9dd8d0cb6944b5c90ba1ac7c1fc468cb9a7ae07d432b5f54f22c9334be1154b1

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
Size 1.5MB
Sample260723-la8cvsba86
SHA256 9dd8d0cb6944b5c90ba1ac7c1fc468cb9a7ae07d432b5f54f22c9334be1154b1
MD5 17796dba6034b7cb4beab5dea2ba3370
SHA1 2a6cbaaac9db42362b22ab876c606e60d522f3a4
SHA512 40334b3e6440d239f741bf3133243dd1aaf3a2a99d223d4495f516a466efceecc3b810d63104b24c0e69efd9f43b81f4a71f518a4be73d4459f2c9d33c367d91
SSDEEP 12288:L4WvwR9AtYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Ldukt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T11D75018A6A9554F4D166C13994690F89E262BC40BB00CFDF47707E2D3F7A2E09E3935B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4888	elevation_service.exe
4864	elevation_service.exe
2196	maintenanceservice.exe
668	OSE.EXE
3720	PerceptionSimulationService.exe
2344	perfhost.exe
4536	ReFsDedupSvc.exe
2608	SensorDataService.exe
4184	ssh-agent.exe
2568	AgentService.exe
2492	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\846ca1108f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006eaf7adc841add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d9f2c9d841add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004810119c841add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002450f89c841add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000717a909d841add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006feb069d841add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006549a7dc841add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4864	elevation_service.exe
4864	elevation_service.exe
4864	elevation_service.exe
4864	elevation_service.exe
4864	elevation_service.exe
4864	elevation_service.exe
4864	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4292	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
Token: SeBackupPrivilege	4536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4536	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2568	AgentService.exe
Token: 33	2492	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeDebugPrivilege	4888	elevation_service.exe
Token: SeDebugPrivilege	4864	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4292	2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 4312	2492	SearchIndexer.exe	100
PID 2492 wrote to memory of 2960	2492	SearchIndexer.exe	101
PID 2492 wrote to memory of 4216	2492	SearchIndexer.exe	102
PID 2492 wrote to memory of 5948	2492	SearchIndexer.exe	103
PID 2492 wrote to memory of 2628	2492	SearchIndexer.exe	105
PID 2492 wrote to memory of 1872	2492	SearchIndexer.exe	106
PID 2492 wrote to memory of 1752	2492	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2196

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:668

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3720

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2344

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2608

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4184

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4312
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2880 2888 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4216
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2932 2936 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5948
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2880 2888 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1872
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2932 2936 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7485da32df2c0902c13c48284917a5de91231abdd1e4a08e84fb55bfe42fb1d6
MD5 ba1132cba5c0590e59618e265c7a383c
SHA1 ce3a29e058027ee213a6620635cb03a30274b670
SHA512 a89f80945343573756d5a401f135dd2296f1f918028fcfe213133251872e87de10a41aa5f71c2bd547cfaa165ffcf136c674ab9f45cb9ecd140a0966eda520f1
SSDEEP 49152:Pb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnZ5UfqkdirbGbc:N3q6tjBu5UfNc
TLSH
T10BD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 6f99a6b4dd45e08a44b56a5f161523d858cb67229a591b3b2fe95b99bb5b7b9b
MD5 656a5ba6950cbf8f4d523539af689b97
SHA1 5a61c2595837c697371c95cd6db57a732062a15a
SHA512 6d7fca9e3a0b0738cafd38264d93cb8aef9b5554ebe8c0271303a249a88202c150b4bb358c0198f4110c865c8c8d36332da9f671482adc9aadf634a2a014de12
SSDEEP 24576:jXYfDtczAyt5wXWotDWi//dirlvZGMApYSRiO:mtcn5UfqkdirbGbc
TLSH
T151850128B7D508F9ED67813DC8A28501EB3378914790E7DF03A4AA251F772D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 28736c6d343d8bde1b8634e6bcb7711951d74b31aadde92d787cc8498542f4e8
MD5 6263be7dc88bd9a51594d924d23434cf
SHA1 b1b1e652745b2d5027fbedb0e9380c4e9de98e0d
SHA512 6a535b1c04fb29f68a8c3ac8b4032b704a58e6909cc2c8df156dbff5bc14f5fdc6c3a2a394abad673a6775cdcaa9e018baac2592351340d37fe00b1b19e85aa8
SSDEEP 24576:70Le5ji0hmxMrM7t5wXWotDWi//dirlvZGMApYSRiO:7Pji0AGU5UfqkdirbGbc
TLSH
T137A59E16F6748771D073C0B9C5D2A68AEE7230825B308ACB4285D77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c3f5fb1780629cf4258c36d66a58bf552ac5459043ad680ca467117522a2b1b4
MD5 641d9867d5320fe892e46b7ea1d593c6
SHA1 fbf1480fb7813419e66101ba92bb902a2977b041
SHA512 3c973a67551677eb3428b0911fdf371575f074010d0ffbd190eaab387cbf386d10c8240b4193ea85f635bea9587344d777693f8d8ebe97d229fdf49e14ba0612
SSDEEP 24576:da7/ezSC6vUyDZaqgrvWx6q8wyuZt5wXWotDWi//dirlvZGMApYSRiO:U/ezSC6vURPvMHjyo5UfqkdirbGbc
TLSH
T12A756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9ecc0390f30ff1de70cf26455d7fd774536515c6e1ca430dc3ab8e73976243e4
MD5 ae5896676a85b5d542546f34f574c474
SHA1 90b70af264713a416c7a4593fc53b9a00f919db8
SHA512 22a7fe9fde9aefc4be11adf8d4a2d55b2da40aa240a55268a523378cd616e5e7a4805d4a3cbbe75f7abcf291434128563b9d73ade3337409a8657fc0c0d9bcb9
SSDEEP 24576:KVbqPb88hv/lV7Ot5wXWotDWi//dirlvZGMApYSRiO:KVO88hXlVa5UfqkdirbGbc
TLSH
T177559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 b270dab0238febfc3f49ac52434eae28a8b1f2d655d526c2d2af965629f12ba5
MD5 ef4fcce2ef445dc972545c5bbfc93186
SHA1 684715fb5397501b06210ae0f4acf7df25b3a78b
SHA512 7c30d95f73d97d5a15c613cdb2aabbed746f25ab3f27282672a72736b57b031c85240a0d6c8719592704a338e414fea105195bf457a70113c235ac612d551f61
SSDEEP 12288:eU3YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:eU3t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T18565234ADF5568F3FB5B4532B06D4E46AB727EC088C1866E49203B6816FD1F4E13236B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 473cf6ccab68e6d8d94a183413962a75b2e090f76938016b6ead780d9b423882
MD5 7a92ac5e580eb5ba4bfcb2bd60580e11
SHA1 3e8e37fa492980b8f95934003c084791a4f15f1a
SHA512 d018d9c4ccfd2ebbf7e2ebda45a47e7ecbb373d882eb654e38d4a600abee28d53eb90056a669c2834903c4cfa06de3124d86ca3ad3972d42af12de6cf1d66f51
SSDEEP 24576:cJIU2t5wXWotDWi//dirlvZGMApYSRiO:cJIUG5UfqkdirbGbc
TLSH
T10585CF3BEE28FCE2C27A8D7956918600E77278704F5293CBD164830EDE275E05E7AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f1d54a1694f335b059a6d6d9c2f0e3b2da084c38f9adc38c7ca94c6926044e1b
MD5 4b87398498b2368cae443c1129866d7e
SHA1 9929febe08dc6512ceba1dab7f04980df4857b41
SHA512 9a8ea0552784bbd763c4f663b599893b4a33507404777c80bfaad9316aa9964a68c502bda31634a9c0bba4c838478545408dede8605ce15ca5ceb12ff4f67bc8
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THy:eQvGAdlCEL8c/pRNw5CH5UfNc
TLSH
T1CB266D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 0a09acae4bcb2616c42d3041952773c89a4e6bbe323e39421436f84bf37b1029
MD5 4d325e595cd14502a9845ab6a9e77a17
SHA1 91b59f38f8596d0b3d7685bfbf2076d5412559ce
SHA512 a711cfcd27df188a837f90e78b7d9289b55fd01e2b73ef17513e3594328595711e8d622cbd0d8284988c13eb5db9013a73b88e5f0ca5bc7df1d946d96c40921b
SSDEEP 24576:EmewsAjct5wXWotDWi//dirlvZGMApYSRiO:jljk5UfqkdirbGbc
TLSH
T1AE85E031FE74E436C27B0DB22B36C706583D7A604B911AC3E3A85E9D59742D26336B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e8a7a6e2292cf83349318809e3dc85afb1a6748ac434a6236f536afa195923b5
MD5 e998861d83aca573043430a080bda4a5
SHA1 d58205d879a0287f62ccdf52a99b6566694d4cbb
SHA512 21a1703ed0c820864e77a1cc42d2978086cd42ac20cbfbc6f826311cdfe08549948f3a92b47f1e49b9c866cc8d4cd6730a0ee22332c7239c555433a507da444c
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH2oN:NUEtQevvqc2W1cpV29I32VN
TLSH
T1DC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 44be18a1357ba35be5c91f8f3534461913cfcbdf876aab9c15dfe6ac401bf7fb
MD5 2b42e010d3073405e69d1a3bf8bc022b
SHA1 eea280d7d2320eba64e5c639de5277e967f775dd
SHA512 9f8fecef9122a370eec34f1b3868577225c69986259905a8377aa6004359ffff4cef6911650f06ab6bac1668118870f2280e0d6d5281b915b58ff7a7620bc989
SSDEEP 49152:7CbRquA/m2yL5zTfFiV+XenmE3/zE5UfqkdirbGbc:koquVjnm75UfNc
TLSH
T151D58D0976B8C1E4D1F6C77886A2CA47F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c7dcc7e9a9427668896f3710f03a2e4c1ccb5a4b03740c94a559546c6d60270e
MD5 5215bf20df98d5d09a434f21169d1df5
SHA1 c05ebe37666b312241ce9eb0b16ce7d0a19242ad
SHA512 2ee5b0651621e779061510e9ab98ea9a016ef014d94d03ef13e983dce36044bb2738baca9d9784f6c2b5b6789e5d8ca83d94d6f6d7951507356c44514020ec2c
SSDEEP 24576:AAhGLmIFoiwtA5l7S53tt5wXWotDWi//dirlvZGMApYSRiO:AAM1Foiq5L5UfqkdirbGbc
TLSH
T15635AE80EBF955D4F5B3AA78A9B68570EA76BCA55E31C20F1160D21F0E33A50DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 26b55e99822121ea317d9b334be9567d115fc62b786b3e8da769f70cd5f0b46e
MD5 d09a795ee2ae97b32b3e527380e7a55a
SHA1 c4f9cbf66faefa2903dc842df2d01ddf06275489
SHA512 0a4cbeaa98a25041bc98df2a8d58f9e116f6bce15b8c5596b37aed9657d3e9fb89d813f100ef62bf179aff911207ec75e9077a2f4009611fb06a7a761e2466c6
SSDEEP 24576:swu1OWQt5wXWotDWi//dirlvZGMApYSRiO:sw6Of5UfqkdirbGbc
TLSH
T10F85F14A77A41CF9E9678239C55BC536F7B2BC012A21C71F0760C75B6F37261AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 12eea70cacb3e4d28408a05363e496ca34236148cd14178db6b3150e4cfaa040
MD5 28c6a1d82b356421e1881f4c22898f19
SHA1 02c0174dc179d80056269d3694d41fe8f0db65b3
SHA512 9b7721819f9e92f62636b7692df60614be610388dca9aa1a0ff8754bad5e6286bf640e94dba2c4763cba75b878401143dd43e5b57e716d96e778e7be5d0e918e
SSDEEP 12288:EtZ1IyMYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:KZujt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1B375128A37E430F6E167423DE8E94A05E7727892576283CF062027691FBB6D1AD35733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 146bf5261547d24ef5eb47a6e58f8605f13738e57b5c0a3a8f6145e3a36764a0
MD5 b25ccffc9d22e5f7d6cd9c885090e02c
SHA1 5faa86708146112452af8b2c9bf14c194a038a66
SHA512 5c1c970191853f5318b9d1707c419f1099fbbca8fa4a9a5af0ebe3bfdc1583350b85c47329fa702dd6e5acc84a4ec39c345a7f171299a75d125547c3705ff090
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Um:MQRQyi36YOcPuLvw2gAf+PN3K5UfNc
TLSH
T1BD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 106b34a2d4ab90226e5bbe9dbb9b0599885d1538abb4141f66b43ac56d0e0c5e
MD5 86eebc95614057a7949ae2b475dca37a
SHA1 ffa08a1325d4f8eb78d42abe890af97926fbc672
SHA512 c8093f61d191446ea99ab8514171ef97a237214f48aa0c30e9f473707fc09ab53da678b2834d99499bd748bf62a76efc20ace9ddfa47ae6c79c8e841b9ac018a
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Um:EQRQyi36YOcPuLvw2gAf+PN3K5UfNc
TLSH
T147667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ee254aa5c6c7f1d61f19dc5bf72513a0fa272a72fdb52c351dad21edac1aa939
MD5 8e45772b81fbbf2a3b63172fbbbca897
SHA1 edbdbfb3b227b5dd5aa1cfce853118b8d0fac546
SHA512 3aba26a8c3658acbd5bc80e7618b1de59eff58350527123fd38aff756083b47bc86b14acb45dace6e67953884fda398712536193d3699cbc8b6461a1eec2a28b
SSDEEP 49152:O68Qg55nhxeWu7PNU3/U5UfqkdirbGbc:cthGRc/U5UfNc
TLSH
T10BB55A33B2F600A9C44DD1769F4A872196D27C718FE1E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 71d615011e37f28fd1c1b6979fbe5456db333073afb3346404c08f4e6c729ac2
MD5 890fc9844a098e1d351edff49a251bf5
SHA1 f987bdd2da4b6393a976082acb8e52736c9f880f
SHA512 f510ea6c8252228c079c7b6efcf8a2b2c46919d5fde058a1df578484a7c4f2c214e44ea57573550529a5c149f0509c96093d450356d7599e75782a38d06c5fe9
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99U:4y5112gYy5azzVvD69nLKnhZd5UfNc
TLSH
T10C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 411c54f8509efd2d3a7fe3eeb4baebeaf6c6b8a1510d30c51c700c1320e96a58
MD5 cc26410f13118f1a90f4e35554f66b8f
SHA1 f920bfe31ead2fc159c7ce7cecaebe075dd30cb3
SHA512 fb7b74caaf0b57b43754c211a6b43e0b8ece788e60e399b53c91e729019acb7e834e912640f1e0ee8e7726023a24a77c18ce907be2c184b5bef6aab6dd808eb4
SSDEEP 49152:GB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glS5UfqkdirbGbc:0u6JmQxd2dS5UfNc
TLSH
T140D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 54eb145a34bc6283ac9dc4ebaaf4d184378158b5dd3940f1ef05a6143b983a40
MD5 55bc99ff86459b285f50515aa3ae9ad4
SHA1 b92b02425867e2423e2750516d417786f1c9da26
SHA512 f51c0c2eda4c642552d81847cba510de8a15d1d093d43abd05401ea06015bdd40843877551fcc876c524a04382c85e3de02a1a825c1bbcae113729bfeb3eee58
SSDEEP 49152:n1hpsNoJpF1A6yU44CwH7R4xm5UfqkdirbGbc:nmifPVR75UfNc
TLSH
T1AFB5BE13F2D900E8D05EC17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0a68c74289b97b44aa096d48371a91dd4e57ce6ae567b2afdb59f882086454b3
MD5 3dfda8ceb42c8799f3d2aeba70148a80
SHA1 f3e2293a93af22352314635e0046bf879aebd0af
SHA512 d73aa706c1fb5bf80306ed091e4b153aa422f728daf7ad05c6445fe2015b6feadfbde9a1c2c72a4fffaaa36e16640d12a375d2c2484397cc98ae22d8c7f41a62
SSDEEP 49152:FSuZQIY0Be2KIRVtOnks6NMHqp5UfqkdirbGbc:L5dKOi61p5UfNc
TLSH
T145C5BF03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c2eb50d64c15884c5a4805f465ae46038883898e571129785cf9ef6f06313902
MD5 848f7ff12b0a11cf574dfb488f88b22f
SHA1 a480e22be400c59fae33a6a8a91dc810279f05ee
SHA512 3a659ff2596ed8ec0f55b8f0a02a99eaaa130a9339f44dc34716f21f448d2e4da88487999438370fbafc2a91dd9d13d43dd3863e7d51265f6558d59defe4e9b5
SSDEEP 49152:bhtSn8EApI0figGgiDn0AP5wi5UfqkdirbGbc:6X2i/ph/5UfNc
TLSH
T10695BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 bea63e20ddaffaac23fac97b1735677f5202fa2dac12f242b246280f7a91205f
MD5 92dc0b853cd59e415b9e0b79e2937899
SHA1 5993b3a20a869550f49a3dd87e242d853cbf1283
SHA512 e1a6d3fc1a80b7ace46ec0a2c98bee4536d84df6a5b9bc6d24178c05276b04434d0e2742a5b1d46d98eb83f96766429ebf6c05bd975d6db56f661c84808d841f
SSDEEP 12288:XfYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Xft5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1B665234ADE9658F7F5078572F06D4E49EB253AC1D8C282AF4A20362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 afaa07dda169dfcb3d6b8dc0e338ec24ddd13e4711e640407ed8601815abcbd6
MD5 476657c5b1af4ce719f8d077873cc817
SHA1 6aa1c890946a7b0e0fc36cda6982af73694fc6d4
SHA512 e919606593075ffd66b43447a03d8f1a5a843705d9b973ddd1db23e14867103db65f0ea70ce8a18cac86e02ebabc4f1b32b832b7e0e94131752521e8cab752ce
SSDEEP 12288:WoYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Wot5wXWotDWi//dirlvZGMApYSRiO
TLSH
T12F65234AEE9658F7F5078572F06D4E49EB217AC1D8C282AF4A20362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 07a54c4b3f9cb258e26842151344523e20754b7b8ac142aa0828f1b24abd2a3f
MD5 93356a753e46a1a8c80b28a6902320cd
SHA1 e265e2374b0e6f9bc43893b2ba54bd94759071d0
SHA512 da4f83f4ab94ade8042fc03b5f223707aef6089b50319a01a431e51a028779cb095708a6f152b1f54e725922496918e45589e5fc3749a248b81f6a59e49d0076
SSDEEP 12288:peYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:pet5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1DA652349DE9658F7F5078572F06D4E45EB217AC1D8C282AF8A20362817FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 0be3ab1965d90912ec3616e0dc3a76fe05c9b18107dabaec613e4d657adced7c
MD5 f8a58249fcbe5a7cd670761cde22a016
SHA1 9720640ee9431547e55862f915d3703c04f854ae
SHA512 12784d7c3d3956c9795caa1c73d470199407f471643ca2a4904e7fca4ca7764933b86810b97a4707fd12aac720101b33ca8386b035cd2a03d4f3665bce8209e4
SSDEEP 12288:4VNYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Ot5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1516523456FA654F2F817C236E0694A45F7727DC0DA4283AF4A103A680FF92E4E531B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 01fe954ac792ac49776c2009f5d456f870e236d07268f6f7c5997e976b4c5797
MD5 34943202d275f9b0fdfbcd3db216e7e1
SHA1 c4ff416f0db6eabdcc007cc76e137f2ec70ece5c
SHA512 034d9a658b109bbbf86c8efe652e6ebdec37c52c66e8009660c76d13868d8f99bc4ee424efdbb01f324fcc2620a75f6786c9d8e6f265dfc57906330ec06d7032
SSDEEP 12288:ZlYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Zlt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T109652349EE9658F7F5078532F06D4E49EB213AC1D8C282AF8A20362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 9181abed35556be10936fbd5e474bc762a41430f91c99572d96c53ff6a3728c5
MD5 ed7ce04cd79d9868341abb1be252d44d
SHA1 45d70e823accd4ee187d03fe05fa94b908c8d80a
SHA512 4c6eca2a3bebf98898596f112d36c6ee2ffec69f60a3f2a0b44d034e8022b39b77875becef0ad9a9d330fcd2e70765a3c42178859023e8b94482defff0dfc7a7
SSDEEP 12288:8kYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:8kt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T18E652349EE9658F7F50B8572F06D4E49EB217AC1D8C282AF4A20362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 3ff22eedc1bc5daaab884d9b8160cd36a0548156e2c71d7a1a77ce0400c22cf7
MD5 7de157c941e5ab36d2bd9c2d744b93e2
SHA1 f7e984ab3bf7034fde6045a8d00e2236306bfa26
SHA512 d44af5ea4f23d9dcd8bbdb01f64c703d3fd191c615c03bb74e857e5898fc25dec02b97bc822fecdad9ba1306fd80036f17f23fba844d521a2c205cda98fd4dde
SSDEEP 12288:DgYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Dgt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1DE652349DE9658F7F6078572F06D4E49EB217AC1D8C2826F8A20362427FD1B4A1317BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 64300bb7dd35ee48f2108d265cf4a7e428442a994c5d895b8c6fc948ad85a7a3
MD5 10f9e58832180d7f0339ed0c7910b41c
SHA1 605420cea1af6287a18c185f8b455610550d7727
SHA512 c4859dcc659dc84fd69a5aa7d9fc8f43ddf777b1e6d4f3af356b97a83cdaf8d6165b1bdaf8deb9ce4c2ce0e7c2cf7d14e34373a2775cb13580d9823265abc22e
SSDEEP 24576:gZMLzFVSOIt5wXWotDWi//dirlvZGMApYSRiO:gZMLzfc5UfqkdirbGbc
TLSH
T158850295B3901CF9EC67813EC8658D06D6B27C550BA0C61F03B4362A1F773A15D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 ac32ab4094c872c8aaf38e4f5fb835cf43122cc3b0402369ad831371011b2948
MD5 34dbabd6cd1702158f81958a2a1970ec
SHA1 c63c5eb05dac2a39fee6f3514aacc5acb7620a02
SHA512 39021b0ce1ee60a57b1870483fc78b81c555899cda99b55e8a0144bb95e1a084a617addf04289b908588d78d44454508df88cebc19fcf50d8657e84ec9952d74
SSDEEP 12288:dTYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:dTt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1A865234AEE9658F7F5074536F05D4E45EF217AC198C282AF8A10362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 a095cb25b3a336d3b34c3d6877283286f5123007dc7da52686a10d0747e30e87
MD5 b7ccaca7c4fc9f1610bea4a994703ba5
SHA1 36eeb285d0163955878b05febc6e88ea9f326c14
SHA512 2330424f25ca1caaee295949ccf95714243d97ed408670c3fcdff99d56530f0aa95efebfb64c370f78d28d203bd3994e80cd2cc2e00af13d52c4ff2ed075cdf3
SSDEEP 12288:7nYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:7nt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1EE65234AEE9658F7F5074532F05D4E49EB257BC1D8C282AF8A20362417FD1B4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 944ebd1ca61a9b60163555676548ce91cafcf68eaf26fdca5aacdcd25ad0320e
MD5 6823f51fa24c95c6cda3fe1b88c4c08b
SHA1 08d44de210697c71124d84931d0b4badca2cf767
SHA512 efcd12406fb80fd418e35775439c9a0b1fc49db559941c4b5027c099bb622bd0ab5f9e5d50e3760f9d16a8e1d28da67b50e3b435eb19db46a88d79ad2f7591d0
SSDEEP 12288:4yPz5L8MYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:ZzyMt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T11C75024777A530F9E1278239D8660A02F772787247508BAF476017762F7B2E09E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 81894910ca05a34a0e4036168341004de0759f856859f836d0009621560c17f1
MD5 b31192b318dc74c7b5da548fe9aed026
SHA1 6b5f0e5d39f502fd084696ecbbdc1216e3443c59
SHA512 557af0daae5e3ce7e6bb4db03f921daf7d3ce1a24c9ad095473ed0c40de73f41e4174a38aae4457044152ca0f631e915d56eed6cd8dc88fa5285574ceec8f576
SSDEEP 12288:vTYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:vTt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1F765234AEE9658F7F5074532F06D4E45EF257AC198C282AF8A20362817FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 e4e7c43b343f2f706c8a8d5de03b178d26d19cec5ed2e56e1ca258cdf9f85132
MD5 d4c7427cbfac9c1a0762ab5ef93ae79a
SHA1 332633079e7b4b1e54dc01b98e6d1aae035fe6b3
SHA512 50fc67ec6c317c8ca5e83f4df3b5275ea23ba11f4b9bdd3e8605bf2a80cd6cf3604ba7a06bf4da6326fcf13769c701392359066919f2542b8c1004b9db101a6c
SSDEEP 12288:VTYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:VTt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T11065234AEE9658F7F5074532F05D4E49EF257AC198C282AF8A20362817FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 116583d0426321fd299407818e3cbc155cc48c9bad67d4ba498905a9e5eac655
MD5 5a8cfa5242353c072674021a6f52754d
SHA1 41ceb3c239695c59f164fb4a47e58895b9e7166b
SHA512 134cd64f08afed52eaf1d48db918b6e6a56bb6504d3b6c7906a8c475c8a7fe9f756f423574c40b01dfd4d12b20870a428749e73777dac133cb6bb94c697a8cd8
SSDEEP 12288:NyPz5L8MYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:kzyMt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T18775024777A530F9E1278239D8660A02F772787247508BAF476017762F7B2E09E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 f9fb3f52876885af690291ecbf70ab3152cf8800628ba2f5ed376e551c1c3918
MD5 a83566c7d1b8ac294b984dc6271c9cea
SHA1 4d68eff740dbafd9a6c095f77694209320a13bb9
SHA512 e81b0a273024105c18165e63c1e7b853046472a6c22605c973061c200c81e596a3bc1607be769797bc0b5247e1abaab405df41cb9c4b8c1e6317031c5a5a0a6f
SSDEEP 24576:wTAaLl3z0zDut5wXWotDWi//dirlvZGMApYSRiO:wTHLlj35UfqkdirbGbc
TLSH
T1F5850295B3901CF8EC67813EC8658906D6B27C560B60C61F03B4376A5F773A15C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 a8ac0a7efbd608ebfe32e8da281f7ba2ec42ea8b7a0219b82bd8ad258e571fb1
MD5 9922231f02f97ee264e1b8c9cc995b7d
SHA1 086a6cde5328d6d7793417e7a3446733a2db29bd
SHA512 2db3a72ea3eca5de8dd4c0ad0de47162ed61db5a49b2a1000836498ce6b9e28bdd6cfc0c22ff4cea04da4e899538aa65c61e012365f3eca2be4e1846273c6b65
SSDEEP 24576:O3Pd9CHKy7GZ6t5wXWotDWi//dirlvZGMApYSRiO:QPd9CHKyac5UfqkdirbGbc
TLSH
T18B95CF90F7E414E8F0B7CA35C9764512DAB67C9A5B61CA8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 867dd6e3e7e894ec04ae6dfe53dbe9fad15500a8846e4bfa21c3681f1ef12129
MD5 fb74aad22a1eedc999ccbcbb628d9df2
SHA1 611cfa2e407f640974b8e0b98aee2160de4b993a
SHA512 fd000f2938056e875aeba3235b477d36a349cb13b882945f2d670c7e2e8cc57a259000940edad0e72caffde31c0b7fd44e28e1c135d69b7c6d68f2e6b9786cc0
SSDEEP 12288:3+YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:3+t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T18D652349EE9658F7F5078532F06D4E45EB217AC1D8C282AF8A20362817FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 237ad20be61eb163d188eb333972569ef77f32a6de8c00348ec939e193b016e6
MD5 b9e4e2e57e835b03af23396275689e5e
SHA1 06d3e163964114dbe0611377fa366b2a81ab2813
SHA512 c9f4f902e5b942a9a5cb0c7d61da5291e6fc87909712a6d5e5e41f0555fbac6f2b604c282fb8c4adf4d1825c2f0b8640d9fcdd9fc4da0d79e4f6f73276e3f73d
SSDEEP 12288:FsYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Fst5wXWotDWi//dirlvZGMApYSRiO
TLSH
T136652349AEA658F7F50B8573B06D4F45EB217AC1D8C282AF4A20362417FD1B4E1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 198ab050e11094d56d73ac6a69c4c30713c3a10a403b41c44de748cfa3ebbbd6
MD5 a487c93a51000c5198fcf6081d5c851a
SHA1 496ede2d2c54159a2cc5ee9ee42ca918d5cc41c4
SHA512 35fd8703048234a8dc8000240b2b28d7341f9b9c8ac1642dab1aec262fb64fd0b48d4798505b7ec587fdc2f3470625ca3b588a0fa037529057e3e423d4105413
SSDEEP 12288:SRYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:SRt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T12E652349EE9658F7F5074536F06D4E49EF217AC198C282AF8A20362817FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 ed32176711227783daa38f8a1b3a94928beb7b78ebe79db9615101bcd376f476
MD5 4afd80ae2d3b5d8b6d0f2738f71ecc11
SHA1 406e95c86d2111c2939e0683d9e4ba7302f9c4de
SHA512 6bbb625780dbeea42d30bfae6fd7ecea94a805b3e4ba52aca4728e48e026bb487b889ab7c38e307edcbe96f0dc9d78334aa7937a7c72e7fe9abe3f0de3a63184
SSDEEP 12288:OTYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:OTt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1A7652349EE9658F7F5074537F05D4E49EB217AC198C282AF8A20362817FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 7b6696085944ec7cf205e91fe9c606f3e4147026e344ab99cd00f180f442d2e7
MD5 8a77e8ba2148ba8a6875290fd4fd3e40
SHA1 c962e264bd8b244f27f07d56359ec709e28e3827
SHA512 4527d3b6a81dd96e8f1e4cfdfe2b9becc22df1de6f02369b0449fd0db448f18860eb51b1d7b0b5f550459850a6a371045de466183b87427f6245901ad4817742
SSDEEP 12288:e+YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:e+t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T15B652349EE9658F7F5074533F06D4E45EB217AC198C282AF8A60362817FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 ec2ad171fda3f31c279b366345c269508daaf22a5754f33c897431b668c1d74e
MD5 8728076ee836da4e63c88ac754dea45d
SHA1 041d9f439e356600ac7a1569702fa257bb8e0944
SHA512 21a54521548f1c4215443f41494b458a67258b62b3c52282e3e0e97f460647133e0e9425a7d9c1ab8b1f154a20658402c4b6dbfa983611e77492196bcdb2fae1
SSDEEP 12288:9LYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:9Lt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T165652349AE9658F7F5078573F06D4E45EF253AC1D8C282AF8A20362817FD1B4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 2c6938288fd0618318621c9d6e4c9e7d859691aa426c602f528d7f245d815258
MD5 06c81f6eacef9865310194c2fd6ff444
SHA1 a14c0c39554867ef9db9e5c285bc2c08b697c73f
SHA512 f19cf9c828f5e37bb243df0ff933c52d947bcbe5ca24ceecf7e100b50249e99151d440d70c9209293cdb96df6c5661883d7971e9ce599b4ea5babce439d87be7
SSDEEP 12288:hlYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:hlt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1B8652349EE9658F7F5078532F06D4E45EB217AC1D8C282AF8A60362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 ccedb2aa627ecc5098e8613524181f38ffe6431c2a74df7e969417ff93949d0d
MD5 6c834f3769a5f383ee4d3b64ee066bd0
SHA1 c0f251ece1bed45edd829a02a04c82bd4b6512e2
SHA512 ab2b2a7fa79a92ce79eea0f6a684e759fd5927b3443782de4da677158558cc762dab409f6925865a91ed3bbfafbf7b9fb1224b13323cbe28707cf2e26a943f0e
SSDEEP 12288:FmYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Fmt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T18C652349AE9658F7F5078572F06D4E45EF253AC1D8C282AF8A20362817FD1B4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.5MB
SHA256 7a8acf54714d0152b995adc367494b1f30f41c36264d894ed4bed85f0ac87ce3
MD5 cc8770c376ba9a12c803d5daa95b9b9b
SHA1 240cec9c8db13bd73b8e3fad83d688b92374d98a
SHA512 ab6e46e0f0117ee82dcf9f436aaa841a06893f3dd8a26165bd4807f4c3c20062ee20023e946fa5e7c41f460ef80c02b5a272416db06d6d7e821e9ffd9db8ca75
SSDEEP 12288:jlYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:jlt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T168652349EE9658F7F5078532F06D4E45EB217AC1D8C282AF8A60362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 8a596db93683e0fe878bfa4bc024a33e8a37841d2803d5925dc10d14379226b1
MD5 359279c9bf7e6e97a31749af494eaee2
SHA1 2ff07c9e066f40334571f119dd7d1b3101e79ab5
SHA512 806914db437e41d35d6479db42d6950564bf2cff23815058b35d6d5bc2538b6073d6305d41b5318bdedb34e580a5816d968a7476692ef10fec473c97dbc75e82
SSDEEP 24576:vfwvLk9RX6wkyAIXt5wXWotDWi//dirlvZGMApYSRiO:CMnYI95UfqkdirbGbc
TLSH
T16695DF29EBDC44E5E177823C99B7460AF6B178581B31C2CF0299536D0E37ED4AE3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6cbbe5c73d1109c1affda9bc523f37a6347d6a0296a382e775892a2f93d9021e
MD5 c7a17c29a4c3155896c8d3bddee61881
SHA1 c5dcafebbf9b349b00d1a489c97c0cfdfc32abf5
SHA512 5d5d37346a1fb082aa76691d421f75316abc718777ad4aa9b94f0b076cb0a68a313124c43e8e968a0a937dc8a60273b85004c6535c074893533ac370118029ea
SSDEEP 49152:cYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0C5UfqkdirbGbc:QySzPq5UfNc
TLSH
T16A067C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6bfcc6ef7e2c670314389d863c7180828b81c6080744dc6cb48b91f665d3eda2
MD5 e2643d299d108429f324b232f7a26363
SHA1 5daa17721016f056f6723104e41095c2334ff722
SHA512 9a6e979fca2ce530ccde4bd0b98fd3daa437b5cfb5af73a5d3acf78095dfbd5e5cb386f255b65d2b39a6624cba6c32212a8a264e8e7bb1f71aba6a2a4705d5bb
SSDEEP 24576:f47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AY4t5wXWotDWi//dirlvZGMApYSRiO:f47JUQjairIhCnDHUPfF/S5Ufqkdirbr
TLSH
T16065AE1EA3EC01E5E1BA827885154A1AEA71742E1F31CACF1270437D6F67ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 51ad8ac1c0b35afd593313ed5b333eb20c55f3a3a2b553533f13cd105e039adb
MD5 8ca239fa1d41a9b9ffdf8c22da0d2346
SHA1 35f7f71f41617531ae54509dd1172e1e00d6f8bd
SHA512 c51d13b2045cd45e3b7b312d6e0b8ab0099881482b0ecc9cc0d0b888ce20e0dedd5b5f113130f6c4542382bed4674a348e256bb703f9b53d8b07d4ac5ac98d19
SSDEEP 12288:sasfjYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Yjt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T12B75F00AD29801E9D06E5236D75A4A41F7337C6187E1C3CB46D0F53E1FBA290ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 eeb80bcfc6c5ef674520e62698127214331bdbe41c96c3967189ea120b618075
MD5 4d3cfad9a13c9206a97d206f7d170da5
SHA1 120da27d7f922577e62867b79e57f121e189c06a
SHA512 c26445a7c8779d4704f9f9f37d9eaac2d945c2c247cc671371a1b5e4f374f732b7dad9af7d3aa0309d4a6f3a3ce6069a934ddc84d7d1a4b5bce93563836541ca
SSDEEP 12288:m904U3fnM8Ur0YQhLCE7pN1DHh4AGpxqNaRMuvXy:m99UP00NCE3194v/qNaRM4X
TLSH
T1FC3529007666C74FC6A940321E37D6CCA7707D01EE45AB0773C8873F9576A58BAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 573f5fb6d5e9f20d58a7905fcd32c2972d18c9760f338b107db2e78762d87b1f
MD5 1971f93bc430d17a2ee431a8f9c98188
SHA1 1bbae1f725a63adbadf82ade8805fd9dc66f3625
SHA512 ad4313f601b7100b94a14870f255e4e6396a89209d6970649dfde64f26d22593deb5e3053e605b28a2ae39ba7d4a16c9b15fdd4d9121657b2550ce1df82f9fa8
SSDEEP 6144:WIIKyFP/BxbDT/svQHwtSqtMxk/UKbSqtMxxku7z4ettBWl9ixU:y7/BxbsoHw4TMl
TLSH
T16C55D840A437A38FD1BA6032072A5B4CB7A4EC16B7455F27B3C8453AD86AB15B0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 462ae2445722907a29627b54b0843f69764997096c3fa0f0cd01c7d16ec0029d
MD5 69a3592e4614e3d2e9a4eb6b4d7f20eb
SHA1 a73d91f8ec3e105a829ee377f711c076f99d1896
SHA512 08f7ae8a4c537e9b217d9fbb2414f24de9d1f819351c6919d3ecdc2a5eb1d1b1ca4af46f27f9156880f9dcf97cc086edfa56840119ca04ca29d00c3604a8bdd1
SSDEEP 12288:r+7bYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:2bt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T102652356DF995CF6F92B4631B06D8A04AB267AD08F80C1EF8910376816FD1E0E93176F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 89f5e449b3eb2b09b849ec56aa493104803f3c965c27bbb5afb7b7906342e1dc
MD5 f9f5491716eb7738876cbce68f6f63ee
SHA1 60b1be42e94c81cfabfeb8c0a36f33b4960e8f94
SHA512 4fa1273841f621ebdde0eb82d84e39e37e785d9f3dd8a3300d1166f43cc0fc07e77bd2b2fa8738c5a80e6add6f0f774df3c8009ba1dd0b92620109eef4513a22
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYZt5wXWotDWi//dirlvZGMApYSRiO:tgb4mBIBhGFw5UfqkdirbGbc
TLSH
T154659E1E22E802F5E0FAD2B8DDAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 5108a99c269e6a89953510f6b4afea9f8b4efaf828fe6768e0dcc4bd639c9b57
MD5 1fd09713a0afd4ccfe4620432bbc505f
SHA1 1aea916193f43727a5b55919508f335c0fc73e75
SHA512 6bb9406262ec4971757d6e1a17be6725b05d3586f7e4d8c9b890bf62c82b5a59093d853a766d035bb8aa1ff06e49adcb903516f7987e7ff1e5e04efef5ee5e4e
SSDEEP 24576:vG88u8FpJqH1Zzria7/mIt5wXWotDWi//dirlvZGMApYSRiO:e7ZFPqVQa7/v5UfqkdirbGbc
TLSH
T1F9A5F165B7E101F1D47BD13889864A67F6B2B4210360EBDF07A88B551F336E54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 2e8f71b1437e75cc89bc12ecb933044f913bd714e28819a7aa8b15e808084b6f
MD5 b81c014f55836e6edd1a95dcc3919317
SHA1 5bd092819e50dfad7c66c6ccf919c6a46b5ed44e
SHA512 104696f53c50ceb6a82c9bf793dab170660ecda494d10cfabbdb17c1cc810fccb473f3c94a50aa3a495cd299e985600ed4e631d313864c4f35f42577a2b13f73
SSDEEP 24576:IPUr+NQUt5wXWotDWi//dirlvZGMApYSRiO:IJQc5UfqkdirbGbc
TLSH
T18485F11F66A91CE5E676D13D85868709F772B4620702D2CF02E0917E0F77AE8BD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 31b2db10eca0b2af2916fe66359d4e9fdf8bce73448627d83e306d7b497d7290
MD5 994f2b64020b86b194001c38c6c3164a
SHA1 1f01048b732102fc2129e2280995a19b790f92d9
SHA512 594c2d8ebb9782f8508ae3ede4ba857af15be3f0a2081590fe2bd17ff2d01f8dc57dbec3179953ce0b4474a3838471e3a71bd0b3e1a5674e4778342306e9002d
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjM5UfqkdirbGbc:5G05lO43bV5UfNc
TLSH
T151D5C06E62EC11F9D1BBC17CD9C64A0BEBB23415032556CF02A486A91F27FF4A57E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a69d5c00412e9a850b584f3b99a35eb6576783c2f512e81e0f4f8e3a0f1f561d
MD5 4f5bcfd45c9eb34146d2cbc9776d6634
SHA1 264c08c75b9abc5543300a3bda5da564bec441ac
SHA512 290895c39f234468aa7ce7435e4c216e70585793301cb4420ef43ec9b09ee5cdf825e5247e8e8763e437b907db1cac27d692313d47fda731bc3a48c3d417327b
SSDEEP 24576:wfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnSt5wXWotDWi//dirlvZGMApYSRiO:Ia5POZ3hJt2pasx2+mU5UfqkdirbGbc
TLSH
T1AD65AF5EA6F800D5E579D17DC5834A1AF5B1346153329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a79ce9b3fbb3e6621d08d2708a2df24a94a873046bb32cb0607346a7a3476e51
MD5 2f3df4d649330dbd77c7e914782f16f5
SHA1 07f2f69f8255237274f25d600a29758088030d5e
SHA512 036abca8fa6cdb33d0846962bbb6697ff305e51c97fd0919dcedc0ad37ffcea80b15cea39cc9a3b6f70cc428619153063c5d08f0ce50b09139b4887108f1fa93
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7Fkwt5wXWotDWi//dirlvZGMApYSRiO:vNc/zEOVHFP5UfqkdirbGbc
TLSH
T1C5857B1623E901E4F5BBE1BE897B9946FA717865133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f23040f0edfd7be973b4ddeb4a5e7851aaf1e4e02b968a19ddd3cfd294cdc92d
MD5 11b5ae38a06aaad154043c230a49876c
SHA1 8a158be8bfba1bc0338b1d9beda01a55d1356fd9
SHA512 9130de9f08c620e435df951fc0657885478c6b271dfffcd0ecf0fb3c79b4fb7f195721c41687b4039d622773aeb95363ff4325d01264b3a52a093bcb677c41a1
SSDEEP 24576:M3kNvNnaFeYhJNtmZBmmt5wXWotDWi//dirlvZGMApYSRiO:M3MwBtOmW5UfqkdirbGbc
TLSH
T13C55AF6EBAB845E4D1FEC6B5DD238512EA727461073293CF4290C13E0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 e5059a6a34c198d9ce97747c3053ae719d0815002b31523a1b06f4d5960437f8
MD5 42b6e01ba69eff2365c3113d0b072e88
SHA1 107e4fb47ce842ef7d7e59287eea754b49e01124
SHA512 137a1be4ad03557fa3a962af52bb9bdb4618cf83b10884094a02752e98ea5fa20dfe2d80934acbaf4e705906d91269f477ac35e1eb96bfb962671b42cee2b66e
SSDEEP 24576:PD3FHshBIYQgA/t5wXWotDWi//dirlvZGMApYSRiO:PDVHeBIAAl5UfqkdirbGbc
TLSH
T10B95E17DEB9C04E4E57BC1BCD6638A06E77138A9032256DB029091B91F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/668-53-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/668-54-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/668-272-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/668-60-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2196-51-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2196-49-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/2196-45-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/2196-40-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/2196-38-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2344-300-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/2344-76-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/2492-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2492-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2492-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2492-361-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2568-125-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2568-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2568-118-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2568-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2568-128-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2608-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2608-95-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2608-100-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2608-356-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2608-358-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2608-359-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3720-72-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3720-66-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3720-64-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3720-296-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4184-105-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4184-107-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/4184-113-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/4184-360-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4292-0-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/4292-301-0x00000000021F0000-0x0000000002250000-memory.dmp

Download

memory/4292-9-0x00000000021F0000-0x0000000002250000-memory.dmp

Download

memory/4292-305-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/4292-7-0x00000000021F0000-0x0000000002250000-memory.dmp

Download

memory/4292-79-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/4292-1-0x00000000021F0000-0x0000000002250000-memory.dmp

Download

memory/4536-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4536-81-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4536-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4536-87-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4536-374-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4536-372-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4864-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4864-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4864-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4864-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4864-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4888-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4888-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4888-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4888-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download