72e90dc4d313716b63ba2e750d7da0b1914bfdc59389a604b71add77bc93782d

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_6b7f1b99f627e187443117b0f15d301a_mespinoza.exe
Size 1.6MB
Sample260517-s6292set7m
SHA256 72e90dc4d313716b63ba2e750d7da0b1914bfdc59389a604b71add77bc93782d
MD5 6b7f1b99f627e187443117b0f15d301a
SHA1 5fd257d39709860c9e89bf968f286bf9aa54f2f6
SHA512 a367fec49d2b7cd75a92b883c06018138881601c9080a9c7fb796d3c0694d7a99a3f701b86b35da64ea639a0ffdc78763b1bb1a4bdca842055715d912cf9b7dd
SSDEEP 24576:vACDtmAWUUlsqjnhMgeiCl7G0nehbGZpbD:5xGUUZDmg27RnWGj
TLSH
T15975E15B73A04CF6E9638078CA92D666E7B2FDA51F20D70F16A1836F2F234A15D2D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1936	alg.exe
3324	elevation_service.exe
4176	elevation_service.exe
4180	maintenanceservice.exe
3904	OSE.EXE
2664	DiagnosticsHub.StandardCollector.Service.exe
4072	fxssvc.exe
1948	msdtc.exe
544	PerceptionSimulationService.exe
5000	perfhost.exe
4508	locator.exe
4588	SensorDataService.exe
4152	snmptrap.exe
4996	spectrum.exe
4816	ssh-agent.exe
2796	TieringEngineService.exe
2060	AgentService.exe
3744	vds.exe
444	vssvc.exe
2844	wbengine.exe
244	WmiApSrv.exe
2304	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d64a6a19f6d6c89d.bin	alg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-17_6b7f1b99f627e187443117b0f15d301a_mespinoza.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000097feabe58ce8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc2875e58ce8dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004175c1e58ce8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000116a9ae68ce8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fda85e58ce8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000934dbae58ce8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080bb6ae68ce8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c9bc8e58ce8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1680	2026-05-17_6b7f1b99f627e187443117b0f15d301a_mespinoza.exe
Token: SeDebugPrivilege	1936	alg.exe
Token: SeDebugPrivilege	1936	alg.exe
Token: SeDebugPrivilege	1936	alg.exe
Token: SeTakeOwnershipPrivilege	3324	elevation_service.exe
Token: SeAuditPrivilege	4072	fxssvc.exe
Token: SeRestorePrivilege	2796	TieringEngineService.exe
Token: SeManageVolumePrivilege	2796	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2060	AgentService.exe
Token: SeBackupPrivilege	444	vssvc.exe
Token: SeRestorePrivilege	444	vssvc.exe
Token: SeAuditPrivilege	444	vssvc.exe
Token: SeBackupPrivilege	2844	wbengine.exe
Token: SeRestorePrivilege	2844	wbengine.exe
Token: SeSecurityPrivilege	2844	wbengine.exe
Token: 33	2304	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeDebugPrivilege	3324	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 3912	2304	SearchIndexer.exe	106
PID 2304 wrote to memory of 2340	2304	SearchIndexer.exe	107
PID 2304 wrote to memory of 1000	2304	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-17_6b7f1b99f627e187443117b0f15d301a_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_6b7f1b99f627e187443117b0f15d301a_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4176

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4180

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3904

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2324

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1948

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:544

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5000

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4508

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4588

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4152

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4996

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1712

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2796

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3744

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:444

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:244

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3912
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2892 2880 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2340
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2824 2864 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:1000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b91005a13ae5c77e853e475379e619c34f78381aa7051f6361555319d8687441
MD5 8fa0bf69b71476bc6b45ec3ba1d94238
SHA1 d5997dba951265e99271692c014df7fb652d98b4
SHA512 6cf6886236d1523a522545e51bc8b8287e4eb2f7c9bfba322d4aae019498b2618bbba80e9b0cf9e7abc2045c46434238635f9436a0475b1dc0abf4b4e96b1536
SSDEEP 49152:Cb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn5Dmg27RnWGj:k3q6sjB2D527BWG
TLSH
T160D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ae72b7163e349c7b962b0333201a182c5ceb8ef2b6ef7d44401d80e6e50c9c11
MD5 1a929e73173f58cbb0eb2f653c3fc599
SHA1 a4b9be3a45168974d2629ee3133f3c2bf13aa6cd
SHA512 6bb7e883789de1319250fdb791b3c5577b7f8f5575ea207ac82222e5a3f6b84612a9de3bcd129748395035cd48dba88af10a148c173175dd5fe02b89e01b7ee8
SSDEEP 24576:LXYfDtczA+sqjnhMgeiCl7G0nehbGZpbD:OtcLDmg27RnWGj
TLSH
T1E365F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 75ba47abd844d16066cbe26308ee277a44f7bc6aadaeb10d35631d73fde8a01d
MD5 beccc5ff1d831f0d027e87775fea3570
SHA1 c565794c1171a3b833f38bb620aec5dab88496b0
SHA512 25da5210aa9fa5ba3e8ef435dffb4f53e4a89eb8782a3b997eea9c51d533fda114c420f0d7e3d05fd179b9c9eb61e2aae7c072e19378b0909e0a79379d1e88e7
SSDEEP 24576:C0Le5ji0hmxxrM9sqjnhMgeiCl7G0nehbGZpbD:CPji0AjoDmg27RnWGj
TLSH
T197859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 087588261d0a54575b1cef2d233de4d8786a3216b810be5c9e7831e2684dda3a
MD5 dd41514fa5be3db02c41f2cf97d30aa8
SHA1 7558c3d47e2b7867317c4f25dac6d49c64e79e0a
SHA512 d19e58c2e0cb9c703df0917209a92b98c406f4194aceebc668342d14d6dbe57577b0e4f73381743e87b1b015bc41a1ceeae6d1f61475a79c280ba119507add0d
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWn6q8wyunsqjnhMgeiCl7G0nehbGZpbD:s/ezSC6vUzPveHjyEDmg27RnWGj
TLSH
T13E755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 faf32bd3d54538134be7887f45d3c46cfed36056a6647f9d3c9fe567ea52503e
MD5 38e76a86017a64fe983118cf9045dde3
SHA1 cd5cec86e9882f1a8e1476265c1c62428b7199e7
SHA512 0c1fa1de1778b70ff0a16a7907fb9048f0699f8861dfbfb92433c01339bb3073a2ca40ff071138e00e7f33fb3ddaab0a4c320cc09ff9563d37380705773d37f2
SSDEEP 24576:GVbqPb88hv/l+YisqjnhMgeiCl7G0nehbGZpbD:GVO88hXl+TDmg27RnWGj
TLSH
T18E559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4c89a076fbb84f157f3baf56c2e4cec4587846e12cf05b5b8a00e7ec63b8a981
MD5 0e74657f6dfa419f09369d77c59ccf1c
SHA1 0ac7a5bbf39efbf8e294553d4b869808bb37080a
SHA512 854a8db490226d74137d746f974d39018b86d3ba3d6cc3196b991b111c0b6f2a5d930365718890e55190031b77169620a423c785fbf4b89b438e1e262c525f6b
SSDEEP 12288:xLhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xLhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C14523BF864C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 636b52a2040f6e4369ab6d8c5469a7e904544c82455de0b15ab0beaef027b3c9
MD5 c87295dfb009d1591dddee8dad8cfacd
SHA1 be3e71801d3dd1fb1bce8b049bc9eb5e7f705435
SHA512 d943e7fa17a4284c063ced805ed198d03711ed27c59776a5996b8b6919ce2bf2c819ee5af60c5bc7c11741c0f521b3f6cfba5db7d5af3b3025ae02a8cacc1eb6
SSDEEP 12288:EeBNUbTVO86U6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:EJIU6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19D65CF7BEE28FCD2C27A8DB85791C600E77278314B6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7bbe5e2a5ddd8a02b809f0d6ead7dd1ffb934daed75e0f2779dd25c50bc999a5
MD5 764cb26620b78c46b0cad8f6282ac9ed
SHA1 37123b562b0aded6eb6ee5531c8a231a8f62dfff
SHA512 a66449a675e90ead9bc397b8d28b654d0d0c5859816643653fbbbe7959ca5d72cd4b118c58c98e2c04086ac16f9b45fa2ad724596db0fd1a47123285881c68a6
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THN:GQvGAdlCEL8c/DRNw5CrD527BWG
TLSH
T16D266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4d214b0c48ffa22faaa4d4af32c1ebff7c3026fd0838b26cf662334876e3e2c7
MD5 e1e98c103217d23dbbd1c46a491cdd65
SHA1 d20c570c0a887cb9b8c4e0eb89791f2c9df12576
SHA512 13a37479e9c950f8bd0b7b87d68790d0aae67b1b37873520eb43105322b7601e6c83bad399ea02595bef25d63e3ed68a938cea42a8df2fdb7f791f6fac18c0b1
SSDEEP 12288:mAwSfxL/2Dc3RDLLmt0LDQewsAjsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:70ewsAjssqjnhMgeiCl7G0nehbGZpbD
TLSH
T12975E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 56e1c7c4c6549f6f5da39fe4828ded87ae8d2e4396f792ed835956af529e72c1
MD5 f32271a256c05c9741cc14f0cc017503
SHA1 3485b8eea66890d93e1ae02dd79d3a261541f1f5
SHA512 87331807714e28b99a1379f6aaecb305bd43fddc7103555f97a305dfbf9ec6d2712d2e77621a7879731fc3d092f291d0a4f60a540c641f320585d279e95ae58b
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHQVQBWG:SUEtQevvqc2W1cpV2tI32XB
TLSH
T1A4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 041c941d9cabab23e24ac228c0b080e781ad31881ea7a091b7b1a1508dca229e
MD5 cb838f9edf5eb952314572ee484bce4f
SHA1 0ac97b7aac6363de4d751f0e8d2009d6a08b74bc
SHA512 cfbc77b38151f862c0a7c1af6f3bbd9601056831bf623cb4f1686baffd8df20d269b9846c53336243d57d80a1357d71df4fe2b48de06e51204cdfcc19e20050d
SSDEEP 49152:eCbRquA/m2yL5zTfFiV+XenmE3/z4Dmg27RnWGj:ToquVjnmnD527BWG
TLSH
T1E4D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 331233ca6d854a14945e7fd523fa62a93c2e564fbe6b8f4a512294b07b5a6e28
MD5 571223d11f2d820d9c004619d5e6e842
SHA1 b081ae5928bc18995f7a242f40fde936ee9fe6b4
SHA512 6ca6c11ffa2c2b32c110df3b6ec6ae50afc3d0eb026dada5f3429e63b6e4f49a36e1cf607eb7609b06cf79c9917ccc4bada11a7b51dced01d769e64f40e40f46
SSDEEP 24576:SAhGL3IFoiwtA5l7S53DsqjnhMgeiCl7G0nehbGZpbD:SAMUFoiq5XDmg27RnWGj
TLSH
T1AF359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 cf94d577bec0642d7c2e0d8ee1a4a682160e097b134c254c0512f75a5000c775
MD5 08169075e6c8301d06705ea1e56e5ae3
SHA1 0b8f09f59a9a6ef5bfa47db0f70aacba3ce3fe5e
SHA512 c0cd5825aae3ae6ea80cc0cc3fe1e530913bd664ad8330cdbc79ef47611ad7d7b346785e4eef00e1000b84679021365ca2f27415d1fd5cafe38120665286d9a5
SSDEEP 12288:rmw5HEjsChNVBFgl0WDm+CHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:qwu4OW4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13865F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 749bded6abb5700e29b45bb6c2199cc33e7a0bcfec121b0147d8d76984d8ca3d
MD5 f0b78372280d9f5cba5a83671032e23f
SHA1 941f5afa26a6cd8aa6f3cb13caac06133c38aa78
SHA512 70a65e49e852d9413623053648c44d92b76df1612492ca27d51970467f70e8e4b6f3e4256d34920ecd6b7427c5bc468a1c3bb14e9b801199c7f02d4b13b4e00a
SSDEEP 12288:yeZ1IycXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fZu1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C75512AE239820FAE163417CC5E5D609E7333C62673043CF166656AA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 79aa66fd9dea9fcefeb53174df11a732528750a28d2ba1b14ed44647afa5b602
MD5 54d320dac8520dbd4efd8e6d5abb1a7d
SHA1 78a56cfb39c25ae74172b01139c1352c520b7c72
SHA512 e6709744bb758b9f4a800979b00c885cd063a2564bf44df662985fe9cd959ba18ceaea2d1fd8837f1858e95cb4af978f3ddfed2e31b36645a27b95a5da330acb
SSDEEP 98304:0QRQyi36YOcPbLvw2gAf+PN3aD527BWG:bQyiKa/X+PNqVQBWG
TLSH
T15C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1b4cb68975ce46afd322dc714bb9c821629177ce097d64ee3057637550491599
MD5 55cdab8ab12dace7d66ad06e53b434e6
SHA1 80e12c927ebea5268f266471037942140826b969
SHA512 2a27ef424a0d27047f45af91944a53e033fddb41b135c55a5301307121f2544a286c0afe14f6415e32006ebeddec1f56f02440a588479991ec32352944bad485
SSDEEP 98304:QQRQyi36YOcPbLvw2gAf+PN3aD527BWG:HQyiKa/X+PNqVQBWG
TLSH
T1FF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 363c980cb49e5cf10dd4ee6219accace311a582bad01cdea633d541c89589ffa
MD5 6caf26ed2681dd1c43e6079e46ebdd25
SHA1 cb730247f69ae3247eee6a3b2b9c767a83d6e8af
SHA512 57ff0b72d91252a547feee00402b8ca61c0a48e277a6f05be18dbfe82313390eb5a6202fa1c59fc21aa7edb550852d9f1e4b30a2f15a27ae9e78bea75c0e65e0
SSDEEP 24576:DwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0FsqjnhMgeiCl7Ge:768Qg55nhceWu7PNU3/oDmg27RnWGj
TLSH
T1B7B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2021bcbe1314d9a568522d06e4ec90f82e6dfc082b5749bc5225875008b18e2a
MD5 a7de917d906ec728da03e841de2c955e
SHA1 58128bd81ba5d5d23336192123652a032951f525
SHA512 8a16868288e077ed117ecbf97f25e1c7633e233c1ea06b9fc115e9210df86803e4d867230f2f42625bb988f56888806a3ace19c8c6eb2f7616cd53e2531685f0
SSDEEP 98304:yy5112gYy5azzVvt69nLKnhZ1D527BWG:7LIHEWh/VQBWG
TLSH
T130167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 efcd1dab78b646fb4d1afa903b914b746a437b519a1291747250776c175b04a3
MD5 b9e9d556ca895d6f89deee7fdf5a745c
SHA1 f113f024d81b7a39795e562f140374e4c2dd4394
SHA512 1958efb54ef8b9288c1a05c4e53406fdd97e085026c705b08ba556e9776cd95c4e48a3526ca890430545667ff74f90487288de1df752b09a98c7250e394e8e44
SSDEEP 49152:nB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gliDmg27RnWGj:pu6Jmdxd2diD527BWG
TLSH
T1D0D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b34f6b00d2c879089e60d6462d9403150f3ec15cbd686de1cbe810ab0fdc4542
MD5 9821035bc1b7f5165942f4c260cb4d08
SHA1 be0973ee6afd3c4fb6911e5d6931a2f6f97cc915
SHA512 0a03a62c504f05ed44aca66eaf3c8c6bb0d74fe379920f5130ae07f36ad4d9c3f7e008a45ed47ba78d7da936ceef055b48939071f3d3d9459d55f8a57d6ecfb9
SSDEEP 49152:X1hpsNoJpF1A63U44CwH7R4xuDmg27RnWGj:XmifPWRnD527BWG
TLSH
T1A1B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 85f63e459f8f07ad715d05e6d3cfab0987cf94a2d5ce1d219eb2c587b968bd09
MD5 b08f49a8591fbc1a6b2ddeee656f314c
SHA1 c78916e6968597d5f8d4d15a8aec6d2dde6dd8e3
SHA512 70d9914343523ef3eca4bc74baf98fbb3bf765b583f633eecee314bb4ae44d17d6bf723285fd00f3a843e25b0dd1762dd7bd163ddff7ce1a82f779497cc16cf7
SSDEEP 49152:jSuZQIY0Be2KcRVtOnks6NMHqpDmg27RnWGj:B5dKii61pD527BWG
TLSH
T13FC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 87777bedbe8a165b2dd068557b3a4faa803549787316da182b7e4e3d7360a51b
MD5 a7e1facd052f29ef6a300062c03fad9e
SHA1 2f7a7a727d16cf18b654b6b27e2e91ec11a4b33d
SHA512 63b4e21da323c310fe04c313b7ffb919ae6edcd4626ef86284373ea956792fd22a9a808e402f3a382316272aca233ad610ce2eb8a592110eb2444cd241c1543a
SSDEEP 49152:ehtSn8EApI0fig3giDn0AP5wSDmg27RnWGj:/X2imphDD527BWG
TLSH
T1B095BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c63cc34189bfdf8a5ea914a55b8f712d019b5541ce4fd7374112e20007a3527c
MD5 ece047bc024d2b5ccc9d98a7550c387b
SHA1 4d779dc959efee8299b285b7b35896ceaa02bda9
SHA512 04c33847139ebef60814924cc978bfa76abfdc72caa10e6b3b6a0484131d7dc65b1c39bd798d20582da21565fdb1698bc48a059610f7397ea27639f40d41137c
SSDEEP 12288:s5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:s5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1664523BF965C41CAE52648B5C3E5F10EAC073E57E92004937A977CBDEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a0cd11ccb207411d11cf2533c89490ac62e91f67e97ecb513ea44bb39cba2c55
MD5 5eb0c08382cc90f1306cde0eade83768
SHA1 c8deb57917cc423cbc353e4ff1bddedfef133fca
SHA512 59b4f1aa57335457a0c049623963e98f2cbbd46f0dcc801577ff4e7d3bd38b5c53c5012348c12a5f2f21c81a2835cfc658f29912db880cf9cdf583b29cd8eb99
SSDEEP 12288:mgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C64523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2b1c1d23ebd487b130d519a85aa1272eca6f96d5dc5fd95531bd0832cf98d3f1
MD5 55419c6984435bc761b718254980a9fc
SHA1 c10e9cf13411703e89c8508c1916e13204c7ae9a
SHA512 0e76fa6e38c76f6654e2fe134dc38384a01e0ba731d93b74db8bb7dd9208971d7b232c3a6a237d0c2f6f137979c92ec38f17de58024efed20d9f477dbf5e6140
SSDEEP 12288:OyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OysqjnhMgeiCl7G0nehbGZpbD
TLSH
T13D4523BE965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 51561851cac371865ef55230fbb92ce9a0a891576098ebb7d59cd641159c4e93
MD5 87f21d44818531ac9751155ad46298e7
SHA1 5debe1f5f87bf2be479805b4a9acf3c3cd413a7a
SHA512 19c98aad05b6ab68ab48059bee956feab2a6a582fc19d9aec42fcacf8b4a796e5004666de423f75d03f729f4c4702d2050d2b39de24eb0ac6082645db52b9b6c
SSDEEP 12288:2VjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C545236F675C00CAD87285B4C2F5E11DE8237D96EB3005DB6B532CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7ad028fd940ac83c780d4e0caf3b14d27434121581b56524e01db7cdd4ce5c27
MD5 4b74f0b05246228b9b4d4fb1e39debbd
SHA1 0a8688c7640b7d5e85c342ede7a7bfab345928c9
SHA512 ded60d2fdbdd5906134c9aa5e1187f8d802c6c1e2b5fe976335e52b0439de439b56ef95004bfbe715f06509463383e343c209f9105280a1c943a681a0fdaa8c4
SSDEEP 12288:frXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:frsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C04523BF965C41CAE52608B5C3E5F14DAC173E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4243a1e7cda3276ce22e6a831a79e130b4466eb3146c816b8367a4658b6913f2
MD5 ba604f8aed53b5db6f60de11112da415
SHA1 9dbdc49de76dbd838fcd106c7faba5d95eb0f95d
SHA512 54bb4aba215b83326a0dcc13c046fd46ed0b84f9a281cd309e25d9979bdc93d8e55598f358e2de3f915c0668b182ea98839259618c756ffe42edcd350852ce57
SSDEEP 12288:ekXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eksqjnhMgeiCl7G0nehbGZpbD
TLSH
T17F4523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 81d500ad5b14a00ec2e109d484bfeb6be8722579d45fb768c0955ac87a43c2ab
MD5 d5aac0b00c1fbf48fb28581ef8d0df94
SHA1 63d3266d7162da656a1e26a806d4fee40ba6a2dc
SHA512 9cc039d05331f818717e37a7792ddda2fcbd40dc59c077038fd5ed140a6ece3832db4ff59b4a79b4cad35ebcedc679c711c51d41e6d1c20045f4758770c55145
SSDEEP 12288:KIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A34523BF965C41CAE52644B5C3E5F11DAC073E5BE9200483BA97BCB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 4e7eb8b931617bd1707e690beae092a9e72411972ffabb94055dc73afa311a11
MD5 f2f0c4a16849ee5d33f472274c5e9a35
SHA1 fb62b95a5ead92b6603069ac6a4ed67fb02ff776
SHA512 a8e07e471b0335fde2b01c4ca51e68c0b194201080ab4a31ca482023906cbc4cc21acf7b1eb50b3682f9d09d7da3f6a79e69847f647529729e270f4a72dcc6bf
SSDEEP 24576:EZMRzFVSOAsqjnhMgeiCl7G0nehbGZpbD:EZMRzfwDmg27RnWGj
TLSH
T14B6501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 bfce58976ee4188b167ebce9c244e116564612c83e3cd4550ea1addb22602ce5
MD5 71d476b9517f11e806bb30f72da81d23
SHA1 45c5104cee8c1f21a89544bb9f1270efe5976c74
SHA512 d03f1081decd405f66ab8b00c175caa3762986b76027371fa9c14f718eef6326541c69be78236aa353f350b9126123f73405e0ee9aef4f09d9e3f413e08da1b9
SSDEEP 12288:6lXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6lsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1954523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8b0d7df31f8d7397ad6bce6048c6e8d21ebee3a595c6dc83efad29cffe4a4bec
MD5 a1a9d4027642f8b1c79f58b93a2a06e0
SHA1 b4463b378af1a9d07eff969e5a65ff495c4b4f40
SHA512 251a103b3e4502184d12c69fc9e617f4b4f91c45ce3a99223d16a049a52cc0cdd6ac5079358639c00b4d45f4e2039971d6fe1c0a26eee0eccc35a045a07e7477
SSDEEP 12288:KRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1284523BF965C41CAE92604B5C3E5F14DAC173E5BE9200483BA9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 afdd5826d34ed83b7f8d2ad60a40876b8f3dcc89de9cb60c00353bb636e71cf6
MD5 c79bc23fd89008d05b778a4ee14fa526
SHA1 a117ca52a431237045338a40369a5c1a983c1cf2
SHA512 32e6c77755f5a813cee9aefd73d6c9a0ac5f1430dac852c58a336de1ac71730622828c161e5ba42f3e7568aab9ee8f746c6abddd55be62f016b12937a8dd0a59
SSDEEP 12288:wyPz5L8cXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BzycsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB55125B73A530F9D1368138C5A29A06F7337C3647204A9F17A516BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 25c3b5310693190db8bf461807751606e6c4f4749f5ffbfb3bdcdb144b9b1dbb
MD5 ef3275e3a45b8f03d2f17c2c148465ec
SHA1 61a9ee21eba54174d427c6a454b81b456a36ca8b
SHA512 87372daa63b5d5c6ccd03ca9d08125bc48ec0d9f04b093157cfdd4d1bb2eec88e4b78c2b32d439b374229adcd5459ec84d39c9eec45c40a0bb458d9ff35caaf8
SSDEEP 12288:mlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1684523BF965C51CAE92604B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a054bee4a4d9f0fe17e056f373ba0022185776697901e93723ab1e7e6c75a94d
MD5 6f102fa29e5e28fc47eb638118139c97
SHA1 1d50523ab94469ca1159204395b7206d10cd0385
SHA512 7ae9ac42109cb4f3e629b6582ce558b45e9a947f0cb00ef9d2a4aac5bda05201133260f4ca1103cdded0629a388d265f161f02f1fade37c4721c3ee6ff10b790
SSDEEP 12288:AlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1364523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 fe2429cd47aa0aa55e5369633055609134c6f83f9a1bab6d794bbaa9aadc0858
MD5 193d5121f6913a22f0206871367398cd
SHA1 05cbce75a0c1f35710b95e6df61dc5506955313e
SHA512 16b8ff10a7851c0e4a33f72be694e3ac4d07e603b95616aaa0a7202704a93a55faf3f0255b9d52dc65a2933670cc568b2be3f560101d8c370c2ec52a98f0a65a
SSDEEP 12288:7yPz5L8cXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2zycsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16C55125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 14c1fd5ee07adedb2258503c425d3496f765b4a717f36e24d94e70c2f6f4744b
MD5 e183af080bf978de7cff1ae311eaf551
SHA1 b7ac397cbb2b7944d77ee61e8a04a44a6e468f05
SHA512 ef1fd85d6a26532ae696879f2e4d516997081ec084e54cbedbaf2f21aba437d23c654953ec2f139bc42dd10b8e2a49876c77b94a95219b101f4dd9f364783dba
SSDEEP 24576:WTDaLl3z0zDCsqjnhMgeiCl7G0nehbGZpbD:WTuLlj7Dmg27RnWGj
TLSH
T1486501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 5490e7d93b23387770cac8f556f3e8b37172a692979f1510b8d904f1b0e864dc
MD5 927dbbb970ce63112af16ca14c82f44b
SHA1 d173cb310351256ae3bbb191c549815f21d37214
SHA512 8bf97f5762835a16d00fef91af89a1aa833aacf6390ddc1908f041b6ab54b01ee56c0cfc1ca9cf1d7aa53f7a3dace7ae68670bfdce611da9398c10784aaf858e
SSDEEP 24576:S3vd9CHKy7GZ2sqjnhMgeiCl7G0nehbGZpbD:0vd9CHKyawDmg27RnWGj
TLSH
T10675CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ffc43d55fb42d69139164b044c51614566733b09056a3fd92742a92ae116819e
MD5 504d726228d1b4d90d0cad449001d98d
SHA1 c7755f796688f1af5125244905ad184a0b6b59b1
SHA512 597eaa4fd33cbd5ed368fb7bbcf43ec61b055f0da9269eee65e4bc0a6e339d70b542212934c56c00ee85f6498bd4341c00f7982be3d34a99582b44428212a857
SSDEEP 12288:KSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB4523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4a20fe6b349829bb0acf38c7c4383f1e6e953f2088b2eff105ce903987c7e2f5
MD5 c3b5f786f641ea5d8b3361efff18eb4e
SHA1 70a1688acbfb6df61da5dca56919bdf5b40b9a68
SHA512 c7ac7071867de8ed60806e8ea1d8885b061982d068d378b2ce6a81871e580dd84c552ce3e14d19c23d363a1f7ba20b9828f89087d705922c1b0127013c35de3c
SSDEEP 12288:F8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:F8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A4523BE965C41DAE52644F5C3E9F10DAC073E5BE92004837A977CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 1dfbd475cebe08a3b959265d24bfc6206a27c44a399648b514eaaeec832ae3fa
MD5 a69980e887d84093523e8aa87829b380
SHA1 99194a4d955fc41ec5ee2bfea35b05b23cf4e5d1
SHA512 059683dec34599876e45891e1dc5d413d3e7f6b8ce9fc1f533dc0f74a888f5d4ac909b25b9819967d21d96669787e04f814c38f5704e6975c621c5e77b50c7b8
SSDEEP 12288:pPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B84523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ad2c9884932dc1c6a96a8d9fc97ebfe2a0c17488f09a6d804970125064daca73
MD5 5d24bc9a8a25b8d6c6ba574a91f165aa
SHA1 da3b72c2bc0e09972438f0f120f844a30aaa86cb
SHA512 87bbeabafb008fd57a8f76d3edc87fbd592f14b00fe9cbe2ee27744c3d375d69e224e6ddc7920ac8aeaa6f8231e77573f990f162306838d593b62808ea837321
SSDEEP 12288:ulXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ulsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1564523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 bc91a8fe65c243c2de5f2053aa6457e242445e4b2449182d5cfc4943bce9e8ad
MD5 3bd06ff207b07c9e0e8a023835b0a7ba
SHA1 6ef36d5bc9f61d3d3ea90fb8cceaed5c5dd3543a
SHA512 4e8d8952d763945ae88e5162e64c2628ba27b254592c0bdbd7071b6bc716c85451407e7b74ecccf25dc633554c555d2248488f978d36dab27d6cfdee0e3b330d
SSDEEP 12288:ubsf1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:11sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12A55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5f4f7047df701ce4f5ee0fd1de8d1fd8dc64915f5a3f97d665bd11cf3de36c95
MD5 2f5fb46d3bcd3b61deced4b4a3b5cded
SHA1 4afda48bace4b34ff425d600e0046382edbf2889
SHA512 1c6ebe141b45d8b036240ea3dcf722abe5c93e0bce07d0daa72907e724db9e95870a78b1ba69e7ef9a8d2dcbf4349b8e44a76f8e18a31de1ff767033e282f437
SSDEEP 12288:y5OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:y5OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F45237AD34C518AE97649B482EAF12D681B7E669F2004C3B94338FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ef60591b7cb0c526d6763070f5d71143d5b4c9ff23ebb3615443ee0ad54ee347
MD5 d89d639ccb896515174f423f889c057e
SHA1 72fc03c35b0fbee02ad4e0c78d894bfacf7190d5
SHA512 40bf6ac3c26ffd91a234dbd95f54c69bb9a9defc833dedec5ef342e5c187340f74fc398bbc1d3f880e350a7f63d591eb9a00d8a71ff6780747d0facb395acbc5
SSDEEP 24576:H8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCLOsqjnhMgeiCl7G0nehbGZpbD:cRZwQCyiHiQEaiPnM7Dmg27RnWGj
TLSH
T15185B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 7c02e45dbbe0b0b7004c18d6c6f8dd93abb35f2ea15e84aa8e0387de6080c31a
MD5 d5410c25c30a0ad47fbbb1cbb03f818c
SHA1 db688d24b73614f880276155d103781c6a6ed65c
SHA512 c429fa290a3a6f8f7d52fcfa7893ed0659e395dbc72abf409d02a249dbe3f70cf19ceb029337502ae2cdb5dd2a6aaee28fed0b9c468059b09f7134602ca88de3
SSDEEP 24576:5bxA1UGJOsqjnhMgeiCl7G0nehbGZpbD:5bxA1U/Dmg27RnWGj
TLSH
T11655123E62AC20E5E176957D86D2C10AD7327C26672053DF21D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 4a9138c857f5e16f54b31e7219424a397738058e58cfbb7a7320bc07cd8e1202
MD5 7b4f2c5727c4721c1d7bd57706f30494
SHA1 61a9384cda119e060b59d32df25111cdc1e800e5
SHA512 61bd9c65da4e8c829aa10d7f570540b962a5634004ce34f12a30493abd0b52674b768a7aa249d33075c3f62919a20b33c6c0abf24560b77b69f3cf343b997d20
SSDEEP 24576:sjsmP0yHaqrVqHra44KDzMsrnWOsqjnhMgeiCl7G0nehbGZpbD:sjRP0yHfVqzlAsrnFDmg27RnWGj
TLSH
T1DE45AF2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 67a0f7dc3f17d237d63cb52d7ffe11a485f452ca152641a6a4bc65dfd27d095a
MD5 5f3adae66844be0eda67e5e71d1e5c1b
SHA1 45ff5458f5d74c690cf7a0dbf8c0051f83365e22
SHA512 652c502f219fc78e164e7fe3f6b09ec00c7ac6928588c3d9c7a4d8cbdbfbb8fd9f870bb258b6e68e9969b9d4e36f975fa56a1d6184acd119557112e0ab55d547
SSDEEP 12288:wjOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wjOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C54523BE924C51CAE93649B5C3E9E11DA8073E169B2004D379A77CFEEBB54D84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 e2c8083b659f5da41a254d16c6cd83ab1eef5e6719fa3cbcb78a4241f31fc99c
MD5 093177c934fdf6f5a2cfa78f49a1f802
SHA1 d64ab467eca03276a00257d8a08d7230d5c87a62
SHA512 7460bfb414a77ddc45376f731dabf6e0d8b167967c63406fdcf4000f06ee9014275e59a0937d547fa642d4ed87dd08cbac13b905fa968cfafea3f0c84e3ebb69
SSDEEP 12288:fObfA4LWO+vAYFT9OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/npp:gbLBUT9OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T163750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 c20b37eff6b0f37383df279e1650e718c9b33c655cce2ce64cf86a6850be5bb4
MD5 60ed16e0a16115ee2c6053ba719c5259
SHA1 dc6c6b3f7085e3fbed2144f3a5aa7bd894fe6eaf
SHA512 5670fefef808cf4361e3d3ac1adb54136a64113416e2c3b3299aa6656be7b5f8f648223d2ef6c9e09399a6aa210258d1159e7f1003462dfa56f02c1741dc076b
SSDEEP 12288:U70Vm9IYNvUyBpcOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:hpYNHKOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16E65E12FA2AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d35f576189a1171ad0d6ad31e98fca496d76891f31cc16bb56bf5c0b3d2627f9
MD5 e53d45cdfbe325ea3435b4c7e67b0880
SHA1 f37f5657a672418f6e6e65d72e1514817887a940
SHA512 2a4b888a8b7ad86b0e09e32d901b66591bae67a8755367ce4f0803e45a4e3a35620618c4293f3a52ffb4dfc14afe3a7727aafb515561b6a8d37b4202c8a5cbf8
SSDEEP 24576:UnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKV:UnXoJJYH84VVS6AmEOJas+cHBjSSKHPh
TLSH
T17D65BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4ac81a477d0f2e501710ed125b466de0123620af542e9f49392813c38abd9a99
MD5 77d37ac7825e00d283f7f31df4698ea1
SHA1 5903e1383970a3c0399d75cb07f574cf9fdb0962
SHA512 6229c23da050a8630a182b749013e8f2c8d0c022a3d34272bff25e027ccecf43f1b5c32ca0b15c2c34d3d2c354ebed33301cbf52d1d4c1a45168a02be1882757
SSDEEP 24576:Tv7Xbxd9Tuycf8M/TYlSuxrr2PCUOsqjnhMgeiCl7G0nehbGZpbD:TDLL9TuJ0M/TYj2PuDmg27RnWGj
TLSH
T196858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 db13337a99d16cb8d622df9f71a6a047df5a748204b1304ba8a272baf2b939e8
MD5 e9a2856a557ab55aa50da1e7f66a7d6a
SHA1 e95d523d7c947584e0ad1397d8e6231fb540d1d3
SHA512 24db7a98d0b84899eba0ee1ead00e65039e7107971b1d3f23bc8420e815444f0ed38eedd2c3eb1d82bc3b025c99edbd5011455346d54ab3eeb50cf118b21a360
SSDEEP 24576:pegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10w9OsqjnhMgeiCl7G0nehbGZpbD:pngOJOmPOHz0Dmg27RnWGj
TLSH
T1CF55CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 9eddc0cd02a2bf91db9088997cfe21aa41179b333fdeb26e2e8c76be0788d59c
MD5 4b750e3e42d4bf448d5a59861c80610d
SHA1 60b812c41691b714e9712174b619a9dbdaa7ea1f
SHA512 a719a587ee0ce8a864a5c5356bb8018ae11369ab3b6903e3a5e990a2fb79c8011d40ccd92a23a4073eaf664211c1aae0b24044936267315e584b67b14a0c4115
SSDEEP 24576:bLJnJiTk3R3waE4JrODOsqjnhMgeiCl7G0nehbGZpbD:bLJnJK8R304lVDmg27RnWGj
TLSH
T18D75E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8ee3f55d1cd0858c266c6dc27e9ce56d4f0def8539a6472ce2c2150c741af4a7
MD5 563474df2dab85e3a036399b7d32a7bb
SHA1 caed073ab1e8c448f5190e9c2b33d2f3ac01107e
SHA512 06da504fc3d59ca3fff82b71472822b7fac48f3fa2f0693701221ddd7c2bbedba459a0856a33567836e1e1ee1b12579ebddf8cefd377feaa87918fc4c0aedc84
SSDEEP 49152:U9mqCzDScAZmlvTcFg8Ph6qDmg27RnWGj:GpD527BWG
TLSH
T17C955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 2ff16c46d452b8de3087ac429acabb6ea0946e119d4a5fe6d329f52906b8f815
MD5 a894201c22a1c7ae490e3aecd5bfa395
SHA1 873e2ed46eb629e0b593077b631fe8f147a0d065
SHA512 4d6dc663a7dbcec7fc030dc75a2ed89cc07b816da465155cd497a804540cfa136f7b5d49e42ab739229cf0f77c286be953c4c8fde64eb02e6e165dd358f8dacb
SSDEEP 24576:WlYJeXm5jUuEZsqjnhMgeiCl7G0nehbGZpbD:WlYJeXmRUuEdDmg27RnWGj
TLSH
T11A5512AE669C30E5E13A8079C2E2C508E633B876671017EF55E0D5BE9F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 23ee2d59bcc112485dd5d293c4d441e4d6c8f6f0e9b02f13947b3dd8874fe1ad
MD5 3b287dc44c156eb37a71d5adaab73cc8
SHA1 a2d37dc0201b935f124cceb006e58fc252105f0c
SHA512 a9afa51d593d72bf11516b4d3d8d1f95897b2bbd7787bf8e44bf1f5e6d9e912add586948215122ecbfa86b3e94966b6bfbe44f2c35e82d6da5e793e131af5793
SSDEEP 12288:Qmu6ky2OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Q7ty2OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DC552219639860D9EA760978C6B3C158DD367C219F2002DF65E1FA3FAF726D48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 82fc2bec4b2f65f2294ed2223e68231c304b9bad1fce2037aac3255a9817c71e
MD5 1656cc34264d54333c1f7ab4ac603984
SHA1 e5a2bd9246e4f8cb1de9f44262b4af4a1cfdbd27
SHA512 8e98adcd3adb4f491e38663ba2323bf8dfd4fe65a4c28b9527c138abe98d1f14d4e18cf2ad95ea0cc90c65caf008b4d561f9a403a4c92f3d2ed9625cd045e758
SSDEEP 12288:LP9OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:z9OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B04523BE525C61CAD93244B4C2A5E11DA8173E36AB2014E779E3FCBDEBB54D44B38C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 03e7a95c45f3ab28de126a7c7d8ec72562675306eb026fa4103d2a8d9663be73
MD5 d7c00561efc18bee4ecc1fb4a97591c8
SHA1 346329e4ad8fa7d8fcdeb9dbbed6f2c1c7d60975
SHA512 f074ef522790a9295fb71ce2ed77225ae24d096e0f41429f71dd1da43e075d496deba20db29038388f867df7e83965d7c1470fd5847c1b6c98af329bc20a65e4
SSDEEP 24576:5C+TyQIu93VAumZr7jmgOsqjnhMgeiCl7G0nehbGZpbD:5/TfIq+YjDmg27RnWGj
TLSH
T166558D2DA7F919CAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 ffc945d245d85a34fa6f7d68e5cbd7f8be9503f8a625e353754baffffca7ab50
MD5 de63a4aab58b75824c93f2f78d8e2d1d
SHA1 51e4259e564b68e94a610b5e020159a4a1ffa5d7
SHA512 d7bf31b40185054bd5665e0fa9009a957158ee680ee440d55bbe0b521477cbc3d0ce77b1a947dac09238e376de3702616604d57fa369ca4c9b4ccd034075de86
SSDEEP 12288:1cyrWOstaa3kcsROXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:ALQikZROsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB65F11FB3AE0095E0A7817CC8858116FA737835571163DF12A1CBBD5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b2722aab8bd2bad1386e5e759d66368c065ee7b17d2ecf135e411e2ef65a4c75
MD5 0c1b8fd52315bfb6518935ab879b1cce
SHA1 ca885ac8c03bb246b06acbcc98101d9c7b43dd0e
SHA512 29b6acd49cc9983fb1b81b76c3eaac75bc2e256b45a571d110ea52c6fb0d40a4dc9aae285e414b40ad4c6416929aab4e7420639dedd2e490f5ca28385005fcb2
SSDEEP 49152:QpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPlDmg27RnWm:BpC7b4+80GTkCD527BWG
TLSH
T130A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-668-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/244-412-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/244-418-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/244-434-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/444-392-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/444-669-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/444-398-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/444-425-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/544-285-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/544-423-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/544-276-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/544-282-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1680-10-0x0000000140031000-0x0000000140032000-memory.dmp

Download

memory/1680-9-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/1680-16-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/1680-15-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/1680-8-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/1680-0-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/1936-24-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1936-26-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1936-18-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1936-227-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1936-27-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1948-264-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1948-272-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/1948-270-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1948-389-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/2060-374-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2060-377-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2060-372-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2060-370-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2304-428-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2304-477-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/2304-493-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/2304-509-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/2304-670-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2304-437-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2304-435-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2340-523-0x000001F0BD480000-0x000001F0BD490000-memory.dmp

Download

memory/2340-524-0x000001F0BD480000-0x000001F0BD490000-memory.dmp

Download

memory/2340-534-0x000001F0BD480000-0x000001F0BD490000-memory.dmp

Download

memory/2340-535-0x000001F0BD480000-0x000001F0BD490000-memory.dmp

Download

memory/2340-533-0x000001F0BD480000-0x000001F0BD490000-memory.dmp

Download

memory/2340-532-0x000001F0BD480000-0x000001F0BD490000-memory.dmp

Download

memory/2340-531-0x000001F0BD480000-0x000001F0BD490000-memory.dmp

Download

memory/2340-530-0x000001F0BD480000-0x000001F0BD490000-memory.dmp

Download

memory/2340-529-0x000001F0BD480000-0x000001F0BD490000-memory.dmp

Download

memory/2340-528-0x000001F0BD480000-0x000001F0BD490000-memory.dmp

Download

memory/2340-527-0x000001F0BD480000-0x000001F0BD490000-memory.dmp

Download

memory/2340-526-0x000001F0BD480000-0x000001F0BD490000-memory.dmp

Download

memory/2340-525-0x000001F0BD480000-0x000001F0BD490000-memory.dmp

Download

memory/2340-522-0x000001F0BD480000-0x000001F0BD490000-memory.dmp

Download

memory/2340-521-0x000001F0BD480000-0x000001F0BD490000-memory.dmp

Download

memory/2340-520-0x000001F0BD480000-0x000001F0BD490000-memory.dmp

Download

memory/2340-519-0x000001F0BD480000-0x000001F0BD490000-memory.dmp

Download

memory/2664-245-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2664-358-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2664-238-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2664-242-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2796-359-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2796-518-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2796-356-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2844-408-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2844-422-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2844-402-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3324-229-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3324-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3324-38-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3324-31-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3324-32-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3744-421-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3744-381-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3744-387-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3904-76-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3904-70-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3904-231-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3904-78-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4072-256-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/4072-262-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4072-250-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/4072-249-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4072-260-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/4152-322-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4152-316-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4152-324-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4152-515-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4176-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4176-230-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4176-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4176-43-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4176-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4180-68-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4180-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4180-56-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4180-66-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4180-62-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4508-301-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4508-511-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4508-298-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/4508-292-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/4588-313-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4588-667-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4588-512-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4588-310-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4588-304-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4816-340-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4816-346-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4816-339-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4816-517-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4996-333-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4996-334-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4996-516-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4996-327-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5000-300-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5000-424-0x0000000000400000-0x00000000005D6000-memory.dmp

Download