8aed784bde1427471184bca07a465409e104fa2db87d19915a8f6393f4b324c0

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
Size 1.8MB
Sample260704-anz3vsdz4q
SHA256 8aed784bde1427471184bca07a465409e104fa2db87d19915a8f6393f4b324c0
MD5 ea591513dd20bfb65bd243532e99953d
SHA1 440510b4919d17dc0d883e7d92a5bc4417ab179e
SHA512 396202eb789ea3ea5ecdc2153c86c2491d856b3cd0686abbafd00483c1e2985f03833446e55cbd899ba46e8250e04d1ea5bcfac48f9097f3f93b2ec402620929
SSDEEP 24576:jRS+OxO8GGC5SYCSsqjnhMgeiCl7G0nehbGZpbD:j0xWXDmg27RnWGj
TLSH
T10D95BD1DFA6848A3F56E81B9FD529786E3737F11477082CB3260722A4E735E0DA39E11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4028	elevation_service.exe
240	elevation_service.exe
2312	maintenanceservice.exe
4856	OSE.EXE
1564	PerceptionSimulationService.exe
3956	perfhost.exe
5804	ReFsDedupSvc.exe
2924	SensorDataService.exe
2496	ssh-agent.exe
5028	AgentService.exe
5524	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9fa6e17ac4173e65.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104437\java.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104437\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104437\javaw.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005dc189354b0bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047046c354b0bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6e599364b0bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
Token: SeDebugPrivilege	5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
Token: SeAssignPrimaryTokenPrivilege	5028	AgentService.exe
Token: SeBackupPrivilege	5804	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5804	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5804	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5804	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5804	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5804	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5804	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5804	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5804	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5804	ReFsDedupSvc.exe
Token: 33	5524	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5524	SearchIndexer.exe
Token: SeDebugPrivilege	5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
Token: SeDebugPrivilege	5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
Token: SeDebugPrivilege	5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
Token: SeDebugPrivilege	5036	2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
Token: SeDebugPrivilege	4028	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5524 wrote to memory of 980	5524	SearchIndexer.exe	99
PID 5524 wrote to memory of 5936	5524	SearchIndexer.exe	100
PID 5524 wrote to memory of 4808	5524	SearchIndexer.exe	101
PID 5524 wrote to memory of 1296	5524	SearchIndexer.exe	102
PID 5524 wrote to memory of 1180	5524	SearchIndexer.exe	104
PID 5524 wrote to memory of 5444	5524	SearchIndexer.exe	105
PID 5524 wrote to memory of 1000	5524	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_ea591513dd20bfb65bd243532e99953d_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:240

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2312

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4856

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1564

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3956

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5804

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2924

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2496

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:980
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2132828192-1552876075-2324613956-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2132828192-1552876075-2324613956-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1296
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1180
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 694273d258cdc72785f12d889e06ab3c6b921dccdd49d280b3b480e17e87d667
MD5 4d51c73ba9d6717f72c7ed58296a4e5a
SHA1 8c543eba38faadf075b24b42b7a2414e5748ee2d
SHA512 52ea0b15a6045e3a744ee487c669edf103ecf5a7c1bcfee3ebc04b0e2acafe6a66e6c69e9ab17e4db62dc4d8610d6bad11a530393b62413a09c8bbe7e6631527
SSDEEP 49152:nb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnSDmg27RnWGj:V3q6sjBpD527BWG
TLSH
T152D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 cea5fb02ca5da9236df5b3a7d70aa095a214f69d75caa20f5573b49528726812
MD5 eed9d53f2a65eea969e4e007a2f40cdf
SHA1 d73ba28a288fc51ced8df5310de89fe110f958e5
SHA512 450ffb5b84c5698f2b177827f9cc1205e8190e76c5d1bfe0d607c147e28548a707516fdf2589f42729f6cd5fa24f3431184075d61189e1fad6f16c0f391cb487
SSDEEP 24576:nXYfDtczAhsqjnhMgeiCl7G0nehbGZpbD:ytcMDmg27RnWGj
TLSH
T1D685F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 8a0ce1685b9f294c8d8f1f7dbaacc9f2fa5ec6ebccd930ec7d36b7af18b91599
MD5 4fd99179c23f195a927b7af92109764a
SHA1 631cc216e21724739b2bd6799f22d1405e2dfc87
SHA512 be8a506544e626bcca2ecbc8370a9ae66701c9ba0df15789f905915db2d6374f596cd732a2669d6d32c9c1137bc13948fcfba6cd0270ca8256032c50bdfb8c2a
SSDEEP 24576:s0Le5ji0hmx7rMGsqjnhMgeiCl7G0nehbGZpbD:sPji0A5LDmg27RnWGj
TLSH
T125959E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5b2d61cc09e44a2b57f779a0e0e7c9102c07c08c1c73af878f10a7bc117d67b3
MD5 43dbb29c231e3d85314525dc419e7664
SHA1 650105dd689e3b6ec6a733dfb6c083b427845870
SHA512 4bbfae85085cad67556388eb1a8b88faad16e7f51528e3245e16991000f80eaaaf1d844ca7381e0e1729710e44ef28f41856176c245caf5c5b550d9c1f3bcf77
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWn6q8wyugsqjnhMgeiCl7G0nehbGZpbD:D/ezSC6vUzPveHjynDmg27RnWGj
TLSH
T13E755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f39c20e3864cd1a378158f68fab2da5ca25ca02b0f2996f76c70a2e98960b5d1
MD5 9675a2b5640d27e67ace56d5a1e5ed60
SHA1 6ebd37eec6b97630a08b33f2a09ec0380e69894a
SHA512 e1098becfd82ef9f12a4785d820141eeee38bcdad6eb59b0360d0d6a41888a05f865a30c49e1dce503b1c2985b1cb518684dbcf7866c2446a052e072e0ae6766
SSDEEP 24576:xVbqPb88hv/l+YFsqjnhMgeiCl7G0nehbGZpbD:xVO88hXl+EDmg27RnWGj
TLSH
T170559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 83812bb2c481f11315e863c747e13fa17b9ac79594d1160e49aa22dc21b7c601
MD5 137bc0cd64ecb2ca6207d713499bf49e
SHA1 5e29734f9ca84d93dde221c4fc8e4665487543ca
SHA512 413bdf52a1b392b4e34679a06c1ba3eba7fde1611488004949fd3bb8eae0b00391f0af5480f4b6a699ebe29822c2141126c0d471c2f3945d3d5cadfee6feca96
SSDEEP 12288:A96Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:A96sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A36523BF874C50CAEA7608B5C3E9F51EAC177E56981008436AA37DFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 46d2bd67c14b6864533b2649606652403800437aa84dc2007daba1032980a6d6
MD5 869772f59393406c570572ea3eab6e84
SHA1 9617ab780d8e0648cefe6c9b22dac481c8ed9bf6
SHA512 a09b457495f102a76bd378457fe5708cc4732685abe158da067531e5de012d24759d1cd6b415be7554d13861bf24eddb6856300e9206229738de6f9438437f71
SSDEEP 12288:1eBNUbTVO86UtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:1JIUtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AB85CF7BEE28FCD2C27A8DB85791C600E76278314B61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6601dabb79176fbfd1b87689e34e737f81e456e48c55a674987795204fdae3ab
MD5 ff523b3a3045633106f43bcfa47495ed
SHA1 df24468976f090e4a37d3150e065682a61ae9de8
SHA512 4ee352b7699e49cb9d2a71f2af8f95bc1f76bd1ec9fe5e6b14042a85a548d13a1e79f997beefbdf29392eec997e820b3fbbc8e499038b751016b9c330c144cce
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THE:8QvGAdlCEL8c/DRNw5CsD527BWG
TLSH
T182266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 cbe7e0b90c5ff8720f94aa34ec78f6ef50fc6954e2869deeef5efe2704f755e5
MD5 6e023c0a9cb45f72aeb0dcf088bba04d
SHA1 3b9ff2346576e18cfd60d14009dc53c59dae668e
SHA512 1f837b589d7079a6856ae299c1af3da49eb78d718d0cf71557ee440da9d17dbfba66f6ebf7ebfb0af97981fb96a709d44b76d57c54467766ca26122d18be90fc
SSDEEP 12288:UAwSfxL/2Dc3DDLLmt0LDQewsAjHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:pSewsAjHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17D85E031FA74E036C77B0DB60B36D71A582D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b0b44ce9b11c76bae77d06e4a9a3e704f1aef73fde4f243ba6a396cbc46661e8
MD5 a7d54729d69287a922fa254d659808f7
SHA1 182ddf7b61cbdfd48a1f18001577325a6908eec9
SHA512 e164d36cf7a6a675570b47b44222c506e1a288366037dd7762a659936ecc229e085583eefcc5e8eda9305d067261233010a14416393c627876104b5253aec83e
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHDVQBWG:AUEtQevvqc2W1cpV2tI326B
TLSH
T164474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8700a0b9880e82ff0be6dd54606a118a2a9a4670c64e2ca08f6c3a36d67378b0
MD5 33e28dc6e40d6b5ab23d582a39f86249
SHA1 cd86a1d5ba8fdd160d15df0562949d88969dc840
SHA512 b2ca80abfe21a96e026a8102400e14374fa42b378b62b7df41691729542316e98d6139d8d9ec9751ab2164e648e66913001974ddf93abb4a94985be053a94b08
SSDEEP 49152:bCbRquA/m2yL5zTfFiV+XenmE3/z7Dmg27RnWGj:EoquVjnmYD527BWG
TLSH
T15BD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d8e7325fd7239ace38b065bd82f777a665ed02868b97e5a69c74a4f5308c8693
MD5 098c92680aa19afd913c58b4bace0cd7
SHA1 ee0e7d0efb69c1823392b264b85a252a5304e88a
SHA512 9c213085c1062404bc379efdad923bc16750a50894c8cf74bc513da9498d4bed10a385953cd809d8a704d0a14e778409b96f1c5e827b2cd02391bc3ab1151fea
SSDEEP 24576:KAhGL3IFoiwtA5l7S53MsqjnhMgeiCl7G0nehbGZpbD:KAMUFoiq5oDmg27RnWGj
TLSH
T1EA359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 492b2d6930ae8dbf6ca5b2d05550bfa6afb6bee2920567f72c223f80b44a753a
MD5 3f0b166311b77bed3864217f69abdf61
SHA1 4a62640e65a25f75ec0ecd48933cce844d0c7743
SHA512 d3c725a8aec808759cb92444d1965d261146d3d2ac028ee21daf968594c41fbd2cb86da9f65c51e19ac7a4466919dc86fda16ba23752d26c3481f82516e02994
SSDEEP 12288:Hmw5HEjsChNPBFgl0WDm+CAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:GwuWOWDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C985F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 58528ed089bfd86b42f3d5a684c72998197ee5656173b99f5176946a513715b7
MD5 b31bcbfc76e9101788cabf1b14d83753
SHA1 e88b5eaedbb939f9dafdb3602191985b623a82f6
SHA512 bb8b954320c1d79337a78387631a2f8be6a193a1362d56c8f0f1e2f3ba799a43a0abd41ed5afa1f9077b63b8c326ff5b794914a28a182fe96c21a809d9669141
SSDEEP 12288:00Z1IyXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nZuOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15B7512AA239820FAE163417CC5E5D609E7337C62673043CF166256AA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e86a645b4960493924319bb512743890e872154064c4493aa021b3628468e90f
MD5 d026f64cf957615e2ba8a81be89eb20a
SHA1 748a900d4563b47451ec0d9e5fc8d2a5e8e7cc59
SHA512 dfb98a4a17567f021ea5c58e3df2d2985b8f76ff2965b5ac18304a9445d4d009805af9842b63853b746da5e1c9f0f6434fe112d06040e040134b61c5fe96cbea
SSDEEP 98304:9QRQyi36YOcPbLvw2gAf+PN3ND527BWG:0QyiKa/X+PN9VQBWG
TLSH
T168667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9185920d30c43cdaa22f7ffa17d27d2393ebdc599ff1b39775483e75576079c3
MD5 14534a720cd11bd89cf4129b1008a5fe
SHA1 21c347b2a3d73a963d5aadf97fb00d4b583c22e2
SHA512 44790f6e9fcf257eace19f9e434c91826353c0dd10ba3f89b92a465bfabf75bb03974791c7ba70996e14bc3cfb4d41746c7ae3d15539c77591966ff3a28fcda1
SSDEEP 98304:dQRQyi36YOcPbLvw2gAf+PN3ND527BWG:UQyiKa/X+PN9VQBWG
TLSH
T1B0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f3742b0b87157e43ab15f41ab477e908ad2b61a9dda43a19ddabb37c005c64c3
MD5 ad2c4641c4aef2192ce0ff8e9da95c95
SHA1 7b1b8da2ea10b949f8ce6524470e42e50b8d8ec8
SHA512 ef66cd8aeea4f2646e29941e094140f6bbf8e7cff5082704048ae61e3458f7a897c9a25af08a3233b7c82f0755600d78ab3fda337fbf56a0f58adfe02b000dc7
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0+sqjnhMgeiCl7Ge:968Qg55nhceWu7PNU3/LDmg27RnWGj
TLSH
T143B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 39c75be3f96c703a8f5ea5762e902b1e73e4bb2fd8c151dff7140abbf4dd940c
MD5 47d107760bdea3a951be7e6a5b0758f2
SHA1 a6b6aed0d8dc1fc23571f968027264b587d927f7
SHA512 1202736a6954102917b91e8d614fa3fe13b0a5e45563b1d2078d507285cfdb49fa688f8a34688b9c213644b04ed59b34f6e6c035d96ce0be28364135751f2763
SSDEEP 98304:+y5112gYy5azzVvt69nLKnhZOD527BWG:vLIHEWhgVQBWG
TLSH
T11C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6f6bb01d323fafa47de754c6f1aeb7c3ddacd5d8e21c78ff3d72ece3098e5175
MD5 cdff4e28159daf6afd4417057485f8c3
SHA1 9fcf07553b4e9a4097f1ecf34aa67e27ea5f3f35
SHA512 2faf2cfb67880b79dd7288e7385a8220967a8c4274c7e1d94b5f9d2ae2a4be491948fc21f149ea9ea315d4c84a5b988ab2ac393009c99d06771478f7551737a8
SSDEEP 49152:kB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gllDmg27RnWGj:+u6Jmdxd2dlD527BWG
TLSH
T17FD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4a34323c5cf2b1d6e536f0caa24f7526f91ba9f3b4286c50a75424a115aaa01c
MD5 e5dbd329fc42751a1884387033173b76
SHA1 165b3442bede13f2275e00b7f1777fe4823e126f
SHA512 873185e35259eeda30e0be2d095552761904e4e73d7d2268807e66acebd1223dedc9f1f0fcb60c2f20f89bd56dcd5b09d8e6d6062bab0c27b87c6d8aba589aac
SSDEEP 49152:91hpsNoJpF1A63U44CwH7R4xxDmg27RnWGj:9mifPWRYD527BWG
TLSH
T15CB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cb9d86366b2cd9a480345d455c0e269bc0c537c4962ac92b306bf97944eb3660
MD5 5fdd61a53233a240c518e68c725d6b4e
SHA1 883d988ef3817d0483eb0992bb2d2b18ca6559d4
SHA512 dd1d4d2c8d3c7aa02da5d6f62544c8876a1c0de7cb868a5746e240175fc4fd83e3c7caa21b012a124b33bda570680d2f617beb86e2c3f3092c65f114034fecd5
SSDEEP 49152:zSuZQIY0Be2KcRVtOnks6NMHqiDmg27RnWGj:x5dKii61iD527BWG
TLSH
T13DC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c46c1699d91fe86acebadaaf61afe4f9efc7b1b08cf5e1f4e132ea22a9ef8b63
MD5 51e9aeda12807908c39178d3c0d836ab
SHA1 d16f17ebdca4ba3c1f77d395c2d42f791049ac18
SHA512 46ee4a2e6a8634020bbedad936c6951f0fed2dab4db7c410fe2aa494f6b4dbd19ee09f209505bd39aabd7cf10c1c7c6f7b00e431971301eb4b8aa4391fbed49d
SSDEEP 49152:khtSn8EApI0fig3giDn0AP5w1Dmg27RnWGj:lX2imphUD527BWG
TLSH
T15395BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 87aaf82937cb22073f5dccf1b2d31b4c755b0ffbee7e45ca8b74ab606eb77e76
MD5 b3c64ea4f6fec10e3851efb1da57ed54
SHA1 3f7c84e7328ff79fd04e4ff75395fa08aecd3385
SHA512 4d456ab3a4297134867cf1097b1062132ae8f0658487ba2a086e6d50bd560dae0ddbf19358b1ae22971bd54462ab914159e1950afd94795b8f174bd6372e5f17
SSDEEP 12288:bCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B6523BF965C41CBE52649B5C3E9F10EA8073E5BE92004837A977CBDEBF14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 049564add7f06ebf3a38c8dd951e749af0e2d4d0a60138c123ef2c84a9103381
MD5 70c758079614402a2f47503901c2c5b6
SHA1 eaf58481fcd3f9448d6b848e7ac92af93085691a
SHA512 6e34d684dbde7cffb9369292f5c65c19c71b30a83016b8cd2671ef2fd5ef01b26bb20009f65a2bcdf8c16f8936a454be0204dbb2f32450f08116fc0f6f62afa3
SSDEEP 12288:M7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:M7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14C6523BE965C41CBE52644B5C3E5F14DA8073E5BE92004837A977CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 0ee22cf20aaf68f3ebd5ee16fb6c12c97040dcf5913690ae894fa29548654579
MD5 e8df43be7d5f63332c9b616c55d9f9fd
SHA1 e96c71193841fdc47962b286fe4f3aacb53e9f61
SHA512 2aea84ede20c5994b00fab871a9095728ec2473109d562469011051165f03af2321c817031b5ae5450595ee57ba0c219c2af332f8485f1713a13bd7315c6efa2
SSDEEP 12288:L1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:L1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1426523BE965C41CBE52648B5C3E6F10DAC073E5BE9200483BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 c234e0d4558baafc964ed37a64621b4ebc327ccf2218dece32d7633e9351894e
MD5 d4dbe44cd3ed5e78fd997f99b3bfe43a
SHA1 5f8c4f96e5679a77ba65cefb2a13705cc9ccaf39
SHA512 b0ec68510c1af2aa4522dc1eb6cfb8e75dc1d562c436fa75bac0e236c3724b506621f5438465ceb7da216ced5a8163bd524158158152fb0156e26e4124fa463f
SSDEEP 12288:7VsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:usqjnhMgeiCl7G0nehbGZpbD
TLSH
T15B65236F575C01C6D83285B4C2F6E11DE8237D96EB3005DB6B532CAD9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 9c75f85d25820a61612333bd990e1a63bd990c74fc6f5493b40938eb813d2e48
MD5 9b080002fbd22fa180723aad1baffe6b
SHA1 f0c85fa11fd7ace3bc77e3ffc74771b6c475557a
SHA512 9738ff892052df402e5e5341b012d23f42a1595fc951b6bec22d43510c7ef467413df7f11fc172d1ed39775923702d653a8da6004c4241657e0407e1f9dd9e5a
SSDEEP 12288:CkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F06523BE964C41CBE52648B5C3E6F14DAC173E5BE92004837A9B7CBDEBF14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 1cebbf77e8aedf76c79129c72286a00db50b65014e907d5050f9b4aa067a2e88
MD5 4f87349d78c4f08553a683382c51c0a9
SHA1 bd339e386d6f36ffd4f9b68509b3cdf388029893
SHA512 f703fb7c2435553363095e36e25b5d0fa8f044d07b4db114e39f8cf98895fea727c873dfc622b841f0bf3a088c15ca17c20ab14fc69b1d8312f98f5c8f268c8a
SSDEEP 12288:bvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1876523BE965C41CBE52644B5C3E5F14DA8073E6BE92004837A977CBEFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 374e08c80b5d3825f487392138d2878f62dd93808f0a376c550b476603d1dcc4
MD5 c7517efe655ee3db1e55cc4e53b5d272
SHA1 f46a5b7de636feb396a8d7a365cb935af639647b
SHA512 9fc3e35839087b4578c924cad02b20fba043b509cff3776bd1a6c6dad4b0772ec83818c9fdb3cd4efd8314075e8743425579fb7126b62c60fea0b3b78b3c346d
SSDEEP 12288:2zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CF6523BE965C41CBE52644B5C3E9F11DA8073E6BE9200483BA677CB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 61d004e9de1b89dc6b1ee35eefc99984e56af77c2001252264c7760b7309e399
MD5 8319cecf1a5501f53214ac92f5233a92
SHA1 0b5af2ef76c26fcecaa3cca1c8f34aaef1b37dee
SHA512 5d0d75a10526cba9c28e503e918cc6808a7651c22f5822891cb7613d9b2976c81b5da12298c7f4efba1cec49b8bead5f1c601190f8b0aa93e7344ff2868fb603
SSDEEP 24576:7ZMrzFVSObsqjnhMgeiCl7G0nehbGZpbD:7ZMrzfjDmg27RnWGj
TLSH
T1638501A9B39418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 66f62e0a37b6a31a55a89555006e7edc54aef943ae115c32acf0bc176492c86e
MD5 089c3c805341be4be8d6583d465c177e
SHA1 47e252108240df4111916f1e7d273753291a60cc
SHA512 67e463301c4ac19ca0570716e74ac08d9f05a4512bf9e1895718922d92d398d4d014c036549f8d8568902e7e5318e1b1519a4cf66b93a5341d6a903cf9d24f7a
SSDEEP 12288:keXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1846523BF965C41CAE52604B5C3E5F14DAC173E9BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 e3ee2b35203dbf47f4f4039c8f7b3fe21478f34c8afa20025985cf3e4dbe1d3a
MD5 8587bb662922a8ed367b220bfea3b5a5
SHA1 8a3da2ce102121dd4471ade6cbf743ee74fc8541
SHA512 bea9e10851a7347b5b861d00018c81dc7e22f6f6a3dea8696e4d3625fdb8243e5551bc99951d9ed9a8505dc19258a0d9696fd0044024ef77753a879abe7bddc7
SSDEEP 12288:sKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC6523BF964C41CAE52644B5C3E5E14DAC173E6BE92004837A6B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 2ea4e5c2b39cafda92849e606869201ad23070ce40329a72288800e25f99188d
MD5 11711e4686a05cb45bd86d90bbe57495
SHA1 d01965acb5cf46c38a36734f0b0688a7ddfddb0f
SHA512 d14c03381a1bb15da22934a6f77df057a3d39a09b9470f8b2e63a8b451ed9b1e61095f393c5d95f2cf169729b62ceb56cbb77c79deb043a7bf8fab70b7314fea
SSDEEP 12288:eyPz5L8XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DzyXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B675025B73A530F9D1368178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 c0893d070aeb55fb5e2eb8ef7f12e59d47c98093613b944d12c898a4259fe4fd
MD5 81d7724356dc93614e9093f2baa83e53
SHA1 5f99ef178b3bd3f4f77fefef9a145fd8c689b6c3
SHA512 4aa1c5841f86d593a17dd950e1f8a75b383d82a3d23f167d55293021ae4c6d018073da4477296c8071be7e0f227dfaeeb39dfe62d2c18669465d34ac6a6a30ef
SSDEEP 12288:qeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D46523BF965C41CAE52604B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 ff46210c1ce38ca2759c7ce860f89ebc0a6f75e1b62595ebdfd7ae3b679e91c0
MD5 ada6e60232b9e26bdfba0e42579f5391
SHA1 f07892e6a08ec9710566f650cdd70abaaf9e8d33
SHA512 be54723b3366d2cdca6456506ea3d6c9a482bceb82d0a2062c571a8d20c6bfb744f3a33acc384be4bd33518ca81d8f4152b829043f4a5e0db2c9cd9bb457de34
SSDEEP 12288:seXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F86523BF965C41CAE52604B5C3E5F14DAC173E6BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 f4cd9cbcbfdf2c88c3df7f4deefe29f1c9224337b43621b5a29bfe59ad99fad4
MD5 9fee18b79ee6b540d3cb5840584525c7
SHA1 65890cf44ee22191a3efd0012a7a3d79745ac0bb
SHA512 a029963de31fd0ff4d6c4171ba586006adbd0cae50983ec985d620f087373921dc4c6a4f2ff666afadc68eac18fc106cc084250750389f9fc8a4791a5522bc9e
SSDEEP 12288:NyPz5L8XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kzyXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B475025B73A530F9D1368178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 8de72f66231c6431961ce2fc0e2968500f90aaf43d8ac921362fb1174f80b4f9
MD5 8e95d311fffb5bd10533e069464cf157
SHA1 1bb8f417e9579896c1041abb22b7c668d212d3a6
SHA512 d21cd6d333a6de6fa295a470f8b260fa9e55f5e5e0b86f80122a567b47af3f4c0bb5839fa15846306bba35504822bef9a791b4e7e120b004492088a2e9de2f7e
SSDEEP 24576:rTxaLl3z0zDlsqjnhMgeiCl7G0nehbGZpbD:rTsLljcDmg27RnWGj
TLSH
T15D8501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 6cfb9dc700b4c911addecccb7f6955584f84b32992965c40fa7034f9187cd1bb
MD5 96a02df4a29d8efe052ce62114673701
SHA1 f6a32361db4a2d6fb39df35bdb2303074b2870cb
SHA512 790696ff732baf5dcbbb97c81e58fdb6f40bfa712416b8e37ff91373c0f183d6d2a892fbd6d014e60a0bd99b88ee6c358672166e27c7990e4c7ab4d81fd7da11
SSDEEP 24576:q3Zd9CHKy7GZpsqjnhMgeiCl7G0nehbGZpbD:MZd9CHKyajDmg27RnWGj
TLSH
T1D895CF90F3E810E9F0B79A35C9769512D9767C5A5B30CE8F03A4255A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 1143360762d63c4c478a3d3769e958e934428400a3eaf691420dc0ee725cef27
MD5 7292290cc430299afcac72a6efbb062f
SHA1 3086057a41649fe24607ae6cbe6b5e013271011a
SHA512 7f04a6223ff76ae36096e066d8982c85ce7eb79b4dfe94c249df6cb283b5c5ddb4d8c0cf5f0940f19fdec86efb37833ed52bb5f64cf79fd6cd786010c12ba116
SSDEEP 12288:UVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1226523BE965C41CBE52648B5C3E9F14DEC073E5BE9200483BA977CBDEBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 6e3821c1178026fd93b835159955dd91341c5ca69c8c059b38b1bde1e3474951
MD5 dc94e43ec236e9c9e1d8189be420a91b
SHA1 2d18f89ad884d597f9d63531d0c0d666b2e6549f
SHA512 c543464d1693464b5ede6ed67a7878756ffa402d9e6daccafe76ea8e1a3051ac4928804bcf4b02a1754d1f9b916e244b1274d2fb056f3fa3433d15df7fd75a6e
SSDEEP 12288:h3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:h3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C6523BE965C41CBE52645F5C3EAE10DAC073E5BE92004837B977CB9EBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 0e817ddbbfe8dfe625c51e418447ef7c667b353ae68deaac937d840ee522b5f1
MD5 0a89592059a4b5106e0dccafef9eff35
SHA1 97ccde418cee9329b2404d9ddb22035729acb719
SHA512 1706985cc3feb8fc235c59c98d3a50a27a70a0f650e170649c363ad3353b476d0b5ccadee53c2d82a589d6d06f20f0824a4277134f11f0e45ad629ea3bf63782
SSDEEP 12288:I4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:I4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F06523BF965C41CAE52644B5C3E9E14DAC073E5BE9200483BA977CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 bb261bd46cd17c4298ecced908d15b28b10f19dd5e45337f492cb7d491b3fe0b
MD5 c44a382d894f60251a38707e61076173
SHA1 5c1e99ccf7870ead587af0ce9ccc00d6dcd3695d
SHA512 c8225fdda4f60255631e2bfb3d6fe8b189cd5adf79e82396036605eb95c5ab6a94909eb8de7b0c6e6d3c8c4fbd9fa3750f537989f5020ed12a04172106c76c7f
SSDEEP 12288:3eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3esqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB6523BF965C41CAE52604B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 215eefa9a9f54ca8ab6acc5d112b6387e6c2553f77bd32446c832b4db59038bb
MD5 a4136741dd8fca80ee84fc3ae7c59f94
SHA1 5316517c12eadb1eb59f486f05959f9614986ba6
SHA512 98b2fdcf3e3a3bd886c2f169019c3b4b2d93bf9b3f13d9eaf47944dbf197f166abe39ae10075c70aa02332c9bf3238a560a2e2066afec9d752e87a6dd8c5a6f9
SSDEEP 12288:EVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E6523BE965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CBDEBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 b1b19acc0ff375268ff65d6d8d4be1ef88ce45137e56afb1318ceaaadfb4a6a5
MD5 5f0571e6f53648764d0eb7fbd87779ea
SHA1 4df12b788e32dbd5c7df9982347c7605c79d3b3b
SHA512 653025d2f7b28f5b8ad47f214ac618aa95ef3b3972e8937c578d5cf5008cd79b7e5d7cc7ac4ee3fd55e61423cf21a6506eeb10ec15142c02b9f87add37cb1dc6
SSDEEP 12288:M2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:M2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F16523BE965C41CAE52644F5C3E5E11EAC073E6BE9200483BA577CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 2386b8b9bd3e3fbc40aaaa4f03f743dcbb6effdb2b398616b74cb0c7bbe4bb6e
MD5 374633ee3bc3834147531dda015dd283
SHA1 3d65fa8af6e1997663002405f89f9590f0099289
SHA512 d70d5b786819f01dbc0938ebb952b8e14e05b1f50539c56ee638f530b2b15d9f99b29117c7564332f2adc7cc93c95400e06d387200108ea81256cd9ad3eba5a4
SSDEEP 12288:9kXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9ksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB6523BE965C41CBE52644B5C3E6F14DEC073E6BE92004837A977CBDEBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 9ba1f1b5326a2c6e4cfefe85a707b485813d38531ffa8f894c4cf3fb10949eb8
MD5 0457b595e50922811a677a310b338244
SHA1 4b4eed6530f3d4ad70555b221abea935196eafa3
SHA512 601e02a336b713fa5f42854945c5fa9a85a03cd810d998157a90beddd5175542eb7574046f4bd743734ae95cc50484151e5834e0030436eeb7f1abdbdcb32b57
SSDEEP 24576:Xfwv2k9RX6wkyAIasqjnhMgeiCl7G0nehbGZpbD:nMnYIuDmg27RnWGj
TLSH
T12E95D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9ad400704614788adaaa2a60b87a3ef847ff33f938ba451bc1d36d859e82c8cb
MD5 bdd76786216f2a4f88df049e601b45b5
SHA1 51938e2cb393dbcfff668afdab5cdddc761367aa
SHA512 7daf19d56a8c57775795f19a92ad1f0bb960d6bb4c14db2ec948bd1bd2408e824bbcd2a4c41f006a315131f424da9048f3ca788fef6833a3d6212054f6760a72
SSDEEP 49152:SYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VDmg27RnWGj:JySzPtD527BWG
TLSH
T116066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1e9a2c69002736bf4edb6fb51e6b86ac06b1bf5a269f1333786cedf598e7323c
MD5 dea4b2b84a2885ce585447d65a292696
SHA1 4c67d01e9dd11f726a94454d659eabab8596d747
SHA512 adfeace9b6818826bbdf015b5c2c34e260983921cb842696f72db85e79a1973c022d31095d09fa65e75e4c8c3444bcd9977796ef107250a10f6ead97e4ef43bf
SSDEEP 24576:147Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYrsqjnhMgeiCl7G0nehbGZpbD:147JUQjTirIhCnDHUPfF/lDmg27RnWGj
TLSH
T11265AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 8cfa13e24898542f80886881f07b29fb09acc541b7536cf4d651af585f8efc11
MD5 df36e492c314c8ecfa425abda49d34f3
SHA1 2d0f0aa9fb87504adad7a25bfd62b3b52586e58a
SHA512 e4bf4de5e12b416765065c058663b4f3fd76d6120ee992c6e98d234aec21e07b76d89c0d71f12c790b920604ad16c23f5a87ae5acb74e3e3f7ce53631fb6c481
SSDEEP 12288:mVsfOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D75015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b0f759dc7aeb2681e059e72add44a095a8f0dd7e8fe718094f74f5c5de66c338
MD5 201c31cb96de630b163fd644ba4fd956
SHA1 0abcfa279d590a53f2f8e4fc033b9e8ed59e2278
SHA512 1ce6db456e02ed2dc081ba2f16249afdfd5cb6033da012fc7f014c33fccab26f74de0aad3d6b595fc4aac50431177be60f3f31f8686d84ae07910b081f42b33e
SSDEEP 12288:ABsFew/9U3fnE8cmPSiZ41iVHBUsPJlFtSIvc/xssbSEaqx8:Ay1UPnEulVHKsRpSsc/qUSnqG
TLSH
T1CD450800766AC64FCA6D40325E32D1CCAB707D51EE44AF0373C88B3FD576659BAE6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 b125118f80f9fe9e47ebcf4afdd6c35b9976b648f442154335af4124a5937451
MD5 19447cc3ac2c30ed413b253e30491364
SHA1 d8e92fd796964a8e817a7c353c6e24c7f339d575
SHA512 83ae101a9fcafb083e9cf00052bf4250e6ddc5ce95625ae5147b20c75270fdb2fa8e109c3c69b2b53f59d15416a876dcae69e9374ab230a8abc4809e8696c9f7
SSDEEP 6144:gwjPbIJP0brm1XFdXGXr0ZKY/6KP8b82819DetMxfDetMxjXYX4m4qQjuINouoWC:pI+m1XFdXGXr0ZB6K5pYX4m4TLD+Qo
TLSH
T1A275EA406537E2CFC1FB603207369B8C7B64EC16B6057F26B3894939D86AB15A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 9b0fcc3b055e9187d3ef45667c981ca9a9e0901cfb5e6b908e9c40c9a72df4b8
MD5 2efbebb3822db5bb8abdaa9d9e3fa168
SHA1 04c0f78cf16054a3d739b133f3bc78bc0b1e8cf5
SHA512 46ccd765e0a9ae85d219964a0591b7570b7c51c8f7e206aaad46fa191284c9d65e4cd31d9a34d0be2603481eff9cc98b0ddcfbbdac5e74724a351243394d73e0
SSDEEP 12288:yO7mXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF65237B934C518AF93605B482EAE12DA80B7E669F1044C3BA5778FDF6B18C48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 98bd49a22c35275a7da3c1fcb598e5812842e75acdfd6d6c5a609883f2fe6cc7
MD5 8a396bbcaa3fea99ab27b8cd18679af3
SHA1 537bc714ebe5b25bc1246b1303e5042c4ca6c75e
SHA512 7c600ae063709dbde588cceed17a7d7c779f2df202392909556c7d943ba2ecef43daaf869a2e5fccb18641574478e315de211cfb410b2233d96d63c3e2a7feec
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bYgsqjnhMgeiCl7G0nehbGZpbD:agb4mBIBhGFfDmg27RnWGj
TLSH
T18A659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 6466f76884323e1a63a19b3d3a350eb44a67eebe0612e5b580772dabb7e22d42
MD5 e5330c7041859113c495b81e8c06cef8
SHA1 e9ee62702a5140fc41e737f0dd9b571fd8bf01c6
SHA512 2e8ba91df85e3d2cd0e12ec1982a2809bc727bf82c0eaf04efcbcf7bb842ebfb45d0fb6aea8b406ac0e99f3238282553752f8337cfcd17469a4edf569e6dc936
SSDEEP 24576:8G88u8FpJqH19zria7/mbsqjnhMgeiCl7G0nehbGZpbD:/7ZFPqVka7/EDmg27RnWGj
TLSH
T14095016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ad45e51d7dcbeda10e67f02d32fca276d64e73d5563bf78720372b0d6f748aa5
MD5 54644f048e58d00f61c6f035ccfe12e0
SHA1 84db0fb6ea04fa7329d468d117d76d40fabc992f
SHA512 6653c8efc1185c0fa03c2378e251a0da5bcc806013a0b5b5e79707b0469af99ffe8e2d63173de34fe8ab30e627cdd27baa4b567f5e176ddac407be8522ac668c
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTDmg27RnWGj:iG05lO43bWD527BWG
TLSH
T129D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 beb669bf9aac8477a1a8e6ecbd7dc0fa6ea9e2d43cc6b890506dea7078b7cd64
MD5 dc153287d9846246cf7dc889d6bee95d
SHA1 d4484c544ef22a696831a8777435291aabc304c2
SHA512 88a91b8d05e88ec232dc1e64da7b0768b18d63252a01bf86313dbfbd8e062ae359c1c7a59eda9ad9a73e1c735a7fcceab235e33174ca9d417f695b819cd1457c
SSDEEP 24576:vfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnBsqjnhMgeiCl7G0nehbGZpbD:Xa5POZ3BJt2pasx2+mLDmg27RnWGj
TLSH
T19265BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 570b57909a9d8554e9f5959a0211ee4c2ba540fce53abc97b4e1625c284a3ddb
MD5 3a8932bcad326de163b226a934e6024f
SHA1 484ca3a7af8beb487f00d8b1b623581a937efc60
SHA512 982a72005b33f22ef6ae014fd82f8749408dfdfae5411633e159785892fff290fa3da46326e664d7382ef74508a8f23943b905c4a335a5bacda80e503ad12ec0
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkjsqjnhMgeiCl7G0nehbGZpbD:VNc/zEOVHFkDmg27RnWGj
TLSH
T144857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c5decafd73d5a8df9d4f2a7617835cdb453c5df6b32c1ec66fb12709125aeff5
MD5 873b8fd64157dec9dd18e235c86731eb
SHA1 611697c30c66a61d327cc4fe4832f74634e8cb05
SHA512 cc64898942ee4150dcb492cfbb2ebdc74ada8edb39501a8995e1345b203099725c1dd17bd5d63bdb461b43c5afb321bff57de654ddb9a0d47de41de9179e13b0
SSDEEP 24576:yTkNvNnaFeYhJNtmZBm9sqjnhMgeiCl7G0nehbGZpbD:yTMwBtOmhDmg27RnWGj
TLSH
T19255AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 725127e0c47dd147b290e0a7a9503bd6a0ff266f6034c74bbba3865891bb7348
MD5 c8307fa6bcff754c43d6d53722265751
SHA1 b4ad5d186b844ddea6e5a538f1ba1204727b6878
SHA512 5d674b7393bd49fb99d8996e666393a1bf1132a83a115792a6ec633c87e8d4bd4530c9798db351c7164e55d569ef260c8a99a5f97ec9b1b13204711b0c534350
SSDEEP 12288:rHvUrBFrEjwaQ/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:rPUr+NQ/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F285F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 92c308a61e704d99ea98b2ce08f4b13eb99b2e71b882df6ddc8820d9e2099f5d
MD5 969a5acc9b486415ad3a15730bd34d02
SHA1 f38fe1a01aa85476badafbc3fc6e76ce8f5bef6f
SHA512 36cc03b2a33bbb97f94de6c89f3cc2ab8f0cb920a5ed02ac64098ed8b189326477086d11adf5e3d36a4c2d1f0c778c05dc4a977b3691db0f0e5dc8c13b870377
SSDEEP 24576:aD3FHshBIYQgAisqjnhMgeiCl7G0nehbGZpbD:aDVHeBIAAmDmg27RnWGj
TLSH
T15595E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/240-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/240-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/240-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/240-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1296-322-0x000002AA0A830000-0x000002AA0AA78000-memory.dmp

Download

memory/1564-73-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1564-65-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/1564-301-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/1564-67-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2312-39-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2312-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2312-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2312-52-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2312-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2496-106-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2496-108-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2496-114-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2496-308-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2924-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2924-305-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2924-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2924-94-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2924-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2924-100-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3956-302-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3956-78-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4028-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4028-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4028-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4028-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4028-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4856-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4856-286-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4856-54-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4856-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5028-125-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/5028-119-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/5028-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5028-130-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/5028-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5036-8-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5036-6-0x0000000140000000-0x00000001401DB000-memory.dmp

Download

memory/5036-0-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5036-7-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5036-77-0x0000000140000000-0x00000001401DB000-memory.dmp

Download

memory/5524-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5524-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5524-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5524-309-0x0000000002F80000-0x000000000321E000-memory.dmp

Download

memory/5524-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5804-88-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5804-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5804-82-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5804-324-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5804-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5804-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download