ec82d9daa9908d8d23b0703a6dc3903c3b11c21fbb3408cf3a28094c30339582

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_4beee7cbf09c495d8b9c990caeb658a0_mespinoza.exe
Size 1.2MB
Sample260916-1pasgaef72
SHA256 ec82d9daa9908d8d23b0703a6dc3903c3b11c21fbb3408cf3a28094c30339582
MD5 4beee7cbf09c495d8b9c990caeb658a0
SHA1 1ee4c6f9790005839cc2c2e308e05cb1f6c26156
SHA512 9d39850d893d01665aff49e38cb7046bf82918de24ed4fd1c6cd95317b4e2563c813a79f6d2c94cc891a6f64e09b39cb5b4e5b60f619a526ecf34b8713e79756
SSDEEP 24576:A9lxr9ZUN2mdDM6s2f0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Sr9mNh5rKLNiXicJFFRGNzj3
TLSH
T1B3556D59FB64D0EAE2A1C2FDC642A659E332FD28473249CB4310551B5E7BCF81A7CB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5072	elevation_service.exe
2708	alg.exe
1020	DiagnosticsHub.StandardCollector.Service.exe
4588	fxssvc.exe
1312	elevation_service.exe
4508	maintenanceservice.exe
1960	msdtc.exe
2320	OSE.EXE
1892	PerceptionSimulationService.exe
4112	perfhost.exe
4700	locator.exe
4724	SensorDataService.exe
204	snmptrap.exe
3348	spectrum.exe
4796	ssh-agent.exe
1900	TieringEngineService.exe
2064	AgentService.exe
3996	vds.exe
2368	vssvc.exe
1160	wbengine.exe
3728	WmiApSrv.exe
1776	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8b13c13d862f6ed0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ea857382546dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e6335392546dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c58dfe382546dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006cdced382546dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025f927382546dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000234a9e392546dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce699a382546dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e455a6382546dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b2bfc382546dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8e433382546dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e6335392546dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
1020	DiagnosticsHub.StandardCollector.Service.exe
1020	DiagnosticsHub.StandardCollector.Service.exe
1020	DiagnosticsHub.StandardCollector.Service.exe
1020	DiagnosticsHub.StandardCollector.Service.exe
1020	DiagnosticsHub.StandardCollector.Service.exe
1020	DiagnosticsHub.StandardCollector.Service.exe
1020	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5072	elevation_service.exe
Token: SeAuditPrivilege	4588	fxssvc.exe
Token: SeRestorePrivilege	1900	TieringEngineService.exe
Token: SeManageVolumePrivilege	1900	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2064	AgentService.exe
Token: SeBackupPrivilege	2368	vssvc.exe
Token: SeRestorePrivilege	2368	vssvc.exe
Token: SeAuditPrivilege	2368	vssvc.exe
Token: SeBackupPrivilege	1160	wbengine.exe
Token: SeRestorePrivilege	1160	wbengine.exe
Token: SeSecurityPrivilege	1160	wbengine.exe
Token: 33	1776	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeDebugPrivilege	5072	elevation_service.exe
Token: SeDebugPrivilege	1020	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 2624	1776	SearchIndexer.exe	109
PID 1776 wrote to memory of 4892	1776	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-16_4beee7cbf09c495d8b9c990caeb658a0_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_4beee7cbf09c495d8b9c990caeb658a0_mespinoza.exe"
1⤵
PID:2536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2708

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4252

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1312

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4508

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1960

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2320

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1892

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4112

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4700

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4724

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:204

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3348

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3796

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3996

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1160

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3728

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2624
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9e84e5e698bf53fd4fdc1d258aafc7aca8cc7d4c1248dae6ea5f346617cb7019
MD5 4324f326c7a8c364a938de135bcfbed8
SHA1 0f432bf8e4fdbd651d79a80ae1ed8282fde04014
SHA512 e16b3ad637acc09b12e6ff58619addaa33cb2bf2c070b514a735439660363c64b34b500d688e82d4909ec2fbfa1eaccd4dfa03defccec3e33ad717432666eb6a
SSDEEP 49152:0b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnALNiXicJFFRGNzj3:u3q6mjBL7wRGpj3
TLSH
T1EED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 68676c0a2116735b040ec029d16f430d0e709ad52c13bd293702f679d2bab4ea
MD5 2953e5587f9b4ebeaa5a7abd176fdfaf
SHA1 d43616897cb29bb12b92a3b394afc3ac12fc42c1
SHA512 b9281491dc6f563b08a694c01fe12e4de82beacf89e1e7fa9ee44b92a834e49f812ae850de3918417864368e756ab96da55a3c261e12b8953f91545bdbc0004e
SSDEEP 24576:NXYfDtczAn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YtcCLNiXicJFFRGNzj3
TLSH
T17575012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 31fa071189085a1d178a5d50ad791bd79a78feb5e54869c7919bb369a6fc7040
MD5 8612e674419c719e28b41dcd95a1f19f
SHA1 886c6e8d02ec791fa339a6ad83eb90fb3de62a40
SHA512 281020415d29c76dc428ab71e61306bd6079c24870a8b6b0374eb92e6377f5220ef7940586b1f81161e9381039b8c539a9477031ab1672e277f604e60a7e3da6
SSDEEP 24576:G0Le5ji0hmxhrMI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GPji0Az9LNiXicJFFRGNzj3
TLSH
T1C085AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c78b64fa661c5b6238e10ba6559d8a870d835af0f92754f61cd858ed502c4c30
MD5 814042da2abcd59b5542ebf1c1a4f176
SHA1 69fb623e9622ea87d32e53c2df5ac62f7e180f08
SHA512 e2a9943f3343bc923929a314a3246bea254fbe1c2052684f283b7dda888310971b5d3c907d5d90d12cf6a53ca13dcc5ed51c5d2b812fb00c79012c45fff3e39f
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWj6q8wyuS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:V/ezSC6vUzPv+HjyZLNiXicJFFRGNzj3
TLSH
T193756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 be33ca55862c173ceae1bd0d3db9cfdd140ca3310cf8ba0b0551ba981452d039
MD5 667282c038b36887b97d06bb85b4f230
SHA1 ccd69b918cc47e97215c7b9851d608f23fe5d31c
SHA512 0eb7830e85051b884182c3695fbe1ebfa0c053b6781e326406e0db92b114d8234cb1d586c143ec86a9be2c3b4bd04e3efad2a23b27bcdcdbe3a2ff213401f770
SSDEEP 24576:UVbqPb88hv/l+Bb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UVO88hXl+dLNiXicJFFRGNzj3
TLSH
T11B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 cf0abe2f36675d2970c7ad54a0e45a613c55235a9f50d1ad1be087dd595b1f8e
MD5 19a7240f169e49780e5775ebce2c3d1b
SHA1 506d6688e7e698c7163bed4ca33ba2812781089a
SHA512 4649de784b851775174a7a5e22c8046e5c2718e3f3b4c827c39e036d7730e5652900ef8c36f06fd4ae3873bb5bbea7a0f38240556db45343094fe66db018c9b7
SSDEEP 24576:EGc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0LNiXicJFFRGNzj3
TLSH
T1F95523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2503E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 8790c320d19bdac183826baa1bbbc89fd3c3d59afc497708a58c2a5c81ee7da1
MD5 ce4af3b583224ab3b176c502dd3bec69
SHA1 c3401ad4921501c6d4db08690d83db3f70a228c9
SHA512 9d1f2b717ce29c1ca21362357cb4ccb6cc0d8c75997e962e53c7606d9102263a2e55ccbfdb53adfd603fc85062b3bbbd77a254ecd3643b77f26604d92b0e4097
SSDEEP 24576:wJIUD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wJIUDLNiXicJFFRGNzj3
TLSH
T14C75CF7BEE28FCE2C27E4C7957518600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 69a13ab84f9deff3d71ae65b75bb9468f09325486a3070cdfcb24ebec64c995b
MD5 61e3d26e39de47eeb3cb3326fd908465
SHA1 01f2ac337a997b3abb1a821ac73e533bbe69e715
SHA512 d48665915e2a898816c855d8fde559029770d9c066fc3177e3eceb7729cfc2e8f9755621dfaa6ff5bdfb0048fd01df302411f3bcb457eeabebe1e6aaad62732f
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THn:6QvGAdlCEL8c/WRNw5Ci7wRGpj3
TLSH
T139266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e402e4d10138cd80bec3116c9ef3164d919c522992cd3a1d1c20254fbec84d69
MD5 159dd01961ddf76aaa512f206568dd38
SHA1 40477b67214c3260c8b73cfeaa4dfd1d162a5afc
SHA512 f67d80350a697274baeb2bdd4951f13686c8d7489e753eae7e0a1f165e5052b758230b79336fedab5b0332d65089ec19fed09b9577e18cda66ebafe5a25f2ec7
SSDEEP 24576:/fewsAjN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HljNLNiXicJFFRGNzj3
TLSH
T1C675E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0667a1fe088b727fb6a9e5a290d4af9d5a4b3d390cc4880a0dbeb2935363d670
MD5 1e2dd1d0afba35157a72b951ae572044
SHA1 99bb4d0d19d1f69421e234ed8997917c024ee841
SHA512 5e9f9aaa3291e0861f70348d93954c295d025656ca773ba6b8b4ebb0fa4162cb13534e698ceddc2f09f9b0acd9a85e61446508a9c596a2a1f26b9cacb283fed7
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH5F9:UUEtQevvqc2W1cpV20I32f9
TLSH
T1C5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1445b31deb9116b54e3ec9eaef53865f08db1c4def12c863e99e49ac233c91ad
MD5 79d3c9149184b4371aad75d587b68bed
SHA1 c24785355367f298a2a430ee60b8416a6348b894
SHA512 21e0384ea36ac949d7583eb2acb30d4a5ec9ef0cbfce36e6411b12d365a869f650e22b684f24f8dae7618c4169a6974afbaf108a83673718cc7e7c6bdc8133da
SSDEEP 49152:WCbRquA/m2yL5zLfFiV+XenmE3/ztLNiXicJFFRGNzj3:boq2VjnmO7wRGpj3
TLSH
T1F2D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ec1256e1a064349519bceb973fde0d74b59a61864fe43104ab9e06216add94ba
MD5 88c0c9eda08fd5443bf76c9a716b393b
SHA1 b6e6a94c200d68bf7daa5be1183a9ccf772b62f7
SHA512 76ee38e402d9bc6a19fdb3b04467ab8e4bf85f22b04a08e2a45712110ff55cc4e8b857b8cbf667f665b6162b822ac243d022441aebe6c0be8ed9279ece4dba5f
SSDEEP 24576:GAhGL6IFoiwtA5l7S53u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GAM5Foiq5eLNiXicJFFRGNzj3
TLSH
T146359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 9d4eefb6f407388259b07bb4d11a13b5cfd7417c2b22c8d3b10d6bc2dced13e8
MD5 f418d7619cbdf7bb0d3378df082df288
SHA1 c3bc77042d6230b22f42775cf690e652159f49cb
SHA512 6eb3b966842c11276b473708bb9bce4b7bafe0f8d2a71bf80f55db58f9562d63efa67d50ef5a583896894b425bc03ff9562f216f16f328335e0a73fbd2148d99
SSDEEP 24576:9wuROW5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9wSO6LNiXicJFFRGNzj3
TLSH
T14B65F18632980CF9E9B641398657C036F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2318f7746ef49f34022b202ead27e0ef3de7b333b97e824c3cd5c79a189f541b
MD5 ff12bd36444ab66a2d7850c8fe496480
SHA1 244df9902413016f85514787ba679c50cf1731a8
SHA512 28b3ce05e7362775c0f4015f3cf96eefff14ed13149f41958a4641c9658ff6ca4000128603030e2e0bbbbc2ff1b6e21797d56766ee48e73d1e032b670e228712
SSDEEP 24576:UZuQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uLNiXicJFFRGNzj3
TLSH
T10555129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 374639d270681ce9397944bec309a5b3b63ad6029cd10a3f074417a33c074128
MD5 de0772b22ca0c1d3768f9e446740885d
SHA1 469d5bd71781d76004f12f25e4e5067fff95ea4e
SHA512 72d82b7b5f5abd1ad4196cdc02657035ea637b7f99b98c7dbaf70b10147acc3481ce1945ffea1349142c335147edc3b65d8bdfa3829e4d8de85cb572be303444
SSDEEP 98304:DQRQyi36YOcPDLvw2gAf+PN3P7wRGpj3:SQyiKanX+PNjF9
TLSH
T1E5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3ec2091511d7a52710956b6328a3cdd4df5fba28e822c053b1d8fa4042ec044c
MD5 ed6d832c0e95e5dfda3d5042c0ebd9ac
SHA1 04fc446a44a654241690c01121f2453ad01fdca7
SHA512 c2ce062a70e96d8bddbc90f7265fb8f600655b3b6bc81f79d796ce2094400d3fa29029059a289ffdc8bfdcdc042d2525aab3e252ae09e1fde9f26018ca6699e0
SSDEEP 98304:RQRQyi36YOcPDLvw2gAf+PN3P7wRGpj3:IQyiKanX+PNjF9
TLSH
T124667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9a12151eb06367473a1abe2df9b0d27562930e42609f82103330157cc06c15a0
MD5 2cb3809f0600ae9c75216ea332b9b070
SHA1 950fcc3081d475986a2982e4f67f9a2466d08d5d
SHA512 cdcfde5de632096aaa5f914490523eb4422ed3d72f43f5db59e07c459eb5f58752e0cb2b68a5f14b7477f16e6e0c6b5728be5cece721462ef13473b9793cacce
SSDEEP 49152:+68Qg55nhkeWu7PNU3/9LNiXicJFFRGNzj3:MthTRc/97wRGpj3
TLSH
T1EBB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9eb7ed026a8b098414ac2b095134f0a885784015c949c89c48f9d5a933e5089a
MD5 a6423a3231d5997c0116831c969b1480
SHA1 94788c10df61b57f9d60ee4459fa1942e0d5491f
SHA512 e15a073b4a4198fefe07bb4c31c7f5e62d52c08de939e5c4625b1db59258a912e40be3edda30fb62dc8123435f8ae213acca9bb6e6faa4f726478f82728ec21c
SSDEEP 98304:ay5112gYy5azzVvU69nLKnhZc7wRGpj3:DLIHRWhKF9
TLSH
T15A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b51f1d4c68f9456f5091f81f56cd7d9d9bbcacb2d61575d72d128fe767b5409e
MD5 e7fd863846b782da70bf2e8c880e1086
SHA1 68b2ee372b8a95310609b0821f825a7182699bae
SHA512 195e9e36f6c29c6edbe4debc95d1e0fcbb490d3eed45ac8b97c88acc24474966868eb27b146374ce4493ead756d372d4dd92a6fdef3c4b2803df3e6a10b34d6e
SSDEEP 49152:HB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl+LNiXicJFFRGNzj3:Ju6JmIxd2d+7wRGpj3
TLSH
T117D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2a8490503903af58ed4448be7fadd879f84c818e89abb17affe6f2d2b6cea334
MD5 e4b9d7976e59166702188d1cdee323b3
SHA1 9c8d29821a07723052bafa870bb53587b0d27bfd
SHA512 efa8dfad6c2c709bd13a8c0e9b329bdf9b86272b9f6d104fcaa4ee5e399f4b251b5b39e7832d4e30fec0d52b1291497f26112ebb1ea573db773ba7759ab50e25
SSDEEP 49152:11hpsNoJpF1A67U44CwH7R4xjLNiXicJFFRGNzj3:1mifPqRO7wRGpj3
TLSH
T1EEB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ae22b15abeb4acd112609294200bde8cd51869ff40f027944374400674ad6ac1
MD5 119a2ab5f2913388db2f45eea1d22448
SHA1 a5ae518a2e7db7b658581b67de9ba40e39fc6d42
SHA512 ebe4a267b67dbce9ba5bc4b42941a5ea062ef953b8b23ef196d256bd01f05e9583db6ffa0322f89b1f56cbec7ef438e6dba1ca8678ba97dc52fa159321649cac
SSDEEP 49152:QSuZQIY0Be2KkRVtOnks6NMHqQLNiXicJFFRGNzj3:K5dKqi61Q7wRGpj3
TLSH
T147C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 95e4da7f5fa6bebed8cde6b8dad8c313b7bbf602a5e56106f4e9f0e2a0906254
MD5 9b14877d840d5b0cf784a46cdd090d8a
SHA1 51105f350eb8f264e6464868d38c4074f1530ad6
SHA512 a2f2e1a46f6c34a119a4bc9c5441f719c57f960d96e9635a72fbce07045bac1e00d4a627c8f08e6ca371f6b40defd24dd7de1121147c0dd4ee800adc4e4b435a
SSDEEP 49152:lhtSn8EApI0figjgiDn0AP5wnLNiXicJFFRGNzj3:UX2iWpha7wRGpj3
TLSH
T1B795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6bf66fc3e40647ef0ec90cc005d713c1b4865973b62f772b299dfa38cb64a479
MD5 6dbfc4e106cc4d0b875791fa17e4a012
SHA1 e6cb36e130223b1b259a3d39f422226e54c088bc
SHA512 166415ea0d5b7ffd433bf8c1308d35bc71ce5063a7f0171e4e850250a70e490e74861d930a20891372922d5b3b5ca25eeade8a6756b104bc35aee3805ee6ff28
SSDEEP 12288:8iiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C35523D3558955B1FAFC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f9252eccc65f50d637ba2c759b3b8c7148165a701de13fb0feb63352147d5fb2
MD5 0bc60e092788f9a90e4d545574a983a7
SHA1 45d900474aab1968ef41bfecf7293f38ede9a3f8
SHA512 9abb7511d9c7f446ed13fa7f496424386df1e82809a7ed2379da7c50671aa7913d1e7d556942e888deb76b2df2eb7b891580fae64faf73de022c7c8afce32700
SSDEEP 12288:utiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ux/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1315523D3548955B1F6BC003986764428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 88474ba5f775ae5bedbc37408f0a51c11e4fe673de17fba55c4faad62b2e3bfb
MD5 1f3d120d9933c45ca75e94695e6892a1
SHA1 17cf3d8f8954b153d8bb713bf4abff4db32d8b65
SHA512 3c46092c37a377fba90fee3af7773a6a6775d25dec74306b3c54988a9d9bb0a9a15ee264c0f77c4aaa7a7d6695dbbc9c4ec16804cb758f7f11c97b387c502d24
SSDEEP 12288:q/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13E5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 b1f5112e3926df2a252b8840892907333110c82391fc747580b493bc125d9c8e
MD5 16e0be5d25a54c2bfea51433258af801
SHA1 4bf57a9423cde452966606fe15afc9a3a7b8baa4
SHA512 303c668450e442aa26aeb8c1423b688481e25d182bcbbd43c65b919d721b43b8e07262bbc3ba3fc6b165abca91296782c2367fe98ed6711213cba7a8e7c9b22b
SSDEEP 12288:TVEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B9552393168901F1E9BD8039CA764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7dee43d765bfda37e885af013c6d9da6f6a9d9c3aa7516328bc92c185c7821cd
MD5 4ce161e9ccfb349660c7798d9e40a678
SHA1 0c054e9ec7b8ef3db467bc8e667794657b7d36b4
SHA512 60e079017106a9febd11d1a71c7edf5e5865dc58e49db78be0dca5740a112d559722c41fcb907cf049573431794dbbc724ffe6ad6d12902242c0469474669ef4
SSDEEP 12288:Q8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1175523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b86ae7acf5cf86b03b7ae33b180da198085953e47cec966f95b1c3b37aeaefdf
MD5 850fefef3e548e8ae2f3ae37b4aed021
SHA1 59daae5b528dfde8d5bcec8fd96c602ad43863e7
SHA512 849d6d7e238538c530da01cac659f766d284fa5a23fa2696b18b82f698ecb109e3958a5c9b536c36a3480dd1265f12fd7b45c8c98e7a4ad87985075e6833a641
SSDEEP 12288:PJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:PV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F65523D3558955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 82b6f0581be977d1e7f8d6c9efec0451a44c17174eec1c050dea17851fa6a552
MD5 8b1482ae0bd7930734d86a3c90319de5
SHA1 6db790469b2cbf03a166a4769841d7000c345d7e
SHA512 4622c0fa8a2a24000208a2bb7988408fd13e42fcf95353eb962c41b7bb89a61eb6294601b903c88e9aa00640cd6493907505050072141b41a241a11f2a9362f1
SSDEEP 12288:AliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ap/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D35523D3548955B1FABC003986754428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 aa31f9297ce1b7fc468250ee7adc3c64356831bdbba33c7ae7b6639d3130e753
MD5 1c9d6a9348b8403f8a959c6e6b6813c9
SHA1 74a9736fe699089860e4eb484ae31ce286cfa56e
SHA512 1d7ebabe27aa4864075fe25baefeb271462b6e8db1f26b8cb46cb68eb821e5b411652391d762d19122e5d3e4aa6fcd4f90d99612a70bced99eb7392ad5d183e4
SSDEEP 24576:rZM3zFVSOR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rZM3zflLNiXicJFFRGNzj3
TLSH
T1C0750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 50027862b8f091ebd1a6057961c58d8cf567510189ce521b6b38dba062e0462c
MD5 40f1a2d6f0d16f11fb5f985b94fd6f01
SHA1 c3bbcd7a19b3fd5da764c49a3ff87031c8dc4ce5
SHA512 9ef6a2ec2ce28724ec6e6af14c1340ca30b99185d1defe67c28e6c54f3dac3acf252dde3852fe1cc05931e3d94ee250517d9c74658ff47419b171adee0930515
SSDEEP 12288:JWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14F5523D3558955B1FAFC003986764428F5881E2DEB5619E3E2083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c9128fa8eb827486a126ef25bad6f3773f56c2cb26789f812b05c6bfc1964792
MD5 0edda491b91303bc0791bfc0ef32245e
SHA1 2acc6534ae90bf47f996ffdfe268e03c593e3a2d
SHA512 6041c071a1ff5d5037c0ece13dbaf7c8734aeb8fed50d02454b73c3d76c38e74f4f6bf9ec2728016fa63d8fdc575d02500cc5caba83b03f83f351f907ab247b3
SSDEEP 12288:cqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18D5523D3548955B1FBBC003986754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 cffbf7d845e19da47ec622b5bc4aee6a96aa0cd21fc7d88045626fb1b28832bf
MD5 ef3656420621daf2c17ca0ca19ccc093
SHA1 393877db202482b97fc19fe69839c9bda1112a3d
SHA512 471ed6cbf4f483c58924b4a8dee1248bf40eae1bf34976c99de023d98b12a06324edbe390b404282f3bac9188def0282c4074069e2f4f87a9934228e31a8ff18
SSDEEP 24576:Jzyd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JaLNiXicJFFRGNzj3
TLSH
T12B650247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2308364e5a497c0b83bd6aee6482bf1ecd6b9cda9ffa88b821326ce394490fdc
MD5 696a707dedde5873fc1e8191c3053895
SHA1 4fc34b438a79b3010e17425bbbe3a89e01c58446
SHA512 486bc6fd441c2ca4ae54ef1436c1f4bf91ea312c1d4c8cefbe086a568ac4c36db9e1a4ebc15603308208a9893788f797981491ab2e45ec8758be9cb11ca571bd
SSDEEP 12288:fWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AD5523D3548955B1FAFC0039C6764428F5881E2DEB5659E3E2083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 aa676cd01b15058b683c3be4cee546b85811890ce2a7b35dda0191efa1cf7463
MD5 359b4093abaef4539813bc7e83939bd5
SHA1 2bf01a8f8530e4707284a4c336ad301262d0fcd2
SHA512 c7eecb400ced376735b097e0afae78ee9c544d29a0fb77656803711474d4e0242a4bf29c4d4740d6610058d544be353fb7b7aa45b6f4f799553ea7282b3f3ab0
SSDEEP 12288:xWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A05523D3548955B1FAFC003D86754428F5882E2DEB5659E3E2083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 f921846de3c9eb57ecb741fc0f0af0acb6ed347ed75321f4f1a18036bf4fc76f
MD5 ba09adb0cf8f849b1e89bdfed86a1911
SHA1 71b5f3977bf034efbf99c8f0dfa2620bb4ad821b
SHA512 d85893112ebe4fc89d3822a4fff77534ae84c36f58bd5d392af8cb6efa5380d15d2fed8c8420d17052d5a5eadae1c0df1ec4b0538c86bad4fc6ce0f001272a0b
SSDEEP 24576:dzyd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:daLNiXicJFFRGNzj3
TLSH
T10B650147629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 b1cb9d0d269d004e02630de492fdd7b70f7ccb9de61ada36589430418feb8f82
MD5 0d81cc26fccb049abd99e89fd2e83f43
SHA1 7bc30183b88844f95a8f36cc2acbcd578321a341
SHA512 ee82647e7bddd4215f009e319df00fe940f09b5377a2c4dd4d22cea45b30dd993476c5f11924c6a98f8fd535ea33439bbd7adba6b307729957f42a3489c52676
SSDEEP 24576:ecP4mcvIjkGOxhKP2l71nNKbrh/8KB4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZP4m4IpOO67W8KiLNiXicJFFRGNzj3
TLSH
T1FB65AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a4fe5d0fe3dd9604c698ed88a63485c7e6290d360f2428ca5d217d97fd018feb
MD5 c58bb4bce712cf5054109d489c161013
SHA1 d3355491841e35f677e0c21095a51621be9f45c1
SHA512 540aed662019db54d4f7d41a34943e2367abcaf4c53b0deb6cfdca0fca382c2658aef92a7a4473d7e6894d3541170add2889017bfc8678f0f11a414b9143e8bf
SSDEEP 12288:4psfmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5Q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E965F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB92D0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 28672d1135a62d07c4df6e1120b30275a10d7677577fa1de91008d86b84a5459
MD5 b124d67581e9c7512523202abcb1ed00
SHA1 d45737d46e5770bbf33b52af097064d50f4276a3
SHA512 00c387b9824b88c65c2df496a12e000c6caff797e669415d51f8da052f292ca52b217d9ddd32e42a89b7dfdbce0c119939bc0d8df6bcadc2e780e6c5ae55a99a
SSDEEP 12288:GGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Gw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13A552393528C55B2F6FD1039853A8438B5497E2C9F1599D3E2043A1EA238FEBDF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d0e95d9b3f04f8fd6e306451252f1e307a7a6b85694022eaf03a4c2f34bd09c2
MD5 b597e044aaea90420590443ef8e90471
SHA1 9c6b09e1dcae2806ff95d1027982790fd9609fd0
SHA512 1c060811ef48135567037113e75b68716f671a9a9857bb057fd0fc9bc7dc98c99bf759c6287f178e9ac8a66141c8ea1b8542affc480fe084c63f7f4c9f48c280
SSDEEP 49152:aa0h2GEkuAe73q3pp46zwwQGLNiXicJFFRGNzj3:aa0hNYG4JwF7wRGpj3
TLSH
T14885AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 40835545c933cc967e2d327d61561b50922e4ceedf61d855adbbaee0841d831a
MD5 bdaee8ea7e94cd8170e232b1b32209f9
SHA1 02125fb4908c19616615e14d109394c76c5bf102
SHA512 36b73502c793c7ac269a285cbae8ad0fddb6ebbd9a17de53b2aee2400a9593f04cac70836d0b64565fec25086c7a741ebb06a0e31702d4a74a381b2cd0ad89bb
SSDEEP 24576:ihbHjPh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ihbHjpLNiXicJFFRGNzj3
TLSH
T1815512BE169C20E5F6B5903D8566840AD370BC29172193EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 5e01ede5b1ad44b909c7ce6338c3c600c2a6f2a71a0ca4fce68c46e927593a42
MD5 b6a4deeb30a04a58cf3e424a050d3f64
SHA1 17b200f42a919f7d1e9e43c4d2c6bc1082639402
SHA512 beb38793c4a7d0f4584ca9e1b17fed62c0e1d18e4c555a8acab030f7c4a597033af35e161363d06976177365cc04e4590a09659fefbcb768ad569c87c7ce7194
SSDEEP 24576:R3YgnJcRTk4yti+R5dBR/5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RIgnaTk46pBR/5LNiXicJFFRGNzj3
TLSH
T1C645B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 7824162d3c62fbf5bd3c9b0158c33a07bacc2271c97c21d1966246b816fb0119
MD5 2eead98233cad079cfb29d75c6feaa6e
SHA1 26a0a53e17bfbc851c4ee390542191d8c73b1386
SHA512 d28a24f3678b47612b552aa0c7f55b271db67fe773991729ed7c2b9eb6f6d7bd179cff3beaa4ae7018e613fca1b9c1bd25143ae079bc4256ffa38a486f1e66ea
SSDEEP 12288:ZaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Z8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1065523D2518959B1EBFD003D867A4428B5442F2C9B2619E3E1543E1EA27CFEFCF38522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 2735277773a7f82261e596c9e0ed95463ce2a506d853a2a7a12a348cc5aab80b
MD5 c416674b0cb26e98b13ac6d13f2ccdbf
SHA1 fc8376202de63c0ddee30ffa64bd29ecefc9ffc8
SHA512 987f5bff644cc7982f7daccfd00de0281441a3cef439b3d53979c19e3e721fe20a0ad0cc36fd62023b8574ccb55c9fbc4c9ed500dc322a205b1af2f0c453f816
SSDEEP 24576:vAL3UTn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vAL3UDLNiXicJFFRGNzj3
TLSH
T106750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 c918049d9395e44f3e58972393339741a3faff3e343ac040fa82e75d5de805f1
MD5 ec137df247385b2de5af1e947178e8b5
SHA1 bac4a4e9b21bebe80af0633079529f60455834f6
SHA512 3b124df887e864edb6cb1ca911d567e7ca9c5c5fe161528a61880a9784ec02a095d856a340cc632a29d47a728450f22ba67cc28f12c39a9b8c90eedf602cd2c5
SSDEEP 24576:lOj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lOjLNiXicJFFRGNzj3
TLSH
T1C155125A32DC10F4E579903D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1e8f91e713f4d393cd13af7cdae2e4499cf05d0c0c263a9d1f36d250f995bbdc
MD5 c5a8274f856a7314672d2bed086996ff
SHA1 7cbf61997b27f7427eef3400dceff5311a9e74c3
SHA512 afb4cc2fbf19eee79a54ce1a63eb018f28dfed96009dbda135699bc9e55bcb3b5edafa2ea5c0a2e884d5a553af880bad8b2e2408185af09f372c38429d0a37b3
SSDEEP 24576:X7NM9YqZqmWMUkPjZM48Mv6bEhsg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:X7cBWMpPjN8DbEhBLNiXicJFFRGNzj3
TLSH
T18D65AE2E6BEC81E5D577D13DC9A28205F2F1B8611B318ACB5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 df464ba3768c4f270f5716e3c87e9a36a58643104d0feb37e2bc27e3b21bbb30
MD5 22866c472f41fa32bf0b2b4aa42ee199
SHA1 a22251c185b24faff9e6d5cc2561ee51b5905cc1
SHA512 7fc4a749b6afb6db016a6e31c1a704e7368854d1e6db7ef5d95671c790dd71ce4fde70912e8d3ccb04b2408936fed5a648da5a3a1838295fed974be1fbaab4c4
SSDEEP 49152:HF2YuHNETovAvNYf8kmALNiXicJFFRGNzj3:e6BCf8kj7wRGpj3
TLSH
T185858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 fc0175f21d781eb19ed37a46f66a9159917bf5314a2ce6ce54d6c110f36fece2
MD5 a75d42e382b3506265bb81887a112c7e
SHA1 5d626b296442c2bacd73456cc139be2265d6f9b2
SHA512 9e69d6a6d1d113d905bfb20c1860bc84070bd0778a6db735b799b9ff5d01f6918e278b5c20c4cd8af804fb4eb7d6d236598aed2bf7bdcef7a8675640f11791a2
SSDEEP 24576:rAFs06+Omlf8NXEbTov/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kFs060loXumLNiXicJFFRGNzj3
TLSH
T16065BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 0757d884ec53e20aaa28137f7dd5279a539b1e2af2f3ee75d3998841525f5c82
MD5 96b1f702429d8cbaef07f93736267572
SHA1 7ff359be5f29c38c03fd0e97baeaff356b6aaef7
SHA512 7baf9f8929a5800b7c7e2828fd851eadfa045b9cd1df0f282effb4b12454f4a6fb0aa47ae2c42cdf9228f722a84b357b132180ba61bfd35c5ba42ab7f17586aa
SSDEEP 24576:RJnJ5D3WXm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RJnJ5DGXmLNiXicJFFRGNzj3
TLSH
T1B975D02DD29810F4E4B7C274825A1A55FE72383D2F226AC724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 41eec0ce2f7e4649dcdb5ebf733de51f421def9992a0ac95fcc2ac9281fa33f9
MD5 f24ecd8b0bd1e3924c519beecbfb1f70
SHA1 3d62650553c0aab23713578f1c5c7d8f821bcf54
SHA512 478e16c6a2ecb2d780ee6cdbe2355ac2ccfc1f3cab458189ef2bea0f4c17058be4de5e7713cf4bd240f7af27f3e8ddc565f5b287d3b1b8bf4c746d9d1bf333d2
SSDEEP 49152:4g06DIKdwc+eQnSt65aVkLNiXicJFFRGNzj3:5q7wRGpj3
TLSH
T1AB956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 77d710a402130cab780df011bc582d1a321531f65fd90874b8f06a3f2df146cd
MD5 9ef9b42954030af540b4256d94d4d7f0
SHA1 df9039d9abec8a72fae8a53144c407caa0571801
SHA512 39971edc57be09bcc34e6fcaa22a25a7ef7409f8e6f0b855262ee06cf93a52658732de4c9ddbc07f602bc72810bfa740a0d32d85e727a0e758cb51e3cc7b48c7
SSDEEP 24576:yny/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ynyLNiXicJFFRGNzj3
TLSH
T16B5512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 af031f4f329b89c47bf626b77a792eaaea0308e54f8ab1affcb88b06f31aa517
MD5 79ad994cbd92ced94a9cecbcb48a4cbc
SHA1 4615300bb4aaaa469a8a3d264a6dabb4eb8dfad9
SHA512 4ad9a23d2de186499fc1f7e53a7336e8902f90053138d9b2c856e93f9b9555180deec43ee9d5e1189f673f6bf2c3d961de5b4e8c118661f9408ac0a1dc69d7b2
SSDEEP 24576:tIyx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tIWLNiXicJFFRGNzj3
TLSH
T13365124553C850E5EAB9013CCA734164AA74BC349F2156EF9180BA3FAF36FD59E34B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 eef74521ea7770e7bcbc33e485b4c3c0c5bf02c2b9c2988655cf42dde92c350a
MD5 d25a9fef5a6f775ac48656b7c7913cc3
SHA1 9031776caa5b6e22cf42f752a2aa8319d6325551
SHA512 59eff48d3e9b75edb3b62cc0bf62ec6f440f95962595910039ebee8bab3f7fe903b2d54d9f837d67064beddf7f889731bf5ffa66ad464f29fce10e0aad8e9699
SSDEEP 12288:1yHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Uz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T114552396118964B1FABD003D86364824B1543E3C9B2628F7A1947E3ED379FDBDF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 45830a27cef307a46d584251b01967a92d37656e01b96caab6a068722e460b71
MD5 fd55787e5c3e477584c9ed3ad6f53aac
SHA1 e3af36e1ca75c2f8e1ba5ea24896660608e2c4c3
SHA512 464ef14b69c54f53d503e88cf67933950070a2fe97877ee153f13a5d5048d606ef734edc144f040225cad5dc2a8d58e974864e0dffdba92beb1970342f1070d0
SSDEEP 24576:uQ9MxZKdcz9dw3o/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uVKZoLNiXicJFFRGNzj3
TLSH
T171558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 347cb64f5cd14e6643d2682d8b1be63109f67dd824845ff62c176d38a33aeabc
MD5 9d242c13d73f84b05d67084b9392b334
SHA1 5a8d9068acf9e76440cac4a4bedf26e0f13e00c9
SHA512 dd398811669ea7dcbc368c3415b672e90c4a0d2cdd2ddd4288de73384d16b5c8f81795a2e3f75e2858f9902b62dd6016eb6838fe02727dad806bcad52fd56f4a
SSDEEP 24576:myocDApN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7ocDApNLNiXicJFFRGNzj3
TLSH
T12565E05FB76D40A2E176813C89858204E773B4345B6257CB6291C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3924c9d97555a5e26eb75ce4af6c101cff9d125f6a9a11b9c8895cd6dc6d7a8f
MD5 9a6d4e24e535cda7d8dc77762a8a5551
SHA1 65ebf63803d7b416f996c4f606eadcdd4fdcfb40
SHA512 0fbd847e37e613fd4195dceaea019587a2ac2c846c29c621abef375ac4ca38aacb52f9eda54ad5054a50b22b4be053c22a5b671ecf44f96a512c9fd88b4517fd
SSDEEP 49152:sWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKNLNiXicJFFRGNzj3:m0zuNIn7wRGpj3
TLSH
T1B0A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1980f1f61aa57c98babbec4933a3cef3db41a4a32bc25ebcfd80a6ce0619704c
MD5 a3374fb1d4ff616fdb345c7b36352faa
SHA1 d803af51a331b5615645c67a7f0c361eae17df6f
SHA512 43d5ade4be052c94fbf29d14a433314f0c7083ae423b71b15acd3045847adb24fd09ee0525a9a2ad52ac85bec2603084df91e8742390a31b8f6bf494b8de7d31
SSDEEP 24576:M1QT7EcpfxR+N5AWAz3ooiYzjMqby/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RTDxR+N5YzTBjMDLNiXicJFFRGNzj3
TLSH
T14A55B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 921c23958b7a531e9dd64e5b582ebf4d000cff3b4860523f89579a2df013750d
MD5 0ec60786b8085ccfda041d2db41ba58c
SHA1 207098b70f739e74b6b50146446f66c1b53682b0
SHA512 618e508401fa706f86ff674bb093346edc7aa2b2ef4df8b1f310baed166973dda838b44fa22a4ee82baaabc8c3425bd77e92ebec7e644ca279412f9cf2807b0b
SSDEEP 24576:4TMdOz0FFS+UmSLO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Q0K+UmSLOLNiXicJFFRGNzj3
TLSH
T17275E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 2ea00960c9df44d9e67bcf2a38e99779f7fc21d6b19218b27f3b8ee4bf7bfc62
MD5 c5427ea29dac4d79159ba198fc2ed776
SHA1 9074a48d59068547992b45cd360a456b592217a3
SHA512 b135e5ba51a8c79c2fc33f975e8091fad2e4d2948c73e4f087af4c8e4678c1948260c47225d32aa8ae0fb0833eb4975454ff40b23149f3a9e68c623ef279ec9d
SSDEEP 12288:D4KTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A755125A13D830E0F5BA5139CA364014E660BC3957251AFF71D0A97E9B36FD9CE38B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-295-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1020-43-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1020-34-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1020-42-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/1160-301-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1312-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1312-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1312-290-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1312-453-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1776-157-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1776-173-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1776-307-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1776-191-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1776-455-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1776-353-0x000000000C8F0000-0x000000000C8F8000-memory.dmp

Download

memory/1892-93-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1892-87-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1892-291-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/1900-298-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/1960-318-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2064-140-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2320-77-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2320-83-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2320-319-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2368-300-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2536-15-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/2536-13-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2536-9-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2536-1-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2536-0-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/2708-30-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2708-356-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3348-296-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3348-122-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3348-116-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3728-454-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3728-303-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3996-299-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4112-292-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4112-105-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4112-100-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4508-65-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4508-71-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4508-69-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4508-59-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4588-72-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4588-46-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4700-293-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4724-355-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4724-294-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4796-297-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4796-127-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/4796-133-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/4892-381-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-357-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-377-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-376-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-375-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-397-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-373-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-374-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-363-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-364-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-365-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-366-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-367-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-368-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-369-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-371-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-372-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-370-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-360-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-361-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-362-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-359-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-358-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-378-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-379-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-395-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-380-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-396-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-382-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-383-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-394-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-384-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-385-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-386-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-387-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-388-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-389-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-390-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-391-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-392-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/4892-393-0x000001C009850000-0x000001C009860000-memory.dmp

Download

memory/5072-17-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5072-352-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5072-26-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5072-25-0x0000000140000000-0x00000001402E9000-memory.dmp

Download