1ad23b5520bf1f8a84c7c53cdfce8eb6f7c5236f70e71486d672105c73fa5cf1

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 14:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-19_50c7963018e2cee164d81af4243f2c8d_mespinoza.exe
Size 1.6MB
Sample260519-r5raqaft7x
SHA256 1ad23b5520bf1f8a84c7c53cdfce8eb6f7c5236f70e71486d672105c73fa5cf1
MD5 50c7963018e2cee164d81af4243f2c8d
SHA1 ce4a8b51ec8d97d0ed00e6b17c130066c9e2e89e
SHA512 d9b68d32f35e3daf3c6069f5cf092f22fc4402a7f8e46f7c07af020f60ad3ef8a292000b64fe5ba7d92ddb8b5780418e5273f312f92f1c474d50ee7a920bb33f
SSDEEP 24576:ZACDtmAWUUosqjnhMgeiCl7G0nehbGZpbD:nxGUUUDmg27RnWGj
TLSH
T19475E15B73A04CF6E9638178CA92D666E7B2FDA51F20D70F16A1836F2F234A05D2D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1032	alg.exe
5096	elevation_service.exe
5636	elevation_service.exe
5208	maintenanceservice.exe
3164	OSE.EXE
1476	DiagnosticsHub.StandardCollector.Service.exe
5288	fxssvc.exe
5496	msdtc.exe
4080	PerceptionSimulationService.exe
3212	perfhost.exe
4856	locator.exe
1564	SensorDataService.exe
2184	snmptrap.exe
1980	spectrum.exe
3424	ssh-agent.exe
5492	TieringEngineService.exe
5340	AgentService.exe
2836	vds.exe
4108	vssvc.exe
4804	wbengine.exe
5196	WmiApSrv.exe
4432	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-19_50c7963018e2cee164d81af4243f2c8d_mespinoza.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\165a25c4396076bf.bin	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164640\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164640\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c5e9d6acae8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067502d6acae8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076bebe6acae8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002484c36acae8dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000420e06acae8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f3c1a6acae8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059ae326ccae8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007122a26acae8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5096	elevation_service.exe
5096	elevation_service.exe
5096	elevation_service.exe
5096	elevation_service.exe
5096	elevation_service.exe
5096	elevation_service.exe
5096	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4724	2026-05-19_50c7963018e2cee164d81af4243f2c8d_mespinoza.exe
Token: SeDebugPrivilege	1032	alg.exe
Token: SeDebugPrivilege	1032	alg.exe
Token: SeDebugPrivilege	1032	alg.exe
Token: SeTakeOwnershipPrivilege	5096	elevation_service.exe
Token: SeAuditPrivilege	5288	fxssvc.exe
Token: SeRestorePrivilege	5492	TieringEngineService.exe
Token: SeManageVolumePrivilege	5492	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5340	AgentService.exe
Token: SeBackupPrivilege	4108	vssvc.exe
Token: SeRestorePrivilege	4108	vssvc.exe
Token: SeAuditPrivilege	4108	vssvc.exe
Token: SeBackupPrivilege	4804	wbengine.exe
Token: SeRestorePrivilege	4804	wbengine.exe
Token: SeSecurityPrivilege	4804	wbengine.exe
Token: 33	4432	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4432	SearchIndexer.exe
Token: SeDebugPrivilege	5096	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 5724	4432	SearchIndexer.exe	104
PID 4432 wrote to memory of 5572	4432	SearchIndexer.exe	105
PID 4432 wrote to memory of 3932	4432	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-19_50c7963018e2cee164d81af4243f2c8d_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-19_50c7963018e2cee164d81af4243f2c8d_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5636

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5208

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3164

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2144

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5288

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5496

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4080

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3212

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4856

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1564

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2184

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1980

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5784

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5492

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5340

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2836

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4804

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5196

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5724
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2952 2924 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5572
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2972 2960 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0c2212283f784ef431b5ab4f9d13b79c91d880a1a3446b52be796fa93cc2a393
MD5 7a03fb565cf2812f2ae3f8c1e3cc7c45
SHA1 bd8c81d86446accc355b3b8cf8de0b82cfe9304f
SHA512 b20ec79f2c448b4b1f87db6c6a3a57db49a2d423104829dc60b32b7517c33e66ce712ab04b2d26efe5b7f817fdba91bc0bc33daca2d80f61faf1550eb9c2ac63
SSDEEP 49152:Rb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnMDmg27RnWGj:X3q6sjBLD527BWG
TLSH
T194D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 bc79c81487f157f3c61d04040831e1d5ce9949baf89422a1c2e42466e18eb8a3
MD5 322bf68b9e2f119f3b695b6e704d0c63
SHA1 f0c8862790017622a30cd530d1c7b761b98b8f7f
SHA512 b56cb9f4110714928e1f26fbffd777de32709a28fad4e555995b12ea358ba0aced0d1186647dafcede2fcdc22ce6358e48d6bdc4ef38968f4a4d5319abfd0d70
SSDEEP 24576:zXYfDtczAassqjnhMgeiCl7G0nehbGZpbD:WtcWDmg27RnWGj
TLSH
T10765F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 38e9f2e2f6a339290e31de622c982c640a0e075237b2719b368d6e7f877722d2
MD5 7ede0b780f9286cb85b3fc7c63560221
SHA1 baa03efcb50b93595ec503f8858a7e48ee1ce211
SHA512 b3d13c3f15056b7c38abb41dfaa2f99da45700be5c232b5bfbfb218507ab30a9b3bd8cd0b9ad8587085c40dace22c4ac5e971d7dc49756dff65b0d8f1ca4bf20
SSDEEP 24576:w0Le5ji0hmxxrMrssqjnhMgeiCl7G0nehbGZpbD:wPji0AjNDmg27RnWGj
TLSH
T1AF859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2effc72c69f83c8dc76aa376bd374625018e97774bd18359f54e4998126aa48d
MD5 0e41c48e49d75ea4421c41884fd89949
SHA1 073ae2d494bb95d15ef1693c23bbfb00a4565017
SHA512 2f3d37fead0b624d6b9bd26c2c9240be6b6122c9827e893985c419b5072cfef78431ddb93138ff244e8205123f522c9bcf24baac2b66941190c4b2e30a48ad56
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWn6q8wyuNssqjnhMgeiCl7G0nehbGZpbD:3/ezSC6vUzPveHjyZDmg27RnWGj
TLSH
T191755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 44bf954550eaef9ee95b04e464f4232357b7cd246c46f77ab3af354fd48c5bb9
MD5 a75d86ea682c8f38e377e885585de591
SHA1 1f55b2cf7063d1b292191b7518b1c9718f546557
SHA512 014757d4b3aa65c903112948486bd4cef7ce06d2045818842114290c239ce78524e10038762d54184a6daf2e8bae2f33f7c33d99036c718aae8cb92abdd9ad8c
SSDEEP 24576:7VbqPb88hv/l+YGssqjnhMgeiCl7G0nehbGZpbD:7VO88hXl+ODmg27RnWGj
TLSH
T122559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 483f1fd179bb1e86f859b9e0de79a3181f5777b5a8396814aa06b9f734effdc2
MD5 07910031a67417ec366555e475aed84e
SHA1 03043234b10dad69040d4ae003b53c6171fff53f
SHA512 6e9382e1042d76b4d24c54aa26436c0b2f6eebbbc32e64b13fedb9f42f76be35e61e547be3064e65dbceede20d39c449843a10f270689eec0415e29b02050c5f
SSDEEP 12288:uLHsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uLHssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1854523BF864C50CAEB7608B5C3E9F51EAC137E56982008536A637DFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f532017e85e82c40ae336f959154fe5b77b964eefc2e6f5ff4d345405a873c9f
MD5 680323309f85be276af46134abb096c0
SHA1 4502413713516bd7203184333ba907b8a9970d88
SHA512 91c7f7fa07a10aa1053b28ffe56eae4c4983bf1600d899e01e0144ebee44856d8a9005e939da1a5d69b26c8ecd81c4e0b136889dbd5d2179a930605df0ea1efc
SSDEEP 12288:ReBNUbTVO86UOsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:RJIUOssqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D65CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d56fcf05732e6de1bd06f772a56ecda169e0ab745c951905b94cd581f9c759bc
MD5 d39f3fd4cbf9ddfa9a2e86bbf72b2121
SHA1 367a76bfa34c47c3614e6392c996ccd9048a21e9
SHA512 9c25279c442df1e918e4cac25edca281a208677552b33b5f11cdf15e8aa74c3807a0b42f57942a64de2d73d7d4e8b7d1cf02a2af5ac953940e5c1b5394c4d823
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THi:NQvGAdlCEL8c/DRNw5C2D527BWG
TLSH
T1E6266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f9ea0749489e7ff2377f2f3dda19b7d9912c2e057ddb53d7faf1ef8827e18f63
MD5 a73125c1ff3067efb84ef058c81c21ce
SHA1 5aa462a4e5e2da228303d6d823d099015b298385
SHA512 bb8d2946f0fed177169e762e2aa897f35f40985124bd9bc5e075ecc4f9b0539f3df0da1ad5668f48c752e39b8700617a709b52a9d376992d752d92409dc1c580
SSDEEP 24576:M0ewsAjgssqjnhMgeiCl7G0nehbGZpbD:Rlj9Dmg27RnWGj
TLSH
T12375E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 616016e3114ffec5a10360689b1dbb344cde055a20c385d0125f27705817091b
MD5 d24cce2b605df9f53caf87bfcd8e78a7
SHA1 a9bcf8f4fdbcb1aba041c9f4245db44101b30083
SHA512 baa743a45f8727a0242cff24a23b41e8b049da6910d07cc45bf952ff149bcc2a1f50b3910e8c9f7bb3c4a937dd955f2e44366615990bd2c23a06f415c382e360
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHlVQBWG:/UEtQevvqc2W1cpV2tI32wB
TLSH
T179474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ca31c114b69843b47553de70edf0906a299641473b3abc79683f322b8e66f2be
MD5 86d315a0a1cf8d27107607463f3ff79a
SHA1 a607ab4151b0e07fb8aed0b03fb5e2549c035740
SHA512 44a1b74aa9730d6820b2dad4b8c8c11aa91596d19e5c0869511497c85d5afe1f51406c13232dd7f3ad2544cb73aea6243289a3e20d5a98ea5ddf9b8144f39859
SSDEEP 49152:4CbRquA/m2yL5zTfFiV+XenmE3/zdDmg27RnWGj:xoquVjnmyD527BWG
TLSH
T159D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c4da8ff7e8e97d0362bed2f99a23ed3bc837d141d9cbbdfeb572b6cbf45c9730
MD5 99425033d21a86d6ffae07f3fe48820f
SHA1 4af48878899ec33ad4030dff14d71a1be332f52b
SHA512 89b3f76f500e7c9f8166b0ad9652d321848da09f0aeba8f96ad35d1c5ddbf50c9c4b62c0b626475af9fbcbded062d539478253b1a38b4c105693a2966c089482
SSDEEP 24576:1AhGL3IFoiwtA5l7S53RssqjnhMgeiCl7G0nehbGZpbD:1AMUFoiq5iDmg27RnWGj
TLSH
T197359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 ab633c2eca9966eda7ffeb661474e46371e64f008df32f1b46d641d059e989a4
MD5 e5da759b0a4a92920de7bddc6c4bf9d5
SHA1 aee9dafcd3b49e9e14172a836241e82bb5e07e3d
SHA512 a31b372b2febd66f0f1ae7b641368002a2b45b45a9ba08930a14e95edbd6b00729202687eb340692e9ba332a78bd83439f509cf3c6dd6f403f737fbc6c554156
SSDEEP 12288:5mw5HEjsChNVBFgl0WDm+CtsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83i:Uwu4OWkssqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F65F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4fa51a4df155fc21bdd9cb288f39af49332190bcfa5fcfcfda6dedafc638589b
MD5 e76091459b8e99392cc1f4cb768091c0
SHA1 ae4f71af28fc087f937fa85a43939b32eeb8f24e
SHA512 d552f2a61f69eb0f616ce08e38b45872585eedeb505d452995875fab029678fb453e33e26f5434e15c00538ecb6df3d5a01ff7525e0e2e69b766a2c68b8f7b75
SSDEEP 12288:yeZ1IyQsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fZuTssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE5512AE239820FAE163417CC5E5D609E7337C62673003CF166656AA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 49d9a01584f831dd1b27e89d09c76d4f8a85adf7b95b74a1c6e16f901e6cf1db
MD5 cfb9a8f82883c856cc5f97bd003ad696
SHA1 76974cae354c2ef6989a540824861aa9248bb75a
SHA512 82e133efa45150586fed07f0169e9a34811f12ed27bb157d22b9235e97675c2bb3443d1ebd3de4f655c3e35e10c85177d5b374396e715514286dd00a6160a45d
SSDEEP 98304:vQRQyi36YOcPbLvw2gAf+PN3/D527BWG:eQyiKa/X+PNPVQBWG
TLSH
T19A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 58e7778808bb1b12f42abd8d7500ae4868eb5622743568c245277d9f7836505d
MD5 0a6ab36fd9e5eb6f11775ac119935e45
SHA1 98ce9f1abc5c781cf8d717d1716d78dea5384846
SHA512 4fed584638bbf81658f61ee39aff3c0236edae6711baa74aebcd011fe37aa399d3eb6ab7a5405f5cba6888c9f8fd9ef4dbc929a2c378f070cf4e52a28b47c453
SSDEEP 98304:mQRQyi36YOcPbLvw2gAf+PN3/D527BWG:NQyiKa/X+PNPVQBWG
TLSH
T104667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b6df8fb5f4e60e5bf0698dda374bd2063d4e856a2ce1e183bcdf7685c6cc13a7
MD5 495dd7ab83d81f45013e4895e8afc783
SHA1 c52aa53b265cf8dbdb2dc9b8953a60f223ef5d90
SHA512 c5a2105f038def7ffc752453e0931a8b38fc098519b447a1bdbc9f5dc39cdb25381803a82ee3b2df3dc96afb05f721633c48b34f202c726a1734eda22278beae
SSDEEP 24576:ywvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0jssqjnhMgeiCl7j:M68Qg55nhceWu7PNU3/NDmg27RnWGj
TLSH
T12CB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 97ac639a4e32dbb7e26974afe5bb44fa19f5986ec0590fafedb92b5b03c28cd1
MD5 89ab527f541f3bc62769db3aec60af43
SHA1 b062486285cffb7f1d0cd688cb29d942f6c4a909
SHA512 6d94c3d9c5c3948c6fe70022fe2582c17d40bca1f4fcf0fed7a3d00098d9d5488c2bd3574a8e2147aa5b5503a1110cb2e5631b6673a8cafc96ec1dc50ff9fcae
SSDEEP 98304:1y5112gYy5azzVvt69nLKnhZ4D527BWG:YLIHEWhaVQBWG
TLSH
T1E1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fe7f3a788dd9d0a9c0587447a88375ccbab041ce09c4150c4ae747f98c972bc2
MD5 20ca6bebe54e1ebab539aca90f59b60f
SHA1 5e1f7e36d456fd094ab7024c652a9ba72ee0b553
SHA512 dd938c48c1f3e6b79346abd43f03156c2c86ccb5056358388756b761a09c73a63aa5b680570045720176f9b20512b32fc67903ebe1bec9170f794699bcc0b92f
SSDEEP 49152:2B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl3Dmg27RnWGj:Eu6Jmdxd2d3D527BWG
TLSH
T169D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 92dc48e2263d05786b7c2d6b30bbf839a150beb412a2bebbecb241416b37c599
MD5 eadede3b62a778715c140a754b0ef715
SHA1 354ca9c90a98a69e08964f7f3d9bbacb92f2cc46
SHA512 ad63aec53379647dfc21d2f09932eb4c577c1d78bccb53f485fff4bb712e12a64e26e1e7b643bcf5645bc978567afb23d3e541f2c95e164715fcbfb3d3754f52
SSDEEP 49152:n1hpsNoJpF1A63U44CwH7R4xzDmg27RnWGj:nmifPWRyD527BWG
TLSH
T14FB5BE13F2D800E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 221249455e3762ae79234bf7b5e75df7b0ed9f1b91bbdfb47f9d3b91f9b17502
MD5 76d8f6b4a2d7cf6159d2041aaf38ff75
SHA1 a534845aadd9efd7a8e7464a5a6aa01d530da39b
SHA512 26777eca4032e5735610ceb5c9905d2a30fa35a4e471b25281e863d2a06b553edee37a778f239a2ae674c41e7b5eed06aa861e65414e8279767845d85d565459
SSDEEP 49152:FSuZQIY0Be2KcRVtOnks6NMHq8Dmg27RnWGj:L5dKii618D527BWG
TLSH
T133C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6f667b08ca5b5ae04a277d6beead7a9adb70a5b12a612438fe71de07621a75ea
MD5 691621638e5c1dbdedddc250acb4fd2f
SHA1 567ca410150c21087d589977f9fe1246f1190e4f
SHA512 75a59832d051d8182a45a84e26df43ba9cd82caae5d46d59063796bb40bad800551fdeded2bf438f41ab97bda3c237dba4e601474e4a0d5daaea14f6aba7980e
SSDEEP 49152:NhtSn8EApI0fig3giDn0AP5wnDmg27RnWGj:cX2imph+D527BWG
TLSH
T17595BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 10246ee37be219a2e765ca513be71a39cde1176dd4479c461997e2884651b5a2
MD5 4dfd0c32d59879ab1a4315483cb3e750
SHA1 b9f1dc18eac100531625f9daca08089a74c1ebdf
SHA512 a3d5907b50753d2755efa3ef6286a7ea1f8c2c2242a5e03e7de83d6734876db8ccab1058096cc4e2ae9d36349ee37bdd8cfc82b0d51be2095d2c8170ea2ab2d7
SSDEEP 12288:PPsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PPssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1274523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A977CBEFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 25986c00dbfe950d1f8a91f940b724466cd8446079bba7fcd2053a42cb2ff9ac
MD5 701576b0514a6a87d31e3bbd90afdac3
SHA1 3d98d1667fce9dfc5f990cb4ae1604d1cf5beafe
SHA512 d44b1ffc063655f478949c43e6222870c7ff361909824df22c5b6c79554508e4c8b65450635d18603825a640f206650fa045eab38ae680f2378ebb0247fa04a3
SSDEEP 12288:ccsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ccssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A24523BF965C41CAE52648B5C3E5F10DAC073E5BE92004837AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0ceced3c4443fc66e9c8af48048a30cfd14806bc911263d36ee67071c5c1a7cb
MD5 d68b1e24e10b80d3295aeace63839ccc
SHA1 69832dcc7bffa7538eae27cfaea903aa57bb85be
SHA512 10cbb68d82d212be8b65e9c8ec032a0b43063ba6ee09e69d5ebfcf30275c4edb3c29c96a135b4637193458e6e3e2b01d9b725c25dd48f7480d9d734a779cbf06
SSDEEP 12288:WWsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WWssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F04523BE965C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d727266cc75949940e9081645736b0b1eb11f6f6eb76d356e9dc6ed8efadc730
MD5 c0f533f6daeee4d0505731d9ae10a5f2
SHA1 a2c51c51c39da69e146e6feac6e06fcb04521957
SHA512 40908b831fedd754b6fe8cbce498b9ad49388a1a17446aa02c487b04357aa643723cc319a15a04f9d1d6cfd329e9ab0352c9c93dbf43c6964446805e3193387d
SSDEEP 12288:2VxsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T19545237B675C00CAD83685B4C2F5E11DE8237D96EB3005DB6B532CAD9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0a02fc431e8b0c8910dcd8a1e40e573397ba2c8025bb86c3cb301f40fa3798f3
MD5 ebec5668805656048d510507f077c294
SHA1 ea8fd7d3d3613aa853b508d6f27ae49584e1682e
SHA512 66b20ba833c9e74cd5b993bc97e418cd168d7ba9c4ffeb91b306b010e6e6a5f05dc35868323a29db73e6f88fd76fde27354374c0abeff1fd185112f59a30c2ab
SSDEEP 12288:7JsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7JssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1564523BF965C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14684B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 aea1cc65871d56e2b61c4dc72f0c37af7f657fd0a43a39e3027d913fb2be6356
MD5 c0771cd751b5428b759bdbdec3e89436
SHA1 76b7a907fe7fd64c52e3778739e7d19feca2e6e9
SHA512 3ea2978b30e9ba5bef77a568abfdb2d92e8ad679e725c55b525b5f7c855a59094c7418a0b855b14e9d98c767e299d7cf9ceeca9f3f912df12426a8758e23ba39
SSDEEP 12288:FIsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FIssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D24523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8f04a642eaaf59c9143d46eb19dad45b3b885384152ab554d0b90577f3bffa05
MD5 48ff945bf41351513d309a940d648a41
SHA1 74e19f868ec828fff232a939c733151adc7cc38c
SHA512 f6be6d5c4aec433e72a2007434da2c9c68972130b713a606d3d54a80b786d5853da0aee6dfce2c474c7cdee0c42492e1966d8c731c33afef95775cff0141cb5e
SSDEEP 12288:i0sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i0ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1884523BF965C41CAE52644B5C3E5F11DAC073E5BE92004837A67BCB9FBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f4d0ca247d134c9683e275fa9e6924ab5e0eeac87c580bb563809e837e0a41d6
MD5 0918fb10f3c38f3958d0743e7be393d6
SHA1 b297c164b192cc19c693a2c8e166782dec234057
SHA512 7fab03f59874a9400f093c75cc508c13117b00966f00b3d084ec3d7b4355e43a7860b064a587417c3d703f57e5859f22b6fb789bf5270250a76f89de287def36
SSDEEP 24576:1ZMRzFVSO8ssqjnhMgeiCl7G0nehbGZpbD:1ZMRzfFDmg27RnWGj
TLSH
T1486501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4684f3582f06dc8a1a008f331b9af9627fdfb62792518b32f270d453536f89a8
MD5 14dbdb2eef45b8e6f0eb6570e2ed9ce8
SHA1 0bb9005fdca6bd14fec842433ca693d8d57ab09d
SHA512 47c4a08ee81c05c2f138e9fbf283a5fe27924e7b82a987f06e9aba389575c1750ea0bcfb32469b578e1fbcbcf95f91c8327c2796d1afd9b4e4737746386a4a26
SSDEEP 12288:FDsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FDssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD4523BF965C51CAE62608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ea2302694db4ea54348247c7ab5de593caedd9394550161c901c1f3517d318e3
MD5 1e4d8efc06727a04b2ccc7c91bd70e36
SHA1 925f5b398bff4743f06f2d07b6ca99324372368d
SHA512 1bfa39957b8b690e898bd7e3f40b8402e0a76e40dd8729104884ab3a0f6471bacc680cedaa84bfcf7da865c7643e445af9df77fcd8edf659ccbe0363adeda271
SSDEEP 12288:D3sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:D3ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1004523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A6B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 7a92e2eae9f2e5709f8d79b44aca903984c4ac35764d5ea36deb253fb856c59e
MD5 e42e74b5df301207ab43b772f04a918b
SHA1 aaeb77aa00ad6b47791581942ae7b2ae893cc8a3
SHA512 910779f0da435b10c5700eb4d95382d16b480a68477ea50aecd3e9e2198e5ea871adb739eb9ca563e0eb6f74b578274b6c522b328ef6c161b5762ca400ae6713
SSDEEP 12288:JyPz5L8QsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ozyQssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D955125B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5d514024ea02a14ded813988c31c6dd5ee42db0a9175b63012668430b2a8dcc9
MD5 b0c873e7e5191412ee778a3a99914e9f
SHA1 f46f0a216fc5af9de64a4d36b95a7f3bbbdc90cf
SHA512 7a6f5dda80f48a7849b02d72c835ad3f3089f51116296e4ef8ea41a59237fabaa3e61a9baa6c47103159a8a909ef9a5d4f1617bf2a90166cd849529f94f6e977
SSDEEP 12288:IDsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IDssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1814523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 8ac6aada1613f003ac197d3dc8a430d4f6c355555a981b4efdc98732eb807bff
MD5 4fb00fe59477ac0b7f15bbb7959e802b
SHA1 c18b20fe332114ef3c0708cd7fa160b62bc73f34
SHA512 bdb7422904ddce49cf633b2d9c6c27d54aabf5e184b5854d89a11ea5f692c91aa256e23aeaa1c15f28e3c0fab0e17750e3aac8e61e0e90e8f7ce534355f6eb6f
SSDEEP 12288:VDsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VDssqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D4523BFA65C51CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 75154d20183394029a1c1093e8c5a6553163c5d3619a5b7ab2d2247027509a49
MD5 90cc5cf9dd848fd6584fce915f1856a8
SHA1 0c70a2d29d9d6002af664c76564a80ed5b609df6
SHA512 8ebbf35ae95ca0c8438d1efdf832eed135ffca43b11576987c7ad7562b9528984b794bd41bebe58e31247e2e732553c1b1b65bbd7b268a3406a83ea1e940d9ed
SSDEEP 12288:dyPz5L8QsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UzyQssqjnhMgeiCl7G0nehbGZpbD
TLSH
T15F55125B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 018a14ec78e4cd50e6034e0f5f7adb2bfa795b68acbce15c53a97c017d0163f2
MD5 a0185fa588302220658d29b82e3f864a
SHA1 7645a5d74d0c51d07e112d2b962ae670c114ff3a
SHA512 8144225274215a648f3d05f3909489b974c1509cb842b63f3a115a7ca3abe8bd10b2531dd52eb9cb806973b37dfe47ad8f1bb1b733bb0bbe7aee8a2170e9cd58
SSDEEP 24576:GTDaLl3z0zDmssqjnhMgeiCl7G0nehbGZpbD:GTuLljGDmg27RnWGj
TLSH
T1766501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 c3b6484d8a561338ac9863f4228fce1689c4666ace83b658c86d21cd4d3294e3
MD5 674c759f57505e581cf220e318ff1bbd
SHA1 50aee5c0315ef1237d9622c74afeaea0d3193675
SHA512 ec2f0bb186572c6f2dbf81e3c1d549712406c44153659c27a166da901f3f30cd0f0817865cb01a3d43288d5aaff2ad1b72355990fa872622f71a9653a0dd6b76
SSDEEP 24576:13vd9CHKy7GZissqjnhMgeiCl7G0nehbGZpbD:Vvd9CHKyaFDmg27RnWGj
TLSH
T1CB75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 80437d03b45fb3b1ad34b663be2dae87e1f9f30b18e696601c6ee0065b2894d9
MD5 b75ea69c846a014a0f92cb3b680e3f4a
SHA1 1dbfb495d49c711af77980460e31c967ab6544f6
SHA512 4a3512ecc1a24a984e5da6e8c720eec557cb1efa2743f0d8fd14c99a9a9df0720961c81c7702ab91744f2bd39f60d58aaea25b5cff31e9756bbaa5433e63f911
SSDEEP 12288:s2sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:s2ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1944523BF965C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5baf0a153de9880953291833cefd6ac12742cb680d233b8e06b5158bc3be2e68
MD5 9736b3da1d723843aa7e1c789bbaa715
SHA1 27dda367c0147e48362dbdf2d12e462b064862d8
SHA512 cf370e078f949d0bc7e680294298eb93142489a8f41e390e93d80510d91215dceb069884f22b7d42b1f4eb8428758568602ac727bfbb051e33b7556178f19d56
SSDEEP 12288:AwsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AwssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB4523BE965C41CBE52644F5C3E9E10DAC073E5BE92004937A977CBAEBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 487c6ebd6cb508c504201550e66d44c14100b9756efd7c3d90e7b38006b361f8
MD5 5f94a6fdbe37a8dc40e26d67ca2e8619
SHA1 5e823eb54ff2814223d065d250541b71b030b97f
SHA512 ebc9f4c4dfd95235717f6f2f2bf1047770f40ed37ff8cb482d30c4d2d6b70660fd96a6b53a658fe42d8afe31e1bf423e90fc54c018a96511f5d60660acce7a73
SSDEEP 12288:PFsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PFssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1504523BF965C41CAE52608B5C3E5F14DAC073E5BE92004837A977CBDFBB28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a70866d0f1950911dda82a84e950224fa44162d5866e839ad51d33ef7301be7b
MD5 283a455451faf32e386e027552bcc8e7
SHA1 87db62105f1fc38877d1fd6676b88e5fd64a8013
SHA512 efd3015642046e93b5ae5187cbc6996da9b09080a87d7cdbdbda46c898c7d35b4694edbe515673034ae9b1b53843be352179645f46fa56a1203f655b81eab7b8
SSDEEP 12288:vDsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vDssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1494523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f2ba130e18cf6a42f95924ff46cfe7bcda1ca09c8c84673ff83aaa585ba12a01
MD5 48225422e06e0eb55b6df9b131c603a5
SHA1 4cfa1fd901dd6c37c9c223513524f1040ffa5751
SHA512 2ee070b4d51d3fdc0bc79c8809a210275e3bef395c3df845c6f39ed6b75d66153f35b690191b8ee695e381a46f39f76ed3938ecc97904c903a00f3536a837559
SSDEEP 12288:5bsfTsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UTssqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 65ca2ab06c7806a1e3a92c49753053b4ed1a04e90ffcfd183b38983daf147eb1
MD5 2405aa13af5ecc26d7e1dba417152581
SHA1 43712ab7eca07418e7956a9fb6e0ebc3866d137b
SHA512 5a1813ccbb8f18221a310deed3e94284dafcbb7d0f1f20ede4526f9876db9cddd6535759345b14871d474f47181a0294d6bcbe8d36b022a38673e97f35a14ad0
SSDEEP 12288:lCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14F45237AD34C518AE97649B482EAF12D681B7E6A9F1004C3B94338FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 b7ead94abcf8329da639e823a6faa00d64d47cf1bfd410f13c638555adeeb7d2
MD5 94a5d0c48704ae5f541e4a70406069fd
SHA1 40cfcbf1e85a0ad5ebb453a8a7139d4c678e0802
SHA512 24b50defdb5959f13b22adc7ba9ef3893d9dc68ccda228501272b46073650b27882949fbb1dbc3bc237ae88f1cd8abefba6b242a59132403c4b250248353e540
SSDEEP 24576:a8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCUsqjnhMgeiCl7G0nehbGZpbD:rRZwQCyiHiQEaiPnMtDmg27RnWGj
TLSH
T13185B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 39da955b49fcddceb24a05a4a32ff1eb3a7a6b4bfd4f8f4d11505a9349e55bba
MD5 2580db15149cba4098594e9140cc91d6
SHA1 2787a1504f2e0a32c11dfcd94249f088fd15909a
SHA512 480c783740ae4ec45a4266897fdae094fa61ffd3292f6a150a35b150b14b9de0bfd2bb46e559ffacce4d516778ec8f7900c21bfd27c94dbf39fe1740d5323156
SSDEEP 12288:pbxA1U7KSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pbxA1UGSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13655123E62AC10E5E176957D86D2C10AD7327C26672053DF21D282BE5F37EE84E39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 40333e8b1eb5d9e375887ea37d5f550fc18f06da9c997c3553b31e8d2803723f
MD5 741902e46b0342f88e743818ae1ef684
SHA1 f24618fe9083c962f12d62339ab0e653dc085c91
SHA512 723fd0be0014bcc6bc7747d385eff9f2c5aa081d11779c31f2f222cbd319ee273c3981c4285a384339a49b3364f652740c9f8e1563c11e91dbe4b19d3a56c3b4
SSDEEP 24576:SjsmP0yHaqrVqHra44KDzMsrn/sqjnhMgeiCl7G0nehbGZpbD:SjRP0yHfVqzlAsrnjDmg27RnWGj
TLSH
T16045AF2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 72bc891d7673237d6adc85afad475a8a0ef181e6a568b8898472abe7d60bf709
MD5 44a8f0a38604945faccc7364cfb8c720
SHA1 be417931de16918d66f379cff89e620dfbcef8ff
SHA512 5bdb5259bd69a56ae626dfbc3685f8068b6e9d294784e828958968363edb021112bcd34882c46299a12a325f4868b4c6835ad1d367d390edd9b972c443c2b9df
SSDEEP 12288:58Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:58sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF4523BE924C51CAE93649B5C3E5E11DA8073E269B2004D379577CFEE7B54E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 96459cd05331278f3923c3b2b7b860c8e5131aea33e1ad10618e3216663240f2
MD5 d089a30214b4ebcc14d5cb02aa71e327
SHA1 c1b184e1b5445079782ebd6240ecabec10c54b97
SHA512 88c4e0f788fc79363197106390266e389a73a254ed001b537dab971026d7f293d4d4b6cdfed7dca39ed3fd9f858b49038069b93fbcc3c20cc37c70544e316929
SSDEEP 12288:ZObfA4LWO+vAYFTWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:ObLBUTWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T133750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 2b8100986f3aec6a0ebfa68d18b0c5bd8ebaff509e52a10924d810cb05a76f3a
MD5 c07ca5b7a53321f9c41ecfb9f5c90ad5
SHA1 ec319f33ce76e6bed91269e904587a44ce227cd2
SHA512 ce2458889e809e83164446b2e038199ba3b57dee53a43328e9fde361fc0b13c3a378c19c1480cb3fe76a8dbd7be49e2e2ffacff0f5a6e12774c0f46509f25219
SSDEEP 12288:D70Vm9IYNvUyBp9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:spYNHDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12165E12FA2AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f0d5fc4400ca4e754b2201691a17b72b6b6f44098243d1c33d42602b0495bf6c
MD5 7541e5e988661944c65737865baa0da9
SHA1 5e268b430084279b96eeee6f840760278d08eda9
SHA512 8e19925bd8b69e39d3d3ec42f12a921bf860fbf929760b9aefc5c402e129c4aa313ab1e4848e300f06ee9c9eed0bd5f2126498adfe11ac78331d9931d7fb5fca
SSDEEP 24576:gnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK/:gnXoJJYH84VVS6AmEOJas+cHBjSSKHPn
TLSH
T11765BF6EA2BC04D8D5BBD17DC5C29506F5B278621331C6CF026182BA7F27AF45E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 87f0d0a157b5ee1931ee2c0114378f3e648de907589f1081aaeb359e5ccd2f30
MD5 017fa7b1df45b36e3e4ca0ac5870418e
SHA1 d5b9d6bb8ba78b996acbce8f65394dba610dd60f
SHA512 9ad8f88e3fe9e5a0d67d5326dad8f5681fb6462107c16c97680e6fcf9b42f4074d58b3017cb518ca6fab216d09bd9e44afb4b889051b1d02a71acc5c20e23083
SSDEEP 24576:Pv7Xbxd9Tuycf8M/TYlSuxrr2PCFsqjnhMgeiCl7G0nehbGZpbD:PDLL9TuJ0M/TYj2PIDmg27RnWGj
TLSH
T13C858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 50299732c9671a35e00fd02b316582d34b6fee45209ca9e8934a4ca1cef9a908
MD5 2258fcc8711c729935734e1c9b994bcd
SHA1 ee7ae3a4fd148d256fce077cc5fbf691d2793185
SHA512 bd79ee28c17a38c27bdf5409dfc8f09aeb331f5fa951441e336f9fe7e1981c5fd20d55159df5c43c6d5e15526bd181cfbcfe6ef0fb4c04a5f33fa952f5fb5add
SSDEEP 24576:cegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wWsqjnhMgeiCl7G0nehbGZpbD:cngOJOmPOHzaDmg27RnWGj
TLSH
T1CC55CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 ec8523dc7f2663edd2efd6c5a9924f15f6be0b46614f3a3abe85137ec82e34c8
MD5 f4060052e27b37946ed6d815ec7d89ee
SHA1 a9e070dc8d468b1ce17b57d3850a0e336314b0e8
SHA512 2ef96b3919d57b323ee3dffa995f9a4c00868bd4d87779dbbf677b9b8fcd5637e383751f4d9834a2302501afefce528bdbb130c954bebccc28e77309b7a84cbc
SSDEEP 24576:oLJnJiTk3R3waE4JrOcsqjnhMgeiCl7G0nehbGZpbD:oLJnJK8R304lTDmg27RnWGj
TLSH
T14075E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b6e8c925ab4b9321c78df7d42327b28784bfaf055198f5c05b3c491e8d01eb6d
MD5 3081aa76c1a704b7f349cc033ceca72e
SHA1 39e9d8a9afe7d35b00fd4bb09ffeb44b1d894091
SHA512 8c0e9ff971586876aeb7e1e32f425d7642f49c8a65a5f4b5428bf01736472b71b9fa566169ffb8cdb4457ba6b754dc91cc6c9ecf545d10f6e79299b7321f41a0
SSDEEP 49152:n9mqCzDScAZmlvTcFg8Ph6EDmg27RnWGj:7nD527BWG
TLSH
T14B955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 3a91a2fe3c808b550fea31f8a7ece156c5ee6b96d85ec12976ab633f5ef41a97
MD5 8ecd767c76d81a5d6b0faab67f193494
SHA1 5f133232cfc8bb1c3331fbadbb5b95fb244dae6c
SHA512 2ef66469ff6184410a0b45e7619014ccbe0fb98bb0cc6ae96fd88c6d6cecb06756c64404defa9c65f2d0fea750e85e2d529d4948c22a529455f0dfc4ba68c738
SSDEEP 24576:0lYJeXm5jUuEBsqjnhMgeiCl7G0nehbGZpbD:0lYJeXmRUuEVDmg27RnWGj
TLSH
T1F35512AE669C30E5E13A8079C2E2C508E633B876671017EF55E1D5BE8F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 0434bc344378c351c059edd6fabb31dab606da56184132ae7fef9dd1ec6bdfd2
MD5 f8283ed748e5f2da8f3e74c28baea02a
SHA1 1ead36311fe9176fda5e8137ea1d8829934e11bc
SHA512 ae2a5a2e2afc5e0beea34452282fa1098614b089df7cb34f09e76a5a1c0075ce04f2f9917d332ddd41dea78d59fd4fe2e08b2703c9d15ec2d860e2e2dd313d76
SSDEEP 12288:Imu6kyfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:I7tyfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T157552219639860D8EA760978C6B3C158DD367C219F2042DF65E1FA3FAF726D48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 3bfe566b586d34169be677283b963e23033564e92ab30547b895281c6d12892c
MD5 9864bc3a7a2c7b460c0b24c874127b9e
SHA1 6bd7320f7e51ac5a0d9d88bf0a14817e0b5702c3
SHA512 c868912907316467810c58f7eb0faab1d533ba56393bcb367f83671413df6302bf84ccc68a7d5d3f9f5d1eb778dd83dbe7ec32f2d2d7f383cf1737f90f3e63fa
SSDEEP 12288:uPWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6WsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F34523BE525C61CAD93644B4C2A5E10DA8173E36AB2014E779E3FCBDEBB54D44B38813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ceb2a83c81d2922c15b3f58004c06e85405d02e0d5d532862a9955f84bf8f640
MD5 ea664ab94e00d506675978ab12c9dfd9
SHA1 27ef9ae283090fef6b65edcf9cb18e6aa4c59f33
SHA512 e77c1bbdf2791f9c6966a05bff169049b41525896a88b0fe0e9f7cf9d7c5ebc3e2e15312ff78553fe3476ecde4efdf417be695d3144224e405a0fa0b70d32ae8
SSDEEP 24576:dC+TyQIu93VAumZr7jmxsqjnhMgeiCl7G0nehbGZpbD:d/TfIq+YFDmg27RnWGj
TLSH
T12A558D2DA7E91DCAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 aafdb0fd9cc9fbd8393dc44955f30314b41443ed0da5442e76d5c978ef3628f9
MD5 70211d5474f146023ec2375cdca2e149
SHA1 b70878c29a60b3c967643cd21932f93498fdc478
SHA512 94ab386427f7a6bb4e25b586bcc355592b7121ee05e340686d9a26b29e739693d21615a1dfe33756eef3ab1f28db2bf91ca19bca7f36ef677de2cb2ac165bde7
SSDEEP 12288:5cyrWOstaa3kcsqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:cLQikZqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB65F11FB3AE00A5E067817CC8858116FA737835571167DF02A1CBBD5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 52cb46ca33a2715a21182b64de2a2768d834300fdbaa6c6f3fa40b1d53dd071b
MD5 1f90c1ad315e786868fcf1c4b91371e4
SHA1 8771bf327a6a3d3d33c4fa413a22f7ddb3418383
SHA512 ebe5900bfac0d4b53ef8f4706a7ba3d57dd7948040904145b43b747fe4aeb4d62d65cb920ca60ff41c190c64c665a956f25fe3ea3efa60ddceb43dda64fe875d
SSDEEP 49152:ypJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPDDmg27RnWm:vpC7b4+80GTksD527BWG
TLSH
T1C9A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1032-158-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1032-23-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1032-17-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1032-26-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1032-25-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1476-243-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1476-398-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1476-245-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1476-237-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1564-306-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1564-300-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1564-331-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1564-513-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1564-512-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1980-506-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1980-321-0x0000000000650000-0x00000000006B0000-memory.dmp

Download

memory/1980-327-0x0000000000650000-0x00000000006B0000-memory.dmp

Download

memory/1980-333-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2184-311-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2184-332-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2184-317-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2836-382-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2836-384-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2836-514-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3164-76-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3164-66-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3164-73-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3164-230-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3212-334-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3424-509-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3424-344-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/3424-338-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/3424-347-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4080-423-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/4080-275-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4080-281-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4080-329-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/4108-393-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4108-515-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4108-395-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4108-387-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4432-431-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4432-425-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4432-424-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4432-534-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4432-472-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4432-488-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4432-504-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4724-15-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4724-1-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4724-0-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4724-13-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4724-7-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/4724-9-0x0000000140031000-0x0000000140032000-memory.dmp

Download

memory/4724-12-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4804-516-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4804-399-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4804-406-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4856-296-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4856-290-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4856-330-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/5096-38-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5096-36-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5096-227-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5096-30-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5096-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5196-410-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5196-416-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5196-517-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/5196-418-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/5208-59-0x0000000001670000-0x00000000016D0000-memory.dmp

Download

memory/5208-64-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5208-53-0x0000000001670000-0x00000000016D0000-memory.dmp

Download

memory/5208-72-0x0000000001670000-0x00000000016D0000-memory.dmp

Download

memory/5208-77-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5288-248-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5288-255-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5288-271-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5288-261-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5288-249-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5340-362-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5340-370-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5340-372-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5340-374-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5340-368-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5492-356-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5492-510-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5492-358-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5496-422-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/5496-269-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5496-260-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/5496-263-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5572-520-0x0000026215670000-0x0000026215680000-memory.dmp

Download

memory/5572-522-0x0000026215670000-0x0000026215680000-memory.dmp

Download

memory/5572-524-0x0000026215670000-0x0000026215680000-memory.dmp

Download

memory/5572-525-0x0000026215670000-0x0000026215680000-memory.dmp

Download

memory/5572-518-0x0000026215670000-0x0000026215680000-memory.dmp

Download

memory/5572-519-0x0000026215670000-0x0000026215680000-memory.dmp

Download

memory/5572-526-0x0000026215670000-0x0000026215680000-memory.dmp

Download

memory/5572-521-0x0000026215670000-0x0000026215680000-memory.dmp

Download

memory/5572-523-0x0000026215670000-0x0000026215680000-memory.dmp

Download

memory/5572-528-0x0000026215670000-0x0000026215680000-memory.dmp

Download

memory/5572-532-0x0000026215670000-0x0000026215680000-memory.dmp

Download

memory/5572-531-0x0000026215670000-0x0000026215680000-memory.dmp

Download

memory/5572-530-0x0000026215670000-0x0000026215680000-memory.dmp

Download

memory/5572-529-0x0000026215670000-0x0000026215680000-memory.dmp

Download

memory/5572-527-0x0000026215670000-0x0000026215680000-memory.dmp

Download

memory/5636-43-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5636-229-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5636-61-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5636-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5636-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download