4a025af394763af6dd095d13b17ed736274bf4aa512acf8

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_087894459346d2b12cb9ea3d9aeb9d54_mespinoza.exe
Size 980KB
Sample260426-stdqxshx2v
SHA256 a9ccf40bb6eda05ec4a025af394763af6dd095d13b17ed736274bf4aa512acf8
MD5 087894459346d2b12cb9ea3d9aeb9d54
SHA1 23ee3e8058a13c7a4190c9a0f6be56a36b8ae4eb
SHA512 b2fe86276626996f8d12ab12d4ae8676b3b6793749301ea8206b9ad1d54c4db52780a7e4285c0a346d0f9e61684d8948e9c8c14d56ce8c06bc4bbda4d6819974
SSDEEP 24576:/gCDtmAWUUrDi/nPaAi/Rztx6CUCNSeJbgI:ZxGUUrmni/RztxawSaUI
TLSH
T1E625D05B77B04CF6E9628179C992C6A6E3B2BDA61F20D70F16A1835F2F334A16D1D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2292	alg.exe
3416	elevation_service.exe
996	elevation_service.exe
2920	maintenanceservice.exe
3896	OSE.EXE
776	DiagnosticsHub.StandardCollector.Service.exe
1092	fxssvc.exe
3552	msdtc.exe
3832	PerceptionSimulationService.exe
2412	perfhost.exe
2940	locator.exe
8	SensorDataService.exe
3284	snmptrap.exe
2224	spectrum.exe
3196	ssh-agent.exe
1572	TieringEngineService.exe
1000	AgentService.exe
692	vds.exe
2528	vssvc.exe
3952	wbengine.exe
3360	WmiApSrv.exe
2192	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e33dfb9789fac755.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-26_087894459346d2b12cb9ea3d9aeb9d54_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a4a591691d5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073ef9c1591d5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000741fcb1491d5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e29111491d5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d051f91391d5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3632	2026-04-26_087894459346d2b12cb9ea3d9aeb9d54_mespinoza.exe
Token: SeDebugPrivilege	2292	alg.exe
Token: SeDebugPrivilege	2292	alg.exe
Token: SeDebugPrivilege	2292	alg.exe
Token: SeTakeOwnershipPrivilege	3416	elevation_service.exe
Token: SeAuditPrivilege	1092	fxssvc.exe
Token: SeRestorePrivilege	1572	TieringEngineService.exe
Token: SeManageVolumePrivilege	1572	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1000	AgentService.exe
Token: SeBackupPrivilege	2528	vssvc.exe
Token: SeRestorePrivilege	2528	vssvc.exe
Token: SeAuditPrivilege	2528	vssvc.exe
Token: SeBackupPrivilege	3952	wbengine.exe
Token: SeRestorePrivilege	3952	wbengine.exe
Token: SeSecurityPrivilege	3952	wbengine.exe
Token: 33	2192	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2192	SearchIndexer.exe
Token: SeDebugPrivilege	3416	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1168	2192	SearchIndexer.exe	105
PID 2192 wrote to memory of 2364	2192	SearchIndexer.exe	106
PID 2192 wrote to memory of 2484	2192	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-26_087894459346d2b12cb9ea3d9aeb9d54_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_087894459346d2b12cb9ea3d9aeb9d54_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3632

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:996

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2920

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3896

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1552

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3552

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3832

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2412

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2940

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:8

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3284

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2224

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2108

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1000

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:692

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2528

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3952

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3360

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1168
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2932 2928 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2364
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2964 2960 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 221a4307d1301628e6928b084609b430d291c7466ace380b4a8136e49923ddd8
MD5 8b14075783c8df77d52ec06844e2a4b0
SHA1 e7519970e2422370d2f63fa1816509415a1e5073
SHA512 fcecf94d43b401e24460910a4310da5c12d679ac1c45cc9962d0b244e75a0100c1334aa5e99849d2452bf45a0e95f63312e625e0aca29d739e1c7df1cd0c6bd7
SSDEEP 49152:Pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnAmni/RztxawSaUI:N3q6HjB1mni/RZx/SaUI
TLSH
T131D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 5f54c529dc0288f2d106deec5083d2157ff96bae9b92bfb3594a6dcfd4572275
MD5 460177786c8e885a722ca0fe66fb1f4d
SHA1 a2043d769ffc9067148cf69c88fc6ac86cbc8f0a
SHA512 a336a40e8d54196229bcf9e1fb33793bd040eed3c02d46eaa0d37588efec54e400f2acb9b20db3a85b8e56ae419da556583ce7ec4dec6debddee6553b9a3d2ae
SSDEEP 24576:EXYfDtczAJDi/nPaAi/Rztx6CUCNSeJbgI:jtcSmni/RztxawSaUI
TLSH
T17305F129B7E408F9EC67827DC8A28516E633BC5647A0E7CB03A495251F337D85E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 cf95ab8380981e4073cc5ded59532560482bbb017e936b1468038b2c6b8e6e54
MD5 20babc0f6837209d9d67e4e5e0299a2c
SHA1 00558c7b8be43111931e92e083496887a135e856
SHA512 de02337dba3b0a20e174b92a80eb14283ef5aa15bc2cd2a1b1177388c6e5fa50c26e5a8f2923b26d4cffe22967f7251aae64649244a628122b69e6a3f895716f
SSDEEP 24576:z0Le5ji0hmxirMYDi/nPaAi/Rztx6CUCNSeJbgI:zPji0Acvmni/RztxawSaUI
TLSH
T1B635AE16F6748335D073C0B9C5D2A69EE97230861B308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2b6f51b9878ec929142b5df1426219d8f1a2a377ffed452d625afcef2eb86693
MD5 e2a658c0670d1fa15b3b5915307eb8b3
SHA1 6e5701ff2a6499576ddd7b7e05b5b012e269b6fd
SHA512 5c1b58ed152689a34490da076aa527765c2ce22d5d3bf6dffffe81fab2099009c9e354a13d93b672cded29ad0a8cfcd98ee651d057376c7d1cd0fb3dc1dfa3b7
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWE6q8wyuiDi/nPaAi/Rztx6CUCNSeJbgIl:6/ezSC6vUzPvxHjyTmni/RztxawSaUIl
TLSH
T1B1755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8679ebe8d3555f803feebdba548c067347e771b45b2a063f2a467cb7c1f1f40b
MD5 1883344f8bd4de9a6658c9393342f389
SHA1 2386f56911a8e95636e0bf0a9d3a72a08e4bd5e9
SHA512 57458f2cf991e2cbc529381e0d9d24832e991e87d9b390c568a615dee4f3a96ea2a17f01ffd9c609eff50f1138d032c50dc9a3dae98281460ca77e56de3bd2b7
SSDEEP 24576:aVbqPb88hv/l+6FDi/nPaAi/Rztx6CUCNSeJbgI:aVO88hXl+Mmni/RztxawSaUI
TLSH
T155559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8ccf3901d5a1fd76d0b1e85d5f183481345c02a162b68327e1cb4d5bfb65ffd0
MD5 aa2256ce12ebad8caefb43fa96bf2fe9
SHA1 0ea25c8be7f02bf560c91a678fb06bbec3c84144
SHA512 0cbd35124f9bd0376ec917fa964a355fa4d735843b9ef9258b7fef2ee1f71c4c0775fe3f23229c9ac4adff88fa5bdc9e650d429acb4737f1db99172dad484fe0
SSDEEP 12288:oRUDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:oRUDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T177C4235FDB7C49F7FE61D9FE881BA4EB002B6C764DA11A4F0E39B2054E30969E1C2950
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 bf4b5db0caa80211d3555a50c18420291b557a96cdf56b46331ed271d9e00731
MD5 d3365add0a2b902f88be03706389d050
SHA1 f6e3741041285dd0beeb3c92c09442df41cf91b9
SHA512 0d3dfa566f45e839755ca78da56214705c1add215420547928e91874c838f1c1b88c5a15839ecbb8231513c054f5d3246423758da72e2d8f1e410676d62fa16f
SSDEEP 12288:7eBNUbTVO86UdDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:7JIUdDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1F905CF3BEE38FCE2C67A8DB95A518640977278314F62A3CBD175820EDE235E05E75C24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 439e0d858f20a2feb87afdda84237488c1d523f21df56a2f4979dbc9a39cc382
MD5 26e0158cc2a72d798e5c004bd0aa2833
SHA1 a7d817b97459b2277a3a677d975c27de34038596
SHA512 4451f4b064a4369911c2684ccc3498e926bb7e155056fe68663f7cb267cca7ba3775f22c8f47f2b1dea3df14c943335eb6941069030f1231b815325eb1cd1d33
SSDEEP 98304:/QvGAdlCEL8c/yRNw5Cymni/RZx/SaUI:4vyEYc/y3w8ymnyRtU
TLSH
T1DB266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 970c877866f0fd3952c1b11d5eb95e22447353cf4029cbab8bedded6f432447e
MD5 1ce8024b3bbd89fffb6f9618baeb3766
SHA1 885663e1dd9ba3dda2404baa916c13b2d982017b
SHA512 e4503079b180a222206dee9d51038df71faf8408202572df5766b71b627d98a2374f0dbff5f904433e127d773d14361ccf4bcd7792a0bfd70a2d9160684b194f
SSDEEP 24576:ndewsAj/Di/nPaAi/Rztx6CUCNSeJbgI:dlj/mni/RztxawSaUI
TLSH
T11015E031FE74E436C7BB0DB61B36D716143D79204F621AC3E3A89A8D59302D26376E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 396dccbc086381dd3100d4519b53913b6b5c9c68457d05056bad51a183fdf308
MD5 bacce873c20154d0022d5405d80fbc61
SHA1 1f748e843125ddcbd623e4fcafcbb6ef74fb25eb
SHA512 09f942ed616c91feddb4aed4bea8f5d28cfba21fcf34a46f324bec1647bbb062729100cf8cc72b0ca8b0e050d42155a91a121051a22268c8bba0cf442a56639a
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHnmnyRtU:IUEtQevvqc2W1cpV2EI32mnw
TLSH
T18D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 342b0a3bf4ae87a4a5bbcf1540d45bc15b763f2a5c76cec275f98900731f416a
MD5 98922a1930321dc9f9eaaf12d71481c6
SHA1 af430c753123ca69b40fc742648c65cce81fecbb
SHA512 e34a365d778fcd84ae244324bd7e68762561a0a1a8afff31b321e38b02a15149753e0ca4688f8d2ee9d263cb6f9210daf2597485af63cb3db06cc1a77fa7f68d
SSDEEP 49152:UCbRquA/m2yL5zifFiV+XenmE3/zfmni/RztxawSaUI:9oqHVjnm2mni/RZx/SaUI
TLSH
T1CBD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1a559eb6b55b1d4ca01a7bc2e5122206a3669503f6b2562fc4e91ac1c5186c87
MD5 69105ec5f05b25ea399cc9fffa3ea666
SHA1 49d4e6dfbb576d7b2fba56035fd1d303eb097cdb
SHA512 b495f625ae285cdccd002462773bc5f9dcae5953c8e9acfd72f65d55b136bb48e18454dbd3f7950b6ccd02506293c4a02b92a56e1ca85513a3724fd5a0559ca0
SSDEEP 24576:kAhGLJIFoiwtA5l7S53WDi/nPaAi/Rztx6CUCNSeJbgI:kAMyFoiq5Gmni/RztxawSaUI
TLSH
T1F435AD81EBF955D4F5B3AAB899B69171EA76BCA65E31C20F1160D10F0E33E40DD24B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 f98910c58470ab3745e1df085a058f11ebca64987e10cb2a05b164ba55baac10
MD5 2efeaa9e5904693c3e05b8cc8e6fcda1
SHA1 e601be740d5b1317ae58d4886bd12769b7e98fec
SHA512 e36d80fb6cde1c274312f2ab35525ea5346ddba3679ba0e9c2aee26b7f1552e11f7e6cbd0e11df8fb759f28fa4167547fc23306e1ecbe22ce285c4cd481fc827
SSDEEP 12288:Rmw5HEjsChNVBFgl0WDm+CCDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgI:MwuoOWzDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T18405F14A77A80CF9E9679639C557C136F7B2BC122A21DB1F0760C64B5F33361AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 3d91d275bbdee54fe2a197c013903cf31a373c6fe67cf3b4354f0a56f062b171
MD5 2b46e2452eb465c9fc70f679828ead0e
SHA1 aad22b0ca898eb4ef76be1fcdde333b85b07366c
SHA512 d9268efa544173bb7baee42d856b752adaa7cd17a82e4151517397da848f4cadbd3b264341e7ae0c8612174c0644d6e25d0d5752d8da593e7f9b0f8069a5285a
SSDEEP 12288:jBZ1IyPDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:NZuQDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T19BE4125E63FC20FAE5A3967DC8A6958AD3327C631B7243CF0A2942451F32ED59E35720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 33f6ccd06c8b79746a7c43e58447b83130ea4ee2cdaed109087565e4859683ed
MD5 8ed1ff0af9927bb84b11c84770769ffc
SHA1 7b09000fe85bd87f9d78533c7b4e8b8bc5cae802
SHA512 4bb5f80968af3e2ba061dff46081458f14ea052e6cd602d1936070a08f954dd64c45e5c99d0a4dd9afa0288238b74ce2723d815d16bcc07848990174fb3bf543
SSDEEP 98304:JQRQyi36YOcPQLvw2gAf+PN3hmni/RZx/SaUI:gQyiKayX+PNRmnyRtU
TLSH
T11F666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 642cae5b5fccf84b869e648e0ec552f87f1c9c33e3e650c14b875365c74207ee
MD5 da8f4869c0139610d6c66f77ba5d9681
SHA1 9f63d002220008d5c06a5488c430feebc36fbe0c
SHA512 59d4d799f1551500ae1bb678c36f1cb527b6800e43966607e41b73cd163a5366bde383022efd44b0860383dd6462d90a1b1484183d58a33fe578ad4b02cef247
SSDEEP 98304:9QRQyi36YOcPQLvw2gAf+PN3hmni/RZx/SaUI:0QyiKayX+PNRmnyRtU
TLSH
T10E666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5340b15419f6dffea8de3ada6356f6d0708f2fd1b38db8fdeeea400cf2d9ff52
MD5 9f3c3e96f5e64f598107c598b6f52624
SHA1 2564abc3da239187b3bb02633758e6ec383a50fc
SHA512 8b0a6e6a67f6db0dbdc2196b8fa359e1a04cb9465db0d01ee000cd25da4c782dc671ffe54518a746ff3e149663fd83753206445ca9d246b450f7deb85e62c167
SSDEEP 49152:U68Qg55nhheWu7PNU3/vmni/RztxawSaUI:+thWRc/vmni/RZx/SaUI
TLSH
T10CB54933B2F600A9C44DE1769F4A872196D27C758FE0E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 780dbcb8a3341199f69cae3c6eff2a2c293f92fc095be41cab32712182de390e
MD5 c840274badec562127cae5916b4e0cab
SHA1 d72afe97e0d40eedc8ddcbd7f582e6dd26732786
SHA512 61a2a31a18b037d067447ad78758314fe01d9001e6d7a9f4b4c76bd66691b23fc0eb223c20eae63f84e47324cf154d5f2544c91eb765c7c7cdb72bc45fbedd36
SSDEEP 98304:Dy5112gYy5azzVvL69nLKnhZUmni/RZx/SaUI:eLIHmWhemnyRtU
TLSH
T138167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fe8e2c4d5614cc374214b92a6e19d90f0f8242b7f2acd0d80b56db223cf79de8
MD5 cefb95671d16a076c595f41595ebad7b
SHA1 cafd31c0be682c24e34e0a9d81992eb316d38b00
SHA512 acf9e3cc3d0d22d9b538724dfbae8220e8a530177b97c55cbd2638655f5621946be6760168a7a66f300b112111609d8749e8183b02d2f730752a6ab1d349eda6
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl5mni/RztxawSaUI:Pu6JmVxd2d5mni/RZx/SaUI
TLSH
T1F0D59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 24c950de45ae71e49fe9d5c7a15e87a260ce9f35fe81043faa5e9b2fef0018c6
MD5 51f8b0b10367d65391974806adf87c41
SHA1 ae1ba7727772200e0536f455069d0c8fe77919d8
SHA512 c62a1c4fc4dea6c70b70e0368fe4cdd91257474a3d2b7c8d1c2664a9a8c4ca2e772b0a3e47741d39165e9867db33c0ad4f87589db97d121a6387af325ac210b9
SSDEEP 49152:E1hpsNoJpF1A6UU44CwH7R4x9mni/RztxawSaUI:EmifPbR2mni/RZx/SaUI
TLSH
T1A2B5BE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 54c8290bb847b2be020dfbb797c16b5f47e0143208076d831c55f90d3c8aeca4
MD5 7359da771863eb40be743b10f2160545
SHA1 cbdccaf0cef9ebaeecbaedb0dfd6ab3e12c9689f
SHA512 bf0b014b7264413475da28747fbe15daa7f184c0427688141539aff9c597f37c332cc8ef385680ee678f7ae418fc5f72077eab89a94db5eae2fe2d9b4f74be92
SSDEEP 49152:PSuZQIY0Be2KRRVtOnks6NMHqQmni/RztxawSaUI:15dKTi61Qmni/RZx/SaUI
TLSH
T12BC5BF03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ada4f4be4a6484b48a04975bf52d3913891b2651058dec0d8c0a0e0c94bb91c9
MD5 90bb1e9e95d3fbdf785a55961238322f
SHA1 5a34878eeb7de7c872d29986a59092c918ed75e1
SHA512 9e28419c508470ad5db4c637126b4f8ca269fd2f90aefa0741cf1b90aacb7a16eefaac0989c8a18136f8c743d7bae1e3d81f755fb5d445f051831c51e77ff336
SSDEEP 49152:ShtSn8EApI0figngiDn0AP5wJmni/RztxawSaUI:TX2iyphamni/RZx/SaUI
TLSH
T1CA95BE13F2D900E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 61176db0a4378032560c8d504acbad1cb65bfd4060fcde3898616e434a1543b5
MD5 c82ec0fb54cdd4bf69cdb71462778b27
SHA1 724b31fe9fc168e37a48afad84570a60bea19b49
SHA512 326d87834c70596d1b1f3c57d8e68a15124e2aad9b0df4f25dafee5f952e0360224b2d68e916c36c96bca97235b7034f41d2e7d364ca4731f0d8c4ed5bea3741
SSDEEP 12288:JMDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:JMDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T10CC4235FDABC49FBFD10D9FEC917A0EA001A6C675EA2169F0F2EA1015F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8a69056cdec4c25049afd00ad450a6f309e262f1e1188918374fe7b627a3e2c8
MD5 49f581aa98867f9437a75245e02a90bb
SHA1 ca58a33ae0413bca033742089a7af56d254aaed7
SHA512 aa69660a791070e2d4e1c7e4e60ce5c55e28181b572f44bc9b0a408fa02cc5326954c32c48e75b0f3ea2ae6c1d0312798c7db1548acb4fa85de1bfc3a24ffdbb
SSDEEP 12288:G7Di/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:G7Di/nPaAi/Rztx6CUCNSeJbgI
TLSH
T196C4235FDABC49FBFD10D9FEC517A0EA002A6C675EA2169F0F2DA1015F30D69E2C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 49adb225a48528f6b941a3463aaa43a5ce0062650c66883be4142464b355bac4
MD5 6d5dce52865c7da7ddec3470ac3902de
SHA1 1ee8c1311a61b1f45cb368a2c91ffc851cf71369
SHA512 9fd6ea9a3dff40898201f8a5488e6aec97516be702da826b5c176cc7211371fa7d4bef4b58b23450314b9239131d73d353fb5eb19f42695622da3d1bd0255250
SSDEEP 12288:D1Di/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:D1Di/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1C9C4235FDABC49FBFD10D9FEC517A0EA402A6C675EA2169F0F2EA1005F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 2435e34f4b80c9da5f4c85b9acd94451c1478d57f8e4d1492738565acf4ce81b
MD5 81562f322485ed42304a378c470a8425
SHA1 d2186e97528ce44d9f58a2ee7d6d40539b66e870
SHA512 4c29651da568a4d960a9c1d48e5422e0fd0dc9b207a3e037045a5f6f500a374cf4e16b4f45cf61e4b8bb7dcee557aeb08851ee11cccc87ef33bb06d8f64cc39d
SSDEEP 12288:pV2Di/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:aDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T113D4235FEBBC44E6EC61D6BEC82690EA913A7C679F3217DF0F1551050F30AA8E5A0E50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 d0e137a4f544de3fd8cbee9e346b91606101892d8519ef26833103c04c74f671
MD5 ece9d6874de39148696d6fe116fc5076
SHA1 24a853189ba0bf9bc2b2752c74c3cbf1eb60d546
SHA512 27585c73346e859be0a4bb978777af7b48dd21dfd33aba9f8ea1eac6840fe7d40d758fcceca40ccba31e4bdf7cfae8dc159c87a556f88848d8fccbfc4bcb542a
SSDEEP 12288:r+Di/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:r+Di/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1E7C4235FDABC49FBFD10D9FEC517A0EA402A6C675EA2169F0F2EA1005F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 6a84c08b79d4b90f637c4a0bd4c8de4f7cf82ba4001ef58d38986ec0121484e5
MD5 cb9f545b8de45b8053935c31ff540840
SHA1 0a56e519ceec67725e42cee15668b1ccf05a515a
SHA512 cc3a48cb848dc9c0ef20e8f843d35c2e206a696194b1e40e2deb72dada31d0c6db64253f66884d5839efc8f9b7a5d5e346272b5247e1ad486c3b96419d84e028
SSDEEP 12288:33Di/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:33Di/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1A6C4235FDABC49FBED10D9FEC917A0EA001A6C675EA2169F0F2EA1015F30969E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 4431e1186742eec2db03a65c59c5ed01567457ce30eb2211eb65d467cf59d2f2
MD5 9843ab0228625ca29cab37466c3a74b5
SHA1 0b98dd158267f602c1ee8b745100479df6a84ea4
SHA512 8fa3704ef1a18145ed8d1223ac8daf551c6e67329c22cdc24b4fb15df85e0399c7e3910212b8104fb1f7c389219daf66c42e68921a3c080579c9af11143b64b5
SSDEEP 12288:tjDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:tjDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1BFC4235FDABC49BBFD10D9FEC516A0EE002A6C775EA2169F0F2EA1015F30969E1C1D90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 a80dc00fa8de61c58a4dbb2dbc10ab570f0f12a029bc116e05167b1b27ce2037
MD5 f6cf9c45246feef77ad6dacbd274afd7
SHA1 efeb516521043ca6453bbb92ad18465ba08102a5
SHA512 19edc9d1400d628423598dd1a296997fefc8a5bf0e5249f0488cb919042bdc907bf17b1fae9e33674ac4e8bf559940b4672bfbe1ee637cb605f61cf6427e97b0
SSDEEP 24576:+ZMSzFVSObDi/nPaAi/Rztx6CUCNSeJbgI:+ZMSzfHmni/RztxawSaUI
TLSH
T11D050199B3A40CF9EC63817EC9168956D2B27C2A0B70C61F07B832165F333A15D2EF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 366403e66b19a2cf3a71003620f4785999ea54bed05a9f4e0355c8b98f4e4825
MD5 23c226c4b1dfe2c1d6db2f94f095b462
SHA1 ee6e2f9d1749b01968d57173309a320ad3ca6773
SHA512 98f0aa1b1bbb48ee1c32df86f512c2f54eb74e14fe7591d7cc10e06be4a0e7f2e8f5014941c617ac18dc61cb69907dc69c7af21769b4109ef66605c26e8c9a92
SSDEEP 12288:AgDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:AgDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T171C4235FDABC49FBFD10D9FE8517A0EA402A6C675EA2169F0F2EA1005F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 688603d2d681b347e31bf46943535c3202bb9014a45601a55c5667371838d765
MD5 df22e901824eaa4e9392f05741277dc7
SHA1 9e9bf712ea8bc580a0ba32110676d747cef8432c
SHA512 100cae20f4e2c1d42a8a8af574f8624864d9f75eba0e407bfc4163054f5c2b95c072bf4fdd86ecae070e40a638d69dbe4d51cbd017ef5380ea845ae57dbbf497
SSDEEP 12288:akDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:akDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T11FC4235FDABC49FBFD10D9FE8517A0EE002E6C675EA2169F0F2EA1015F30969E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 d069f0e75c2056f6f6a106ca120f982899b42d581ac60c89c96cb033de77e964
MD5 2241b0143b89400104e67e3093b268f4
SHA1 b15c772fddd5177706f66d304e601287054fc267
SHA512 3a6736d8eff85c0a26778b54f62f8a937cbc9613e2a763450172581cf0e7a9635a94cd04a603247643b53af4d99a04c87c2771b73281c7595f5c043ee6e5f91a
SSDEEP 12288:fyPz5L8PDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:SzyPDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T105F4021BB3B520F9D5369279C8521956F3367C360B318BAF076443762F336A09E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 6630de50273b128717f891aa3e3821b4d88b41ab089be090f9d29dcf38758d6a
MD5 3120de2e8b3a7f27bdb6a29172232a93
SHA1 c302a723d735f103823b624ccbe1e484eb6ea938
SHA512 97c78fd656e0dd0db18ec5456e823068e8297cde5fa46f782dbc310a0e1978374c4846bcaff55fa27fb7572efbe8e75854dbe568a1eb3b8c40a3a1b3bc4232f1
SSDEEP 12288:egDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:egDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1C4C4235FDABC49FBFD10D9FEC517A0EA402A6C675EA2169F0F2EA1005F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 a1d84e2f82f8e949f699b5a274e1998b66cfa46f476eff904ae1551707dd4902
MD5 d8acb3343eadfbe5dbff066e927d7c66
SHA1 12dd63634eef464bd5794984de480e931d9c776b
SHA512 fde4e3e501d83f543f22bdb7abd083755591794b57523cfaeacb0be0efe4e9871e3ec2d77e4b0b5a7eb7d51350fa4371a9dd725fd7f84368826057b65ef53e1b
SSDEEP 12288:KgDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:KgDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1E3C4235FDABC49FBFD10D9FE8517A0EA002E6C675EA2169F0F2EA1005F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 d837794f307e25fb5202d0ee0865c4c1ccf38cb51452991be88f9a33f4c5d63a
MD5 2c1f828cdb083f170469b0b8f84749de
SHA1 75a511bedd6464c251ac7f9540564d59e9e4eaa7
SHA512 8583f720970353c077e7404111b1a438edad9d1052f37ed2520972c38edec648c9dd14e8318732c5f7b272f56a2df9d93e54a0e5e27d028bdf91c699f323ad1a
SSDEEP 12288:+yPz5L8PDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:jzyPDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T132F4021BB3B930F9D5369279C8521956F3367C360B218BAF076443761F336A09E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 72c144e167d1bb7d384fa15fec099fecaeb716476c74fccff8784f593995021d
MD5 afd24892d0dba5c2a429618658076a6d
SHA1 354edad9fd6a8062e90063dbddebe35275f21d26
SHA512 1fd23ca5f85d4638aea74fd7dfd9adc6748a6241e33611a87ac1e6ae3efed9b511e5e6d0a817408eaf42c321eaa7e2dece250921ff5ab89c9bed1320dff4585f
SSDEEP 24576:ITHaLl3z0zDlDi/nPaAi/Rztx6CUCNSeJbgI:IT6Lljimni/RztxawSaUI
TLSH
T1BB050199B3A41CF9EC63817ECC168956D2B27C2A0B70C65F07B832165F333A15D2AF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 2037268d8d23f7c975e5dc28c2b8dfb070b52aa1c7edaf916e35c785d32abb04
MD5 33737bf0d6837910015ee93dce56d159
SHA1 76804bd1be3dcebacc72ec3cfe24aa1aba3db2b4
SHA512 8996468bcb41b95a7585573b45a94e75dd8fe7ec38ad5a1d4032f45531bcd167c18d48e7ed4e1b1ea845ac72e7641c0006ce9ba1f857c9a460894bd81f13c1c1
SSDEEP 24576:237d9CHKy7GZBDi/nPaAi/Rztx6CUCNSeJbgI:Y7d9CHKyaHmni/RztxawSaUI
TLSH
T16825CF90F3E814E8F0B7DA35C9765511DA767C5A1B31DA8F03A8261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 7aa39b9aceb9c8434b5dea275c36696f1a38cdc14122aaef3d683cf2ea6ea043
MD5 44e396be1581626924d95015bb6a4ced
SHA1 8de157cc6a457f8746a92852dca3071c99cbbd27
SHA512 c0ebd20f2244b7bce76e96ca7ef69b767e50385f01bf9c80912c069e31b1c7cdfa7f1d461d1402014e4a264fbb7a09b48218591cfa8a58d54eb3ed47067d17cd
SSDEEP 12288:0VDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:0VDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T17AC4235FDABC49FBFD10D9FEC517A0EA402A6C675EA2169F0F2EA1005F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 00c4d546e09ef985513fde8557f846774e755a4df6e622888bc885966139b500
MD5 0186ef0d4975e6051f038a2e8faa10d3
SHA1 3f371c830cb41f48eb3fa6ebceec45b27ec90039
SHA512 e4bb0fb2fbf71f080ad9968bcb71d0fdecbf1a201b42870a240b1b9092af08f13ffd0fc39b1dda0789204c41bdd9423e0ba17ed74e2515525c7727afe11fc817
SSDEEP 12288:TvDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:TvDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1C0C4235FDABC49FBFD20D9FE8517A0EA001A6C775EA2169F0F2EA1015F30D69E1C1950
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 3c00f2a5d82a2614429bddf85547df3492ae0ce98712b87da374093041d42b86
MD5 0c7d66ac20bbd1bfea1d6c73a6461af7
SHA1 51459027e8adef692ce4468a791c8266a15b2503
SHA512 08bec89821bc84402c83b60a108df66775bd20f90cc09907c325930f61fdea0444d555a34ee57b889c1ae8da8c8790166c846f8b1b65a53be465884cde7f4b40
SSDEEP 12288:NqDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:NqDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1F1C4235FDABC49FBFD10D9FEC517A0EA402A6C675EA2169F0F2EA1005F30D69E1C1894
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 c5ffd80b34f60839d6c027184017a9ca5e0738e4b1aa5cce8ad965148719074d
MD5 11b25e787e1cd33a30ea7c355897d51f
SHA1 88318773679e510cffd5be1c10ddaacb6aeae219
SHA512 39859c484a5c77583e4b7ed013e38d032f432f21d36eec6c5049184aacf253ad67505aa5328536e5512b6ae6a9b4aaac0542a14104249ab13a650c7cd42967b7
SSDEEP 12288:CgDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:CgDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T11BC4235FDABC49FBFD10D9FEC517A0EA402A6C675EA2169F0F2EA1005F30D69E1C1990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 01d4ff572c3578e849dbd248463f157ba5f6063c9923e2ed2ee718894c02e800
MD5 f4bb6fb9e0211442d53147d54cbdf021
SHA1 b887eedac745cffa71746ca37e0ad2e680292a16
SHA512 53944272818faa68ac557bda9a9043e10a9350b6089edba72e16158d1ea633568e7209612b2d24fb395dac819a6d968213af100a5db57f955a4ef7f3d67a74c3
SSDEEP 12288:yNsfQDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:LQDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1B2E4F11AD2A802E9D46EA279CB565681B3377C2687E193CF07D0F13E1F316949DE6B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 1f86fe616d7d825d0b2be7afdd4af542dcbfa6f20930ae77342c20db5c939744
MD5 00ae73d5cf080934120a47af7bbf3a56
SHA1 7330e8a82631e65af97eedfd92091f3bc9d503ce
SHA512 633ed202a9a5ba89939da295c00502a9b58f86a37c5c51d5d7a56446f8a30f057d662d386c44ba9f0f45c3b0263246f20dea5dc6d46ec61bcc81ee98568f0cc3
SSDEEP 12288:F7Di/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:F7Di/nPaAi/Rztx6CUCNSeJbgI
TLSH
T174D4231FD7BC89ABFC71AABD841BE0BA002E7C764F6155CF4E1962045E30DD9E9B1A10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 9cbd281a4df1ebd8b055ed1c96c6bbc90d1b2d3f78fb22b78db15f99140fd56c
MD5 3d45074ee41cb382e332728fcc1c7de3
SHA1 e99206832d3f7aa80169fedbc6da802c52f27bea
SHA512 911491892f19dc7bc2a7b54668f622cd0cfeb7c7b055887f27fd1cd71b22b15f8247dc09caabc8edde920e0276f77715e501020a3bd0feb40bfa04ebfdce40ff
SSDEEP 49152:dRZwQCyiHiQEaiPnM6mni/RztxawSaUI:v9xPPVmni/RZx/SaUI
TLSH
T13985AF1E62DC46A5E0BAD2B8CD674407E6B27816473197CF0291C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 d9fd7823290839113344190dbab1bf86866d5978414120f305610d796ce02393
MD5 2563aa57a6bfca2034a4f077bb1818fd
SHA1 20361852af82f39340c353ff8fc28df029ac291c
SHA512 61c42e7ddf10dbb83f4b2bd930e26d5820b65add9bbbbbc14309d3b6693d5e5b07ef438789a7038f77222126d788d908a12611e495b077ad1a0a1d07db13d211
SSDEEP 12288:4bxA1U7KrDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:4bxA1UGrDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T197E4122EA6AC18F5F575E57E8996804AD3327C271B2193DF0595C23A0F32EE89D71F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f4acca45aa365139c64d183a66d49b463f50eccc15c6dc4791212943fff5a60a
MD5 acdf77e7a3d05c83a99e79d0475b25e1
SHA1 47192f48ef28fddbf54f38c95ae297542c8d441a
SHA512 38c2e9527640187553baa6fd604aa3b1708957df4578fe2de9d1fa1fcb9fbfd98277a2f846df4d06f86eb66572a835378c91c7c97987bb969b14349519a087f4
SSDEEP 24576:ejsmP0yHaqrVqHra44KDzMsrn0Di/nPaAi/Rztx6CUCNSeJbgI:ejRP0yHfVqzlAsrn0mni/RztxawSaUI
TLSH
T10045AF2EF2B910F9D8AAD176454107B5BB71B82D1F219ACB0170C234AF06EE89F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 4605338c819f678e3e30bf2d2c3662b8c9ce89d041d90e3ec13edeb7572ceb40
MD5 c611c2cfac18aed5f3a12d6388a43adc
SHA1 3f155b5e730ad96fac24cae91f4af3a2cceab0a9
SHA512 598452a604abef08b00607f2287596af91452f30a79a419cc451cb40ab2c48a7642633740f803dba2bad81d386379dfb6c77239d0a4e55451e59bd5de4bbb35d
SSDEEP 12288:BBDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:BBDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1CED4235ED7BC49FBED21DAFE851690EA101A6C270F7217DF0D2AA1015F309EAE2E1950
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 83e49031af0ad5c6afc49f55da7f6313d7df9fc08649ac9da9bd32ccbd341a2b
MD5 069f3d281c54798df83e71c9b62b6114
SHA1 c415447787417cb1fafbd1586030cba812f87165
SHA512 d62f9960ff02ab18799c2116bea2a10c106018eb220695c52d6811131baa57ae46da3012c0301578a7917c78d08e3b4c1a7a66168e7aa5237292a59d5088e94f
SSDEEP 12288:bOb9A4LWO+vAYFTvDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:kpLBUTvDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T14D25F159E7A800F9EC77D13CC9628916D272B85D0760E7DF07A88A551F237E68E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 299c248d0164fd7f3897b405792491cc4e7f25a84ef44dbfc4e75fb8d1b87814
MD5 443f61984a8426b121960d5870ca7867
SHA1 274fe8be331facca752177147a36fd5755f8cff0
SHA512 0d6e0d63876d61fb6dcad49569c60b417bfbc8f3ada04f6366ff287303204ae489048e69b786f08bdc00ca5e2690120b8db206f1af269037c68a1936ea6ba7e7
SSDEEP 12288:D70VmvIYNvUyBpeDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:srYNH4Di/nPaAi/Rztx6CUCNSeJbgI
TLSH
T13F05E12F92AD0CE5E57B917D8A838159F1737866171192CF05B0C27A1F23EE9BD3AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5b14e02086b1b74cea163b8c5e2c5f56c439393f6e7118af60cb35ccc397160a
MD5 5b98bb3bda87a2d4062d26d936298d28
SHA1 be61ee3936e34a4e55a97388f43eac98b5590979
SHA512 e0107c84928372a63dc82ff85effbf26253a9faa7569904c6fca87459ed10523f208f59659ab1c172526f763704a9ad9b627867c41099eccdedd35a5ad21ee8e
SSDEEP 24576:WnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKR:WnXoJJYH84VVS6AmEcJas+cHBjSSKHPh
TLSH
T19465BF6EA2BC04E8D5BBD17DC5C24506F5B278621331C6CF026182BA7F27AF5AE35B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4595c3bebe92c13a3ab2c97087e6be1b713ee98bc99bf4721c5d8b5424b97423
MD5 76eee2d093b1949ab925835f88b52d62
SHA1 5ff2a5b07620bd41c9ceddc22962602575ce40a6
SHA512 a5682ac1fed0f352392c6bb40e1d2cb42ef3c3d7f0ec2d22283f03ca22191eba76ca1eefb36481c0923a5d2d94e6ba85a103268f7f4b54768124e7c08067bae4
SSDEEP 24576:av7Xbxd9Tuycf8M/TYlSuxrr2PCmDi/nPaAi/Rztx6CUCNSeJbgI:aDLL9TuJ0M/TYj2Phmni/RztxawSaUI
TLSH
T199858D5EA3EC42D8E47BDABD85B79046FAB2B855173081CF0251856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 7d3ea1878a24153e1bb1f8991257e4d5bb0fc4b9d7c1a9aace5452f23f1fb1aa
MD5 b5d7245f1e68a388dcd1e6780d83782c
SHA1 c555a0d43cf12f290a1e33be60f59db4bffb1ac8
SHA512 299574993614b8be1288d90b31f17a9e620d59f9eed4a2710fe6c92dbefaceb359421b0e10663837a81d489095f253f23a59971d9063c0b321aa18f8c12e8dda
SSDEEP 24576:XegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wvDi/nPaAi/Rztx6CUCNSeJbgI:XngOJOmPOHhvmni/RztxawSaUI
TLSH
T1DD55BF3FA7BC15D5E03EC17D8A978816F6B1782603255ACF0560827E5F2BEE46E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 46d891a91e96be0e7dcdf55beb366d3272d8a65c4b26102220bfd229aba39c8d
MD5 fd180f0134294313245c01ecf06822be
SHA1 f5a58853bba863516f8944dcaacfc2069be8a074
SHA512 8d03623574aeafba149b8d37a08a131c7235337347f3d7d61780270e814149e90638f7ca7eb7f1aca99248664c0c9eb6f7a2dfab6ff6515ff8a6d594c3e60e17
SSDEEP 24576:qLJnJiTk3R3waE4JrOhDi/nPaAi/Rztx6CUCNSeJbgI:qLJnJK8R304lEmni/RztxawSaUI
TLSH
T10515D02DD2A810E9D4B7C2B4815A1696FF31387D2F2169CB19B4D5313F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1d3629b8b6683a0b482d9cca32f58cdb4d49c44f54250810549015228e2e2f4a
MD5 fe05cc411d4c314728dff036bfe7baa0
SHA1 5412093e7fedfd116ca8cde1e88bccc22099678e
SHA512 e29fdb43623f8ac64c37593c3cfa9696c3045696fb46a935ed835018a4cead151a5700a231c1707c4be5288f05e9dea8c0c402d907d1863e8ac251473f5badb3
SSDEEP 49152:t9mqCzDScAZmlvTcFg8Ph69mni/RztxawSaUI:hYmni/RZx/SaUI
TLSH
T103955C05F7EB5298E8B3CAF1C96294159B327C509B34F7EF0A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 cb47974e5a8f178ef966fde02482d1fd6ce1c8b9bb451eb9e13edc5a8077450d
MD5 88e6f79963b821e21fa89daa369e1d47
SHA1 a9228ccb195ddce358f688f290a9ef75b6aad691
SHA512 3c81656c4869ce97b718f0863eb28596f785824e38ecaabf92f5b087e152158b4061838a91446e499eb4406042b3532eeb19417189c1df0796e0c1c1d11e7a3b
SSDEEP 12288:vlYJeXm5nkEUuEYDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:vlYJeXm5jUuEYDi/nPaAi/Rztx6CUCNN
TLSH
T153E4125EB6AC30F5E52AD1BE84528599D332B872175223EF06E0C1794F32EE56E35E80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 38574df348cd28e9c8909274fc9b63f68da1c0467718ef0a1edb23139bf37be6
MD5 e0f136c443594c81bf1474d5e88e45a6
SHA1 3cecf9eb86e718123fc6c7d303c4191597fa9c7d
SHA512 479c889db874c0fb9066fbac681348fd95d56759b1e4fcd2a5d7b8a572952c5895f4775b84dbbf0922d962b371e467f26c84d6cc45a89a559347764526fd34da
SSDEEP 12288:+mu6kyUDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:+7tyUDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T18BF41209A3E855E9E9B59A7DC96380E59A39BC314F2153DF05A0F22E2F31BD4E970F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 6121802d840a5ac5d5fc591dcb540355da7b13ecbb0af410762ddf0e74a735e3
MD5 cd73e7e50394d1b5de29c3acb0cf2511
SHA1 97ae66b6421ce892fdf9f549c99762781c8cba87
SHA512 452c5a41c6cff2ee1a15a9f5eec21ba1de185bcb557528917043be22957bc8c0001424bdc97761051291d5ce9aa507d30c9a4e47272d28378bac59bae9dd319a
SSDEEP 12288:TPvDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:rvDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1D6D4235ED7BC59FBEC21DAFE841794EA002A7C364F6126EF0DA9E1218F30995E1E1D40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2dc0cc0b6b565f1488e4ec6410c968d08d5e5f87c79451477c23e342af39aa73
MD5 164013cd96b75c365004e7a19613c524
SHA1 13e8702660fcc614087c997ebb2807d5891f3e67
SHA512 0a6226f0ea22771f14367d40c315398e999a361b6c438eefa4ce8cf5d57ea79cd986fa6d856ff22a83ccead20cb4c184dd09f965253ab53fd3ac232adbb8f44f
SSDEEP 24576:aC+TyQIu93VAumZr7jmiDi/nPaAi/Rztx6CUCNSeJbgI:a/TfIq+Yimni/RztxawSaUI
TLSH
T174558C1DA7E91DCAE276C675C8A34493E533B872177186CF2044C07D4A9EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 4e8160f2f6ba2d3d0b58a42481b754503511b1c7392410cd0fa8f4a6ea8557a1
MD5 cf75f7ebd5d2f2c698cadd81e9c8022e
SHA1 00ad56f4f3b9d749d5b86ba714cf8efa987e80e7
SHA512 e7674f204c8fbfba9b0ac0cf2ea3df320fae540ba63e5f4931d2937aeefbc8c8f78eaf3e5d2d0f67c29d7dae32715302fae0f010cd57eadfb7c8e56f4bb01ea0
SSDEEP 12288:acyrWOstaa3kcsjDi/Z9scPaAV7MYgM+zcsx6kiiUohLNSGpJQEPDxgfE3:7LQikZjDi/nPaAi/Rztx6CUCNSeJbgI
TLSH
T1FCF4E00FB3AE00A6E4A7C27C88464156F67378754B2267DF06A0C7794F675EABD38B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d76289ac4ca5d5f3b5952c7f35678751e88f026f24fe40ff73075d062fdb2bdf
MD5 d2d5ee5f00e353d20d06ae40a2e5d454
SHA1 2f7a6e5d5388aa55dc7a19ef70517bf8b51f9f56
SHA512 a254adb3bd203038a40a1791ae110d321469d2ee7cddf4d8be3051cd8179bb7bc0f959c440ae3e629464c5193b929a91042cc0b064ba9277dd97ed7d76362d2b
SSDEEP 49152:gpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPUmni/Rztx1:RpC7b4+80GTk1mni/RZx/SaUI
TLSH
T190A57C3DE2B810ADD8AAC775C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-559-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/8-343-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/8-558-0x0000000000C30000-0x0000000000C8D000-memory.dmp

Download

memory/8-337-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/8-557-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/8-468-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/8-345-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/692-420-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/692-411-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/692-417-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/692-555-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/776-270-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/776-272-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/776-264-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/776-553-0x0000000000C30000-0x0000000000C8D000-memory.dmp

Download

memory/996-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/996-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/996-42-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/996-231-0x0000000000DE0000-0x0000000000E3D000-memory.dmp

Download

memory/996-228-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1000-409-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1000-408-0x0000000000C30000-0x0000000000C8D000-memory.dmp

Download

memory/1000-401-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1000-405-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1000-395-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1000-407-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1092-275-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1092-276-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/1092-282-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/1092-288-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/1092-290-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1572-392-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/1572-390-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1572-384-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1572-552-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/2192-525-0x0000000001FC0000-0x0000000001FD0000-memory.dmp

Download

memory/2192-509-0x0000000001D10000-0x0000000001D20000-memory.dmp

Download

memory/2192-579-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2192-460-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2192-541-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/2192-469-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2192-466-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2224-367-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2224-550-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2224-360-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2224-366-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2292-25-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2292-229-0x0000000000800000-0x000000000085D000-memory.dmp

Download

memory/2292-187-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2292-27-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2292-24-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2292-18-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2412-316-0x0000000000760000-0x00000000007C6000-memory.dmp

Download

memory/2412-321-0x0000000000760000-0x00000000007C6000-memory.dmp

Download

memory/2412-444-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2412-313-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2412-561-0x00000000013A0000-0x0000000001404000-memory.dmp

Download

memory/2528-423-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2528-567-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2528-429-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2528-432-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2920-64-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2920-60-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2920-55-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2920-53-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2920-66-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2940-332-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2940-326-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2940-451-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2940-334-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3196-551-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3196-373-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/3196-379-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/3196-381-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3284-547-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/3284-357-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/3284-355-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3284-349-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3360-455-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3360-574-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/3360-452-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/3360-447-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3416-230-0x0000000000730000-0x000000000078D000-memory.dmp

Download

memory/3416-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3416-31-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3416-37-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3416-227-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3552-291-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/3552-287-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/3552-419-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/3552-554-0x0000000000E40000-0x0000000000E9D000-memory.dmp

Download

memory/3552-297-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/3632-10-0x0000000140031000-0x0000000140032000-memory.dmp

Download

memory/3632-9-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/3632-2-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/3632-13-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/3632-16-0x0000000140000000-0x00000001400FA000-memory.dmp

Download

memory/3632-15-0x0000000002160000-0x00000000021BD000-memory.dmp

Download

memory/3632-0-0x0000000140000000-0x00000001400FA000-memory.dmp

Download

memory/3832-308-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3832-310-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3832-302-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3832-560-0x0000000000C30000-0x0000000000C8D000-memory.dmp

Download

memory/3832-431-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3896-232-0x0000000000D30000-0x0000000000D8D000-memory.dmp

Download

memory/3896-233-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3896-68-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3896-74-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3896-76-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3952-435-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/3952-441-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/3952-573-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3952-445-0x0000000140000000-0x0000000140216000-memory.dmp

Download