08c5bfb3a4e6e115c1bf768d0a6767541d686cf81793607f6d927c4c7af4e4ea

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_c0c32c199d9d1cf3be4b01066db0469d_mespinoza.exe
Size 1.4MB
Sample260529-pwqlqaby21
SHA256 08c5bfb3a4e6e115c1bf768d0a6767541d686cf81793607f6d927c4c7af4e4ea
MD5 c0c32c199d9d1cf3be4b01066db0469d
SHA1 0c7c8ddd228d583c51f0e3c8a4a3f039ea722624
SHA512 3aa27e530ce533fe5c6ef99387e1b2d2f77b21dec957b1362a8c6b34cff6678c9e879c650ed9c9e8498f6d75c6cb006b9f9b1f293bf738b49c91bfc341dd6b4f
SSDEEP 24576:hIuANgerUCBkloO5Pg+Kj6xjI5skz8o9uZqybqcutu2wBWs1n4TP:hIEer9klN5PhKfskz8oNNru2EV4
TLSH
T137658D5D7A68C2DAD2B1C1FCC153ABD671727C28837219CB8310562E6F77AF41A3D9A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4960	elevation_service.exe
432	elevation_service.exe
5792	alg.exe
6052	DiagnosticsHub.StandardCollector.Service.exe
768	fxssvc.exe
1412	maintenanceservice.exe
1672	msdtc.exe
6016	OSE.EXE
4388	PerceptionSimulationService.exe
3192	perfhost.exe
4736	locator.exe
1408	SensorDataService.exe
5968	snmptrap.exe
3292	spectrum.exe
668	ssh-agent.exe
1792	TieringEngineService.exe
6004	AgentService.exe
4528	vds.exe
3592	vssvc.exe
4868	wbengine.exe
892	WmiApSrv.exe
2332	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c5da918aee2c9d24.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173093\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000328b2b9168efdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008661bc8f68efdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e57df68e68efdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe
432	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4960	elevation_service.exe
Token: SeAuditPrivilege	768	fxssvc.exe
Token: SeRestorePrivilege	1792	TieringEngineService.exe
Token: SeManageVolumePrivilege	1792	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	6004	AgentService.exe
Token: SeBackupPrivilege	3592	vssvc.exe
Token: SeRestorePrivilege	3592	vssvc.exe
Token: SeAuditPrivilege	3592	vssvc.exe
Token: SeBackupPrivilege	4868	wbengine.exe
Token: SeRestorePrivilege	4868	wbengine.exe
Token: SeSecurityPrivilege	4868	wbengine.exe
Token: 33	2332	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2332	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2332	SearchIndexer.exe
Token: SeDebugPrivilege	4960	elevation_service.exe
Token: SeDebugPrivilege	432	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 5876	2332	SearchIndexer.exe	106
PID 2332 wrote to memory of 856	2332	SearchIndexer.exe	107
PID 2332 wrote to memory of 440	2332	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-29_c0c32c199d9d1cf3be4b01066db0469d_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_c0c32c199d9d1cf3be4b01066db0469d_mespinoza.exe"
1⤵
PID:2596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5792

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:6052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1744

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:768

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1412

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1672

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6016

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4388

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3192

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4736

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1408

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5968

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3292

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5480

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6004

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4528

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:892

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5876
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2844 2852 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:856
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2888 2868 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 23a89e1bb0a07cbef550e614cab92e2917b5277578c991c8b3fe03b66995af1d
MD5 c9aaeb75edc6aa3d10d8ebf5135b70cc
SHA1 3fd5ccabb71babd4a410b266789e640fc25182ad
SHA512 5b88903765438094b63c346746604a21c0af36890f269bf5be006c58a6c87075093815cbb8302fdac600da2aec111dcd9bf0fb8901f9d4d11dbbe75b4eff59d9
SSDEEP 49152:Tb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnvskz8oNNru2EV4:x3q6mjBcsg8ovru2EV
TLSH
T127D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 5ab2022090f3270c44b07f8f406fb5ccea5ace1c9fd25222f70d9cc3252d0f90
MD5 8fc99d393c725111866edad399f77c16
SHA1 ea2f868d15b3966b45d4b98783de3e8d5bfe5abf
SHA512 dc01b40842d85349a38aaf614c2c0c3f99664180bf14fb091eee36d35e0748d96bdbd22f0bfa08a0a4cff6ab738b90410e1ef5e4be8d1d5f89f0c8ef7df2fac3
SSDEEP 24576:AXYfDtczAy5skz8o9uZqybqcutu2wBWs1n4TP:3tcDskz8oNNru2EV4
TLSH
T1BE65F129B3A508F9DC67823DC9A28415D633BC5547A0E7CB03B499291F333D99E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ce5c5fb0482170a733fa070df5dcf1903903f09597ee1c059815dba40c0e27b4
MD5 03f991dffe62764673b4830be327a471
SHA1 25b01303905ca9cedd175897e845d1a7049a51ae
SHA512 7e6af9cdf3ec16838bd70a15026ce7013290f06211fe9903327f252a3b8ddb080ce510204135f0957facd58528515f41f8a875520c855c97107a321d9337b416
SSDEEP 24576:10Le5ji0hmxbrMb5skz8o9uZqybqcutu2wBWs1n4TP:1Pji0AJIskz8oNNru2EV4
TLSH
T16B85AE16F6748735D073C0B9C5D2A69EE932308617308ACB4296D77C3E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 91f13f7bada7230de72b61b1443f20088cb39f44209c374b7144d977ccb8a492
MD5 a10887f74801c821239a533a378ba418
SHA1 f35b61fc7fcfea180014efd28020dc95e02b7483
SHA512 95991a3f8674c0ebb303a4c1eff9bb70da0fb7308e3543a7cd7fb2b5c1bb45ab06ae26e751434dcf95a6bf47fa934926381eb1a5967feaf73bab17b3cc8f0d1a
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWj6q8wyup5skz8o9uZqybqcutu2wBWs1n4TP:H/ezSC6vUzPv+Hjy8skz8oNNru2EV4
TLSH
T110755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e4e7681640c0da59a8f14c2d01657bb0e74f85108380fdfccec5f585bbf13766
MD5 0dbe5b4fa3bf3b394b95737d22c0d0fd
SHA1 a395ed08d2421a98132807a5b6448fc299123bae
SHA512 dd0f9d99545f15590d7a3ed62666d716c378d8f0f23725c36e19be1221f383ccbe8a5b9c171389c47a4d74024ea106457360c21aed5c65693d5b1b962155aed8
SSDEEP 24576:WVbqPb88hv/l+BO5skz8o9uZqybqcutu2wBWs1n4TP:WVO88hXl+oskz8oNNru2EV4
TLSH
T186559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f0831bff062b620fda7af1cc135a99ff13db8ec360bb6b12befd1a55ac05e6f8
MD5 5558519eb03fd87427e2608d579dc8fb
SHA1 216c7782dd6e027695a7479ef5baf77fd63cc69f
SHA512 66a44d2a2ea8218dc05aaa191e347d851512fb853125a884712645368234e2382c40d2da5fb23e203ea979dcf3a3e942503de9202e29455f2166b792ef5176a2
SSDEEP 12288:gJQu9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:gJ35skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T19B453387E11D9C59C3AB473986AB646D072B8D2C34C4618653703A6C2CF56EFCA353BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 466e5508f16c56ee15db87153d5b5f553829ae038a0820ec3f6ef22fbde190b6
MD5 5bb679fbfc6f7a29153f7ec17ec2cd8f
SHA1 56b6efd84fd9a870eae7fa6bf83da6fefdaa731a
SHA512 2d2f1d1b40fe4e01fa1782992c8b2b28f2c33e1378660a18b85e79c217dc70532b4c40bee4aab068db0712442aa197ea1bcd2eed928dd893a9e3d5fe282e068e
SSDEEP 24576:BJIU25skz8o9uZqybqcutu2wBWs1n4TP:BJIUKskz8oNNru2EV4
TLSH
T19665CF3BEE28FCD2C27A8D795B918600977278304B52A3CBD174830EDE235E55E7AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dbf34f92667be67fc6e40fe2f4698067d71463ede9b93f0714a1d52c33b5bbeb
MD5 7a02da9e15c8941a870ff3b3734b2105
SHA1 381a6582ab2ed5a3dc44c4dcad25d1032e7cfe6b
SHA512 e37a132bd0825c3fc2bfb418cf9acbdbf49db8fb614b4152d9e36029404ae01fdfa8e89c5286225722305add01c0108d5c70982aa07153d2b3e9482664ca777e
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THy:WQvGAdlCEL8c/WRNw5Cjsg8ovru2EV
TLSH
T165266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 828c1accf88728c0b233ccb5cbf81a8adf2f930f43d127589cc5aaaf5624046a
MD5 d36d55ed104757791c0266243b9c1e6c
SHA1 5a2254a4d41dcf4721dd0da8c4fef672132127a9
SHA512 075df22aaaed9d275a9801c8aa35ebb18fb568ab0103bc16252b5bc54b15e30e2fc152a94ee78d9a93743273c2b18cbe0530796a0a49d7943a753f6105091cd8
SSDEEP 24576:qRewsAjM5skz8o9uZqybqcutu2wBWs1n4TP:Wlj4skz8oNNru2EV4
TLSH
T1B975E031FA74E436C2BB0DB61B36C71A143DB9204B911AC3E3B84E9D59702D26776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e25883b9742b7c68b09b4d9d1a46911487780894c95b10a601afd620401008f6
MD5 9cf14cf3c8b28ef18f6a4c87a1729672
SHA1 5a43eee8d01835a8bd46987f6ae32734bd2d1fbc
SHA512 5fc2f9862237ae7717d6f165b366f2ebb915cf0f462cb71144eeb0d7fd5313d86637586c1752ea95ddd141673f7512f8053f71468d7f023f0b30b9e993b0fa87
SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHK8oSV:1UEtQevvqc2W1cpV20I32n
TLSH
T13E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3f36100c82750fe4a5bf387c0b25d367e41112bf52a545ff0afc56217f2671c7
MD5 50c320ede4d0aaccabd7c3b025a96325
SHA1 4751319879413a735116ce0af63fe79b011e9054
SHA512 6b45e71e1a3a783c5fc7faa84c14466ef457535ace922f1f4359487d3f7fb40304f70a714faeb0e3f371e58c0d243d64a8458645f876f233b6dea0c8cbc2427b
SSDEEP 49152:zCbRquA/m2yL5zTfFiV+XenmE3/zYskz8oNNru2EV4:MoquVjnmnsg8ovru2EV
TLSH
T1C6D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 975f6a8ead762f4386e2c9add27003f49d03b7746e629e150a23e7811fcf519b
MD5 3f57ebbd095743166e0e10b3209396e0
SHA1 df3b198f9754c3517db4856aabdc2b1e3f384962
SHA512 2fc12e028381992b73910450249784346c5e54613116c8a16d94b7fb38cd89c85c42e07ff91f04e796ff09667e76d3dc94b70f227cb4636d9e0df3caba05bb54
SSDEEP 24576:2AhGL6IFoiwtA5l7S53t5skz8o9uZqybqcutu2wBWs1n4TP:2AM5Foiq5Xskz8oNNru2EV4
TLSH
T1DE359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 efe3dc6e6c098e332202d5876a91db15178f3d5f98f077a20cbc37209954a460
MD5 5c87e20ddadd3b4157b24dc2a7bcbd77
SHA1 b2c87663fad1cee30dcc64d9cbd550d6b30195fa
SHA512 93bfaad07b0bd9160f8e4443b746cf4679877ddd4d0d7664f282dd80652856d5dd6732939d4d746f6cb73a19e624614cd0d38ac2408c978ce523516579ce0297
SSDEEP 24576:wwubOWQ5skz8o9uZqybqcutu2wBWs1n4TP:wwIOrskz8oNNru2EV4
TLSH
T18965F14A72A80CF9E5678239C697C136E7B2BC152A61D71F1370C65A6F33362AD3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 e29565e7dc8c864d20c9379eb09d2714e379bfaf44d8005dae4647d55f79a825
MD5 b94e88655f72a3e617a2cd1f9609af5f
SHA1 49f93eeb408c7356f729a84d72422ed852531ec6
SHA512 736181161c103e9d4b893200a24b793492173fd3b8503085db2ca97005967332cafb741e3b5c58ed3e839e1e5750195840292e5786c2c13897863f2e1381bf55
SSDEEP 12288:PrZ1Iypu9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:zZuj5skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T10C55128A32A864F9D1A7423DC9E65549C7337C2627B543CF127006692F73ADB9E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e3dec5629d75f3fde4413f3fa51b7d471f0c1980fd6fc6a82ba39df780b09ee0
MD5 fd1ab1f8927bbed48d30d77675d852b7
SHA1 0b7264e872b817bc88956c5b8f46f729bfabc677
SHA512 116a1824fb079fed7e3177e0b94fd9cb3154242dee10e62936c5154ad467f814d4cde90acd74f9bf92175c1681ff08197ee76c879445cb2727a7e4ea80e2c0c4
SSDEEP 98304:UQRQyi36YOcPDLvw2gAf+PN3Osg8ovru2EV:7QyiKanX+PNk8oSV
TLSH
T14B667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1a3e8d32029dc73d65cba7092f3d8560d7ee87571556f437975556db82ecca7a
MD5 b681d8724dffef9ae2b7ed1bf0b2a07f
SHA1 aa84470597bc3e0090b526c7944b09c05ff82e1a
SHA512 abfef714a2fa5ac1a197a60241e33c0e4fd0d6af54cf766cd590c55c6eb5529392bea6d7933d346f1d2e88dc97335d0b0d22465d0f81009ea8edc2909d897dba
SSDEEP 98304:wQRQyi36YOcPDLvw2gAf+PN3Osg8ovru2EV:nQyiKanX+PNk8oSV
TLSH
T11B667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8909ca21d8cbce2dc05099bf928f5acfac26200dc876a107fae94564cbf1e948
MD5 e68450b626e5eed3504d41d19b596b21
SHA1 8c7aed0c395fff306c7a958247e0dfeb8baac5b0
SHA512 42e3d0c84efc2d3410fc2c9896ca6b2907983ab283932f690a2ae2a06df0ac731976b3d77e82e63da9fd8884b5dfeeca4dd2a3851e284b7ad4dd69c22730504d
SSDEEP 49152:n68Qg55nhkeWu7PNU3/Iskz8oNNru2EV4:RthTRc/Isg8ovru2EV
TLSH
T186B54933B2F60099C44DE1769F4A872196D27C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 de96c53ff8145d6cdb46b8b862393483583837c19f04ea618cc66c173c5ceac8
MD5 0e8b73905c8448dc0d74be4e541f27e6
SHA1 317cfb7ce09dc8bb21d7eba5696c2bdc7aecb3dc
SHA512 f9200eb0e25ef7009756249f440b2d25e0098370b7c4064e227f26326a40de105de71b4d4a2b9d32507ec86fd0efe42acb4ab180e662e63eb19ff817fecb9812
SSDEEP 98304:2y5112gYy5azzVvU69nLKnhZpsg8ovru2EV:nLIHRWhD8oSV
TLSH
T106167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9f89b5ca7f54b982a0486c5b5a9a58b2a991f398d46d6e9f94786bf522ed0350
MD5 905fec4660d0531a7460e648e0d58a0e
SHA1 0a8b146b6191972a0ae851154019c738a1ea438d
SHA512 a4ca83962b98330aa8e7bf732f47dd4177026a421f4493fc2f77aaddb3c92cfc531d21416057ddf7a2c4bbc644a33922704a3bffec1c010c1ef4c8a479f28334
SSDEEP 49152:RB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glwskz8oNNru2EV4:Hu6JmIxd2dwsg8ovru2EV
TLSH
T172D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 65b5b08b9defb8fda99944bec9b54bad4ab7eb122d0d561aa44e9990c718aa42
MD5 fee16afb838e68f1bda41f836d71a00c
SHA1 535bfdc5799624b2e1be4cc4654a5efff01941c8
SHA512 8355b1c57045cd79bf90b9f3932dce31621d2e9a8e3932d5d2b018dc005344699ae0901829324670385270aa3cd0d7a176572afcd3ff222180149d30f8352337
SSDEEP 49152:A1hpsNoJpF1A67U44CwH7R4xqskz8oNNru2EV4:AmifPqRnsg8ovru2EV
TLSH
T1BFB5BE13F29900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cf277a4e7887cd62a9dcb92bb201db1d3e1d3cb4eca130d6151e3b572c42e1f4
MD5 f9ad8cc4615cd532bb703c0f40879f4e
SHA1 8ca0a75e7cfbc7e43f8310929ef91a2668416f90
SHA512 70536238de719bb380681b75db5c357e2116333d6ea68c2299ab92d62ee722cd58116301824202d849f64c967f0911de6eafdce16e9ad5a3670f04d0df5a4235
SSDEEP 49152:uSuZQIY0Be2KkRVtOnks6NMHqFskz8oNNru2EV4:g5dKqi61Fsg8ovru2EV
TLSH
T1B3C5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 79a76f27762a5492f941f5e5cafdbd552035f62395a9054f7b46eaff7df5d583
MD5 53a3c99b7e938808e3ccf099f2638199
SHA1 7eda77ff80e9120bd28cf7cdcd5d929edfd83e24
SHA512 c03a544b0a7e2a503a7e89526f00e8099e6252c5ce35413a1fb03706f86e9e0e2df51956bd362fffe72bdcefb0110990069448e054b74c2e92e514af47bb3a2a
SSDEEP 49152:phtSn8EApI0figjgiDn0AP5wWskz8oNNru2EV4:YX2iWphLsg8ovru2EV
TLSH
T15895BE13F2D900E8D05ED178C7568632EA62BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9c0ac1ac8f02ee729d9842e8bbe410e10189bc9bf6bb6359511de92aead24662
MD5 28f5df03e80173363d1b10d6850e801c
SHA1 7d78e1d46741a05f7877c2a12cd62bcb5e3c191f
SHA512 8d23a9cdf2f2d8b7c30101ff565a6477785e0dc8dbaa8501668c45cebb490bf7b6e9d66a7478231da318e90e57c0bb10ade9c11068ef7adefca8f8a3ca20ed19
SSDEEP 12288:nYu9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:nf5skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T10945238BF02E9C8DC156473AC6AB20AD461F5D2E35C511CA637415282CF26EFDA353BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0f9e37f61dba27223f8c5d0e003d42d4122881fb88da64882419a0ab22464857
MD5 b97e4a4b7d6b2c2851e36e3f1efd05db
SHA1 8685e9b02893655eede1fba07e6931bd049e81e1
SHA512 ef77e71519768c17cba62815e79e1e825e4b09abaeec19fb24f5bfe9416fa134266b58b10cbce89d5b675370a58bd3ec0565f960a1ead7600f8bea3e2892561e
SSDEEP 12288:4Nu9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:4I5skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T198452387F02E9C4DC156473AC6AB20AD461F5D2E35C511CA637415282CF2AEFDA353BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a8b48a8aa9d60a94544fed3953b4115fea40db32e09c058cb7af6b1e87bab359
MD5 120cc366ec482945fea9031e9cdaa15f
SHA1 d100c96e35fedcc691ca26e3427923a53f0b0b50
SHA512 95f42ad0f946fa3fab520270a0f9bd604b90a4c312a871383e349d4a1c5b0eab283a6ae71f776c5ab75023f5e6cd94bc95eb1b23d4b2d23a44d0a9fd0680afd7
SSDEEP 12288:yXu9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:y+5skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T194452387E02E9C4DC156473AC6AB20AD462F5D2E35C511CA637415282CF2AEFDA353FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 bef19d2e74587ebdb40936503c964492de5be824fd2d76570c0585738a5c6e08
MD5 876e6122d3125c98db3ddce1660c3d7c
SHA1 8d168913c5d8f3a7b051c4a4d3ea79672f093aa3
SHA512 c1ed9af75f7fc965e386de5f14e974e006f9951d682f5aa64766c4cad4a821c47a50c8a0d55804609270b64d136723adbee78ee3cce6b305d6ca22e6e4c43869
SSDEEP 12288:pViu9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:x5skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T1E9452387B22E48C9C166C339CAA7506D833ABC29769152CF573009281DF27DFD9347BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 91ac32aeee22969dbbddbd0dfc3662496b9ad09d582858ab65912c87cc14444d
MD5 b67b2dcc85a832bd4e7efae3efdb8940
SHA1 49843eeafeab05b718970968c070374fb98ed168
SHA512 0302b9724985a60e6f03ee4f240b167e6b9e54a3ee74ecdac782e204c2b69029698878f047efce178eba84d0ad851d75557202baf969db04ce9df3b21b2f17f0
SSDEEP 12288:I6u9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:IF5skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T197452387F02E9C4DC156463AC6AB20AD462F5D2E35C511CA637425282CF26EFDA353FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 aaec47e1e69c237d6f30913c82e498d822659e224ef8a321ea4fc9b68f53a4c0
MD5 10c39cf072cd3c89e9771d71adbaebca
SHA1 940e4b98d651f977e598b72c999a301ea779187d
SHA512 026e342c944163cc898ca15960a2efad33bb47dba8b92f64b3f4d823eae5a32c62c2a046432ae85cf08aa185db0ebd5dcaf860aa3031b9d6c9c7ae708c11ea7c
SSDEEP 12288:hBu9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:h05skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T11A452387F02E9C4EC156473AC6AA20AD461F5D2E35C511CA637415282CF26EFDA353BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b9e025e9fe9567d23281339d330b8722e24bd6938876b0be7534c04e3aa6d255
MD5 fed3f77a8adf258f25a91761b56cbc6f
SHA1 a3936f355db37b3f217f3c925317cc9de985c089
SHA512 4b84a2a3117f122330c691399377403814c1750f494f3908ee5cbd2a809dd5835a544c20d4674c677891fb63c090c7cf5ed0c273551bfd4c2a50a906251fcf27
SSDEEP 12288:jlu9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:jA5skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T100452387E02F9C4EC256473AC66A60AC462F5D2E35C511CA737415282CF26AFDA343BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7757ff6b4d4922793acda7796d67c93fe236608353f4777592a5df1c80f1a591
MD5 63971d23e3cb7705ff45ed86b9d8d6c1
SHA1 2691a413be4d830847391044c99195677061dd61
SHA512 62f0143c69eb39eccd9a97a6e1c50029522c00838704685438519b56713d41d95870f61648c006b02c94f90777488eef429cd1ae3021e8debfef2bbbd7e0c407
SSDEEP 24576:TZMRzFVSOo5skz8o9uZqybqcutu2wBWs1n4TP:TZMRzfAskz8oNNru2EV4
TLSH
T128650295B3501CF8DC67823ECD55891AD2B27C1917A0C64F13B4362A1F733A25D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b4ad86066ef78a3c40363701dd62ad982e74297bfdd274ef7738be1c4261d1cb
MD5 6729eb2db7cbff07bae05a4137f592ed
SHA1 6e1da86793ea08920f10d2d1d942e883f68bd6c9
SHA512 b6dea550b09a46893349224d71c23fdd059f5d0672e3c2f22c0f77f07e599f5e737e19261c8ee6ef2f21af0256a88a6308a9addf483a143b6f77ebcefcb2a4b6
SSDEEP 12288:Lku9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:Lz5skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T11A45238BF02E9C4DC156473AC69B20AD462E5D2E35C511CA637415282CF26EFDA353FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ccc324c90039cd5cd272498d5a2c40f86a3ef55205b5729334f3e9766bd90035
MD5 e13e960b6df32bffd2a262b33f7b5f81
SHA1 68834e6c7c732559d67a4ca604efd47e9dbfb17a
SHA512 1788c3182e5948e16a20dc7da46b7e9ab7d14e5ef4a8070011ff470b88d5b6372ab0a83107a423bc5e0f9140520e000fc0af2c86032a3e0c5243d4587f8810ce
SSDEEP 12288:XAu9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:XH5skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T15345238BF02E9C4DC216473AC79660AD462E9D2E35C511CA637415282CF66EFDA343BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e06edc5922024e39ee769695e94c06771ecf7ab259d835ff0bdea27607f66a88
MD5 bc92db54ee62d4fa1e65c77418046686
SHA1 3a03f1e15c4f19b137706d182f6dcb84831fd497
SHA512 81aa76d2dcb3da259783d6e47605216b2e4b0f4e0e7a3c5cca833b810de841b3126fe9dddfdf3db3b3efeb15da32c120fecbebb2902ef132f9f2c6ec547f4267
SSDEEP 12288:dyPz5L8pu9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:Uzyc5skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T188550247B26530FDC1768239C9A21915E336BC3617608A9F13B0077A2E736E6DE3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 53f1065a4db59cbbb60ae03dd57c0a6daaeec82aa6de278d05d27d194b13eab9
MD5 2337066964c321e9df2e9e090a7b0150
SHA1 bc35050ef44212eac95ad5e748915b2d95c1d25c
SHA512 2b0193a693d6a93d0bd39179cecdd70e8aacbb6e8e31dae056512f497d1ac5e9de3d6ad2692f5bb44c88722b964ff49389e2e6ef681cece23145ffc438e0630f
SSDEEP 12288:/ku9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:/z5skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T1FD45238BF02E9C4DC256473AC66B20AD461F5D2E35C511CA637415282CF2AEFDA353BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b7b890bd31aad84e005e3ed95735534198250c55d129e43f78fa51089aa48e6a
MD5 c919d855d25b03b411b82eac2158fb4a
SHA1 6c6090fa1a18439fc4256bca9c699c93a170f040
SHA512 96e607fc8e86903fc9a17d09bd77001247d0f7e253616bf78accb10db283752ff8e7f774f919ad0ed897a3275aa7e2128fef666f1938b4b86e60de64af2caab3
SSDEEP 12288:6ku9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:6z5skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T15745238BF02F9C8DC156473AC65A20AD461E5D2E35C521CA637415282CF2AEFDA353FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 f928e221e4e207528c6d2667a186963c8e41e588b2916a95a1fd7688ce72bbed
MD5 ed7c6ecd27cdf9dc2871fc3edb597d63
SHA1 62943eb7bb29f488a4e79e650a9bcc550c317f0c
SHA512 405161dd61e09e70b614291936dcec48d3ec91e7dcc47b975658bae933cbda2305d0822fb349e155fba0d2d0c6567626ef18103974650d2d6474e3d77dc84076
SSDEEP 24576:ACUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAK5skz8o9uZqybqcutu2wBWsk:ACUAPTY+8Wg2lIL8lrIUJLWwPskz8oNv
TLSH
T15665AE1EA3DC0896D0BB81358A518A16EB32782E1B21D6CF2170C73D6F67ED95E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 cfe66da06c3f32fc7119140c0fb8756c5df8ddd0d7eaa2556982463ea714b07b
MD5 42a1dc87d61b20b8213fdc7821d36169
SHA1 406b27011bd9f5acf406ca2f414302a86f5f4876
SHA512 f4bfadfe0fcfe071ab39eeb34026cf5688fe52f91a5527659c2156282fc4957b77b54b55e1600761a7e458ee63c27f71d6e74dfa8c33305273dcb41cbfd20bba
SSDEEP 12288:TXsf0u9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:yj5skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T18D55000AD25802E8C06E5239CB564644B3377C2993E193CB63E0F53E1FB66959EFA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9362183151b46b74c9813b69f4aca3bcebda67511c7ad5369351e25c8fb8a3e7
MD5 fb3d7a007400909452eaea7d327d2710
SHA1 8b6e350d5b863df5a7d2d7132ce6f60fd00349aa
SHA512 e02c1087e317a0fa726f36647b86d2683c336a3f09fe0b60e3067b2f0cbe3630f3d6023b6d9339d8a8b4b481f02ab15b0675078181c6426525f5fb837563baf6
SSDEEP 12288:Z3u9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:Ze5skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T190452387E21D9C49C17A5739866BA03C022FAD2D2BC451C7B27016682CB5ADFDE3536F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 3562d28e00326b0b49fd40ca7324f08a9394ab38c1354cbc49990df270b5730d
MD5 70193f8110c99f98cece555b389383d3
SHA1 7b64c415dad1c171183c93bead536ff16eeb34f5
SHA512 7f522f4ed18617eff287dea85e95d6a91a51e4aa4f512024f89b94a74812e61b96a54b6942761d828a032f997ac394560b66cd478723cac3d3390d6e3e68940a
SSDEEP 24576:m8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCs5skz8o9uZqybqcutu2wBWs1n4TP:fRZwQCyiHiQEaiPnMtskz8oNNru2EV4
TLSH
T19E85B01E62DC46A5E0BAD278CDA74407E6B27816573193CF0290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 974ea7c6cda948eded90a7ae22de03b5da958877a96760ad601adbab99bc46ab
MD5 6aa06856808f7e9c07cbe2c47742e257
SHA1 43d40c2a42a7021239e2751dfa41290a905cfc96
SHA512 188ee0ef9eb9d20f9ce7ddbfff46afc10ba34e8e7f9653e0da3518275e99d48e815ff429a438ac6c39d8eb5b8197944e8de1801d037d1e39dabe638caba29dde
SSDEEP 24576:HbxA1UGu5skz8o9uZqybqcutu2wBWs1n4TP:HbxA1UBskz8oNNru2EV4
TLSH
T19A55125F626C18E4E176923D89D68109C332BC2A275193DF21E0827D1F37EEADD35B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ad331c88e64055953eef8c1322a679bdfb3c8eb04dd86cfed2ae9534dc4ce85f
MD5 c160e2c4be515437f0f2867fbe9bd6d9
SHA1 813c6689895280d15fe77b73d5aeef2f6d4a244f
SHA512 e44fce64075f51c891c4f3c9be8248e069d48239c15769e7a9480d9929c61a41ff6b04a02cd9dedb6bbe1d17f9f73df7d1498fb5f89a71aea7ff3f80624d368e
SSDEEP 24576:ajsmP0yHaqrVqHra44KDzMsrnd5skz8o9uZqybqcutu2wBWs1n4TP:ajRP0yHfVqzlAsrnXskz8oNNru2EV4
TLSH
T1A945AF2EF2B910F9D4AAD136454107B5AB71B82D1F209AC70170C634AF0AEE99F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 8c45056c3027f69161a72e4f134704419d6fa102bb5a30b1e2340f7006c81cd7
MD5 b0fc1bee3ec9bb5b03e1e500e082b08a
SHA1 7faef2cffa3e86830e632e1d49db936c000368cf
SHA512 08aaff3a7978d21c8472ae27245799410ffeffc9071cacceeb973138feebc0876c14a515b57c08fa1c5b77a77e2673d5f6ee1804f022b7cc90427f94f8881951
SSDEEP 12288:jhu9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:jU5skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T1DA45238BF11E9C8DC166473A866B606D021E5E2D37C511C7727026382CF66EFDA353BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 69b4d7d9abf286515adeadd23e3f7a0919dfeb47af01a74e562f2f1df99b9427
MD5 308b72fb450e2d5ac9ff79f459526439
SHA1 2cf7a8bf49a97f94a66a95c3c5a175d06b86e75e
SHA512 c8d95a8ffb9b7d532ddc39ca88782ee71f820b40110aecb2d02a17981851e52be10bc5f8b33c00eea0effb98d60f88931572de7137d244ff1cf3d0098067db50
SSDEEP 24576:OyLBUTy5skz8o9uZqybqcutu2wBWs1n4TP:OyLBUKskz8oNNru2EV4
TLSH
T1CF750145F3A404F9D97BC23CC9A28516D272B85D0364E7DF03A84B691E637E68E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 c2c5b1ebebb4fbf982710f19e8f7b89f4b6cf135cbe97fcea47bd100a0e15731
MD5 6c47d4d53f9fcf73e6612b3a7319546a
SHA1 a840c90b79a8b6f66ea054243e5d285e7657933d
SHA512 33045e80a76b32314a4cf25364e6aa5b7d64a98f198db688d8e0be1455280a3f7e5c508c9c74ae7a70b8d9c0f424defa53698df1a625d42b025b5ca5ffe7a0f1
SSDEEP 24576:RVYNHB5skz8o9uZqybqcutu2wBWs1n4TP:RVYt7skz8oNNru2EV4
TLSH
T10D65F11FA26D1CE8D57B913D8AC38209E2737866175192CF01B0827E1E27EEDBD3A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cdecc586127cdd783e3106a90af402fac260ba79c59d0085e62974d80a3daeb9
MD5 61fba65b7cd9c8ab57f8562470aabebb
SHA1 74cae96bd8383e8d610a14403ab8100d3641a74c
SHA512 994d0da22a5a5d0ad1f0cee5af7c9395a5e3e053aaf4e6ef81b791783036358d876c35380a009d55527f26ded1372bc91997299f7046e7c3a07a5beec0caf6ba
SSDEEP 24576:nnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKa:nnXoJJYH84VVS6AmETJas+cHBjSSKHP0
TLSH
T1B665BF9EA2BC04E8D5BBD17DC5C24506F5B278261371C6CF026082BA7F27AF59E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 81713f85c1374afdd7b0a569bb8fcc49f062ff80b93f0e01429b1f9c59bb2c69
MD5 5b22b25cb778ad8c73d39c3d746f7f08
SHA1 37256cc799c212b92692a1976a83cf3baa559016
SHA512 b638678b4fe223e72509e0b79db357f64b639b558b58a1d408bda8d2faf4d7856ce108bf7f78359a7258daf3b69b73e4e9bfa695f585303373c2a9c088e85ebf
SSDEEP 24576:8v7Xbxd9Tuycf8M/TYlSuxrr2PCX5skz8o9uZqybqcutu2wBWs1n4TP:8DLL9TuJ0M/TYj2PQskz8oNNru2EV4
TLSH
T128858D5EA2EC42D8E07BD6BD85B79046FAB2B855273081CF1251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 3e3eb470368b34d89894938312ac7cb3f14bdbcc350eb11c9d65e7e5c29328b8
MD5 29c520034548b788531925e0d461698f
SHA1 1d196b12b7512ccfa91573ed1d7aff50a62ec697
SHA512 857256d3a2a488d91c5530d9b9801cc72690bda330743e4fc7ecf91b4c0c83307fe6f3823178b7b7e0cb534437ca2e37c6fe0efcbfdbf2c22d62c5c886a19304
SSDEEP 24576:KegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wy5skz8o9uZqybqcutu2wBWs1n4TP:KngOJOmPOHkWskz8oNNru2EV4
TLSH
T10155CF2FB7BC15D5D03EC13D8A978816F6B1782613255ACF01A0827E5F2BEE46E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 cdaed33e74f4216c4add25d85ed8b26ad0885f21bbad314818449df703884c7c
MD5 4ad6aef62d24980eda9d89008b9fc43f
SHA1 249f0ad88f3c6f0355c2d038d07e993559f80b59
SHA512 35c4bbeeff0dfbf98d19c88dc3d0309395d8303006f88123f523361bd8cd6e7cc9dc5373706b22f3638fca09405627150886c736ffbb4ac07127e43dcd5e1c50
SSDEEP 24576:iLJnJiTk3R3waE4JrO05skz8o9uZqybqcutu2wBWs1n4TP:iLJnJK8R304lnskz8oNNru2EV4
TLSH
T11875D12DD2A810E8D0B7C2B4825A1656FF32343D3B2169CB59B4D5353F12FE0AA39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2741b7814413eec7a0e8a8472fa9a4de9c1819d52efee3f848e79395ee069165
MD5 44f082721d9b675a880b7bc61e80b4f1
SHA1 3ca7afba686b6a4fdb77ea7e2142f942223bb782
SHA512 428deead4668e557ef5fc6c330ccd7a9676f7b60cc4fc3c534d5fab0e9a934d5809a566ea2ad5eab1b2c07879921f000267c4fb74ca9a41b979e0fc9afc28add
SSDEEP 49152:w9mqCzDScAZmlvTcFg8Ph6sskz8oNNru2EV4:ybsg8ovru2EV
TLSH
T142955C05F7EB5298E8B3CAF1C96694159B327C509B34F7DF0A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 52d002a3add337697b3d1059db58f1cc8eaac83b166eaf7af9f8d25833f9e7cf
MD5 39b41f500accf9866020f1455ff0e994
SHA1 684fdbcd553262228f4287112f8a33dbe3c1851d
SHA512 ffb6a6868d2449377edfe9fc218f94cdfcfa84790d4e8583c656fa1b0b9898acd14abaf496580b3c7d2df4b356c6930f7cf8f548b8ff0d1b5288957ffc93dfcc
SSDEEP 24576:xlYJeXm5jUuEC5skz8o9uZqybqcutu2wBWs1n4TP:xlYJeXmRUuEGskz8oNNru2EV4
TLSH
T1E855128E716D70E9D12A813DC5A24558D332F435238123EF52F0C27D4EA7AEB9E39B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 bd6183f28d398bd51ea683aeeab3e07b2ffaf25dc6980c457d5707c806374456
MD5 94a05e811811e9aa3a494741b7f736de
SHA1 923d911d208b48095343ff83f8e67be4ce0bec09
SHA512 a4d7eadf50ad21bf44c934af5e4356d25cf7962ffce3617aaa333b3d2108d8095c2505ce4100df9702f6367d425625a35aba6f20826f5568c7eb66f0c6be02fb
SSDEEP 24576:Fqty95skz8o9uZqybqcutu2wBWs1n4TP:FqtUskz8oNNru2EV4
TLSH
T13955234572586498D1BA4638CAB341688B3ABC342F5053DF51F0E73E2E727DAED30B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 b1dd24744cc2a1fe4cfdc1b50791f7d287319b2bc223ee885685f417f7d6f7bc
MD5 15483776d1e09d3fb3e571feb4cbc37c
SHA1 0fbc3abc048209fe3d40a54b5b6a51d6b99c6c9e
SHA512 e3646286fdc99f925bc0b468014467c073dc64591b31950beb7b4ddd5d638b34f17f67d315fc3d063b66409dfa44f80848cc64db0a71ada644c2ea9a7cc231f3
SSDEEP 12288:9PTu9vYfhkzCAIqqod9uWqqyBdqcuIqZgbptC5wBAgOvVs1nXITccP:hy5skz8o9uZqybqcutu2wBWs1n4TP
TLSH
T1B445238EA12E689DC1164739866B206D022F7D3C37C021DF22F065385DF66DFD935BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a0fce8135783c25e07f9005cf692d8641387f3c27f056e63a6f045ed4aad2c1e
MD5 eead273864076c06b7abd2c9716b0848
SHA1 0effd062004817dea35522c688a1a05c333e1995
SHA512 b98719e93e517b4616a6f4fadb358854ff18b5c80ee0ddd6be41846fa82a2d4f5045e2890bb0fb1a79b727347290b5b6da5b931bb0a7d5be65e0e0cf25b208a1
SSDEEP 24576:SC+TyQIu93VAumZr7jmD5skz8o9uZqybqcutu2wBWs1n4TP:S/TfIq+Ylskz8oNNru2EV4
TLSH
T17F558C1DA7F91DCAE276C675C8A34493E633B872136186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 2144309da78c472c4700be3dad97e87d1a6f360903a99abf5aaae1d1ae620c50
MD5 0e8ca401274de648c28987c311428b25
SHA1 1b8071cec065c8a4223e6c60db0566b7de1c6202
SHA512 e2fefc3ded316227df39bb51e43db2c19e6287ae3b5b1012ccac09c12af7ec18a6f30e706a71ec838f1733cb5205f1810cb18e812e748a616a995caba7276832
SSDEEP 24576:MLQikZm5skz8o9uZqybqcutu2wBWs1n4TP:CQik4skz8oNNru2EV4
TLSH
T11265F10FB26E00A5D0A7C23C88864156F6737835575263DF42A0C77D1FA76EABD38B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 187d66a64bec6835ed160e8b9b4c14e66ebca7654e3c45e6e935249e0ed60a20
MD5 ab8d59381095a3c0c18326672492cf8b
SHA1 db2b56d7c291d3b8dde78934a9dcf38f09a2e670
SHA512 e0d3c7120e6ee0ed12183d8000299722039cf574480baaf91f730c6d936465673cf4489589d05964708598874a0e00860a08c02ed78bbf6008fd73236e7036a5
SSDEEP 49152:ZpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP3skz8oNNrp:qpC7b4+80GTk0sg8ovru2EV
TLSH
T107A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 708f616bf0391d442dd2c4165cef78993eaed88760fbf4550c38db1682948ee3
MD5 ab7ae705263fc2209446d78ffcf74e22
SHA1 a0a8dec18085c5d2a8ed856b29082335091d27aa
SHA512 05718b5e22271c8da0a171d07185a4b0ac0763cafa337695575d8ee596429852e559ce18a363d62398ad662b3e7e8b87b084e5dcc6ace318fa19df9378923844
SSDEEP 24576:nSAwJPE1IDAo+4Kt+l4413lUQl5skz8o9uZqybqcutu2wBWs1n4TP:nqPCIo4Kol4jQvskz8oNNru2EV4
TLSH
T11B55BF1AA7F956E4E17ACB74D663C511FB737822133163CF52A0813E0E16AE89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 4aab9f85b20d2412973f5177e6edc8a2293e87dae7e2f7f3fa9f859952a47efd
MD5 1255e7bd60af68762df059f2fb501ad0
SHA1 0e1edbbb3224cb22294f53bd727180043fb74109
SHA512 3ae17738efd68e706c5f3f5de9f77e84ea66c5c1d5f7eb03dd84f16263362e796a1a1321aa313be29f4f334e29e0912e5878cdd770fe16bdb88567a4b99ffaad
SSDEEP 24576:cyLXPLc194t15skz8o9uZqybqcutu2wBWs1n4TP:cy7Po4tfskz8oNNru2EV4
TLSH
T16475E13EE66D08E5D47AC23CC6A38506F6723CAD037166CB15A091791F6BFF4A939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 3fc2d2dc1b46ec697274805c1f234e4e8fc2e34b03014ff427539a6c758962e9
MD5 877270cf40848e01cd7ddeb95a77f2d1
SHA1 a74a699b5506c55117009dd71d90f2845a252475
SHA512 190cea9a8e0ff86ea6a1fc2acb62acad71c709bed416c83d37dea8a5c8c51c0689f76a287a6fe1954cf51d25c80b2afb894dbbe587927cc24ad7b8ce7f55155d
SSDEEP 24576:CWv8qjpW5skz8o9uZqybqcutu2wBWs1n4TP:CWv8Hskz8oNNru2EV4
TLSH
T16B55234FA2A868D8D0794334D63781294136BC36239466EF31E4D57E0F71ADAD93EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-38-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/432-28-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/432-34-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/432-120-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/668-191-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/668-467-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/668-183-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/668-189-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/768-91-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/768-65-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/768-64-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/768-71-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/768-89-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/856-495-0x0000029359C10000-0x0000029359C20000-memory.dmp

Download

memory/856-484-0x0000029359C10000-0x0000029359C20000-memory.dmp

Download

memory/856-479-0x0000029359C10000-0x0000029359C20000-memory.dmp

Download

memory/856-480-0x0000029359C10000-0x0000029359C20000-memory.dmp

Download

memory/856-488-0x0000029359C10000-0x0000029359C20000-memory.dmp

Download

memory/856-481-0x0000029359C10000-0x0000029359C20000-memory.dmp

Download

memory/856-487-0x0000029359C10000-0x0000029359C20000-memory.dmp

Download

memory/856-490-0x0000029359C10000-0x0000029359C20000-memory.dmp

Download

memory/856-491-0x0000029359C10000-0x0000029359C20000-memory.dmp

Download

memory/856-482-0x0000029359C10000-0x0000029359C20000-memory.dmp

Download

memory/856-486-0x0000029359C10000-0x0000029359C20000-memory.dmp

Download

memory/856-492-0x0000029359C10000-0x0000029359C20000-memory.dmp

Download

memory/856-485-0x000002935A430000-0x000002935C34A000-memory.dmp

Download

memory/856-483-0x0000029359C10000-0x0000029359C20000-memory.dmp

Download

memory/856-493-0x0000029359C10000-0x0000029359C20000-memory.dmp

Download

memory/856-494-0x0000029359C10000-0x0000029359C20000-memory.dmp

Download

memory/856-489-0x0000029359C10000-0x0000029359C20000-memory.dmp

Download

memory/892-266-0x0000000140000000-0x000000014015B000-memory.dmp

Download

memory/892-263-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/892-475-0x0000000140000000-0x000000014015B000-memory.dmp

Download

memory/892-257-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1408-279-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1408-473-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1408-152-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1408-155-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1408-471-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1408-146-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1412-88-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/1412-86-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1412-81-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1412-75-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1412-83-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/1672-93-0x0000000140000000-0x0000000140153000-memory.dmp

Download

memory/1672-213-0x0000000140000000-0x0000000140153000-memory.dmp

Download

memory/1672-94-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1672-100-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1792-202-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/1792-194-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1792-200-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1792-468-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/2332-304-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/2332-280-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2332-270-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2332-323-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/2332-288-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/2332-276-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2332-476-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2596-0-0x0000000140000000-0x0000000140173000-memory.dmp

Download

memory/2596-25-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/2596-37-0x0000000140000000-0x0000000140173000-memory.dmp

Download

memory/2596-9-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/2596-2-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/3192-132-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/3192-253-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/3292-178-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3292-176-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3292-170-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3292-446-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3592-242-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3592-233-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3592-470-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3592-239-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4388-121-0x0000000140000000-0x0000000140163000-memory.dmp

Download

memory/4388-128-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4388-241-0x0000000140000000-0x0000000140163000-memory.dmp

Download

memory/4388-122-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4528-227-0x0000000000AF0000-0x0000000000B50000-memory.dmp

Download

memory/4528-469-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4528-230-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4528-221-0x0000000000AF0000-0x0000000000B50000-memory.dmp

Download

memory/4736-265-0x0000000140000000-0x000000014012F000-memory.dmp

Download

memory/4736-143-0x0000000140000000-0x000000014012F000-memory.dmp

Download

memory/4736-141-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4868-251-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4868-254-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4868-245-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4868-474-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4960-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4960-13-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4960-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4960-22-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5792-154-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/5792-48-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/5792-40-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5792-49-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5968-403-0x0000000140000000-0x0000000140131000-memory.dmp

Download

memory/5968-167-0x0000000140000000-0x0000000140131000-memory.dmp

Download

memory/5968-165-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6004-205-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6004-219-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/6004-214-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/6004-217-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6004-211-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6016-105-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/6016-115-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/6016-111-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/6016-229-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/6052-61-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/6052-59-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/6052-53-0x0000000000550000-0x00000000005B0000-memory.dmp

Download