fd87fb4e13838037251c3afbf58f83b6a7e8d45858a56e0260482c15d33ca413

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_fd93be02e1b8f9b6fa6bfeec0f8e52f5_mespinoza.exe
Size 1.2MB
Sample260709-3bf4faby3x
SHA256 fd87fb4e13838037251c3afbf58f83b6a7e8d45858a56e0260482c15d33ca413
MD5 fd93be02e1b8f9b6fa6bfeec0f8e52f5
SHA1 b070a109414adb843a7237a2e0e4b3b9487eeade
SHA512 73bbdbd0076ec86fbf05ab3ce4ca0dd5050b6fe01081a4d29865a996bd71dd98164993cdd882dab21a866eef1becfe3ccb811d67d11ef90b5f114ee33ce779ca
SSDEEP 24576:g9lxr9ZUN2mdDM6s2f763J/mB0sqFlXN2c:yr9mNh5rh6MBH
TLSH
T151556D1DBB6890EAE2A1C2FDC642A659E336FD38473145CB4310552B5E7BCF81A7CB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
4664	elevation_service.exe
552	alg.exe
2184	DiagnosticsHub.StandardCollector.Service.exe
3204	fxssvc.exe
2932	maintenanceservice.exe
220	msdtc.exe
1120	OSE.EXE
1644	PerceptionSimulationService.exe
4312	perfhost.exe
2788	locator.exe
4244	SensorDataService.exe
3168	snmptrap.exe
744	spectrum.exe
1680	ssh-agent.exe
4792	TieringEngineService.exe
4856	AgentService.exe
2008	vds.exe
436	vssvc.exe
4296	wbengine.exe
2136	WmiApSrv.exe
3448	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1868474979c0b0e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-09_fd93be02e1b8f9b6fa6bfeec0f8e52f5_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001cb5d88f90fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8f28086f90fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064611287f90fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eda47286f90fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c631c587f90fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d461386f90fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f3fae86f90fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007eb14d8af90fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071069486f90fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f61a0f88f90fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4664	elevation_service.exe
4664	elevation_service.exe
4664	elevation_service.exe
4664	elevation_service.exe
4664	elevation_service.exe
4664	elevation_service.exe
4664	elevation_service.exe
2184	DiagnosticsHub.StandardCollector.Service.exe
2184	DiagnosticsHub.StandardCollector.Service.exe
2184	DiagnosticsHub.StandardCollector.Service.exe
2184	DiagnosticsHub.StandardCollector.Service.exe
2184	DiagnosticsHub.StandardCollector.Service.exe
2184	DiagnosticsHub.StandardCollector.Service.exe
2184	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4664	elevation_service.exe
Token: SeAuditPrivilege	3204	fxssvc.exe
Token: SeRestorePrivilege	4792	TieringEngineService.exe
Token: SeManageVolumePrivilege	4792	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4856	AgentService.exe
Token: SeBackupPrivilege	436	vssvc.exe
Token: SeRestorePrivilege	436	vssvc.exe
Token: SeAuditPrivilege	436	vssvc.exe
Token: SeBackupPrivilege	4296	wbengine.exe
Token: SeRestorePrivilege	4296	wbengine.exe
Token: SeSecurityPrivilege	4296	wbengine.exe
Token: 33	3448	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeDebugPrivilege	4664	elevation_service.exe
Token: SeDebugPrivilege	2184	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 548	3448	SearchIndexer.exe	112
PID 3448 wrote to memory of 3100	3448	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-09_fd93be02e1b8f9b6fa6bfeec0f8e52f5_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_fd93be02e1b8f9b6fa6bfeec0f8e52f5_mespinoza.exe"
1⤵
- Drops file in Program Files directory
PID:3180

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:552

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3340

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2932

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:220

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1120

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1644

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4312

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2788

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4244

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3168

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:744

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1680

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1912

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2008

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:436

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2136

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:548
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7b62e492febbc9ca6a31f855531d7b6930f91bb2dc23b66e5f4f48cd38981b38
MD5 cf2d3ea94d8cea904c7ac92337ba9a36
SHA1 536e7868c73145cba80f8c150c4903e0960c95aa
SHA512 48258266c0f79544bfeea9e37900ad0dd6fa1a653337922f2f97f93a9935b09536d38d579fd843b172e1cbe1ef4c18e8b77718bf4c9221337484ad5fec7ea35d
SSDEEP 49152:Qb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnd6MBH:63q6mjBw6S
TLSH
T1C4D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 c6c18020e84f943f161affaa03b688f85ba4c3e075ca848a54897f5d9e65ab7d
MD5 e876a075b89c15f0c31413026c0847f9
SHA1 e815f181880a70b85dbdecab26889618268ae33a
SHA512 c44cca6ba8718cae61ce7de09d147e6fd27199e3c7795cf941a0c8a81dd43826d31c1ee4fb9bf818ebf2dbaaaed875882f0388ecb0954f28edbfa1d767d2bed8
SSDEEP 12288:C1XLsswWkxy2lRq2czAn63dT3vWZqqVB0sqgyIclmHRG2EkG7N2J:IXYfDtczAn63J/mB0sqFlXN2J
TLSH
T19D05F12867D508E9ED67823CC8A18511EB33B89447A0E79F03E4DA251F337D96E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b9ade71f304903a225047c26ae0e23696cd1d0f6a49d133573c237df2d5fc204
MD5 b739bd06e36c7f98d1fa55235cae88d3
SHA1 5631a3857b3f262f21229022e9781f9255d2352e
SHA512 d58fc2aaef1abd02c8b71a75371a1ceba4a87f7aadd075aaf61a21faf187d6482be6bd63b840eac044755bd01572805592ffb13e4c144640c3076b8aabb40a0c
SSDEEP 12288:fXZNYVLeyUji0h90ZD0wxpGZIVuGrHsu63dT3vWZqqVB0sqgyIclmHRG2EkG7N2L:R0Le5ji0hmxhrMu63J/mB0sqFlXN2L
TLSH
T1F5359E15F6788375D073C0B9C5D2A69AEE7130811B308ACB5286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2d93f128b6b59373497188179d90513648c6535aaefda58d329fd453e6e7ce22
MD5 35fd903e62c85cc3362c3703ab48e2d4
SHA1 ea0dadd944aebc3f11bdc514d9b3e58eb078135d
SHA512 ab4e672719d2574037c5eb77c906a56523484fcfa0d51dbfb7ba11536a5c037a2a9955657ad9761823082fa97f87b2f9a752e9a1f38fcff3fdd272af85ee44ab
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWj6q8wyuU63J/mB0sqFlXN2d:m/ezSC6vUzPv+HjyF6MBH
TLSH
T1DD755C15F5788323D0B3D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 22c03f56596c3ffef2cbb3e29a4183184034e620ffed5ae893ff2cedec4f9095
MD5 0908af2de2497606698d849ee2a0b9cc
SHA1 e4b719fefe00cda6593f48679f3da6e1ab976056
SHA512 74147109aad53d4cee49e9035e6cdc801768a0e1b3b5dae6a0083eec4f0afd4768e41724e2e2e9d640b5acfabff3a8d7374f9d9b28946e87638b40d4d291dea1
SSDEEP 12288:8VJjBq33vb5O8M+l1D0hwsEBoW/lx4/f0Im98r63dT3vWZqqVB0sqgyIclmHRG2C:8VbqPb88hv/l+Br63J/mB0sqFlXN28
TLSH
T138559E65F5B48321D073C0BAC4D2AA9AEE3234415B31CACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 ea78e52bb9d3f4963fe9402f2ea9e88204eafd54afcef3b2b0545d45038b2b7d
MD5 9b37ecae6a02d46708dd158a8bd9392d
SHA1 2fb11a57d3a7b3bcc2c7f078b2ff678329add23b
SHA512 1f9c9c81daa16e902d12a42da79c9232cb113127cad450d2c464ae9bcc776de1e8e0a30916aae8c1d7113b6e165d523a982e4e9c7e087708fb8726ee4e355fde
SSDEEP 12288:1GC63dT3vWZqqVB0sqgyIclmHRG2EkG7N2V:1GC63J/mB0sqFlXN2V
TLSH
T15EC4230C05CD24C6CBEB8E3985F042A5DB25ADB40AE0D93FB4D1F7111CBAA27F664A56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 1c3c4a9a78a2fc427cb062f13412f4bfb752c52f4df253dc8f8301a4a4261d93
MD5 f821db39ce5f3d8cfcf78b60ee42aa8b
SHA1 21cbdf0d5a0ef2b30b9fed5352a3862c5f43d3df
SHA512 fcc786b173b5c149e88f9d051c0eb5d60aa85ca87194ea5ca1ca021e178452af7bb95295b6017c61beac2cd196b69cbc2c8b6933f55ee628f77109bcbcc96b95
SSDEEP 12288:CeBNUbTVO86UD63dT3vWZqqVB0sqgyIclmHRG2EkG7N2u:CJIUD63J/mB0sqFlXN2u
TLSH
T13305CF3BAE28FCD2C27E8DB856918740D77278704B61A3CBE165C30E9E235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c4976a1b5a76c4b239eea9585bba2a97468f813f5789c793fd4644fbd53deef1
MD5 3ecadf15a62faec8176288ce00ab37cc
SHA1 7483e2b96edf3fea9c6cb4cc18db24c0191b9812
SHA512 543b094cbf4df40eb65dc5f16662206911e2f02ed6d396cbf8ff5703b3a3256661e4a868b4550877d04c1e6fd0bce659f15267470d066acee1d223106226f202
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THh:EQvGAdlCEL8c/WRNw5Ck6S
TLSH
T12C266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 20a747f50cff75a9fb82c8145c177369abce5588c3615a0eddff6e6ec12f3e17
MD5 ffdc818b0f80978f28bcc57e61842799
SHA1 900a2de952859b6f951d2b6500fec787eaf1c847
SHA512 2c44d0cabab5776c2615dd9169245af1a935b4d65ba54043369bdfb1c51607c6879de7e89b3d84590fb388dc2270af27c9628b9611930ae1ab0643818d366992
SSDEEP 12288:kAwSfxL/2Dc3mDLLmt0LDQewsAjp63dT3vWZqqVB0sqgyIclmHRG2EkG7N2X:5fewsAjp63J/mB0sqFlXN2X
TLSH
T12A15E030EA78E036C7BB0DB61B35C716583CB9600BA119C7F3E89A9D59702D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 75c1af6fe9c1d08696128bd57dfe0942b5b5390289bd3a209f9507c263722480
MD5 1b7661bbbfbd34c63d4bf7e8ffc83ac5
SHA1 332b7836fcb9b2e2cc8918e2a0645845d10343b7
SHA512 0c418af1f0d691891450a9008a2ce4abc3d77588ea9df632d67efc04c4faeda5ce94da101b4ab5190bc9235cf3570caa6acdf760b4a53ef55e935cab8b66daba
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHx6:EUEtQevvqc2W1cpV20I32M
TLSH
T14E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 157b7da03e22ef5827f7e701a02f25098941cae93ebcaa6f2681e8d25e1f971d
MD5 eedb78b9d3804aafed799696332f2ff4
SHA1 1512014014a8389aa9f0f9d4396418f8eebaeb4e
SHA512 0e95302ca90c7fe3793e6b2c40959576e17f9a56a8c494b9cb6440e04b669b0613bf95004ab0449038cc9a4441d2aa6d8c81f569cd98ba48391c1e37a5519900
SSDEEP 49152:5CbRquA/m2yL5zQfFiV+XenmE3/zJ6MBH:WoqtVjnmQ6S
TLSH
T15ED58D0976B8C1E4D1F6C77886A2C647F37178154B30A7EF5266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 871ddb52f24db34ce2fbab0e3fc756328019e671773ef2a47c5e8446779354d7
MD5 6ecff892eabd820beea59c291d600e64
SHA1 a0848d32c71b7cae855edd041ae9c72b44ae70bf
SHA512 e0991734c45382e54a13c8790758e50b5c532c20c42f51a33aebbad94200e117f53ded2651fe32d492f1959f45c954ed8f31ef396e733d9b338e6e2a057920d9
SSDEEP 24576:8AhGL6IFoiwtA5l7S53w63J/mB0sqFlXN2Z:8AM5Foiq5g6MBH
TLSH
T1DC359D80EBF955D4F5B3AAB899B68171EA76BCA55E31C20F2150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 28f54aa0cefb35fef52977c0566e616c5f675fa18b25324a6938bc4a89ea3b27
MD5 9bcdf0e7800c2cbdf8df3a164202ea9b
SHA1 4785fb72c530f793e3e2abe7d371febcf32b2a51
SHA512 b37c9a809adc15ddb234ed1dcfed1ca71f13f0f3934fa7e5de10b848e1af122cdd68d23d79c560dc1f14491e24b543925f42e184d200ed850098046a8ea476db
SSDEEP 12288:jmw5HEjsChNEBFgl0WDm+C063dT3vWZqqVB0sqgyIclmHRG2EkG7N2b:iwuROWl63J/mB0sqFlXN2b
TLSH
T16C05F10926E91CE9E9A78638C593C136F7B2B8112A61D71F17A0C7575F37321BE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c2b142f1b115e6b1efdf7078dd5c28aff5817fba2dcc9a6665139c8dafb04e0e
MD5 a8752c77ea39c7f3a3af2141f06669e4
SHA1 4910befb8c1e17021e23c4fe95a24daafa3f1117
SHA512 d4b743c4067433b7009772e5ef383c6d3318021d560a4ac2b2e580881ad58f288df999b8ff202b868e9cf31cb88c8fa9acdf9008d19f6a1cfc612cb21aa3ecf6
SSDEEP 12288:UyZ1Iy563dT3vWZqqVB0sqgyIclmHRG2EkG7N2F:pZuG63J/mB0sqFlXN2F
TLSH
T176E4120D22DC20F9D6A7863CC9F04645E77278A0277183DF65A093661F73ED66E39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a76c26e84528b753ee935f3c31e08d4f94c4ac97401e12c566b51b0070165bc7
MD5 06bc0215ae9d2caebfe2436d9bec76d6
SHA1 964369e2043b3e9b2af2d4e216cffa05af9a1f0a
SHA512 71f7670c0883fd8a859a72a7ebc9f7bf0f9f2798cc6327e1289e83b883f2abfd66455664517c0b087a633d0762cec5fd62ae4da68268d38075b096b52e38757e
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U1:oQRQyi36YOcPDLvw2gAf+PN3/6S
TLSH
T1A7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f420fc8d58b333c67c6c553b65bcd50e801e75544eddd6e4ed5b3e361ea51d05
MD5 00c08cf22a7d550131ef807eba76d1c8
SHA1 cd04bfda9b6ddf5c2ee8de4332832eafd729e96d
SHA512 224289ec57716852cda83d21c96ec9323bc79f35ddb4f527acc5105f4924e0cfc8b4df9d45076cb3cf2b4b35199c55381cc2b554925f0b1583e1e4f8aa67a15e
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U1:KQRQyi36YOcPDLvw2gAf+PN3/6S
TLSH
T15F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 62de4e4a7b3146347d5ab65700248b475a234349aed3cfd2fe31599717580939
MD5 c26733e1d0095baf99f192f1ce09ca05
SHA1 ccfd061ea8777fbf540a9186c1fcb1acbf790496
SHA512 c946cc9e0c3c897e425db4fe7cb350b0a6a0ad56194fda21330f95fec93e022366956acb89c4e714346d4f19f5c991e4a42359b99f8fb3a78713883f155a4b7a
SSDEEP 24576:dwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0263J/mB0sqFlXNT:Z68Qg55nhkeWu7PNU3/Z6MBH
TLSH
T113B54933B2F60099C44DE1769F4A872196E27C758FE0E3DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b39727ef82012c144d4d5c2e891f7ef33113d162965901f246922645cae8bbe5
MD5 d789b82896579898ed3e8f0c15857ac0
SHA1 2c09b010e94f020ff57c02f089cbc51e99a177ed
SHA512 dac927aff9bec8159ee03b1513e4f082cb1194e60cf05f4a0172e8cce7ef7f67fa3b65a9d01c76d94474328d94116fc492a4ed8b954c6685a34306fe43cf8899
SSDEEP 49152:l3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99f:Ey5112gYy5azzVvU69nLKnhZC6S
TLSH
T183167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7d168893420d85257f123f7e9e36fa0b821208629295376459bb458eab45faae
MD5 e2c7f2e0ddac824d7ca73f09fc35aac0
SHA1 dbbc2649c9c44fe65e77b566499da7f431227a84
SHA512 db729c28e311b15485ff338c0a4d5eb2cc5ecdca573e55a6f3e41cf9239ba39f58ee0e139f1a66eba66ebbf76398428c6aafa410aad0e04f3f37ded1c0dc12e4
SSDEEP 49152:mB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glU6MBH:Uu6JmIxd2dU6S
TLSH
T170D59D13F1DA01D8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0f58417bfaa1df8c3815a785383cf12f29c25e908cca2437fdffc8b603d62be6
MD5 8a551b31d211d4ad323e90b5eb835924
SHA1 ab767809e3dfa0a02609160494342488e591d4f5
SHA512 7efdf5c95591bbf18b84855ea4a2373a753b68602390120f5b9ae697e6b9eb3a3735e898a113c291f6e1e77c040bef8225048ed265c98e93327f4bab10fa5c23
SSDEEP 24576:Ihv8E1hps0+ogd2z615uCMVF1Agz6oUQ1zNOgLLwH7ReaQXx3z63J/mB0sqFlXNN:01hpsNoJpF1A67U44CwH7R4xj6MBH
TLSH
T1BCB5AD13F2D901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 107b33952ffde207ab1967fa6b03063800ba8579b5c4d6fc774d329f67df9641
MD5 ba1c9b5bb7e512a41b50357aa1bc04ba
SHA1 e79d58bb8639d9cb8feb5c1fac5c984b1c150e76
SHA512 4540314463ebaa9228b7d9f8e17221bb52d6fe25689b5bd57b3710a8733ea214e98e3444036c5e7f9d1db35299338b9cb52f7a8bb17c058bb5fed6336f5b2730
SSDEEP 24576:v4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6zR04FxGgVG2Onks6xt4bSMHnqG63J/mBL:JSuZQIY0Be2KkRVtOnks6NMHqG6MBH
TLSH
T1DEC5BE03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 15c6955f9999bfa027dafe2c17f68bbee1ba7e17253f829029b7602404c7b911
MD5 87919d62738933e3b415580c137b7fde
SHA1 afd04b74794d07d798afbb7e72afc56237621b79
SHA512 587fa89e69df2b72353d5de17ac415a1e70101c0dfa946ade86420685e7b2e33a0e7da347ae786f252038c2893705d45223e9f353f8b8520394109f310f6d93f
SSDEEP 24576:mhiavrPSLT8EARn+FgyUgd0fJY6Bji3iy9CTn0AP5+2QLz63J/mB0sqFlXN2H:mhtSn8EApI0figjgiDn0AP5wn6MBH
TLSH
T13F95BE13F2D900E8D05ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 a680e3a77a6916254eaf485cdd3c52b94e966bcb60dc94476e636c97c311ee01
MD5 709a3b8e949bcbabd9aca974b4a7c157
SHA1 804fe352e1b97807421d1568b10fe33ec38bd883
SHA512 fa0169b7c4e37fbbebc2fb6fd770a7476faedfd149acf6493ea53c04519eca9db60932ebdabf22402a57c7dd81aff696eac39c6f47caf6903f19bcd57ed96f05
SSDEEP 12288:6663dT3vWZqqVB0sqgyIclmHRG2EkG7N2E:6663J/mB0sqFlXN2E
TLSH
T133C4230C08CE14C6CB9B8F79C1F04294EA286EB42BE1D47FB5C5F3212EB6A277664D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 694a1785abc4cfe49918638b33151fd0432f4f69e7ff464dde7789a8904e7219
MD5 97c342baa75582f248fe1fafeb0fa0ac
SHA1 c844a4993e4e57be7e0283682303b94f5d21f4d0
SHA512 65e4332951202b8ec3a9ff226d6aa9feec555ef16d07845a133d7f97c8b97ba15f58b29842d787931a7d5353ca2888d038c2d2ee313aa748c6d47e913703dbda
SSDEEP 12288:2t63dT3vWZqqVB0sqgyIclmHRG2EkG7N2E:2t63J/mB0sqFlXN2E
TLSH
T148C4230C08CE14C6CB9B8E79C1F04294DA286EB42BE1D47FB5C5F3112EB6A2B7764D65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 f679c6e18695c020b8267c18ac3ec7f7421045a0aa60e8c66eaf277878b01e80
MD5 7d239021ba2734836bae2801cbf35023
SHA1 7f758065c6271aea72c72ff3e461ad774b664fda
SHA512 ae721689ac2afef376359433ea949640893a6f3018e64d775ef7b2aab9147109bebbb6d17eef816139acfceb37c35fbd556b20cc6f9f72ffc92b5281a7d8f533
SSDEEP 12288:Bb63dT3vWZqqVB0sqgyIclmHRG2EkG7N2E:Bb63J/mB0sqFlXN2E
TLSH
T15EC4230C08CE14C6C79B8E79C1F04294EA2869F42BE1D47FF5C5F2112EB6A2B7764DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ff8ee09bc137f6053cb8fe0f7ce2c6596c2a3818c19b16cb3841a5e0a6b8d4c3
MD5 8c5dc22f96ddd1b1509ce63b8b556d99
SHA1 4c03f02000f639b0401c39aff1158d4419cba565
SHA512 2397cd49ae501278d7b7b8ae4cb7750743b17c71eb212d147df270201b60bf0f5b46a508b728ee17eddbc6d2b18ef12a47c106abf488c2b1ccb06de68d457a78
SSDEEP 12288:VVQ63dT3vWZqqVB0sqgyIclmHRG2EkG7N2K:g63J/mB0sqFlXN2K
TLSH
T163D4230806DE10C6CAA7CB78C5F08254E775BCF417B1E6BFB580A6111EB2B267A34F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 f8229041961aec2dd29ff120a28ce66c8473bcc2a7eef3df8fb7d9f1f3f7524f
MD5 55f25c0ef775f4965bc699048d523e13
SHA1 a0d022be3f36f11f6f7db96284aa4566e29f3570
SHA512 c9e8938eba4557df606e8eb2ef0ee45a6f03c847816321bb27cb4f978cd921bc6b87dea56f3a2060fed9ace4562e4b30e1b302d02c2cc6b74433c2ee9158538e
SSDEEP 12288:SY63dT3vWZqqVB0sqgyIclmHRG2EkG7N2n:SY63J/mB0sqFlXN2n
TLSH
T1C8C4230C08CE14C6C79B8E79C5F04294EA286DB42BE1D47FB4C5F3112EB6A2B7764D95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 8cc186dd66c8c194876fe0be24bec27a36f8dc86a85b2cd061e5ec70b4fb9b10
MD5 5b1608a7a1fcc3b817bfef24c1f8336a
SHA1 4d5f718a4ab37a71ebdc3a74ae869c4903d3e7c8
SHA512 ce26a5ce2af14f5311229dd3644f5273d9bd2e72d9101625f389d09c7e644dd0eb3a94be0f84136b7c9ace4968075fe44f2a7707154b695ad2372af50cca7561
SSDEEP 12288:WB63dT3vWZqqVB0sqgyIclmHRG2EkG7N2b:WB63J/mB0sqFlXN2b
TLSH
T1F8C4230C08CE14C6C79B8E79C5F04294DA286EB42BE1D17FB4C5F3112EB6A277764D65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 f9a2a093b9fa8b6b5aff4ec92639074e63c6c3df591f0689a16e4755be35174b
MD5 28a33f87252c5c1b265fac23b46631f4
SHA1 b321b7d530798b7dbd1f20587720d781aa1a4a21
SHA512 33c168fc27e1bfd0dd4572bed60883c8d8070b21062f3b073ad497ba2ce5ac9204fe0af30b4b3575d45a573db140a16e7e982b01802b7333b332e31c0788dcc0
SSDEEP 12288:FV63dT3vWZqqVB0sqgyIclmHRG2EkG7N2z:FV63J/mB0sqFlXN2z
TLSH
T1C5C4230C08CE14C6CB9B8E78C1E04294DA286EF42BE1D57FF5C5F3112EBAA277664D65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 3b74a5fb86a01275bd2cc1675c15df9140de4c752d469f63e38794c2b6b599c3
MD5 dfa22536f08ab7c05f6176a820d15227
SHA1 31f6ffb5b81e1997fd3dcc779344c4497031ebf1
SHA512 f260d0b3c1399918db63d5149d4bfbb3d65e2c2725e36dd1b4a672c85caac22dbbf9eb92ef64da03bd89cc3b90b8ed1475482030454904a849eedfa9da12146a
SSDEEP 12288:OiZwbDzzFEoS2cPvyN63dT3vWZqqVB0sqgyIclmHRG2EkG7N2B:xZM3zFVSON63J/mB0sqFlXN2B
TLSH
T120050158739418F8DDA7863EC9618906D6B27C690BB0C61F13E436261F733621D3EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 d92f5fdd076696b741a0b4a2c0a1cdf579cbf7287d50b3d2e458ff8dba483754
MD5 c7a972deebf33c413d31ecacf03d9466
SHA1 add36a597df7943537e55818a5084c978cec1d8e
SHA512 1da17866239576212aeed688d24c9049eb11d103a23ddfad11b4129233772f63a0a484e22d4c6933487fc2a05c575d6cbf7b92d7ed64bed3f3d3ac13c51487d8
SSDEEP 12288:bW63dT3vWZqqVB0sqgyIclmHRG2EkG7N2D:bW63J/mB0sqFlXN2D
TLSH
T15DC4230C08CE14C6CB9B8E79C1E04294DA286EF427E1E57FB4C5F3112EB6A2B7764D55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 8c0643b6485ec873db945c99cdc227d74069b86cbf243fab7c27b3b0111aa84f
MD5 9271d3a55737e228c90fd182f4b8d6f7
SHA1 522747d2520b5c166dc9f9d0dfaa45b5236436fa
SHA512 98a8218969489346ae3a1fe8e4667255e3bddfda22bc501331ed94bde415f77ebf4ddb703013a46c5997a54e15d572aba735d4f1b4e7873977f56da265efb62f
SSDEEP 12288:2S63dT3vWZqqVB0sqgyIclmHRG2EkG7N2D:2S63J/mB0sqFlXN2D
TLSH
T135C4230C08CE14C6CB9B8E78C1E04294DA286EF427E1E17FB5C5F3112EBAA277764D65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 223aa041dfa2bf1c120b87762e9503a211163c4645da944b28cd2206ecc6bade
MD5 8e242726d452e26e3340014c8d654351
SHA1 90ab0e2e1b8b494a2045912e8b288fb48c9328d0
SHA512 2bb7d4f7b127669ea0b7554139f3001501e4b7c4b13151ea531e4640ae5fc9f0710b29dc096c137894eb836aecf7826268c33d4fc9ddfb3266c73018aa46ebf7
SSDEEP 12288:SyPz5L8563dT3vWZqqVB0sqgyIclmHRG2EkG7N29:Pzy563J/mB0sqFlXN29
TLSH
T197F4120B22D930E9D1778638C8A10A41F775B8710770DAAF67A453722F777A16E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 4f6585ce8797caac0fd1fa00b72846c08781d4fb7a3cd8341391d0d745cfb4c1
MD5 5ea925a703351cdbd88f537c2b70deda
SHA1 218cc16c6180980969986b442b59db03d4eff68b
SHA512 4f424b2d84faad7a3b0846b6b7ccda4f14967e3d8cac4a823a1315337f31fb865bf70699829d68f49278d06f8eb057be4b2134a169cad89cd86421aaf9b0bdd5
SSDEEP 12288:CW63dT3vWZqqVB0sqgyIclmHRG2EkG7N29:CW63J/mB0sqFlXN29
TLSH
T18CC4230C08CE14C6CB9B8E79C1E04294DA286EB427E1E57FB4C5F3112EB6A2B7764D65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 fdf121a6991413c4485bf640495435e3afceabcf4d9848b3bf65375e1da0762c
MD5 991bc2b8585391b770cac7f4d8548fe2
SHA1 de9b1a3a0370b9d6cd2338b321542f1978e871c0
SHA512 5fea55999d7ac35011d465fc48cd4e9bdfc7025782f9de5617572dd5aba2bf04a0511675467cd53f319e40d736be9c847d0b7b82fa8f67e15b10482ce1c7b901
SSDEEP 12288:3W63dT3vWZqqVB0sqgyIclmHRG2EkG7N29:3W63J/mB0sqFlXN29
TLSH
T1AAC4230C08CE14C6CB9B8E7981E04294DA286EF427E1E57FF4C5F3112EB6A2B7764D65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 338cf921a5cad768b0816c08ae30ebc126e14fd8b116231ebb00bbd638d5725b
MD5 637a7e0f7fec617b7eeb5144dbf18fa8
SHA1 3e679db00a59e2344ad5679e20dd6b97c9001a1b
SHA512 4ba3aab132a3cbf2a2968a7f8257017978cc6104f178e494c6c9fe8b68450a47f38e8ef72caa9f8b1ab6c29e5a365649a80ed710d70f0581e206cb8cb7c4369d
SSDEEP 12288:wyPz5L8563dT3vWZqqVB0sqgyIclmHRG2EkG7N2j:Bzy563J/mB0sqFlXN2j
TLSH
T127F4120B22D930E9D1778638C8A10A41F775B8710770DAAF67A453722F777A16E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 2e745d135d23f47a1d0ecaf06412c655d8b4b8827291de43d8b9a103882840b5
MD5 0715e52ee868449efc37dcd7c4da2846
SHA1 de17857cb5f8d2feccc604b8f14d6f57c41470ad
SHA512 c6325d9e9db24b21bd60211a75576e18be309c99a02b5349977f491784c35bc81cdc2a742c9cbce0abe6e3d833e069c4a57fc605bcc63764b89b70ca99461e15
SSDEEP 24576:LcP4mcvIjkGOxhKP2l71nNKbrh/8KBe63J/mB0sqFlXN2p:gP4m4IpOO67W8Kk6MBH
TLSH
T17865AD2DABDC0096D0BB917885658A4AFAB1742A1F3286CF1160933D3F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 1ed22b84ec9a02a0561921c48b6c59ba27e76662dada846328a5bd47c17f99e6
MD5 29e1f7d126bce2de4b737074194e0406
SHA1 043aca3c6c52da83681c652e8ffef4417fa80ebd
SHA512 feb3701352c78c83f3f675fda13f35b20a54983f643b17ac5088091423d316c04bec8d78f5907e4ec7de6df095043099fccdbf823e2a49ce79783d4a03194876
SSDEEP 12288:HpsfG63dT3vWZqqVB0sqgyIclmHRG2EkG7N2T:oG63J/mB0sqFlXN2T
TLSH
T1EFE4E009C29812C8C1AF9679C7A14641F7337C6447E1D3DB62C0F63E1F76A91AEE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 e5125fe56e714e7903e5958309c39f561593d8ef70a50d349a616975f0f454b6
MD5 5212e638d17ad203c8fd0b73ef029e38
SHA1 3eb816e88059ab20f2b82d8231fed6c191bbd37f
SHA512 db7a063beb4e95b9f177cffebf7671dfbffaa0a49d58f965756dc227a859a60cc466cb52ce599a8e7390b3046f245d630da19e45234eac4a2f66044a17bf3ae9
SSDEEP 12288:am63dT3vWZqqVB0sqgyIclmHRG2EkG7N2Q:am63J/mB0sqFlXN2Q
TLSH
T180D4230C46CD14C6D7BB9F7485B08264E6297AB41FA0D46FF480F3211DB6E27BE74A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 762ae8583c430968d7668234565869dc530a552406e720c790679066c50b2912
MD5 2878e7e833deedd3674c85fffc32506c
SHA1 d9bfd731e90c6140030fce413844a7299755f601
SHA512 909f6ab2506450af47b6581d2b3f39ac94fe7774ff31f905edcda8613cac7073ac0529f2bed587385c4e7fd8e5828c58115dd128e2373d41ed111db9014b0b6f
SSDEEP 24576:ooiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBu9EzwwXg/bU63J/s:oa0h2GEkuAe73q3pp46zwwQY6MBH
TLSH
T17C859E1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37EE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 e7ea677fe91c653fb5b4e7fa692251ea9e64f611db8db6b9673d4d1c212b492e
MD5 653515380afbfe754d6ad3e7cd153e99
SHA1 9928dc50141d0ce5ac40ea4ad949205d31dff6f4
SHA512 aae8cec8229b8ff199baebcb6861749f9a40fb3a13eac0fea8f1d8501383b1b69f6cc4d82d5c8a6d8ca05041d35a9e100246931a6a4e2beb1ccc98d1b210413f
SSDEEP 12288:shbHjfXd63dT3vWZqqVB0sqgyIclmHRG2EkG7N2k:shbHjPd63J/mB0sqFlXN2k
TLSH
T19FE4012D06AD20C9E6B7D67C85A08246D731B8641721A3EF72C1D2390F3BEE66D35F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2136e1c50736233e9aa0cdea451158fb19a9cbe9a85cf935c26468c854e5be54
MD5 f7c2ba13afe1186ac4925eb93e89c5e0
SHA1 ce597e01a462d523610fb6be22c05598694cd9a1
SHA512 899cec8ffba108eedbd14d8f899fb230a8cb9c8422b81ee6757059bead920c8542ffe11e19c80d1913d47b92f2b405522299f059259726316714371edd713c2d
SSDEEP 24576:o3YgnJcRTk4yti+R5dBR/l63J/mB0sqFlXN2b:oIgnaTk46pBR/l6MBH
TLSH
T14145BF2DF2B910B9C8AAD236454147B5FB71782D1F209ACB0170C638AF1AEE85F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 e24052f9f4f1076c2e4e27985799d0ec9f45407e85f36be126db2c15db1c9cbe
MD5 bda993a8ec46a1aa43934c3dbdcbe62e
SHA1 779aed92545a525f0c4dde23cdb5264c1c5722f0
SHA512 bb9846dfadede6f4aaa39c93313f15a109b1be3ed009a625fa15fd51b9f5cbdea317d2d462a13df58d42cbd6663dad15529e6cf93507675754ea7df86747bf85
SSDEEP 12288:Li63dT3vWZqqVB0sqgyIclmHRG2EkG7N2o:Li63J/mB0sqFlXN2o
TLSH
T1B4C4230C04CE24C6CBAB8F7885E08264E6246AB017B1D5FFB4C5F3111EB6E6B7B74A55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 e683d07ba42bc416ca5d016f9ef19dc374390b520da30019c9523fa666bae139
MD5 8b8a597b60ab2f6fd8471b01abb2faf2
SHA1 f10d801c91ef95017c195b0f35836687203f3a0f
SHA512 d7b504c4269aa0dd4bce87b169305cb83a518f34a493a19ba75ce55cec62cd1bfe06ce38d6f0f508089ff41c1d0fdbd147acabba4d3116164d8b512988b560f0
SSDEEP 12288:UObIA4LWOsvAYFTn63dT3vWZqqVB0sqgyIclmHRG2EkG7N2c:5AL3UTn63J/mB0sqFlXN2c
TLSH
T10D25F118E6D900F9D97BC13CC9A28616D672789C0760E7DF13A88B651F637E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 96d6ba62a6cac1c06114f93847e1192afee60fb10ce557b17972b1d4f517c5f7
MD5 ce024e480a30a2d47825f9fddb4bbb2b
SHA1 81709aa268c569e8028482a6ba54a9c626da07b5
SHA512 58d500f3db3dfeef0e83dac2b63a69c698add49b6610f2823185120176fd555d29a7b5ba0704a0ad6fc6cf7a3ad5f391939bf32f47e5cb7729fde0508ed5c7fe
SSDEEP 12288:ipFtvOj63dT3vWZqqVB0sqgyIclmHRG2EkG7N2L:WOj63J/mB0sqFlXN2L
TLSH
T1B5E4021D26DD20D5D67B963C89A28349D371B8A0076293EF52D0C27A1FA3FF86C39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 15ae378de96cf86e05a582118b90ed334cc38203163c4c7fdd9994f8ca620447
MD5 b36b4ae2467e2c8b527cd32a22897836
SHA1 b12a2b6b9e75f7e64f24ec9fdd5b2eddf7f7e15a
SHA512 692b445d71f4c2b026d85553a90ab866515dec01bbe31ac483615ae9adf598b4436f7fffea61888d6d234d5774ea3d30a98e77aed7c2e631fdd7df06ab4c4e45
SSDEEP 24576:I7NM9YqZqmWMUkPjZM48Mv6bEhsW63J/mB0sqFlXN2c:I7cBWMpPjN8DbEh96MBH
TLSH
T16765AD2E6BEC81D5D577D13DC9A28205F6B2B4611B318ACF1162833E6F37AE44E35B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9a1a2ad63d00f72f36daa3744cc7205f44d62cf9dd10703d22de544d99fd107b
MD5 fa59725fc0fe431f6ae06dcde9fe1a01
SHA1 d69a21108afa77a5ce1d2fa3b9a4139805575f28
SHA512 baa03a97946f97e7b23f7f998fae371eae69450785d7bc8fab4408ad5b24e463bbaf008cecea79af3577ef2d7400599c8ed3ca0ee807ca9e1e39b8db46dbc54b
SSDEEP 24576:8W6BApg2YuyuNDYTabvcdvNYf8km1c63J/mB0sqFlXN26:8F2YuHNETovAvNYf8km26MBH
TLSH
T111858E2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 9a40eb16615c73024c129503e225061ba510a46368c01194d15f4912f8f841fe
MD5 4d2a9afb5fe82944dd5515ef279c1ae3
SHA1 b0ac42a37a7c6a48c25190c355a77593fd62a5b5
SHA512 f304f7d9c211f63d5b4da6dff22b206aa263b4bf477a26a2bb696658325c641579737694d487bc019971083532e4d4948054967a2b6641957c03c84b5e9283e1
SSDEEP 24576:VAFs06+Omlf8NXEbTof63J/mB0sqFlXN2x:aFs060loXu46MBH
TLSH
T16465AE2F66EC00D5D07ED17D8A96C91AF6B1746307256ACB0160C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 cb6225780c2225edeeea843d809e5445051a8e3b52ca4e869ff06f49665de9d4
MD5 142d75402ff4c9adf3d37685fc1b71e4
SHA1 b6e0466e12a8214f7567fa58bd424e7ec02a0f95
SHA512 5c9b4eaeb9f79c5c8c4c8e0c977a636c5ade7ba9f2dab8664f488867874a64ac9ea05226704b9ccdfaa7eaea6bb49e6cf770e2313cbf5b93d5ebcdcb392609ca
SSDEEP 12288:jCJnJ5D3VkrDzx263dT3vWZqqVB0sqgyIclmHRG2EkG7N2J:+JnJ5D3WX463J/mB0sqFlXN2J
TLSH
T10315D02CD2A810E8D4B7C27481991795FF72387D2F2269CB68B4D5353F12EE0AA79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 317708782b0ef15794200264c6a32c4e858044f11f45b9efe7627302f0428bd9
MD5 4ca8c4fa33969b1470f6b72c5aab9cb0
SHA1 45fdfb6ada8e3d9ee6e70b55789764849bced7d6
SHA512 41c65a4a476c08ab283a02821bc44378be542df9b860bba702b043080473811c9d14c21fa82c50629774669cfa48e2b8b35f15d9c9f62d9a846332003784c22d
SSDEEP 24576:lEPghm6/7IIXdwcXrif7qQncjlP65i3Vul63J/mB0sqFlXN2p:yg06DIKdwc+eQnSt65aV66MBH
TLSH
T131956C15BBEA5294E9B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 63360a0143668dc78d5c9ad747f5bb0a7e8ca2925c780018ff1fd40ed04b2edc
MD5 7c7f925bc5d97d25d6bf9232dc517b16
SHA1 0f9e2e72d5a7de29b1b20f71c7cb6fadd1a4673b
SHA512 09d33ff6de05b9aca69d9d05e0666ddc04b573b9a5b23ccc1ec124cde352bc07ce322ab5faf67b94e98b5a0c6a4cb4bdabe041ef66efbb10a93eac9217fdf55a
SSDEEP 12288:AEP3Rn063dT3vWZqqVB0sqgyIclmHRG2EkG7N2B:bn063J/mB0sqFlXN2B
TLSH
T11FE4121C16DD30C9D66B953D85A08244D372F0B02BA267FF65D1D23A4E77AEA2E38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 bb9570bf44ce78ddedc132547effc71212f47612d8f7b614ad6d759793637e17
MD5 79b4ad818a0fd8a7cd72911d74730835
SHA1 d2fd101f1f72da68ce88b537595fc9e6b44a3204
SHA512 d9b90eb07d2cb16e04a21dfa139f6aa30b4a7a1d89ccba2144cb8c6e653cf3323d9bfeeff9b0724fac3da861f8b1617019e8e636f12386a4581df1bbb5e0f5a5
SSDEEP 12288:Gjkyt63dT3vWZqqVB0sqgyIclmHRG2EkG7N2p:GIyt63J/mB0sqFlXN2p
TLSH
T1E8F4120813DC60C5D6BB4A3889B28294DA35BC701B6196EFB0C0F73E6E76BD56934F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 9bf79c0704437fda4871bf028ffd71243937b8c13a4e99ac28e7ab48f231d30a
MD5 4e5369205f7374bdc880fe84e118833d
SHA1 09c23f4730bc5e4893ac817c2a44bf1acbdb54b3
SHA512 005b3ec87b81a28e571ab8fd629d02dcb09a6f620708774a9435ede18ffbabf404b3ba18573bca78618cc71656bb20ea18abaaf27f521632bafccdce20cba665
SSDEEP 12288:myz63dT3vWZqqVB0sqgyIclmHRG2EkG7N2c:Pz63J/mB0sqFlXN2c
TLSH
T18FD4230C05CE24CACBAB8E7881B04794D63479B41BA0A4FFB4D0F3315EB6A977675E45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a3cebde601644f7f5961132af4d335426c4c12acfc1a2f9f2696c30dc904c410
MD5 844580771ea36d7f1ae4735fdf6872e0
SHA1 1fe8ffaa1310c370ebc87e6644081264ea8ce00b
SHA512 5cda97959345f6ae07a1e41c68707db933098c398927ce49716677ccee2cf12f7887344d54947c0bb71b05e3a793652b2e106656cafd8617290f3b385f7ce7f5
SSDEEP 12288:aLQZb3C97GYnZMv5zBcKY9dMD3O63dT3vWZqqVB0sqgyIclmHRG2EkG7N2X:MQ9MxZKdcz9dw3O63J/mB0sqFlXN2X
TLSH
T1CA557C2DABE9058AE177D27995A250C3A633B4301B31D6CF2448D13D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 597fd074e97831ad6944c0728c184a9ef3d2c3a4e520f25f6a8a82a3a50e76fb
MD5 4c8ee7060c6855e033bb530d51262957
SHA1 f648a05d41287b7df4279f88308b21d753e37421
SHA512 d698e272b20908add7bf96714608f3808fc0ecb8037254254b72ba68d9d541b1b35be626f29041034b28ffd35abb4ffa932b08c718dc93ff466d08b8ba348b6d
SSDEEP 12288:vyoKo2JRple9pp63dT3vWZqqVB0sqgyIclmHRG2EkG7N2S:vyocDApp63J/mB0sqFlXN2S
TLSH
T139F4E01FBBAE00D2D167823C89818345E773B0701B62A7DB6591C33D4E67AE9BD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 013f695e3afb93bee9f39254eaaa839749153f72f78017a789b2c601aff933a9
MD5 5b7f706311d9fa7b9405fe07702ddb45
SHA1 380c5764b79589acaa920a94bae963731e85ccdd
SHA512 e8ef9487a76442548b715cc6edbebd6f2fa8c665219b81890dbafd34f2dd5008bd6bf4646e57d31acfa748b4e97d148e94fa3842e820155716f349b6590a0fae
SSDEEP 49152:kWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKp6MBH:O0zuNIn6S
TLSH
T1ABA57B3DA2FC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C578BF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e0879d645be0d30e8967791b828147656b1fd59863b411843f82758ebeaffcc4
MD5 67a64a8345a91f129c8559db0a244503
SHA1 fa66cbcf284b23da89661cc20fc50f2b9a055306
SHA512 029aeb35f2225d328422a76f5e26850a71ea85eb95707eb0ea8b224d87f62cd2a6ba71ad442468d5441a0e307e41361c823ec669b2f6b3a20cb93d53515d5ebf
SSDEEP 24576:w1QT7EcpfxR+N5AWAz3ooiYzjMqb063J/mB0sqFlXN22:NTDxR+N5YzTBjMD6MBH
TLSH
T1E355B02E67F915E9D1BEC5798A23C512FA727821033193CF42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 03fc9d24404e286d0ef4811876c3ab497884945bf30ff7b87af97cb855d7c7ed
MD5 a860c02878bad336c77e5787f2935ce8
SHA1 2b3c8e08a421b9f3fa24f98f1df8c0ce60c28e50
SHA512 654e9e07c2ac52c967e445543e8ba1f5b46f37a88f10c0ff9ef8c7a9fe3132db476722c24442fb5d80788884e0e4aef35c124c4353ec564c24eb1048d7975721
SSDEEP 12288:F/5T+RdOzMbFFTG+eEqNmSL+t63dT3vWZqqVB0sqgyIclmHRG2EkG7N2s:PTMdOz0FFS+UmSLQ63J/mB0sqFlXN2s
TLSH
T13515E13E63AD14E5E57BC27CD6538906EA7234610322A6DB16D0C1792F9BFE43A39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 2b029a45b9c918b979585b3ba87c04c1178825ffd190f9c431aff5ee86af07a7
MD5 50b483a34563b4156d335b687ba89079
SHA1 ee7a579b68d0c79eccb2d3f6e38980ec94d25a03
SHA512 64b1cfc87d52df8b0b0dda88fd11c3632bde4da7656264082bf2d2e3a8110dad1a89961fcc9c398cd69ea05550c2367b7bb6f60504fc9c5457c124d65b954b98
SSDEEP 12288:e4Kn63dT3vWZqqVB0sqgyIclmHRG2EkG7N2b:sn63J/mB0sqFlXN2b
TLSH
T119D4120C03DC30C5E9B79A788AB14255D630B8741761A6FF34D0E6365F77AE6AA38F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-65-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/220-143-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/436-360-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/436-153-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/552-108-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/552-29-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/744-117-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/744-324-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/744-123-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/744-125-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1120-78-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1120-75-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1120-148-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1120-69-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1644-89-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1644-80-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1644-152-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1644-86-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1680-129-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1680-137-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1680-135-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1680-342-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2008-149-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2008-358-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2136-442-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2136-161-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2184-34-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2184-42-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2184-33-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2184-113-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2788-160-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2788-105-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2932-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2932-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2932-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2932-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2932-57-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3100-397-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-376-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-372-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-371-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-370-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-369-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-368-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-367-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-362-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-378-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-379-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-393-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-392-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-391-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-390-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-389-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-388-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-387-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-386-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-385-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-384-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-383-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-382-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-381-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-380-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-394-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-395-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-396-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-399-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-398-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-361-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-400-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-403-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-402-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-401-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-374-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-366-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-375-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-373-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-363-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-364-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3100-365-0x0000026D74090000-0x0000026D740A0000-memory.dmp

Download

memory/3168-257-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3168-114-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3180-0-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/3180-2-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3180-9-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3180-24-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3180-27-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/3204-45-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3204-63-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3448-213-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3448-166-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3448-356-0x000000000CD00000-0x000000000CD08000-memory.dmp

Download

memory/3448-449-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3448-194-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3448-178-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4244-359-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4244-165-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4244-109-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4296-377-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4296-158-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4312-94-0x00000000004A0000-0x0000000000507000-memory.dmp

Download

memory/4312-102-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4312-99-0x00000000004A0000-0x0000000000507000-memory.dmp

Download

memory/4312-157-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4664-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4664-20-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4664-14-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4664-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4792-355-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4792-140-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4856-144-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4856-146-0x0000000140000000-0x00000001401C0000-memory.dmp

Download