5dd12d69298230e874f67b9ec402e5367eecfbecb5d9ac950dd307f22d57a672

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/04/2026, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
Size 5.5MB
Sample260427-pvsppaew6n
SHA256 5dd12d69298230e874f67b9ec402e5367eecfbecb5d9ac950dd307f22d57a672
MD5 a36741a614684d46f1c90950dc126a47
SHA1 6ecc2f7f774ef914ac7f99f65100366351df1b77
SHA512 94c9350a71fc8ae77d384f30e05c6b691a2e7f22dc80016c6a259e10256a258b77bd9befc480f753f55bdba33d7aebc1a40b85a128d6fc5279f74e738dfae0bc
SSDEEP 98304:NHnFkb1kjZ2vFFWjb8ww1V9CYPASWNZ7WCGir9raRtvVjiwy3GR3klNIo50:kb1+b8wwxCYP1WNZWy4tJiwy8kwo5
TLSH
T150465B1267E9A039F2B31770AE39B36456B9BFB55831D10F7244260E1EB4AD1F934B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4304	alg.exe
4412	DiagnosticsHub.StandardCollector.Service.exe
880	elevation_service.exe
4868	fxssvc.exe
3216	elevation_service.exe
2540	maintenanceservice.exe
944	OSE.EXE
2800	msdtc.exe
1496	PerceptionSimulationService.exe
4840	perfhost.exe
1776	locator.exe
5020	SensorDataService.exe
2628	snmptrap.exe
1656	spectrum.exe
5044	ssh-agent.exe
448	TieringEngineService.exe
2308	AgentService.exe
3632	vds.exe
3964	vssvc.exe
3940	wbengine.exe
4280	WmiApSrv.exe
964	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fd0a0d32c8368bef.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96484\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029f564bc50d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b7166bd50d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039683fbe50d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084eee0bc50d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3a3d2bc50d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b4273bc50d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6b80fbe50d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025998cbd50d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ccc03be50d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4412	DiagnosticsHub.StandardCollector.Service.exe
4412	DiagnosticsHub.StandardCollector.Service.exe
4412	DiagnosticsHub.StandardCollector.Service.exe
4412	DiagnosticsHub.StandardCollector.Service.exe
4412	DiagnosticsHub.StandardCollector.Service.exe
4412	DiagnosticsHub.StandardCollector.Service.exe
880	elevation_service.exe
880	elevation_service.exe
880	elevation_service.exe
880	elevation_service.exe
880	elevation_service.exe
880	elevation_service.exe
880	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3948	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
Token: SeAuditPrivilege	3948	2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
Token: SeAuditPrivilege	4868	fxssvc.exe
Token: SeDebugPrivilege	4412	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	880	elevation_service.exe
Token: SeRestorePrivilege	448	TieringEngineService.exe
Token: SeManageVolumePrivilege	448	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2308	AgentService.exe
Token: SeBackupPrivilege	3964	vssvc.exe
Token: SeRestorePrivilege	3964	vssvc.exe
Token: SeAuditPrivilege	3964	vssvc.exe
Token: SeBackupPrivilege	3940	wbengine.exe
Token: SeRestorePrivilege	3940	wbengine.exe
Token: SeSecurityPrivilege	3940	wbengine.exe
Token: 33	964	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	964	SearchIndexer.exe
Token: SeDebugPrivilege	880	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 5108	964	SearchIndexer.exe	120
PID 964 wrote to memory of 2744	964	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-27_a36741a614684d46f1c90950dc126a47_elex_glassworm_mespinoza.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4304

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3216

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2540

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:944

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1496

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4840

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1776

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5020

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2628

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1656

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1472

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:448

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2308

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3632

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3964

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4280

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5108
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7675f6059f316dd748ecaf5cecd7a4fd80a1caf03e333765b3b10fa509fd3a3d
MD5 1188bc2533232cd583dbd2972b5aa006
SHA1 9a6c24b74ba61d36d145e4a24a1cb31119ae4a19
SHA512 c03955af366ce04f7535b257c14a6bc10680534268f513e9a6bbfbccea470234798c9a4bc867b5500ddd964ef6b7cad8a567cd4a2ed759a8411b340e1024ce9a
SSDEEP 49152:Jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnk1PlklNIo5uz:f3q6HjBH3klNIo50
TLSH
T1FDD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 ba030dc67d3eef78bb72b0cb430da339155fc61326e487f40d697957ad2fc003
MD5 d03e3ebd9b8ad26da1088a28c54382b0
SHA1 649552529a67d4d0aa659afe80f6746aa3665bc3
SHA512 624fe822c4a48433a06924d5eb0a7e05a2020fbe1312a49547cfee1074de62f9e0aaca584160682735846496d477b0f6a3d05c8557d4014bf38e46f15138f746
SSDEEP 24576:KXYfDtczA3u/GT/2S1FtlkR4sNhCu5kTMsjz:RtcS1PlklNIo5uz
TLSH
T122050128A7E408FDED67813CC8A28511EB737C9547A0E78F03A499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 c6351823d72da50704e0a069f9b3eb7e89d9d72799ceff42d2f3d6dfbe676789
MD5 4d79c3d1d38800be9d78d97b805c1a27
SHA1 0b60999ad2e1cb66ae45318a82ca74668666d027
SHA512 349fd3e01b06072735c6048b2dd5dfd2689ce62b568231fa291b76da9d3cb086bdc0e8fb8b476bc0cfea133d007b66836430f6adbc019a57337b406aeceb8ce4
SSDEEP 24576:A0Le5ji0hmxirMGu/GT/2S1FtlkR4sNhCu5kTMsjz:APji0Acd1PlklNIo5uz
TLSH
T1E935AE16F5788335D073C0B9C5D2A68AED7130865B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d86594148f7d3bfbfce637483295a1a285149f200536fe71031e48e53525607d
MD5 64b61ce967e544cf9b845e4e26fbdc0e
SHA1 29e59da90a999ad12979333b78866d0dd7cbdcb9
SHA512 3fe4e27533644b06b6b099af534a4d5fd2372c2cd0006841df26db089a0ed84b5038c70f20bf2785941cdf0cca11c7866bfeab2cf22d277cb3387d0bdda808cb
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWE6q8wyuwu/GT/2S1FtlkR4sNhCu5kTMsjz:P/ezSC6vUzPvxHjyB1PlklNIo5uz
TLSH
T1CB755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 037fbe31a4cb00031d5cc3a2b7dc9be6e944bb5ed8f9fb837f642917803fd235
MD5 24ef15fd33dedb16fec0d146aaec36d7
SHA1 53b2ad55c2c1f9292763959f422b10c991127f48
SHA512 8c122fb9ae35b3361eb8eca3af69017223b1b3259c9c4f3d9b4cbd03200a1e442dcd1db7871cde84c46e7945e05b6f506adf9b422cd5c76460824ae316a95e27
SSDEEP 24576:JVbqPb88hv/l+6ru/GT/2S1FtlkR4sNhCu5kTMsjz:JVO88hXl+Q1PlklNIo5uz
TLSH
T13C55AE66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 2552f01d9b589fc8c8c774882bfbc468ef279c80c4e1baf4c0339ec62925043f
MD5 a3d31528c2fd29284d015b4bf3260834
SHA1 5cf829b1d10ffb441a5afde2c81195c2f0cb20a6
SHA512 89db08a7118d9e60122c755a1ca01edbfc1be6599e6c890cb60e8bc37e67e1abea3e190b09d32706d2cf3d60027ce732036d9cf8e5cdc9bdeca2523cca83fcb5
SSDEEP 12288:TRYFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:TR6u/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1ADC42322CDAD90ADFF070034327E0FA097B57CF99EE0960F2417359B8A33862BA55751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 dbb0d8e271835db459864109d742343a6c73085b2f69bf2d3504ab5eefde4648
MD5 7006d80e6def1f9dabc5a2c5205e0efd
SHA1 9a9b3aad4ce40578e6e92ad04f43a15f3064d00b
SHA512 48c3fd4b147fa5feeb709dc7efab3178d93360927ccdce2b6efa85243c849590ba74e87e72192ff504124916aba98227ea3b853796ccd6de1fdb32426c9a8db9
SSDEEP 12288:deBNUbTVO86UlFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jw:dJIUDu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T13705CF3BEE28FCE2C67A8D7856918740D77278704F62A3CBD165820EDE235E11E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 40a999cff371a0b4e355aec82d1b2ac6615de2eeb6e39ce18ca126453f4d6070
MD5 7e48d07e0ad68fe6c2286aafac365294
SHA1 fdcc4828c90402de21e72d63cd91f39237c1ffc7
SHA512 8ddab492f7117ec17d88957362cd62f17e7b8532c78291bae077d7d948526b6696c08651cd8ca0c890527fd763e14b01c5753aecb1832eabeae1fb84ea577e28
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THr:IQvGAdlCEL8c/yRNw5Cy3klNIo50
TLSH
T10E267D656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 1a9e2bd96220eb5cd42c549fe0e887c93e5d445dfce38f69fb0b65d773083f86
MD5 c8d77edd7e4871b9fa9642214a97faab
SHA1 83d235619b24eacfe0803d83e6632d609763b723
SHA512 3eb92e74d9bcc26f3f5e024bfef46b3d80a1cf868840b252700e21302bd50019e252c6f457a83accd74fb58a17f88a19e2085bb185e418da2ddc35d84f11ba12
SSDEEP 24576:kdewsAj1u/GT/2S1FtlkR4sNhCu5kTMsjz:8ljN1PlklNIo5uz
TLSH
T1E115E031FE78E036C77B0DB62B36C716547C79604FA11AC3E3A84A9E59302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3ca3cd1a157e66fe369afa12aeb8d19bad8a95ef193f7a8236cd29638688f488
MD5 17fe916f543ae78c3c6181fd139f768e
SHA1 51b032e50e8dcac4ff5f275b74a2a8739f66e629
SHA512 36d842f0b634b97bc2afa4b276ec44779b8f6b5ac144aec533841b148f57a66b143e9ef0fb093c0f6832f6185be3cb6d32b3dec53a106f7e968ea6755f8313e1
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHBkwo5:LUEtQevvqc2W1cpV2EI32E
TLSH
T1E4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 575ae1ad0f492dd4a07c490a712c2d143f8c530bfb3ed9f4400465f8e9491899
MD5 09bb2a53941b0fdae752d108808ede65
SHA1 96bb3d29300f6a633579be888d19215247182c9c
SHA512 05e572f424bcb7599afda3e330a81c31e5f27f684d54d4a2d751b782fef6f2acd922ba5e51a6a14e0f3a4bf21e066e531a9d7b9565fa03aadcade27decf26492
SSDEEP 49152:KCbRquA/m2yL5zQfFiV+XenmE3/zt1PlklNIo5uz:/oqtVjnmW3klNIo50
TLSH
T1D1D58D0976B8C1E4D1F6C37896A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 104fb6d6654d57aff55b0622daaddb397f109ec70eb508f2a234af679ab06906
MD5 409ee2a7c1fc2728227dad79ada08bea
SHA1 4053c750ff6dc994cda7df313dd282f403601c16
SHA512 6c57f682cf8752d7124d856203eeb41dd380d1c2ee1b66eae6b202e3ef401a3ff18321a829caeff38b226c61f625e8778fe651bb41b6bda756eb3fa801c43da4
SSDEEP 24576:wAhGLJIFoiwtA5l7S53su/GT/2S1FtlkR4sNhCu5kTMsjz:wAMyFoiq5G1PlklNIo5uz
TLSH
T13935AE81E7F955D4F5B3AA78A9B68570EA76BCAA5E31C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 1d5ccf046468f4e4303db04e80aab0338f099f42ea8e63cc3fb31eada6d5ee8c
MD5 47454f71f298c9bc9cdc3f7b6c1d382d
SHA1 8fb03fcaa41e486f158c1f14fa2040af1edfb49a
SHA512 a0d95cff46dc4cae809c1538395688ccd8859564126c3fb085c993e0920c88f6285fff46f97bb92caab73f48005ac4b63664c08412cba87f88d31eafd76923f0
SSDEEP 24576:EwuoOWhu/GT/2S1FtlkR4sNhCu5kTMsjz:EwDO61PlklNIo5uz
TLSH
T17705F14676A80CF9EA678138865BC532F7F2BC122A61D71F1760C65B5F33261BD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 e9512653cdb71b5a737ce962b33e15e46aa697868ba056e8d7e45188b9046f5a
MD5 477d10c7c351a8b32ddee7ff27321fe5
SHA1 73d7f80eb64e4f05743e8e9a8f2fd6690b2ef962
SHA512 3f30d36d9fba5bbba5ea8e2040872d96802380eeb24e86576c3c2abfa13bee7f90c76b4909337415a76d099cb8a27960e9f7e6c34874a52015e304b03073a444
SSDEEP 12288:VBZ1IynFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:DZu+u/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1E2E4125A26EC60FDE653413CA9F94B41D7727CA66B7183CF1026025A5F33ED22E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2f59a944be707bd0b821e3f99b4ac7e36b6be9c131b0e651b606e0f3b73e16a0
MD5 e5fee7627578c6f177fca350f0ed6a22
SHA1 fc5d351e2f17b05a46ee82f4a5d0374bf286d17a
SHA512 30995eada8b0edbc0a49ea571302ef9f9836d0c07d2ef77e447dcc68a33a0102479e70bf84c35e87e0f5bb69913e715d4e78fec962b7e6df05c5783884743cf2
SSDEEP 98304:LQRQyi36YOcPQLvw2gAf+PN3D3klNIo50:6QyiKayX+PNrkwo5
TLSH
T1A7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 db3faf9c7380c3be2bf42dc7cddd3955a57483f1b5ad0b3238f6d37329a75dd3
MD5 fa1c18ea27973997b5b9d10b23e3e6fb
SHA1 a03608ba28a1ed2f395ca7ec99bd73843ea7a83a
SHA512 422d681c1565893977a081ca0b921083691c65e16be0b5744744ed31935a3925334dfe8c5dc757ab98444ba948a8fa5a4e58554ba1449cab176c5e8f13b33af9
SSDEEP 98304:JQRQyi36YOcPQLvw2gAf+PN3D3klNIo50:gQyiKayX+PNrkwo5
TLSH
T122667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5a6a2a7e1cdece26258dd55b1fe1ee67570404eebb01bd302763e0dd5abc7d63
MD5 5530ea43ec807f1e5fa12dd2918902c5
SHA1 8d5db45b7ea0ccb49d4ecb677de54a00bb3bed73
SHA512 57a90c3fc3a319e643b95504edeeedda7a8aa0c93a951b9ac04abaf8dade246ceb468b7e6c78d518f691d9b2e2e14f580ac600fb886552fb8d660eefa8bca26b
SSDEEP 24576:+wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0uu/GT/2S1FtlkR+:I68Qg55nhheWu7PNU3/d1PlklNIo5uz
TLSH
T14AB55A33B2F600A9D44DE1769F4A873196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 24ff6b56196d32d6ead8ce937243fe3e09e46f020591ffd2f800b4c93f17d8eb
MD5 fa79b29c172d0b9d132d318c58891768
SHA1 f64cbea6ced4bd724c3c25c224e8d95619efb173
SHA512 ae3e6ce2f7483608d53de01646adb8785a7ecdec165febb14e649f4557d0a334c0f77333e0b4f9b527e828ea902865865de35828529a33f51c6d447a18609bb6
SSDEEP 98304:by5112gYy5azzVvL69nLKnhZ43klNIo50:2LIHmWhykwo5
TLSH
T19F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5167153b29328d50d36c7d92d79a415cf6101cfe967f29073df8713569e88204
MD5 42e327cc582d0c81c7520e7555cf56bf
SHA1 ef57bec0c4f502219fdc009dfde43a0d122d737f
SHA512 7b49c73f895581e0413a8906c8c19bb8f4942001231f17e3fef356dc5fad60886ce177760e86d0ca28f6fabd109a241776547f4f3ad4858b302967ba17b29d03
SSDEEP 49152:UB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glb1PlklNIo5uz:Ou6JmVxd2db3klNIo50
TLSH
T1C4D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 877b150d1ffc0257cf6cc6706536687f8107d6dd2c0ce5068898ab10f0f5b69c
MD5 dc62f3b7bc8aa6d6a15b1422f3e3faa2
SHA1 7e12e0c9341e51be2b446350790cdce7648e5f37
SHA512 840cc00c7eb62f168f56a32b0694f49e220aea0b152f50f602f9e400cb726cb5168caebbdeca6d831a3a09753f763db6117a8115e11e1c0722e63ab200372979
SSDEEP 49152:61hpsNoJpF1A6UU44CwH7R4xv1PlklNIo5uz:6mifPbRW3klNIo50
TLSH
T152B5BE13F2D900E8D05ED178875A9632EA62BC460B34B6DF0A9077961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 15c5acdb2e7963f83f7b81b2d6616449cf11e4fbdb5df46757e1f61ed0b3bb02
MD5 7502d97afafb467a2b6b52c05ff943b7
SHA1 cb18bad61a20a24989b8f1a6dfb0da2c35f6e25a
SHA512 267e1fc6e835eaeeefd238e2b1cb3169643a2860ceb49803b323be0f1517eef08080f746cd70f400b339f0bc565626dee9a28dd24b16053bb75a78d5a2e758b2
SSDEEP 49152:WSuZQIY0Be2KRRVtOnks6NMHqU1PlklNIo5uz:45dKTi61U3klNIo50
TLSH
T11DC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 72908c64783899a558c452685e891cb3c4e31b4b4183e895380a5a41047e4c4d
MD5 1758f1c295cd4605abc62ff4c3f7a001
SHA1 7e6198c2d9f788e086d068992a0750f7d5cf980b
SHA512 bc67277a2472b04d13018adbdffb0c4369c60dde1e76f55554aa11f9f0cdb77f930c8da993a47ef3a6c1ccbaa3bef54767685ec34ad5d6168917c12d89291bfc
SSDEEP 49152:mhtSn8EApI0figngiDn0AP5wL1PlklNIo5uz:nX2iypha3klNIo50
TLSH
T11595BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 7ff918d0cf3399e9b1f6d2d6338cf54cf84983d7439c6506846730708c2f0339
MD5 6258432e5f29b10224576edd8ccfa9f3
SHA1 2bafe97137ea6e603ece7259a528d9fedb746b93
SHA512 45e83321607b68b43147a67d31f008109c9219f231fdde68c0e91ea2c6a8e9aff59fd727665451ab706c2f2d02f739a8bd879aeeac6b3a96523452cf51af6a7f
SSDEEP 12288:awFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:ayu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1C9C423169CAE909DFF064135327E0B90D7687CBEAFE1521F341B20179B33D623A597A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8834653703335239d76dd08d9c495d7118b2eb2b2b0cc610fa4dccffa3208657
MD5 fe0fe97d32b11c2b9461b2b92945553e
SHA1 06473ef569ed0b0663b87a649aff7aa4a4b3bc87
SHA512 25655c51f65fefe11a88a41a742e600977ad70a7afb51da3731aea015d3889c71cc0c56ba502a5d02178be40f7495ac4ad9ff1867df0f2cb3ac0c99afd0e5da7
SSDEEP 12288:7zFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:7pu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T160C423269CAE809DFF064035327E0B90D7687CBFAFE1521F341B205797339623A597A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 e8cd5b394b7394b6b672c25ec36c55d492f91cd2c43dba729970d56bd200d7a6
MD5 2acd28feff7fcbd668e646db3b4e8cf5
SHA1 9d353f7f201e873d8fcf9ed0e662ee89023511b9
SHA512 f588c110e4d9300fee7309a5a1c16f9ca7c638a22f701238530845d2ec09eabc4ebc52f6d6753e8d9c0237fdb2963848c0362154ec1a7effdf39c5d418abf077
SSDEEP 12288:idFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:ibu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T187C423269CAE909DFF064135327E0BD0D7687CAFAFE1521F341B20179B339623A597A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 b14170b12bef67b4fd8235e37061cc242d133808fbb69f9b4c7470ea344edbe5
MD5 d613da65dae04f030eea384170c5403d
SHA1 bed7cc800c424d04dbe63fd64aa33e932ab7e537
SHA512 5aaa583fb5b6682cd103c3432999daa981a3b0232ea2ea63ddf9775a1e279c116baf38f0b46030f5d430314e8826f2c84459028171b22dc3d1f05064c4572378
SSDEEP 12288:GVaFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:tu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T195D423125AAE40DDFE078138B67A4790D7B5BCEAAFB1935F6402144B4F73A913E34B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 cc62884c6938f4fdc6458f089d482f30495284b49ef2640314a6d067daec3a47
MD5 781e01553fed1c4790b68514d28ca853
SHA1 9fb01ba6c3616249346fb6f66975a487cc476558
SHA512 317e244539a3af78a5670d64d769a78206af80e9792a4eae813e303174c9c3d4bd49036691a31f9e5e98586307aae708a2365d89d45dce1b193d6f011880268a
SSDEEP 12288:9iFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:9Uu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T17CC423169CAE909DFF064135327E0BD0D7687CAFAFE1920F341B20179B339623A597A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 46a321b3481bd3298085024e92148e93ea41a98b1d29be3a01b0dbe66681b54f
MD5 14b4c85c637d07575d58383794391a9f
SHA1 ee1a4597b3c47f06a99f77c8290c38de2afc581b
SHA512 bfbf47bcbe411d34b7b2dc28b5a81758a04d60a96c957fc8c43ef6ba8e7776edbf03f0448091f0ae40e8d7e2a44d22b53bfe04440b28023b8a5ece3616c0efa5
SSDEEP 12288:gvFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:gNu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1EDC423269CAE909DFF064134327E0BD0D7687CBEAFE1921F341B201797339623A597A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 fd0d3403f146b10ac4957fb1c9421a57c9dd6306a4bf89a386746013671913f9
MD5 cd18acdef382262496b8661b6b5cd5f5
SHA1 341e356e4de13e9eeef6081fbb4697734f38f224
SHA512 c2cafcbd47a531769f160ad5bfa78c84bf6d7719772cd3bd1e3460e823e87b58cbff0c34e0cefe63e87699f0d698786f6be078253567987de0327ad634aae446
SSDEEP 12288:kbFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:kRu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T186C423269CAE909DFF064135327E0B90C7687CBEAFE1921F341B205797739623A157A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 f6a3e73757a9c3c06a454b5bd543180727400fd2c6028622e8eb8b855f14812a
MD5 c7da91ea17fe20b3549d695f53b30dcb
SHA1 f1a7c6fe984b344ddcfec5b21865a7685c2ae9a5
SHA512 016c66c34975155389268f4ef8b9e426cd37ddf0de3eff67acebae3fda9c0f944c21f5a5c1c4c4ae4da1d53eedf4a3fab6b2d97201a5f6a723cbab3ccc222ecb
SSDEEP 24576:1ZMSzFVSOJu/GT/2S1FtlkR4sNhCu5kTMsjz:1ZMSzf11PlklNIo5uz
TLSH
T16C0502A5B39418F8ED67813EC9258901D6B27C6A0BB0C61F13A436675F333A11D3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b5a2e43c9c399b40cb095aeba7b812486665a674f23f238f0af3b87e6b569f5d
MD5 77aa4a217acd21f1eba401a940a3855a
SHA1 69faeb7ac0d5742d40fd6b43ee2c534f7591322c
SHA512 da766674f543715fca66734e51d5de4b4d08f20da1c69d66136fd4bedc6f5b4afb42f1cdc32ee86924c818a69879c693da5b9bd8432b9487a1827aa15a3bfc88
SSDEEP 12288:AUFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:AOu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T15CC423169CAE909DFF064135327E0B90C7687CAFAFE1920F741B20579B33D623A597A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 dcc1c53680f2cc5f0059afd803704dbe7874cd1845586b7c96b330187bc6eaba
MD5 d0a550969c660f36dcebaad92a56eeb7
SHA1 fd2b0098f9473ebd86e57809152b80a3d628b45d
SHA512 db89a330249f1f3bd79d5cdd978749175c7eabb95b6655cb866933ae74e0eb38a95ae0e74b70a0785837dadce9f1f8db03790bf9dadb5db3d32029b286ee5a42
SSDEEP 12288:hIFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:hKu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1C2C423269CAE909DFF064135327E0B90C7687CBFAFE1921F341B205797339623A597A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 db135351a92ef7022b3ea4cd0a4873b05ae74990f573b87c5ca0d6f430fc4fae
MD5 383e955ea77a057b0960e32dece0f1b1
SHA1 3ce9cfa29428f04390c12009c83961e9a9197429
SHA512 ff4e18d416a51615289ba9b703490904f1ee628be72a5fc09d11d1cc02fbbc106d5e6e2c1b07436fa5a5d2aa5bd1e2d96f883d1df7b4274fb319a562f2bd2be5
SSDEEP 12288:6yPz5L8nFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:nzyFu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T119F4121777A930FDE527823899660A41F771BC764B608AAF126402771F336E16E3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 7047af3662cdccbc42d69f981fe38a42ec8e56656ec927bde088f7803e917bd8
MD5 c7c200a55882a19b0a81ad886aa5456c
SHA1 e8b63fac87d522444750cbc8b8fc5155418a40b9
SHA512 391688893225699e8dc019bc195505a87ba44f2b30c8ef4a4aec48192492286e22259892ca54c172a14aa69324d545f3b6ec0774ecb4cc55435d8314c4d0c45b
SSDEEP 12288:gUFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:gOu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T199C423169CAE909DFF064135327E0BD0C7687CAFAFE1920F741B20579B339623A597A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 e2de1aa80fcabef3c22b1e8fd4b916ec3ca35a7c1155e49899e612cfab13af57
MD5 9146d229292a9448a75c18904a74dd46
SHA1 69fadb77570edab6c374d9c624ac9903dd145321
SHA512 8f8c466a4c2f117d77ea2577338dfe60f09209bedef23d395dd40cc4d55261ed1d9d0be2f85a629704125c32cf3bf7318fcda902a5611150d7ba129258c2738b
SSDEEP 12288:xUFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:xOu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T10EC423169CAE909DFF064135327E0B90D7687CBFAFE1920F741B20579B339623A197A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 8b51c091b685965982a2db5b3e01d652a99ee5ec6563fa73f7f251950e9a1171
MD5 745c6c98202bc221800b1bc6e7237e01
SHA1 2e600575cb5ff49076b21a0ddde7dc8514b6df35
SHA512 3f39729363457f1ed0994b10dc66605649014c4d2ea5d67bd11cd91b86e5c461c1abf4614b7b192aad99715280e4324df24c6b63bc755a055f46e85cffbad5f8
SSDEEP 12288:byPz5L8nFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:WzyFu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1F5F4121777A930FDE527823899660A41F771BC764B608BAF126402771F336E16E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 09080c5302804f1d750bec6b0bf3bcf3796394f4a1bde4a617e30b0d098f30ff
MD5 763ac43f3f3d57697affcca0f951cc10
SHA1 d27eb49b9d40d711309db049422ddbbc940307be
SHA512 12c68197c2422908ed0c9bd40ffb8b07243e7bc9f5a95c9a61fe8031f9b93d13d317acbb29ed5caef4cdbcb45900253568b5fa629254cf84fdd2f680257739d5
SSDEEP 24576:0THaLl3z0zDLu/GT/2S1FtlkR4sNhCu5kTMsjz:0T6LljC1PlklNIo5uz
TLSH
T1530502A5B39418F8ED67813EC9264912D2B27C6A0BB0C61F13A4366B5F333A11D3DF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 125ae5e9e996865768d391fc7333d5e2948f8fa44436e7b4a84c3241242a85e0
MD5 2a03cb4d9c2f04a2f98af4abb2c831bc
SHA1 e5fd8a7f088afd276570f31f9e87dc0ab9db7c05
SHA512 9e637cf3051e588f19edfa830fb5456909b156f6961f62f557fae92b906603cc0063315a5dff4b7bbaa8a437ba4822ae288186e5ca68da9f9081cc0e5c927d54
SSDEEP 24576:p37d9CHKy7GZvu/GT/2S1FtlkR4sNhCu5kTMsjz:57d9CHKya11PlklNIo5uz
TLSH
T18025CF90F3E810E8F1B78A3599764511DAB67C9A1B71DE8F03A4251A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 1803d11eb372f3606ed91be3b1b6c30f7960ca7229d78683dc09cec166074b92
MD5 5e3a5d13f926231b4527e0ed3219435a
SHA1 ff7952490718a0d64296c22506549e14d517181f
SHA512 0052b183350b2172fd65f65c648421780ad27458e82f7015334fb2f2aab18c9f3cff988a1f09b8ce557c420dd12c30cddcf63a6b5a76324c8ac3fa93444f4db4
SSDEEP 12288:P9Fu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:P7u/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T15DC423269CAE909DFF064135327E0B90D7687CBFAFE1911F341B20179B339613A557A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 47e93c4e363ff153fb5c1239db9cb4ec8660ccfe3059c751644775f88a843c31
MD5 0292e3b41f809983b5167db9e773eb43
SHA1 b1b92c63f4695dab7680eae098e733c59b2940a3
SHA512 dde673cb495a89c55a9f40cbd5c93516c99cb6d0f8bbfecf7e91713cc5f89bd3a68508157744b362268336cb282b471357429a705fa845c56e5c2bbd19f4847c
SSDEEP 12288:KHFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:Klu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T101C423269CAE90ADFF064135327E0B90D7687CBEAFE1920F341B20179B73D523A557A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 a7c5ad36f0c6cd7088a48b5b9c73b44b9f703988e7e12111bb8311b5274afe25
MD5 5ae6d311628244fe4d6c9f04c41ae6c1
SHA1 25196930d796a2c7e6cb4a2b2a4a62268eeac9d4
SHA512 90b34f37ce88adb3203fb8a00a972fa52cb6db8a3d39734110bfb7c7dbd37feceeb92f8cf14ecefb6f87f24bbd1216ec940c0e027bd9ccf5c98805d8a43379e8
SSDEEP 12288:AuFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:AYu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1D7C423269CAE909DFF064135327E0B90D7687CAFAFD1920F741B20179B33D623A597A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 2a37fc83501226c5ed0f262f306f5f2384a367c437d5e72d93b60083c4e85bcf
MD5 4664beafa77700c8a4318479303538ab
SHA1 870df2f1f2fccbd15195fb31234f5817aa218278
SHA512 7653fc6a1be8f33172220c692e856d329c86ba2a732d58f25210c55be110e35294bdb41e0c67dc12b487c681838333cbdd353adc3578a3f5a305d5d74732743b
SSDEEP 12288:fNsfkFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:8+u/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1B4E4F01AD2A801E8D55E5139D76A4A40F3337C6587E1D3CB22D1F53E0F36A906EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 9651671ed7f48f6e00116a66681c645907d539f460f953c5111ca4fc52e7d101
MD5 90af025921171ddc11a4039fdac535ac
SHA1 a4ca8dd9448195c3098581ad378bb550888f93e4
SHA512 e6bf3f8ba65460aee5c2f19d8ea49d5a92a553be79a80f3bb062a56f53e87bb33d8d3ffe3da29f0f09d840448c0ff5950d2b0ae705a1553bdb0844d9d0dbb9b5
SSDEEP 12288:7dFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:7bu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T16DD42326DAAD905EFF1A4134313E8770A72E7DB99FA0D10F7407215B9A33CA26E34B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 117fc76a8c8c6fb6ba56442145985812358b4e714cab1b711d1e45ffd79e0162
MD5 9ab1416b4278714d7f16b084f6642036
SHA1 68a5852bcc23d4f20baad6bd8f181b62559f0b1c
SHA512 3f14205380e0210ef51704acba033c4f1ac0a22865733c7ae06322404fedcbe519b73c5adbee6407f9e4d2a1ad66d896beae7a122c02e731cf119f616f84a390
SSDEEP 49152:Da0h2GEkuAe73q3pp46zwwQt1PlklNIo5uz:Da0hNYG4Jwy3klNIo50
TLSH
T1A185AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 5a74de892b4ad8f8d1ffdb6bc22efd0886656173599ae134dc09ecac4ea562b6
MD5 311a32966a7af8a1d8872f1fc0942c30
SHA1 28a9b8f1e7d8cbee6085063c8762355c83b9bacc
SHA512 1ba60c5f71b5568af1eeeff03c9a3fc950fd2de34a5ebdb3246dcce188b80c4079c6abad7bfa5304ddb2e647a369c41405421222a8d8a502f760365a1ab461a0
SSDEEP 12288:PhbHjfXFFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:PhbHjPju/GT/2S1FtlkR4sNhCu5kTMs3
TLSH
T162E4127E16AC20DDFA32913C656A4642C331BC6A1B21A3EF2192427E4F37EE11D39F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7c9d4f7cbceebddd62d5ebba77fcd418dd7c75fed11ccbe39cfafb861ec39d2c
MD5 d1644038b1532c055089031ad4048d3f
SHA1 f19b4f4a09c1d1d7f2df2129997c9186ce2bff10
SHA512 cdd50cb4096a1ebacb66d662d2fbd67c4827ec93495a667c1c8e4475d4dfe798664375de4d97472a94cf11dbc1c87fe94dd4e05bb10bdddc5a3a92a6a7add7dc
SSDEEP 24576:l3YgnJcRTk4yti+R5dBR/7u/GT/2S1FtlkR4sNhCu5kTMsjz:lIgnaTk46pBR/n1PlklNIo5uz
TLSH
T1A445BF2EF2B910B9D8AAD136450147B5FB71782D1F209ACB0170C538AF1AEE85F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 23565fa3929c9066b45b1e320e936d52c77d307db6ee1bc13a973592e01b27d1
MD5 8cb68a8c6517b66610e5a8332bdfbdc6
SHA1 e77b7d5b1671186a7bca1ecb86805a69641d7c23
SHA512 5d8343dec6d6c5174cb91d0816494799fd77d28a73af826bd61ab6dd00f5d2017aa00995a888af692d3d85882dc42063a65821c48e8c59c66e626a42caa8d692
SSDEEP 12288:DRFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:D3u/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T120C4232699AE909DFF064138323F4BA097647DBA5FA1528F3417205B9B33DE33A35750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 f115614d2a0e1e44d5824967769da9ce18e757d5130ebf829767339320d14ba8
MD5 6c5fe10230c5d2247176c9beaf8beffd
SHA1 263793b24bf0b847c00eabb44185d3bd1dc39ef6
SHA512 85e8799dca5ef92c04758bec52647f0b17041a899a45c27c108ddfd34ff929712758de8cce96620295268aea642daae7aa3239cc5c15594960045ca8b1b681be
SSDEEP 24576:fpL3UTuu/GT/2S1FtlkR4sNhCu5kTMsjz:fpL3UY1PlklNIo5uz
TLSH
T18925F155E7A900F9ED6B813CC9768A12D372789D0760E7DF03694A661F237E24E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 50cef8d5066a8febe4a8d62c55da70a527ef4b80ab9fe37dfa6020377c96265e
MD5 f8df81a366330e9813fefbf039c7bec3
SHA1 6cde0918556292b48128fb503904466288fdadaf
SHA512 4d83571d74c7df2967972a129c1f6413806c63b75df013a7882c772ed8a92eb3fae25c2f127e8e104132f9aeecbdca97646712f017743803ddd898b6ebc16ee4
SSDEEP 12288:1pFtpOYFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:dO6u/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T128E4122A36ED10E9E526913C9AA74349D371BC760B6253DF019041BE4F73EF46C3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 98bb3e60e2f27b49704d24dbb3d117c040cd687a3e7988043cb317173c93076a
MD5 dd75cfbe5d812dd2b04eb5276df5edc6
SHA1 8a815b0433c6fae4845128eebf76c588240eb5f1
SHA512 047439bb76aac6d6878ade9bae1fd26952a351f342eb9c282abf2b4e95f981a08e3b3e34e676b7aaa107b7037a981f382686b248638f15a3d8d4265233670382
SSDEEP 24576:Z7NM9YqZqmWMUkPjZM48Mv6bEhsru/GT/2S1FtlkR4sNhCu5kTMsjz:Z7cBWMpPjN8DbEhW1PlklNIo5uz
TLSH
T15565AE2E6BEC81E5D577D13DC9A28205F6B2B4611B318ACF1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 3157df96c6eeb2517d4b304515563800ec071e9fb901e547b41c0e7e5518c2f7
MD5 12ead3a6bed12cbd242059b62f6151f8
SHA1 c01719ef6352d75339504aab071a07414dcc106f
SHA512 243bbd4c48d62fa7c4546be5d1021ec1bac7ac1ad53570b92cb41b44fce4723e5567563eddcf6ff16f20705852ce6d2969f0af39a49847f0d396779a9f6972f2
SSDEEP 24576:xW6BApg2YuyuNDYTabvcdvNYf8km1Ju/GT/2S1FtlkR4sNhCu5kTMsjz:xF2YuHNETovAvNYf8kmX1PlklNIo5uz
TLSH
T1CC857E2927ED80A4E0BBD27D45B7D246FAB2B8551B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 eeba8716f8904c1a3a68b21e88f4b6514de4d30f2987087e8c545dd934bc9c3c
MD5 e1bbc429a50fe8598096b5435318c906
SHA1 69d94be8069de09ccc953b74fad5b006dfc26b82
SHA512 47d452e01e1b7335b088c043b6e76f93ff052a43e09b7ade85c18acafbad2d809c175f0f922c19ad3f1214d3f56b6447c466561c92dfdcb6af68b39233cd0a1c
SSDEEP 24576:0AFs06+Omlf3NXEbTo2u/GT/2S1FtlkR4sNhCu5kTMsjz:5Fs060lVXuN1PlklNIo5uz
TLSH
T1ED65AF2F66AC00D9E07ED17D8A97C916F7B1746707215ACB0160863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 26b5c76f33fc4cef2fef238a281ba14be8bdcf318fd56fa7dd65bb01f3d7c8cf
MD5 1b605beae733377aecf429341a3f2bf8
SHA1 82f3ab8a9ea1fa56c3dc48040981c8a8350cc7fd
SHA512 d116689ed86c4d66d3622c102b5a0b290c8026dc2354fb7e6fa0dce6e742a0ff3a50c87fc5dd9912e61565cb55971e274860cad9178e571f5513e9a9f8422518
SSDEEP 24576:7JnJ5D3WX1u/GT/2S1FtlkR4sNhCu5kTMsjz:7JnJ5DGXN1PlklNIo5uz
TLSH
T18A15D02DD2A810E8E4B7C274815A1755FF72387D2F226ACB2474D5353F22EE0A979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c0a2a350a0109d1fd617089e5fceae6251a8db947810d327cb72d4fb61d7f091
MD5 a08ca9e6647adf219bc2ce7f63de57d7
SHA1 7f261501c609e706a4879fdd8eb72883bec1085a
SHA512 68a844dfcfdec091485c46d64be12bf88ec469b811d4a4e872028e9af95f8b4f2244b3c97d702f9263d63b0bd943c1df9ff974c2863b294c6f39baab96342d52
SSDEEP 49152:dg06DIKdwc+eQnSt65aVz1PlklNIo5uz:2p3klNIo50
TLSH
T19A956C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 ebea807614a195b532d245e37fd113b319374643a14a938696c77b6a28dbdc3c
MD5 083a5bf0793520b4a7ce415bcb2eda25
SHA1 5605573f03fe58c8750144627fa76249fabdc1fd
SHA512 ecd8edefb96b1cf21f8a965141eaf13664c7db2a9ced2424e2528c586590c2bc1319731d938011fd3402f2e764c141589a1ee1b5780f1a176b4293265710686e
SSDEEP 12288:2EP3RncFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:1nWu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1DFE4126E6BAD60EDE516903C61A58640D3B2F8752F6263EF1492813E4F33DE52E3CB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 2b2f60b803b4c2070f2e44df47a6ec8ed6c1fe051362ae9a74d4822cd458130b
MD5 944a6eacce14788d59fd313d3ff07c4e
SHA1 d1259ca040733cafc6b522726ae05b4d04239181
SHA512 df83bc5e9a2e2055ea8a4e5a43829921fc97852d51e3e4f62cf6e84b198d6db1c7573fd7765202c196f52d8acbe13e198ae2307c6933545abafa2d206b027305
SSDEEP 12288:PjkyKFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:PIycu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T16EF4120563ACA0D8FA664138A67742A09B75BC305F2193DF6091B63FAF33BE16D34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 6e705ce29882c84ece67a7245320baa7bc58382518021f6cf1eab09b4e0c9541
MD5 17267350d2829752d5c8ae84b14434ae
SHA1 5ae437ede56b10dbffebe236d7d7f91b326c4762
SHA512 46ccd885ce3b41d47f47304ada94952719f97e81dedc2cf9402a4ff1672cac8c4196047e1ea85fb86824890722b70c21e74b87623239a4eb32293d1395156244
SSDEEP 12288:FyoFu1JlgAWttbqS1+K3tewhHkLF6WGnsNwDhwsnuQMk+egK1Gl+jDHOH:kqu/GT/2S1FtlkR4sNhCu5kTMsjz
TLSH
T1AAD4232959AEA09DFF064138323E0BA087747CB95FA161AF24576177CB339D23A35F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9e44a49b029a26459408c9e5620335b25151bfc67e98a4091c5ebdd5c5169340
MD5 3ae6bfebcf8d87a7b6ab76f9935b48f8
SHA1 e5b1c6057fcd957e77a908d7cee0818a7da4b56e
SHA512 e0c8bd26137aa287837071db95c6c9dbc865804fe4fd16217f5d04c4c8571d4bdd0fce39bebf827750459152b6831a3b1a6696a4064aaa87958e404421db58a1
SSDEEP 24576:aQ9MxZKdcz9dw3zu/GT/2S1FtlkR4sNhCu5kTMsjz:aVKZf1PlklNIo5uz
TLSH
T168558C2DABE9059AE177D23995A240C3A673B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 0cd9ba61dca05289c4a9ca53c1968b2c1933f5f8271fed88bb94c901bb181376
MD5 b01ac5ffcf0136768514a2f08c005a04
SHA1 5bc5d30fcb62e2e510ac7f12374d5ec949ff96ae
SHA512 8bd3646a8ea342d023a9f0d9409b68e65039f3e177b922a47183de4386b2e5f5d799a9c91d78429537f6af7a6ad340d03154e70dfeeb2cb6f396390aa8dcb7c8
SSDEEP 24576:HyocDApou/GT/2S1FtlkR4sNhCu5kTMsjz:SocDAp61PlklNIo5uz
TLSH
T13BF4E01FBB6E40A2E166813C89858741E7B3B4705B6253CB6592C33E8F339E9BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 aa6c2767a1e3ba89cbefcda6fdb46f225563fe7962797284968092fba50cf8ae
MD5 3287e90c7de4e7fa952ba81533eacddf
SHA1 de52907a41434f08793fa2f15c3e775983c38313
SHA512 c9761c3ce3588f2c48868f7df88bed077a08711fe85578f2bcb4b18efd536c778817ceb41e1cbb78a2b1ef12099935a2becb648601de45b0ef4639299d128b72
SSDEEP 49152:iWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK61PlklNIo5uz:U0zuNIk3klNIo50
TLSH
T1DFA57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4d79b99987d5109181b135000acfcfcbd8b701fb6054dc40cb09df774447e946
MD5 2c9837cf7cc57bd09cfc2674ecce1f90
SHA1 5fe90ad6be9fccdd984b31fef1e29f70dfbb7624
SHA512 410ec77d432a9ea6811496b99e118b5e50cede118b964dab5c47b3874a367c2ce5b6812d8c6786f146db0251d2e0d947d8b3723005a65f56b1a9077231496077
SSDEEP 24576:T1QT7EcpfxR+N5AWAz3ooiYtjMqbWu/GT/2S1FtlkR4sNhCu5kTMsjz:OTDxR+N5YzTfjMN1PlklNIo5uz
TLSH
T14B55B02EA7F815E9D17E85789A238512FB727821073193CF42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/448-362-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/448-484-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/880-70-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/880-79-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/880-78-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/880-271-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/880-272-0x0000000001540000-0x00000000015E9000-memory.dmp

Download

memory/944-187-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/944-111-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/944-105-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/964-459-0x0000000009F10000-0x0000000009F18000-memory.dmp

Download

memory/964-443-0x0000000001AD0000-0x0000000001AE0000-memory.dmp

Download

memory/964-427-0x0000000001820000-0x0000000001830000-memory.dmp

Download

memory/964-583-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/964-388-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/964-465-0x000000000CE80000-0x000000000CE88000-memory.dmp

Download

memory/1496-374-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1496-318-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1496-312-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1496-311-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1656-346-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1656-464-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1656-347-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/1656-353-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/1776-382-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1776-335-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2308-368-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2308-365-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2308-366-0x0000000000C70000-0x0000000000D19000-memory.dmp

Download

memory/2540-100-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2540-113-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2540-119-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2540-94-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2628-343-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2628-461-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2744-473-0x00000276851A0000-0x00000276851B0000-memory.dmp

Download

memory/2744-470-0x00000276851A0000-0x00000276851B0000-memory.dmp

Download

memory/2744-472-0x00000276851A0000-0x00000276851B0000-memory.dmp

Download

memory/2744-469-0x00000276851A0000-0x00000276851B0000-memory.dmp

Download

memory/2744-468-0x00000276851A0000-0x00000276851B0000-memory.dmp

Download

memory/2744-471-0x00000276851A0000-0x00000276851B0000-memory.dmp

Download

memory/2800-370-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2800-307-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3216-273-0x00000000015F0000-0x0000000001699000-memory.dmp

Download

memory/3216-90-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3216-84-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3216-185-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3216-275-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3632-371-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3632-533-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3940-379-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3940-577-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3948-65-0x0000000002700000-0x00000000027FA000-memory.dmp

Download

memory/3948-49-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-62-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-60-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-61-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-58-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-57-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-45-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-34-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-67-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-59-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-0-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-35-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-1-0x0000000002660000-0x00000000026C6000-memory.dmp

Download

memory/3948-8-0x0000000002660000-0x00000000026C6000-memory.dmp

Download

memory/3948-32-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-36-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-41-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-43-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-44-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-47-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-48-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-13-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-50-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-53-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-54-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-55-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-56-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-51-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-12-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-46-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-37-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-40-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-31-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-10-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-11-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3948-14-0x0000000000400000-0x0000000000981000-memory.dmp

Download

memory/3964-375-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3964-574-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4280-383-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4280-582-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4304-17-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4304-241-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4412-29-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4412-21-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4412-30-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4412-186-0x00000000012C0000-0x0000000001369000-memory.dmp

Download

memory/4840-332-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4840-325-0x0000000000640000-0x00000000006A6000-memory.dmp

Download

memory/4840-330-0x0000000000640000-0x00000000006A6000-memory.dmp

Download

memory/4840-378-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4868-81-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4868-127-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5020-338-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5020-566-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5020-387-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5044-357-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5044-467-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5044-358-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download