0c9cb932bcc4091ab36095cb909af1440ace1821fd8f527067794096855a12ee

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_50bda7cca354fb20015559088b7a5f39_mespinoza.exe
Size 1.6MB
Sample260504-vs4basf14z
SHA256 0c9cb932bcc4091ab36095cb909af1440ace1821fd8f527067794096855a12ee
MD5 50bda7cca354fb20015559088b7a5f39
SHA1 215d0b1c10a02aa4b92ac42b4a1b3689a0f51db2
SHA512 dd2a764aad4d4dc20e2616029dfe85577a1792d959271b6dd4bea680867e46ed61f8dc4c61a26b30c666e090a5980da3fa4a0324b5b990e31e7a45256d7bfb3e
SSDEEP 12288:QVNhxbitwzLi45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk2:4bAwRYz7KEMdX6keYnAcer3
TLSH
T1C875025FB77049F2E45AC17AE9A697A0E7B2FC8A2D20930F1754E30E2F3B6A05D14351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2184	alg.exe
5088	DiagnosticsHub.StandardCollector.Service.exe
2024	fxssvc.exe
5224	elevation_service.exe
500	elevation_service.exe
4144	maintenanceservice.exe
5204	OSE.EXE
3300	msdtc.exe
5624	PerceptionSimulationService.exe
3004	perfhost.exe
6000	locator.exe
4348	SensorDataService.exe
1748	snmptrap.exe
5072	spectrum.exe
4968	ssh-agent.exe
5344	TieringEngineService.exe
4972	AgentService.exe
3740	vds.exe
4604	vssvc.exe
4676	wbengine.exe
5732	WmiApSrv.exe
4696	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-04_50bda7cca354fb20015559088b7a5f39_mespinoza.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-04_50bda7cca354fb20015559088b7a5f39_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-04_50bda7cca354fb20015559088b7a5f39_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ad0704f5da180f68.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-04_50bda7cca354fb20015559088b7a5f39_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-04_50bda7cca354fb20015559088b7a5f39_mespinoza.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_172312\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cc1eeefe9dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075df47efe9dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095bf2cf0e9dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000406832efe9dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000185f2af0e9dbdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ccf7df0e9dbdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094b405f1e9dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000508bb5efe9dbdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5088	DiagnosticsHub.StandardCollector.Service.exe
5088	DiagnosticsHub.StandardCollector.Service.exe
5088	DiagnosticsHub.StandardCollector.Service.exe
5088	DiagnosticsHub.StandardCollector.Service.exe
5088	DiagnosticsHub.StandardCollector.Service.exe
5088	DiagnosticsHub.StandardCollector.Service.exe
5224	elevation_service.exe
5224	elevation_service.exe
5224	elevation_service.exe
5224	elevation_service.exe
5224	elevation_service.exe
5224	elevation_service.exe
5224	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
692	Process not Found
692	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6112	2026-05-04_50bda7cca354fb20015559088b7a5f39_mespinoza.exe
Token: SeAuditPrivilege	2024	fxssvc.exe
Token: SeDebugPrivilege	5088	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	5224	elevation_service.exe
Token: SeRestorePrivilege	5344	TieringEngineService.exe
Token: SeManageVolumePrivilege	5344	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4972	AgentService.exe
Token: SeBackupPrivilege	4604	vssvc.exe
Token: SeRestorePrivilege	4604	vssvc.exe
Token: SeAuditPrivilege	4604	vssvc.exe
Token: SeBackupPrivilege	4676	wbengine.exe
Token: SeRestorePrivilege	4676	wbengine.exe
Token: SeSecurityPrivilege	4676	wbengine.exe
Token: 33	4696	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4696	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4696	SearchIndexer.exe
Token: SeDebugPrivilege	5224	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3900	4696	SearchIndexer.exe	107
PID 4696 wrote to memory of 2272	4696	SearchIndexer.exe	108
PID 4696 wrote to memory of 1860	4696	SearchIndexer.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-04_50bda7cca354fb20015559088b7a5f39_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_50bda7cca354fb20015559088b7a5f39_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:6112

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2184

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1344

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:500

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4144

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5204

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3300

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5624

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3004

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:6000

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4348

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1748

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5072

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3956

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5344

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4972

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3740

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5732

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3900
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2896 2908 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2272
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2876 2712 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 108947369c6b410f60a3e6197005758535855e8cc4eaec2202fee28574d49d4e
MD5 de00d07523e500ddf5e0507d09343f07
SHA1 c836734f93be870d9a92da3096931499defaad91
SHA512 fb8dab7a033bef49b621be25527d68fb8f4210b1dc4cbe466ee8d37bef94b3353b52a5e8293677d1309051ce845874b8f30e41ed92d03388a8e4b24e30377cea
SSDEEP 49152:Eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn6YPKEnSG:+3q6HjBLYPKES
TLSH
T1BDD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 8dd06f2f72226feb82c3f6ee7adac740b468b19d829ec571ef7e2840b0a35ab2
MD5 cc4d8fa5dedde4c5c7f971c89b1866d7
SHA1 b268442f6fd076f367b2f5d632b5c1d04ecdd18f
SHA512 dc4b0c9c9b4b89a9a87cbcf4884422952c4afb0c23e2db80de087c46d321748fe901da305ceefd55a330e0db75c895c240239bd3a2ec80486129967ce94beeb9
SSDEEP 12288:81XLsswWkxy2lRq2czAc45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkN:KXYfDtczAfYz7KEMdX6keYnAcerk
TLSH
T1C685012867D508F5EC67823DCDA28501EA33788507A4E7DB03E899661F373D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 a063335648fbd5a50b1312573207799255581eda12428ef4f19e614c53ea9a79
MD5 6fc304393cb26aade397db8e289806c5
SHA1 ec590c5c7d05a52ecf70b162d573d0921fbccef4
SHA512 395681b7a249b535391f11316b60d8293174ab89fb1021a1edfb6e5d165ad012e82bce0f85cd7838c3ee16f56d9ebc5a46a8b6d0af70b155822002ed010e8488
SSDEEP 24576:w0Le5ji0hmx3rMSYz7KEMdX6keYnAcer3:wPji0AZ5YPKEnSG
TLSH
T1E1A59E15F6748771D073C0B9C5D2A68AE97230861B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c66564df7d4d6b8a30ec3010a647bacbfb086903dfbd47645a0522f66ec0473d
MD5 ae938cb6ab767a20af0814269a6f26e2
SHA1 345bf97f0949571bbd49a32602d9f66dafcfb917
SHA512 ebf666630810514aed0adce50c1f2801801a71f69ed7162e0f3e839fd4dcb7f2e34a4095faa7ece8615b53a9cbf92de3c5dfc7fac8adc19d7d1353eb8c316f46
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWE6q8wyu4Yz7KEMdX6keYnAcer0:8/ezSC6vUzPvxHjyNYPKEnSG
TLSH
T140756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ccf8163ec88e379973bc32534b72f6d866a2bc09ef734ec088ddbd59224f2680
MD5 49fd36e9efa605089fd5ba082daad075
SHA1 b268603e9662eda7f9989846a26f911a06cb01ea
SHA512 d8b4efb4d5c0847ba313bf35e8009629d570ebbfe1fda4e50360c366192dc4a3d0cfa62cd03e966bd3f8ee6f7f6c2426a7aff63a0a787d457877b94d37faf261
SSDEEP 24576:zVbqPb88hv/l+6bYz7KEMdX6keYnAcero:zVO88hXl+mYPKEnSG
TLSH
T180559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 5017589fe786efea8d7da17bacfd7d29fd713ced68f1230dd371f67a4d0f2487
MD5 6abd3644fe0a5c3d90f825146867fb6c
SHA1 e7417aa64c167a6c24a72a0a352e22eca5a6f270
SHA512 6c08d63eed39cb0b1d851a52d57620c151cd2f0cb04c232ada3b6f0b77cbe48918901ff47cf0f81f981b453f4db20bce237ea81eb0f74f6cf900ecbc732a1fb9
SSDEEP 12288:dXB45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkl:dXOYz7KEMdX6keYnAcer8
TLSH
T1576523048B1A99D2F85F067BFFF5494086375DC62E8C97A1C94CFA4293BE222C50679F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 641afb7ad7f5b2f4964f294dba3ac6f63c95255d6eb16ed80b5558942b51409a
MD5 7f28605ceac9d018d1089f2f8470d174
SHA1 c102d07bbcfae0317f98be5b456a2f0591ed5859
SHA512 2a532f65898e3f2030d524bcb889706ee09e5964243000081bbd65e3c4b61f62cd6ff65b3487f42689a1685dd0b6bb70444bddb2ac8bd02632b7ec6b89e7d8f0
SSDEEP 12288:WeBNUbTVO86UY45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkk:WJIUzYz7KEMdX6keYnAcerp
TLSH
T19B85CF3BEE28FCD2C27A8DB96B918600D77278704B51A3CBD164C20EDE275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4672ed0fee4ce40784109d0d410e9559d35f86612ceca1c236a2cb4d5c2921d5
MD5 8cdbb0ea96bfbe3070da98e1c741cea9
SHA1 a1de3c788da4ff2abb56ad4b878234bef5ffbc00
SHA512 df6e3bc883c4b223a4e6c7984e6c2e738b7df0dff61008abe07f5bd8462b27d64ae875b94293c9567e4b7132e0e08efb84327a2123865f90e30078f9473276ed
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THi:zQvGAdlCEL8c/yRNw5CIYPKES
TLSH
T1D5267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 bbeb568fc0f1eaa1ec3363c7ce11c905c12ce7425615af377ecd5f89836fea77
MD5 db6b1ff377aea7cd3efdcac70794e987
SHA1 edf38de48dc8f946c8d49a34872ac366cdae5899
SHA512 c26f27fa29c980bbb12b90a55f6012f4d86eb5b8a9d65d91286bdb65d39d5c27d4f12cf4294ee57c353d5b1c1f22a8bedb2ed5d0ee94531a08ee930beb998034
SSDEEP 12288:KAwSfxL/2Dc3BDLLmt0LDQewsAjC45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkw:fkewsAjJYz7KEMdX6keYnAcerR
TLSH
T19295E031FE75E432C67F0DB62B36C716543D79600B511AC3E3A89E8E5A742D22336A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a8ac952d007637602a6d3b7a7be87ce8b94a147228c4b83e9bf8c4232995b598
MD5 81dfc76d00224e74b5c796eaa39a4ddd
SHA1 4d2323996bd8de931321f7c113e3afb1a3411b24
SHA512 cc0a53a774eabaab9cbb41cac8bd01b2254a94b9c2f297e9d70a75bf3f3f12644da35cab970dd5176ca61d0d6dc1d7315f870c26700e18adc7655325a57cf7fe
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHRcKZ:2UEtQevvqc2W1cpV2EI32Rn
TLSH
T178474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7efce8ed42d5969f0cdda177a0cc65075ea872d59af4437d644efa086b9411e1
MD5 ae6f821e9acccf03fa3b34df8983873b
SHA1 d07d1d98a61a4cb180d87da4462ad3a7b0b6250d
SHA512 d52ecdc4820a8e781caff377838949140276c0f4383a46cbe78fcb016dcf2d99b88d898490c7974f3a512bf5ab73edcea3eee99482fe7e7299b6535a71b78721
SSDEEP 49152:FCbRquA/m2yL5zQfFiV+XenmE3/zpYPKEnSG:SoqtVjnmcYPKES
TLSH
T1ABD58D0976B8C2E4D1F6C77896A2C647F37178154B34A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 28d76879fb5a5738e2ed4077341fdce4792ab3e88ba641a923a8a0d6364c47da
MD5 9bdc4f3306e8e11c164fa8428148b585
SHA1 a173b3534cc0345caf7cd0ba5aafeca425cd54e3
SHA512 8cdf37d4726c2ee659eeec90f108fe11922a91886dfaf6d526681a84a620d81d972409fd4d2430ff9194b735a2981c95ff37d9153dfa8b3dfaf9577b2b7b1130
SSDEEP 24576:+AhGLJIFoiwtA5l7S538Yz7KEMdX6keYnAcerK:+AMyFoiq5sYPKEnSG
TLSH
T11335AE80EBF955D4F5B3AA78A9B68570EA76BCA65E31C20F2150D10F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 da8a0e3261fb1d011e3213a252efdcd33447cc4b9224628e77d48ba2aa4df04a
MD5 a0857e2fb7faef92889f4c287c5a3209
SHA1 5ab0da972fa3bbbd708e71b93a97f160f4169a2b
SHA512 2d9e8b93ac7cb8b860031190afd59383186565c4f935217096f5f591b373b1a6220ac9c1b27d4c907040afd1555046f5472c3f419d8a033d92bc11ad219e920a
SSDEEP 12288:qmw5HEjsChNzBFgl0WDm+CH45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRky:jwuSOWtYz7KEMdX6keYnAcerT
TLSH
T11C85F14977A90CF5E8A78239C697C132E7B2BC422A25D71F4760C6576F37321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 72e414da1f28f044a463fbbfb01b1b6aa33343c457e9ab93d5e76e0a852e74c0
MD5 9c84d808a129fd1d9fcd0c8371bbcfa7
SHA1 3199d713eab89379aebb0518120ecd09b851eba3
SHA512 e26fd366a3a8d1c81bcf0843814371e7d892a78b383e61370904ab06030601c85b8579feabad96d4fc355bbc0ae79ca53c2be64fcdbcfcd28022121e0adb0d2e
SSDEEP 12288:HjZ1IyS45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk9:DZuKYz7KEMdX6keYnAcerw
TLSH
T12475124927A820F2F0A7423EEEF14601D7727893277983CF465896925F7BBD24D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ac6ab2f647654db3e0c9fe62a89e3e5de64cc982f90abdf4e089b7d91c32b57b
MD5 047905dd3d10da11a35555ef5735761c
SHA1 093b1a4e943de129e86c5fc07302da4cd8c4aee5
SHA512 3a8ddad7be271d8046bb7fb0d51777b621a07551f8519aae84c9b333cb9453c4d70e68f16de3d84e7faaac0b5fa81cbe2ff863d9f1e5c4dfa3a1977d1e157054
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uu:zQRQyi36YOcPQLvw2gAf+PN33YPKES
TLSH
T1AE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7c3ba103bc6f01795ea4183805ac4e81d9786cb7e1914f3123b982b8469ad473
MD5 564420593beb40b789e87da23432c16a
SHA1 8c12b93adb55ab6353f69f1ad7979870f35c2cd9
SHA512 c3537a7bc5b27fc0b16bc13b874b7dec3956def2da5340473430ef297446aa0927ea1f78f74a37be358ce2c30f4a4a721c481a0ace98949a06f53afe5488fd29
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uu:6QRQyi36YOcPQLvw2gAf+PN33YPKES
TLSH
T1FB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2f16732c290643f93bbacb9273bd1a0f08344991541c7afd70d8433cbbab7bf4
MD5 5cb7ea43ad048776b73cafd676d18c06
SHA1 363f4b2cce4cd9cfc94956f2be70ab5e3db768cd
SHA512 92851128f128232dedd6c2c0b312aeda02a2729ade10a8c0150eb207e945919e30cdab5e7e47938c0ce7b14009672135933346c1a15114e97584b5ee70b2595e
SSDEEP 24576:CwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL06Yz7KEMdX6keYnm:868Qg55nhheWu7PNU3/5YPKEnSG
TLSH
T1B6B55A33B2F600A9D44DE1769F4A873196D27C758FE0E3DB850572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 292318ce6c9c69e6d2c6b3c125d1c77d1ba57ee851a52b187755aeb005953b85
MD5 ad13ed0b8856d85c2da83a613d46353f
SHA1 a1a8d52710cebc746b8014cb97c3b12a86d16e52
SHA512 3dd746bf43163959d26707fdeadcfcb022e7cb89675758508913d4b3369904208b99b0836041602d67825ddd95a522f0afd05982532916cd092d9e9ff75fec53
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk998:Cy5112gYy5azzVvL69nLKnhZOYPKES
TLSH
T133167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cf80a609ab9bd2eaab2dbdf8a42dcb5366989b22ea23a04844f49829d34eaabc
MD5 1429769bb29d8e62b76b3b4509ccc44b
SHA1 7ac5a7fbe9c3fcb20cb3b72342d800f977639095
SHA512 61f5d207e0485f779915f73b464dc73fe596c987f01c09aec7441ecacea95240053b33024a9fa2488e41896967c5fc7f2314656c8322b85d1d4272fe897cd415
SSDEEP 49152:mB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glPYPKEnSG:Uu6JmVxd2dPYPKES
TLSH
T1F5D59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d6f165553efb6be1915593ebdf5d53236647c0384d2539d9d13ffe549d4e4b61
MD5 5357a25cf74e9f1862f900a72ed92ade
SHA1 08bb0739e74313fbc641303fce2f1569875b7c7b
SHA512 163e74f70c4b6426a248827749201ee1a37952c57427d85a2af8a93cd21dea94f4ea0b47c9babf6bd5e3668cdb6d2e60825f2a459597a3525ce49685353977d6
SSDEEP 49152:51hpsNoJpF1A6UU44CwH7R4xTYPKEnSG:5mifPbRcYPKES
TLSH
T19FB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e81510f0984248abaabe95071b4241209341dd791f96a097c88066884e54d01a
MD5 0fa95ad15c91adef787d9c6993b0ffc3
SHA1 fc8d5a6439789c06e75f658e85c8b77668eebc31
SHA512 1b8fda070d3a6a410de8eaf50de1787472d5c55659a1b4d6ada7d302d223cae6ba7e89bbf46a0a67ee032f788c5b5eb7be5be9a93af4faae638ba713b267a341
SSDEEP 49152:2SuZQIY0Be2KRRVtOnks6NMHqKYPKEnSG:Y5dKTi61KYPKES
TLSH
T18AC5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f53ec47535b06cdf72c113fbc0483957e5970e1d0f07ec6fe430965a2532bf6a
MD5 81d902d0b90a7153356b38410ab5f95f
SHA1 be713b257d2e93528b1d28c2da24ac2dae9d04a8
SHA512 7414aa5252389921153ed2400aaa2507e3c326bab28d3a1c464021090106c5bc132f948ef8cbd7343cedbe62de226364676ba07c1fd4464d6fd0a59b0171e8c7
SSDEEP 49152:RhtSn8EApI0figngiDn0AP5wfYPKEnSG:AX2iyphwYPKES
TLSH
T1C395BE13F2D900E8D05ED179C7568632E962BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 03c6e6f2415420ead3f25d1ba4e148d6a7d1157c3927d38d042bc06349848211
MD5 681793eb20061ab76a57210dd2404d87
SHA1 856e755d1e5d737335a2828e1399ade4a8ad18d0
SHA512 c55a3618f834820fba33cccf2bc7f51f35198c139b9d89de66354a5ed2f72c069b7fa8e90eded9336d6873fb074fa0e985296b194a68e85c83d51d69db656732
SSDEEP 12288:zZ45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRka:zmYz7KEMdX6keYnAcer7
TLSH
T1E16523088E5B8AD2F84A467BFBF04540C53A6ECB3B8C93A5DD4DF50293FE622450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 41d5a7025c2bd5c804c6f9958fb34ebeb1657184864755de47d5188377a50eab
MD5 4726aa8429a193bed8046675a13ba1bc
SHA1 4b4133e97851e0681d249bf9fc6f3b2d471f587e
SHA512 d41854b582a8953a0379f823ecf2a6112482a6f6c24dd773278bc91a7566959d76c4a22045520fe4ded497a5ca3908fab02fb468141c11f9119f2c195e269a0b
SSDEEP 12288:0G45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRka:0VYz7KEMdX6keYnAcer7
TLSH
T1036523048D1B8AD2F84A427BFBB54540C93A6ECB3B8C93A5DD4DF50293FE6324505B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 06e60dd5c82d123313f303b22a825085f415a98573538acf4fb2683666253486
MD5 b089b3897be9ed0dda1395f4260a5fc2
SHA1 c327c46ceaad7455e87171dabdd62e458c86049f
SHA512 38652dbbf3ab42c5da3a1d875a140b0e47ec4649d8d8f265d7ffe1fc7a9745250556b2478c5ae2d7b9b7e09c485c74e441a66dc1b29bed83ff6f663a13cfdbc4
SSDEEP 12288:pQ45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRki:pLYz7KEMdX6keYnAcerf
TLSH
T1A96523048E1B8AC2F84A467BFBA54540C93A6ECB3B8C93A5DD4DF50293FE62245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 3d1506923a40dd908e6f43b7d81ab174fd904ac6a51008599d96592f24bec676
MD5 f3d73ec24f57e2d251357ee3aefd7279
SHA1 96a77c44519633e90840dc2fdfc91f93459eca01
SHA512 b29b9baa7a25995e90ea41c0c32ab2059aa19406c651579b81b9a38a51a65601db9887ae080273652dfb39b09503a4244e34963345db1ffb636ad3d28bbdcdb6
SSDEEP 12288:fVz45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkz:OYz7KEMdX6keYnAcerG
TLSH
T1437523044B5B45C2F85AC27BFEB18500D6767DC73B2893EFCE08A5424BBE3615924B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 59f623fde34b846b7dc955594362da731ea67c8ded1cf3415cb4e9ad6a95f6ad
MD5 fea840e6e0eecd9e35ebc4986fc3e8c2
SHA1 fff45d583a90d991c7d2284b982bf8f63b483e0b
SHA512 649962ca572873f521b8bb44359f8c9e836241848cc3ee634e09ad7d0295af852501e51005f432efcd1b7959e9c7d32367df9a72d3f946dec3b4e492079cf743
SSDEEP 12288:db45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkl:dEYz7KEMdX6keYnAcerQ
TLSH
T1B96523048D1B8AC2F84A427BFBA54540C93A6ECB3B8C93A5DD4DF50293FE63245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 ccbe0de85d7fca1bfd4b831d7c07d258069a094b7bb61e9fa1a38bc5fdcb05b8
MD5 a745220a8c8d6231d8a045ef1e9fafa8
SHA1 ee2b1c873d814c96f6bed67ce34286499576397a
SHA512 d4e2c665bb0842a65456d77b812443ba7ab6edc1caa2a90d19048df717c96ff501fde587403e537a31341e21f7391082116a8f123a1a078e8567846e9ad34fb5
SSDEEP 12288:Ta45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRko:ThYz7KEMdX6keYnAcerd
TLSH
T1A16523048A5B8AD2F84A427BFFA14540C53A6ECB3B8C93A5DD4DF50293FE6324505B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 0e1ac58368d90844f36cd6289b40c3022c67144bd648984182df44e9ef5aba72
MD5 b3375f268079080b7c0948f191d34cc3
SHA1 c78be67da189eb0eaf975eed8b527dd3f0114e0f
SHA512 c1c44480326d1819ff1e02dcf4f734a3ea04eb66be9d22d4f5761cb151e7e38ecb34a48688d5777d5fb445867b6dc8c79bbca9e5a3e5e6de727a2ea61d1a651a
SSDEEP 12288:GO45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkg:GdYz7KEMdX6keYnAcerl
TLSH
T1026523048D1B8AD2F84A427BFFA44540C53A6ECB3B8C93A5DD4DF54293FE6324505BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 92c1cf71fef50f586f015c309f6455e8c560d8025107ed611e90f8cbddf1f064
MD5 bc6bb385238290a2396f8aaeaaaf800e
SHA1 80a3ee27ea3d763a240b348479ca25ace9b29fac
SHA512 d9f7e77625e89d24ff945d6f8a663c69340af56fc3fe545f5aef613177c46da7d411bf350f639c9778f85fdb91ce2ca6ca1dee029e3380abb3e1058dbd2d5631
SSDEEP 12288:WiZwbHzzFEoS2cPvym45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkA:ZZMTzFVSO1Yz7KEMdX6keYnAcerR
TLSH
T100850194B3500CF0EC67823ECD658906D6B27C5A1B60C65F07A836675F773A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 d26653de490c504774dc6b3928f76c2a9cbafd95f89e59fd83917389c7f64e6b
MD5 c0520869f5a5e7984b733606cb69a49f
SHA1 160efc2aaba43c51c140489bc1db371d39a2c22e
SHA512 f196f8a43f4682679ea82510e12ab2584b0083bb7a53bb20738ee445a9ae90a72a5f96eb8845ef520650f91f9980a2d407ed93f0a73ec6c0003e9b9d4e19d77a
SSDEEP 12288:R145Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkx:RaYz7KEMdX6keYnAcerg
TLSH
T1F96523088D1B8AD2F84A427BFBA54540C93A6ECB3B8C93A5DD4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 c0e0945c5c563434b3879e9e56259956b480edf193f79a303e9882dc5683c811
MD5 0623ae5a827749a76e0d94eb1f91e944
SHA1 27747e08c935bd7fca8c001150e24f4876290d83
SHA512 4a860875b40c71893652aedfe36b66f1168b48c215c7e0ab397c1cb0e471bd1154bc453c2aa5cf2b52e842ffa9dfdc173329181d47cdde9496dd42ab23f5d94d
SSDEEP 12288:OR45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkr:OeYz7KEMdX6keYnAceru
TLSH
T11D6523088D5B8AD2F80A427BFFA54540C93A6ECB3B8C93A5DD4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 7e01a7a7a46b956af081440c214567c9920122ff72d2014a428d6c5722eb013f
MD5 becad240a5bd3aa21036fbf337a59d11
SHA1 3851c872660a7cd3c268921bb70ead8235b8369c
SHA512 0db39fd3bc360563ffaa893e5ec2d89970d24e83e337235af08a5821d8af2b8651952a27e73bd59b7eb6d531d6b68dbe6991d997a66da27fb7fe89b887d413b2
SSDEEP 12288:iyPz5L8S45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkd:/zyZYz7KEMdX6keYnAcerw
TLSH
T12275120767A630F5E0278239DDA10A01F77278761B248BAF579447732F7B3A15D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 1a7653045bf4e92a7e1372d190fcc0fb01ba7c07a61da9b451da7189cb432e78
MD5 208fa7eadfc97daf4d5b7dec0a9d4838
SHA1 3f65b4c7522fcc34c778c2114d380324ceebad34
SHA512 a6f3c0b455b30385e629b8a3e6daf09f163cdc9bd0fa3bb1c18f8d213914b6ad06b464d3b9e018eb0ac07fb06c03b4179e5b2cc67163cd3563c86a40075a15ec
SSDEEP 12288:7145Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRks:7aYz7KEMdX6keYnAcer1
TLSH
T1156523088D1B8AD2F84A427BFBA54540C93A6ECB3B8C93E5DD4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 75507680805f565eaf9ef89a00d87ea6619db13ef1c94d894a7ab01028425adc
MD5 62d29a08f28ca39126687483caadf7de
SHA1 8900d81741d2252171ecb3475d7225b718525fe2
SHA512 f223a2911f4cd4bfc96e22b8acaf0f66df38826f41b012791b21a3ffa04dd3102c66aa177db4ccf9a0814930306fe6049eda9d00e6ea5f38362cdfb87f857b98
SSDEEP 12288:k145Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkn:kaYz7KEMdX6keYnAcerm
TLSH
T14E6523088D1B8AD2F84A427BFBA54540C93A6ECB3B8C93E5DD4DF50293FE632450579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 1525d974dea35885eff2741e5f04cf913909fb1904088d2461c19ee108d736ff
MD5 32794d1e08503ac90e1dc7a9723f3e27
SHA1 136378d883c3cb55629d197e5267278df39114c7
SHA512 1c60a805e04bc4c37ca82502ec358762cf5c5386d7706e143bea558690ce7e629ebc0c32132d7913b0b9121a1c246d6bd161ae21afa1cd99b4241bc1a48aec97
SSDEEP 12288:+yPz5L8S45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk3:jzyZYz7KEMdX6keYnAcer+
TLSH
T14275120767A630F5E0278239DDA10A01F77278761B248BAF579847732F7B3A15D3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 e5b43e743289a175e802e88d94866c542d86c87e74faacf968a3ed4d5f774ca1
MD5 e14cde8e9fe2bdbe473a76463c2e22ec
SHA1 4afaabd14e595620aca538331a541f2a33497be0
SHA512 f52049607c555e7b18e52920756bc2c4a7a3cec7b4d48e39523504699be3787372af9229c99943333f4907abbf5dd4a32cc995219a8c2129b5c56342a1bf4b39
SSDEEP 12288:6Cd9ZWYoaLHF3z0z04PDvhA45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkN:LTIaLl3z0zD7Yz7KEMdX6keYnAcerI
TLSH
T11C850194B3501CF4EC67823ECD658906D6B27C5A0B70C65F07A836675F373A11C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 f50f354876227d946ef44324017240c4790390e303dc0677d573b22470c1aacc
MD5 c790f0ec3609db719479582d46512fa0
SHA1 4c9efeafc6a58d07f82d44cee457a85d7a8dc42a
SHA512 66a36c05f2e2f8563ead1082f8869750e8e17bb9e1df00bf16f9a8af87566579016c6c15c89a58f18a77a5bed1d785efebb978965b92941ae224a15f6a49aeaf
SSDEEP 12288:Ei4e7wRdTfgwCHKy7GLbbdIvv45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkL:E35d9CHKy7GZXYz7KEMdX6keYnAcery
TLSH
T13295CF90F3E414E4F0B78A35DD764511DAB67C9A1B21DA8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 041722253742f7fb946aac3b178f33a08dd830378b0b6cd4b3fc347e4276068f
MD5 0828d8a26230988060ae41c555819041
SHA1 adf0176db483bb745564ebb6da6d57ab7dad43ca
SHA512 2eabf41419c2d7fcf46c1c8b0ea3a347089e40293f7d85473c4ce90af07ba4b4c0f6fbe6712ce4b2d1e2ad736573b0b5990f425b44fac16882fa78cca63feb7b
SSDEEP 12288:aw45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkY:arYz7KEMdX6keYnAcerp
TLSH
T1156523048D1B8AC2F84A467BFBA54540C93A6ECB3B8C93A6DD4DF50293FE63245057DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 07286ffd8db95f704d34bfa94986a08aedbe565b102d60e6d74d66770858fa4c
MD5 c173343f6fa908099551aa41150956a9
SHA1 5b8ca662f1be50e3d7e33e157f6dc4c124f67d16
SHA512 052fb34d837e979121066a4c7c40ca11d7c9e27d43a8644b660f9c9c6d7293096c67c8570e4189a9aec2e1f6ad02f61c64bd47424863537582ede8f270d5c27e
SSDEEP 12288:Azsfl45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRk0:/KYz7KEMdX6keYnAcerV
TLSH
T13E750109C29802E4D06E527ADB964A40F3337C6657E1D3CB96C0F53E1F7A6909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 9cb3d9c2d2f813a59ae05b595f7ca1d9dafbad1e198f8fc2be2d5422a88bb588
MD5 208e195fcc9a8e0d56571c1cd5b72f7e
SHA1 a6658fb88e37ce26142c4b16e65a05aa0c401154
SHA512 874642e8291e6ed758d5cb84b59e99946662a6a080a14e3cd5e404e34bcd9b628779c084f972c3623416f7a13caec74644ae512a2aecd58317e81a920655fda7
SSDEEP 12288:xm45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkO:x1Yz7KEMdX6keYnAcerv
TLSH
T14A752304875E89C2F86E4777BAB58520953E7DCA2F4882D3E80CB642937E6E18D3574F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1365f751cb0b6c3f87f5e80d5d95d42edbca60b731da43ca13ea3284c6057598
MD5 8ebad0542c7f2df462d01312572f70c3
SHA1 ad70de33ee566446faf79a23dbd68d927d8398af
SHA512 4c634a0a6cbb624f505edd07b61792e1460b7184bf24aa2179a5bb24ce50e83b19c172906a9aed4dbdd4a4d3c67f39c71be4952047578a0bdebc4127dfa055c1
SSDEEP 24576:n8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCPYz7KEMdX6keYnAcerR:8RZwQCyiHiQEaaPnMwYPKEnSG
TLSH
T17D85AF1E62DC46A5E0BAD278CDA74407E6B27816573197CF0190C27D1F2BEF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 a49945d4062ccbe5af4a5a254f84a0075f6add8b13494d354a661ba87dac8323
MD5 be958aad208e4c83316ce71b4c9a306e
SHA1 eef9544b9d2ea5c97becc1f01fcf5aec7abcc5f3
SHA512 0ea3922ab610d0fccae5071be66738cd6ccfc575ef66fe56b6630b8c5d9179e2e36cbb9d9a60fc8068230931c6026552403bd9f1f874c6a412d56d38af7e3561
SSDEEP 12288:6bxA1U7K/45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkF:6bxA1UGQYz7KEMdX6keYnAcerk
TLSH
T19775122E56AD18E1F47A923EEAE18101C3327C56272493EF5484C27A4F3BEE55C35F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 9a0253861f7d4e8fb9166c4ee33cf8798b61418743151df7e392c2a24c0a495d
MD5 d6833447ab64c523df63fd955e897695
SHA1 632161a0e733c27de098487aacd32027fbe5f79c
SHA512 ff07d0bcbac5abbceb2676916b653ce7074552cb98e6ac09c7c0b8cc8efeaaae3273a0140a19831f5adbf16449186721b097d33cabf7389875092e648856ffcb
SSDEEP 12288:X045Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkG:X3Yz7KEMdX6keYnAcerX
TLSH
T1047523088A0B8AC2F85A467BFBA44500853A6EC63B5C53E3DC4DF54293FE6B3453579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 ed4b8ce645344df19404a8018adc31cb00dabdb3696abe89a4fba24ab88572c4
MD5 3c2e4976545e458eab7da6b36910fd4c
SHA1 414adf0bf4a01dbdaa37d91d38fd4984c196f6a7
SHA512 14f2ef2d39a3fa119a6cec3f3549197c186ac09c589cf3b0a0f8fea421d46fc77e9fc9fee87b06dcb31b35bc63eef5068e90ae78c7a97d34a1709bb6d6275f52
SSDEEP 12288:ZObMA4LWO+vAYFTq45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkB:OMLBUTxYz7KEMdX6keYnAcerU
TLSH
T178950114E7A500F5E86B813DC9B28912D272B89D1764E7DF03AC8B561F637E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 4e6907524fc3ae3c14e7607fd600066b7319fb001d327d5a5d9d85465a9ba23c
MD5 8f5f358448cc826324191f5d338d1946
SHA1 82a4b8f87fe1e3fd5f0b27c0449e5c86a1471780
SHA512 11f262a85802491d7ac28d79bb5687b3b03bbf6f203f3cb3882a0cbae235e119a7510253b91d216c66d4a2011ce2bcafe4cf29b08a80eb26138d116e349afd88
SSDEEP 12288:/70VmKIYNvUyBpT45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkJ:oGYNHCYz7KEMdX6keYnAcer4
TLSH
T12585F11E52AD0CE1E57B917ECAC28205F2737896171193DF05A0C27A1F27EE9BC3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 145cc68433c1800c826c1d8159b5c5fc4904ffaf7d9f55c61457a593d34aa9a1
MD5 e2782babec24b21091140021aefff549
SHA1 ee525c887a274fe9d5e003ec2e584550a98268ba
SHA512 5b107229e90ecd1c8476e25e75a3cb74d0933be07f5d4da373a693b12dc01b1fbf585093ba674e88bd7c51ee23bd4afad894c981e6b5dd8a021aae478a6d326e
SSDEEP 24576:lnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKo:lnXoJJYH84VVS6AmEcJas+cHBjSSKHPa
TLSH
T1AC65BF6EA2BC04E8D5BBD17DC5C24506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 52507d6ac089d6c7f45d0ae6a2adb65fe873321addd04855d943fa50897a0d88
MD5 30585268e1bcafd9c66bdc833e8dc0ae
SHA1 63205c2ef7c1cc197a86581f50db2c9411b637ec
SHA512 730e55a1cd733fb256ed61e849b69cac5a8788d60384487c7d1cd611a17f8bbe4d25c7031e09d151081bb63dd74c990ad8dae79b6a4bc378f8b121d448092843
SSDEEP 24576:bv7Xbxd9Tuycf8M/TYlSuxwr2PCEYz7KEMdX6keYnAcerm:bDLL9TuJ0M/TYW2PXYPKEnSG
TLSH
T160858D5EA2EC42D4E47BD6BD85B79046FAB2B895273081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 92706828f614a1960552ccebab8f401acf65f84e1adb5d2c4990505dbb8f01e4
MD5 3d7e402eb7b6fff89a89ed3fc079ba18
SHA1 a6a2eab0749f64ed54cab4af58e60897c396cc65
SHA512 1a582370b945fa28c95c4f0eb96612064a5b156c301c0120ad60c64001b200e0e435ede6a3eed74eed0a89bd28ce393ffe5790dd850b59e3749d6801b7ea513f
SSDEEP 24576:legJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wxYz7KEMdX6keYnAcerM:lngOJOmPOHhxYPKEnSG
TLSH
T11855CF3FA7BC15D5E03EC17ECA928916F6B1782613255ACF0560827E5F1BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 46e45699322096f002cc9f874f581f877be6116243077d84703871394fc15f9b
MD5 1a6585c603aade6fcb8fa1b7ca1e8d61
SHA1 d81275b571f4d1323b4f778a98b07c499425eefe
SHA512 55fdc37ad055bc9b4bac90401cd51a7c45256b7adb819c875ad2d8af50c41896853d976d278d98d19cf49d1be5479aa3f44eeef6c32eaa133b5805f71f428e95
SSDEEP 24576:5LJnJiTk3R3waE4JrOXYz7KEMdX6keYnAcerc:5LJnJK8R304lmYPKEnSG
TLSH
T18F85D02CD2A910E4E4B7C2B4825A1756FF32346D2F2569CB59B4D5313F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 9e97c9eba527eb35deaa9679e8a6c7a487ffba3d8880bc6016437c072756cb94
MD5 aea61a3f80de47997e4910ec1ef88667
SHA1 7af8158affb96dc1af1285787501b8bdfecb3bed
SHA512 630589c58bb077c4024834aa5706d288a3bf85eeb952566950310adaf5e9ff855ee64a85f480ad1c86897d121ab0a47b5b29929b3e71c8de6566607f5487da3c
SSDEEP 24576:BA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pZYz7KEMdX6keYnAcerQ:m9GqCzDScAZmlvTcFg8Ph6rYPKEnSG
TLSH
T1D3955C05F7EB5294E8B3CAF1C96294159B327C409B34F7EF4A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 4bf5660d365c1b81bd676812a874b72919beec50171986aa0d5bd978d2c82e03
MD5 fbb24d6f03e179ecc06895279b32e9c9
SHA1 aecfe3243073399e5d32f03be7f895bfae5d4ed8
SHA512 2f33273e7579ac579bc0ce000e0975fc8da159ae6b4dc845516464fbf9e3c18e092979f3b12faa91d0d905eff74aeaff23e0ee87f4f9cd16e204e8c19160bfa6
SSDEEP 12288:+lYJeXm5nkEUuE745Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkE:+lYJeXm5jUuEkYz7KEMdX6keYnAcerl
TLSH
T1EC75120C6A5D70E1F02E817EEAA14900D372F4A6274553FF85D4D2768F6BAE21E39F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 7adb7dedbb864d083cdcf2b7ade12c7d710d35d9070c25def0cb997b2d14d513
MD5 fe27cec0a55db8195c1a7bc720de2450
SHA1 5ff773590f6904df74a5f9912dd17656917f9094
SHA512 b55f41577c141542f84d35297f1c5201e168a3589cd4ebfb9265a346c75e90ff243c214f957a62f8eee8db04ad57820f033c65550e0d7b9e54bc4801bad519b4
SSDEEP 12288:OCu6kyp45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkg:OHty2Yz7KEMdX6keYnAcerN
TLSH
T14D751204579555D0F8BA4639EEB28150CB36BC612F1483EF94C0F62F6F7A7E1A830B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 4db65a7ac008d288083c2e0d5baa43b4db544b64b12d515d7b673cd7aeffa53a
MD5 7e9f8d9f9e2fa7794b8ce79ce40e391d
SHA1 ef3877aef1cc95c1f41a3ad3d2075efdb2e4ae53
SHA512 eddd26dcba2ba0c9c7a9cda6273b9054c9e85580a6ef0b5eef3b3fe526ef8a8a56687fea02b5fc7f4cf6a62d110ea7f4026f994bada0eff5240421b58f869b7a
SSDEEP 12288:8Pq45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkJ:sxYz7KEMdX6keYnAcerI
TLSH
T1D175230C461B59D2F80A467BFAB14540C53A7ED63B5852FB98CCF562C7BE2A24431F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0108ec87a91bb9bbb5d5e8edfae94a1b8fc6aa1bfbc9d98e16f7f922973ada18
MD5 3538140ae8e5f297d174d8f88a49521a
SHA1 2c0beb1460ce42ac2dffd975198783ac48cbc238
SHA512 361499052d13d549acdd0a666156fb5fbc705470d81851ac8aac7785f175f90d8fb473a48fdbde3607bd57c44f5ad70c64950aa2cf921fb5a1fe4a8bce6493e0
SSDEEP 24576:yC+TyQIu93VAumZr7jmYYz7KEMdX6keYnAcerk:y/TfIq+YYYPKEnSG
TLSH
T133558D1DA7E91DCAE176C675C8A34493E633B872137186CF2044C07D4A9EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 e5d1e60864aaf88c75e30afab81933c0acb95c333c5322129c89090d9804d32e
MD5 afc6637dfbfb47fd6c286fd29326c3f3
SHA1 0a07bcfeeec366d9ad2d1739b5ff128d881f4502
SHA512 67c701d34e979d6ed29b6d61eff32a4d501cbe6d7f7117dcf0ff8b4fb7a9ae00c88e1ae21cdc8dfbd1952b306acaa7359d870491476de36fa85ef67e324604ef
SSDEEP 12288:pcyrWOstaa3kcsO45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkl:sLQikZdYz7KEMdX6keYnAcerg
TLSH
T17B85F10EB7AF00A1E4ABC23DC9954101F6737475171263DF4690C77A4BAB6EABD38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c7c63e120352c25e460021b8b393648c129d3dca557d09bc360185baf3e1800e
MD5 bdb8f129844c0ca833d6bcbaf8319852
SHA1 ffead38598048e859f8798ee2bc90e6b0f7bf8e7
SHA512 ee33f3dbca76ec1b5ed3adb873fefbf1eb76b0a05b9630d88811b31e07a26d82cef5c930ad9b9a300cec4419f939535c3b036e18c116a8e7bc3d768abfefcc36
SSDEEP 49152:CpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP2YPKEnSG:/pC7b4+80GTkjYPKES
TLSH
T1C2A57D3DE2B810ADD8AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 39d7fc34be219690dee9ec6767700437c635125aaa5319189453c4eeb8ed7b4f
MD5 8f9266c6047581e08449b219bb88cabf
SHA1 664788d706eaeb9d4e134a34ae8b7b9e343c002c
SHA512 c0a1624879b14e55e1d6bd71f035be5d01b49486b5101fdf9255d676a987e445c7cb13e4027f826a25da60f3fbdaf846113045e1bd27e169c33969cc7a738781
SSDEEP 24576:8SAwJPE1IDAo+4Kt+l44135UQDYz7KEMdX6keYnAcerE:8qPCIo4Kol4/QDYPKEnSG
TLSH
T1E955AF29A7F946E5E17AC7B5D663C601FB727822133163CF9290813E0F16AE85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 cd3cfc3d784673c1c21688525336bfd5422715e328f95bcf3ca4990c6aece5a8
MD5 bc13eaab79457d810232537f579103a3
SHA1 8044099b7cde9ff965472c80c77338fbb50f0828
SHA512 052ef7c3e54abbea5ddc6960a3a5431a199891faa3bcad6d1eb061f92c35d38044015dca4fd2a91f194487a7ae4393b8e21bef668c79efc7d4c1efa216006af8
SSDEEP 24576:DjsmP0yHaqrVqHra44KDzMsrnrYz7KEMdX6keYnAcerF:DjRP0yHfVqzlAsrnrYPKEnSG
TLSH
T17145AF2EF2B910F9D4AAD136454107B5EB71B82D1F209AC70170C635AF0AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/500-82-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/500-235-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/500-56-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/500-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1748-287-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/1748-419-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/2024-35-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2024-36-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2184-13-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2184-233-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2272-444-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-455-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-445-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-446-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-449-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-450-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-448-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-447-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-442-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-451-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-443-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-452-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-441-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-438-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-453-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-454-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-456-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-435-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-457-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-459-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-462-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-439-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-461-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-466-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-465-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-440-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-437-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-464-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-468-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-467-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-463-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-436-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-460-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/2272-458-0x000002DAC80F0000-0x000002DAC8100000-memory.dmp

Download

memory/3004-273-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/3004-331-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/3004-268-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/3004-267-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/3300-323-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3300-252-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3300-426-0x0000000000750000-0x00000000007BF000-memory.dmp

Download

memory/3740-324-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3740-428-0x0000000000680000-0x00000000006EF000-memory.dmp

Download

memory/3740-430-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4144-60-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4144-66-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4144-72-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/4144-70-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4348-424-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4348-283-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4348-347-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4604-431-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4604-328-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4676-432-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4676-332-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4676-429-0x0000000000CF0000-0x0000000000D5F000-memory.dmp

Download

memory/4696-345-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4696-339-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4696-434-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4696-417-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4696-348-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4696-401-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4696-385-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4968-309-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4968-312-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4968-423-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4972-321-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4972-319-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5072-422-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5072-290-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5072-298-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5072-296-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5088-17-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5088-311-0x0000000001690000-0x00000000016FF000-memory.dmp

Download

memory/5088-25-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/5088-26-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5088-246-0x0000000001690000-0x00000000016FF000-memory.dmp

Download

memory/5088-242-0x0000000001690000-0x00000000016FF000-memory.dmp

Download

memory/5088-236-0x0000000001690000-0x00000000016FF000-memory.dmp

Download

memory/5204-80-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5204-83-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/5204-74-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5204-237-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/5224-47-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5224-45-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5224-234-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5224-39-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5344-315-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/5344-427-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/5624-262-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5624-256-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5624-327-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/5624-265-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/5732-433-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/5732-335-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/6000-280-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/6112-0-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6112-34-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/6112-8-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/6112-9-0x0000000000770000-0x00000000007D0000-memory.dmp

Download