b9a42a760a3debc4aaf5801000bb0c34a03ffca63cf13780defc5414239089ee

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
Size 1.4MB
Sample260810-3tnw1abc68
SHA256 b9a42a760a3debc4aaf5801000bb0c34a03ffca63cf13780defc5414239089ee
MD5 748605b48457da025c8033b0e2440ed0
SHA1 cac0c5afa9a9e7e387e6b2ca7186892f785ad963
SHA512 3e93ef6937fb4ec798c63a2d477f97f96322e80cd543c045384e880f86b7704f97baf8477fe22e72bce9ef056204df546f71b9d8be2b6993e7f2a5a5729d4856
SSDEEP 12288:zJRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:z/zQPI9hAH8CzQgAqvuG
TLSH
T17F651203F6C506F1DE5B07721D768FD1086FBD302B90ABE31725087A4EBA4D19E35AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4780	elevation_service.exe
3760	elevation_service.exe
3548	maintenanceservice.exe
1720	OSE.EXE
4756	PerceptionSimulationService.exe
3400	perfhost.exe
3620	ReFsDedupSvc.exe
4152	SensorDataService.exe
824	ssh-agent.exe
2588	AgentService.exe
4616	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9f25c2ede62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ec202102329dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd84b10f2329dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9ab01cd2229dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f2455d02229dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081a1d50f2329dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
4780	elevation_service.exe
4780	elevation_service.exe
4780	elevation_service.exe
4780	elevation_service.exe
4780	elevation_service.exe
4780	elevation_service.exe
4780	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
Token: SeBackupPrivilege	3620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3620	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2588	AgentService.exe
Token: 33	4616	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeDebugPrivilege	2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
Token: SeDebugPrivilege	2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
Token: SeDebugPrivilege	2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
Token: SeDebugPrivilege	2020	2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
Token: SeDebugPrivilege	4780	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 3148	4616	SearchIndexer.exe	99
PID 4616 wrote to memory of 4592	4616	SearchIndexer.exe	100
PID 4616 wrote to memory of 984	4616	SearchIndexer.exe	101
PID 4616 wrote to memory of 3672	4616	SearchIndexer.exe	102
PID 4616 wrote to memory of 4228	4616	SearchIndexer.exe	104
PID 4616 wrote to memory of 2436	4616	SearchIndexer.exe	105
PID 4616 wrote to memory of 6008	4616	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_748605b48457da025c8033b0e2440ed0_elex_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3760

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3548

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1720

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4756

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3400

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4152

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:824

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3148
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4592
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2612 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:984
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4228
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2612 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3ab2e4cff3c9a0c019d80773504876aa18e2c66e5111a4f487613d29212608fb
MD5 bd0fc378f14b41116b66e7b09c156cfb
SHA1 e14cceaf0b82e416286e8bf8215d24c1ee3863c1
SHA512 eef06246d9e47c988efd7a42ad853d68e961bf31938c1bad30f24d0d95d0b8c088a020653a16341302f1a9e4be153bddf7a569aa4d2814c4924ad4ee6d3f2e5f
SSDEEP 49152:ub+632BuPkFKRrdE6ohvstBhuXjfS4LWxnYzQPm6YgA0uG:w3q6sjBb6YgAn
TLSH
T13DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 f31db3f4cd6850629106c1ac845c075294b090eecc859047017acdffd7e06fa3
MD5 a72101f95b7304e3e3f30ba91555a8cf
SHA1 b0b08b1bea08f90aaa9a20335d2d0a1aa27b0b60
SHA512 af92669d93acec1203cbe3fcb5659780509f31e5396f1c2458f0cdaf5b5bc9a8a87a75ce204f5e27439e4cc012cee27538c7e493c5c002e3e392f2edad6a865d
SSDEEP 12288:b1XLsswWkxy2lRq2czAZRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:hXYfDtczAvzQPI9hAH8CzQgAqvuG
TLSH
T114750129B3E409F9DD6B827DCCA28911EA73785047A0E7DB03B489654F332C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 e1b1828e8a0278e97774757871641f4c771f73caa7c5c25f552646250f225fae
MD5 72a8a56c68f92fcd40cac63a9417a6ad
SHA1 fef7594a4b5525ad474da52e131ac4325d1700ee
SHA512 7ff422d4e57527cc6be90dc57614612313203b18416ee7cc9f2c66de6e84c7eb33c21fbc30f086f84c7f72ca660cbd5bdefc89ec991e7c8a49cc2e05cfc829cf
SSDEEP 24576:j0Le5ji0hmxsrMwzQPI9hAH8CzQgAqvuG:jPji0AKRzQPm6YgA0uG
TLSH
T1C295AE16F6748371D073C0B9C5D2A69AED7230811B308ACB4296D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 35436b9ad58b2e3fe5f2180bd4f8391cdd89ff1cc09429bc8e870886ba2ffe78
MD5 e2603b8d2ad2de0710fe0e07ce1b7cdf
SHA1 fa393114eb831cf90dda6370685d55c507f8e747
SHA512 5ce5379b0382b320bab69e840a64060a450ed0ecff0206608f540d3110e7796369af4d658e60e292fc2bed55a261c9d703f536d893527a7f20d9a9daf9c1769d
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWn6q8wyumzQPI9hAH8CzQgAqvuG:c/ezSC6vUzPveHjyVzQPm6YgA0uG
TLSH
T1EF756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 175876f12771260ecc73aa92e713296dc2ba0c5e463713eb7c7fe18e1bf0b6bb
MD5 16029fd65965176aaee1dd2adf9c626d
SHA1 5d31a138eca9749bd336de4a2bbda5f494021f5b
SHA512 316f626606880a853d2a6b32100727625e389d318fa1c7ee1f0d26bb4a7a549a4e9404a9fd40e0ef1ce9838e70e05c7d91985a3e87391d20258aa5a83ae69474
SSDEEP 24576:KVbqPb88hv/l+YbzQPI9hAH8CzQgAqvuG:KVO88hXl+OzQPm6YgA0uG
TLSH
T1C4559E66F5B48331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 86327e3078020ce9341d5b9184b3061ed50f7930ae1cc235d600bcdef8cefa38
MD5 1c55c0bfb699e6f2956bbc3559232ec4
SHA1 ea146b435665daf05c3b1993f8836b986506babd
SHA512 14a75df14323700adc36e10d8a418f21c8e81f10ec46670370d8cc7d9f438fef8d6e7390b343cb8e5643b5d1aea6ac7a6b6acceb5484ce044c4cb46fb10429c0
SSDEEP 12288:KfaRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:KfczQPI9hAH8CzQgAqvuG
TLSH
T126552347E59805E5DF5F0BB25C6B5FE2087D8DB43BC4A76702322DA68E7F0C4E906292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 5fc10318383851349cd26d41f95a47fa49861c1d8e814c6045aa108b3fca356b
MD5 5e6de8615f7f43cb6fab803ba914039c
SHA1 61d7ccd9f2073d21d68167b52ab336c9ecdddeb9
SHA512 dbd292f8975bcbc22f351872e6c9c0cf3186a5e67db3b506803ae2ed35bca27475d27bcf19951eb73b35a492187177d9f39bdb42555da478617de771783d0270
SSDEEP 12288:reBNUbTVO86U9RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:rJIUzzQPI9hAH8CzQgAqvuG
TLSH
T1CE75CF3BEE28FCE2C67E4DB95A918740977278704B51A3CBD135820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 44336d8a780d7db53330f9287b6f50112aac784969c3790195822afbcbf2e56b
MD5 abe1b5a5021d5c533edc4ec85dba8fa4
SHA1 1ef9aa083069bef06154f1045ecd923e8e2466b7
SHA512 2f11255ad3aadb28b8fa1ee75b1063ac39eb3dc50d81d75d3f2e6a0c7bb3a78f30a9f194c6f12e8569be08b0181f032d1ec14f64d5514724e12b51fa547ae5aa
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THm:AQvGAdlCEL8c/DRNw5CY6YgAn
TLSH
T1F1267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 13690ab3d84c440ca55fd4ee8fd73d8a95601a628d0909bc897395a6068a6d90
MD5 e718d986d492a1bf0b05af545639dbe8
SHA1 945e4f092507722745a984180ef7119d949efe3e
SHA512 d55868e99ffcb92df821aa772892f7cff56be368e5ce4ffdd20e79d0dc61b6cd6940e0b124aec3d1d6f5069220cdbef6cea93bdb289346100c90bb981cc0d05d
SSDEEP 12288:IAwSfxL/2Dc3FDLLmt0LDQewsAjXRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKole:twewsAjhzQPI9hAH8CzQgAqvuG
TLSH
T1DB85E031FA74E436C77F0DB21B36CB16187DA9204B912AC3E3B84D9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 57ededbb7c46f9e9c3d576dc84a9cf30db11c32e1feed0d89b060cbd35e2902f
MD5 69e4e4210af283c6966c4337c45d4c62
SHA1 7cdb5d6ad892bc9967f72c656e8e3159f74a599f
SHA512 0b9e809e4973d0d700779f3acf34c7a7f996bbb5c5765825c28fe95575ffcaba51e6937bc1119b72431a26dc8f264493452d613b9a4bfacf14fceef1350d4c84
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHEp:6UEtQevvqc2W1cpV2tI32Ep
TLSH
T13B474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1fb0c0779777a3098d9470543853bce273e1443412ba38eb4fe9dbae7c0fbf07
MD5 cd053acacab50e4d002d6f57e24721e2
SHA1 a03da876d8cf2f8ad0bd99c9fc0a569e20fe8306
SHA512 e2d4ee4bbe466509f9cb03f2de03ade9f9e471a58c7aa94629b373061d621290246f322a4bc804bc7567965d32fd55afcedcaaf0847b734d71fb7de4a87f55d5
SSDEEP 49152:ECbRquA/m2yL5zTfFiV+XenmE3/zBzQPm6YgA0uG:NoquVjnm86YgAn
TLSH
T1C6D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cc598e00037664d34459c575629ca482dbfe5e3989f5f569255c7b6b8fd15edd
MD5 70e5efd0194e4d7d9f5e85233a2b4ece
SHA1 9842e0ce053bb92445835971b9e9fb71b65236ef
SHA512 47840bd31393072c0f3a9f9cd953e1bc38a42181892ee1c86939ec23d815c2c7fddc7a28f2b4b198d5a981c14cb7a7ad601ef1de2dd5bdc8b030f9445310ee91
SSDEEP 24576:qAhGL3IFoiwtA5l7S53qzQPI9hAH8CzQgAqvuG:qAMUFoiq5azQPm6YgA0uG
TLSH
T1D6359D81E7F945D4F5B3ABB899B68571EA76BCA55E30D20F2160D11F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 e8a45e4984b9245a8b21fda3a208d3b0c1b1be6bfe2a6b6fb12ad8761a7e0c06
MD5 52edda48bb783a2b03ffa943f13a570b
SHA1 c9d030f9c40d825e029fc17f09cee0691bc27cdb
SHA512 ba2d62420713082e3ea2437f5ea27e457ac92792fb05ba7a539a070dfa46a9efa2d0aab1904f7b474b8f51a668c677490243ebb56d6961d7cce388aed866625c
SSDEEP 12288:Tmw5HEjsChN5BFgl0WDm+CgRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:ywucOW1zQPI9hAH8CzQgAqvuG
TLSH
T10975F14A76E80CF9EA6B42398557C632E7F2BC112B61D71F0360C65B5F37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 ae4ef6579f0f0a72ca257b946a5b13b2696c30c1df95f52f02fef16789304233
MD5 062f960f1f9e772077ea846ca3951ebf
SHA1 02caf41cc604eaa038c11d7bb89d9f87784aa820
SHA512 8400b3595eb888c74850c01dfe816d357670798de46ff896f37089cd22850f9e4f89e63e64eae6d6f80e493a7ea2b872052036df10cde54d6a9d7faf3356c6c5
SSDEEP 12288:36Z1IyHRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:KZuozQPI9hAH8CzQgAqvuG
TLSH
T1DF65128A72E821F9D6AB4379CCF64B8187767861277193CF023106A65F37AC56D39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 71dde734eae6c6284a855bf7adef41382ce1152e28e14224747d825331dc8843
MD5 2016e918b077c934557ad45410f04a24
SHA1 7daf79fc6daee2377452fdbdeffc1aace1643698
SHA512 48b56c558c10274ca6b9292cd2c4e119654a68fca0c3f4d557a23beb38042f0e9a044d45040b62c739d602ba1b929c59a5e3325ca9bbfefd6cc642154b637b5a
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UC:xQRQyi36YOcPbLvw2gAf+PN3X6YgAn
TLSH
T1EA666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 613e0f9b47dbd954c2d3c7b303984109238810adc4f0564390ba0f0a2e6cb0ff
MD5 ba059db8578fabe3a530ca8982ed3b04
SHA1 906e97b825b24dc5705c354d5d01e2e50f8036fe
SHA512 0d7bfb119a2e8d364452e39a084b8f8c0e118a05368ccac27970a5a3bce942c6d24734823b440e4110e4f2a31c9b72c1d52f4313b45401acf5b2693b612262d3
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UC:IQRQyi36YOcPbLvw2gAf+PN3X6YgAn
TLSH
T175666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 57c6c6ffcf5ed484f695ff03deeccbc55851b53bb734a89bf7aed127060dbd9d
MD5 d078ba0926b4130ec775a7b4265ef1f3
SHA1 ad561e2c7a6d626d632fadbad5f08debbccf0096
SHA512 58b971bbca07ef037032172424b0dd5c1d0d2a9f6f5c24847065a525e64d9b877db4df5f337d2e28855616cb18d570deaf60f06042dd4480727118ee592e151f
SSDEEP 24576:1wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0YzQPI9hAH8CzQgv:x68Qg55nhceWu7PNU3/RzQPm6YgA0uG
TLSH
T1D3B54933B2F600A9C44DE1769F4A872196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a57073dd50b19ea71be0ab95a0e85b061f8fc2ce754db027307c91c9b4ead06d
MD5 21eaa302c3426cc066cc0586bf964c75
SHA1 e69f22fc4625c8dac557c7534a9df6c4693bd6df
SHA512 feb623b5da22cb638f611fa69a6348980dd1957fbe76f94b0dd9c020b1d31b4b37d3502addede45064985d7e1b0f745a4a864ac68d56119decd06e4cdf425c73
SSDEEP 49152:d3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99Y:My5112gYy5azzVvt69nLKnhZW6YgAn
TLSH
T1D2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 818d1606ab030300d5269b275b0961af2faf5acc3c3370a8513634418084c6b4
MD5 94903571a58e4540f3b494a0b2c64f49
SHA1 1abd3819394fc2dc2b953f9cfd2d0130da6034c5
SHA512 fe08eabf955ac1fa613870970c35986a4ab22bd1d6e8d80426476ab89a8172838ec87b1cb76fce7a7b4c16d51e0ddcc760c3f0cd475130eefdc69f8c04ed7bfe
SSDEEP 49152:dB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glfzQPm6YgA0uG:Du6Jmdxd2dv6YgAn
TLSH
T129D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 24b43d2d2f0a6d1cb675f3f1a3eb6d41b2ab9b513f48a6b05bcacb2a005edffa
MD5 d29a0551e45669454be419640a55576c
SHA1 05af41b51d5300e4a5c62e77f70805d58e8267c3
SHA512 d7ca364f2aeba4f46f676c69b448091a9f2dc34fb72d76a3f3dc65bf7fe61b1f037a83a0fce9a9162b0d45d574791ec410b927ad72c93e7c8688a23927206cbf
SSDEEP 49152:j1hpsNoJpF1A63U44CwH7R4xTzQPm6YgA0uG:jmifPWR86YgAn
TLSH
T17EB5BE13F2D801E8D06ED17887569632EA72BC450B34B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 08a71ea4053e39560190388ce3685be4e94d4fb43bb81cc228570a4d3f2fb284
MD5 0bad7411bdb56c5ba1c082107833b5ee
SHA1 b4990fd79e0051f27c0eebac74099133a3f7ac89
SHA512 c387c908f7760b941d045a56a2b8810b913ab15380795dfadcd4555c5124f52a690585ecda1917092d3b0d79a30d22891913dd0397e1b350c467373bec63a328
SSDEEP 49152:LSuZQIY0Be2KcRVtOnks6NMHqozQPm6YgA0uG:Z5dKii61i6YgAn
TLSH
T17BC5BE03F2E901E8E0BED6748B669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 65efb52aa1f054ea895591a607d83b09191c6facb72a4cbde7682ef5a2f57063
MD5 47dfbc1ab811fa758e34267ef27c06cf
SHA1 e4e32cd356c90f015cc1fa58f571cda1c970f8a8
SHA512 ccd2b1c8a9389b5cc41155503b4d5f3b18af73620046ac712543ca7beaac98db4524d0e7298a394f5f739c2034920f7ed99a45cce4b0d7347fd2af9ddb408d35
SSDEEP 49152:thtSn8EApI0fig3giDn0AP5wvzQPm6YgA0uG:8X2imphg6YgAn
TLSH
T1AF95BE13F2D901E8D05ED178C7568632E962BC150B38BAEF0A50B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 ba64bb0fa91ef040999e43364da00c4f04fd51e6f67c5a89741f24b893bc3064
MD5 be6897ada675ffc8b128e254df5638ae
SHA1 9c9d32354c3afcdd2e2003b32906c53cb46cdd93
SHA512 14ab28be5f980c759aa81a1550db0be7802e29c559b4864b59c478c5ff7eedb97e51620ee961ab11d74aa54827a2100c53e188ce206d3aec47ee849602d6060f
SSDEEP 12288:wSRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:w0zQPI9hAH8CzQgAqvuG
TLSH
T1B555234BF59806E5DF4F0BB6886B5FD1086D5DB43BC1A36B123218628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 55a7195ce5224d81060f3c9d88752c11633a76f9ee44323aeb5d4741cfb1c9b4
MD5 79902c17369d5410dc535dbcf47761f5
SHA1 d6983a3f6d2e538840f09153f1b938ef369c6f4c
SHA512 730545c1fb4065df5ef59f734736f6eefe7a6a89540282f9ba130a728981e076c7950fe380e0953e4349c749c4017d0e637628b0af3aece124af27ef6420180a
SSDEEP 12288:VDRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:VdzQPI9hAH8CzQgAqvuG
TLSH
T11A55234BF5980AE5DF0F0BB248675FD1086D9DB43BC1A36B123218628F7F5D8690A2E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 633b0530d8f6d255f1f0a67f68a1c6d7268d4e97c46998148f48320c0e56d768
MD5 6373b2e7920c2305fa88d14304cf8704
SHA1 ac124227c1a4dd8582418b4db55f4d3803b7ad1b
SHA512 b78776a36189e399bf965bd196c77b4ab1e44e2e9d6aed6339d9e30aefdf3ade2208ad4b671f51e190f80799aa17a315e9a6cd3c29087950f2aa6f657e38e68a
SSDEEP 12288:a1RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:aLzQPI9hAH8CzQgAqvuG
TLSH
T13255234BF5A80AE5DF4F0BB648675FD1086D5DB43BC1A3AB123318628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 16bced04c01d79afbd253c76f6b43e36b760dcf8e10a31d34393792060f288d3
MD5 ffdf03f961d60fd3581f310fc5808bf4
SHA1 20506153906214dd95b0cfdc328fbb73a5b36ba9
SHA512 156d8e372b6d959760d5eab086e583bcaed2e4ffd5a19ddee42c8eb9f324bcec785b4d25a6c56803b478334ef1f49b1054a3040e6fdde2a248ba75f3bd05f07b
SSDEEP 12288:vV0RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:szQPI9hAH8CzQgAqvuG
TLSH
T1B3652346B6A802E5CE5F87B6C8774FD144BDBCB47751A3AF032208A64F7B2C4AD15790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 a5d51d70eb566adb0cd46b0fcc403d400ea84a92b87c0495f6fdc520f9bc2fa2
MD5 c2cd0822bc08e25372ff2ebe1a988678
SHA1 b56d7a79d31c26111446b9d2f89880b117cc2003
SHA512 c0ac9f13b5ddfbf917afc2abcc7555dc59e9152235d5d1479c284aa2eb7a06c93bb7b2930dc8ae2f02f7d5e6215c5b1a6b59165697e5a19ccf30027ed5be5c7a
SSDEEP 12288:f8RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:fSzQPI9hAH8CzQgAqvuG
TLSH
T14555234BF4A806E5DF4F0BB648675FD1086D5DB43BC1A3AB123318628F7F5D8690A2E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 ce0e8ff0c9a40a75b5788802f1d6acbefbddf1d6c801869a87d8048bf2f12065
MD5 b3be5f2463002d38eb90f3e58f35ada4
SHA1 3509622bcebbda74d2295b5564c8dd38861ee888
SHA512 1a64c56fe216b2ebddaf733f92a49e0385f44cd8a98e2a6f7a9def5f43cdd7eb5228a372543ee6f01d2861d2fbd6ef768601577f43b5219ea115ff306154c205
SSDEEP 12288:sPRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:s5zQPI9hAH8CzQgAqvuG
TLSH
T15055234BF5A806E5DF0F0BB248675FD1086D9DB43BC1A37B123218628F7F5D8690A2E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 d703baf93921190e48c98a0a282f676fba4e5b12928b7e9209882d606d4fd21c
MD5 c032b34010c3eaa48cd63641701d43a5
SHA1 90f9313cb3119a19b3437b4613a8fa6a458abde4
SHA512 38082bcdf8d2cd38011b1eac51d72791b8cf7d0b056792effe105acd524ebc6af67b3bdb56905703551b43e50fbab176b7c4bab10a372d355738713058a15e84
SSDEEP 12288:gLRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:glzQPI9hAH8CzQgAqvuG
TLSH
T13655234BF4980AE5DF0F07B248275FE1086D5DB43BC1A36B133258A28F7F598790A2E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 552db888ec2194fd99adc9ba8fcc8bbc16c27a6505645e2d7db41ee50dd91359
MD5 050eb80fd69cb480c9f3e43e74516ca2
SHA1 2badf4f30571ca078d47a1bd277654c1cfce0bf3
SHA512 0595ecbc0229124d06d4f16bfec3f9ff967929f4adfb12c26467dbe7de9ffb67604ecdd8694a48c9f24410f66a94d3871025e123748f59355f29d62d03849440
SSDEEP 12288:TiZwbJzzFEoS2cPvyjRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:+ZMNzFVSO9zQPI9hAH8CzQgAqvuG
TLSH
T1DF750195B39008F8DD67823ECC268E52D5B27C691BA0C61F03B436675F373A11D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 a7e2063817a995d9da46fb091b68c7df2eb44de2b5a7978f956d6dd90f54bc89
MD5 b9e04eceab96833eb866387d2434fffc
SHA1 73459da03ff163cd51e5b662bdcb2398877e4595
SHA512 84da4fd44687b5b306413a9d6bc771a3446fa4ebb3b1285cf5eb26320888db098ac164c96402041a3afac96f4cb880c3aa6f4a90d07afcbd8352e73f1692c7f9
SSDEEP 12288:CGRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:C4zQPI9hAH8CzQgAqvuG
TLSH
T1AB55234BF5A806E5DF4F0BB648675FD1086D9DB43BC1A3AB123318628F7F5C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 a40ea077f6431ca6df187d5dcf6ec8ce23183bc03ff7b4b5b29522578867e2a2
MD5 b6a996b8ea541e7bbc5fc3f08c95df95
SHA1 6e96d2c7a536c26887ba5d38b0d631ae6866bc2d
SHA512 6c443e8f08c1196ec58256d01b336c96778f65500d0585f4fa87e93dc7b808d8c662ea1e2ca171c811be279628e28a8b3a1dfc1260214baa64defaebebfa366f
SSDEEP 12288:sKRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:sszQPI9hAH8CzQgAqvuG
TLSH
T13255234BF5980AE5DF0F07B648675FD1086D9DB43BC1A3AB123318628F7F5D8690A2E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 814f465697cc81bd710764413200182cc4d5d80dbd4b92e5bc54a8d2e4359e5f
MD5 d05d66e6152b56384b44580fb7ced54a
SHA1 920acf4a4b2bcfcbe599fda4a207aaf8669e5960
SHA512 f764910f11d4b907f73548611765707f5f2b86f4a5ccbe6abf27224f1c6353729c3ce6c834554bd7c75c7d4e69a0ade26e155713bd5aff3255a4408009652e31
SSDEEP 12288:WyPz5L8HRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:rzyxzQPI9hAH8CzQgAqvuG
TLSH
T15A650247B2A421F9D56B8379C8631F82E776B87117609BAF136006761F372D0AE3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 c832e4326b19888a61d642a8a5314d50c29be5078bbb19f75f0b6c1d414821f0
MD5 ee3583ab0ec229ae92a4ed6eb2858d52
SHA1 37fa3c9202e9f2af2c86ac8595fbbfa5ec3d68af
SHA512 d0e02690c33957d3f58f3fd3d362516ea5eca04063ac31007c3bfe28be7e21c1dab342e3d14b7fb7517155ecfcfcb5855e395c30f66a92f5bedf4e931f3a324e
SSDEEP 12288:zGRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:z4zQPI9hAH8CzQgAqvuG
TLSH
T18955234BF5A806E5DF4F0BB648675FD1086D9DB43BC1A3AB123318628F7F5C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 f2202f1eeb16a0512b61017497503760df2105181f85e987f768b446c0fb5d2d
MD5 683ceada8c125d7c859d1599d1d535f1
SHA1 6905a8c31bf91769bcfbf77e519d6ba88f6b902d
SHA512 84e85a142e009868141bdf8731f3d38053c47ef2528ea72e8b9ea52ec16ca9c30fec23ea56d54f8e2cc97be74e84c1604a94050575959c8010f9142c2bf6cd17
SSDEEP 12288:MGRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:M4zQPI9hAH8CzQgAqvuG
TLSH
T17D55234BF5A806E5DF5F0BB648675FD1086D9DB43BC1A3AB123318628F7F4C8690A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 49547e7e0aacb283ae2f3062ca69970d54d4fadd52fb901bb4f11a96ce2d7863
MD5 3eaa979ee31649f73532cfab4badaf27
SHA1 d02f1204b974370ca41c9f5b3efce0daf28e8bc1
SHA512 736fc57a0290f949dfcb2018b33f626ad59d4608fc1261caeacaf10bcc48a05eb962c9d85baddeadacac06b34ffbced1c8d70e09799d3d9aa9581c50e87b45fd
SSDEEP 12288:gyPz5L8HRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:RzyxzQPI9hAH8CzQgAqvuG
TLSH
T139650247B2A421F9D56B8379C8631F82E776B87117609BAF136006761F372D0AE3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 9b0b93dcfb62e98f37f8593dcde6897d2294229f1bec40d13a68fb9a9434b7e9
MD5 17085330c2355c2e3788500a51ce96d3
SHA1 9a0dd0d93aad9f37817463b30ae54704194311c0
SHA512 d4510e643d24d3577be68b75180412f14a57f270e47c9d4c3384a29e6aa7523ff0868434277f70f23011dcd71252211879bfbd3fba7d1159ecbdd826c6bff0bb
SSDEEP 12288:JCd9mWYoaLHF3z0z04PDvhFRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:UTvaLl3z0zD7zQPI9hAH8CzQgAqvuG
TLSH
T1CA750195B39018F8DD67823ECC268A52D6B27C691BA0C71F03B436675F373A05C2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 14bb2c28563c1674dab5eff034c08cff36689284a00c4fa9ec9af9cfb31a5e7c
MD5 b80233d58e46f61147ac7e884a306f09
SHA1 6783078d2867549017cd6a893d9f3e3ad806a763
SHA512 764829df2f50e5e63576c8886860063f558c6262e175489a38b711d3791e89991a0e3ab65e1debc75d9b84cefb82f4ca1988e524338ab99c7fb7da6a9d7c9c83
SSDEEP 12288:Qi4e7mRdTfgwCHKy7GLbbdIvIRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:Q3bd9CHKy7GZnzQPI9hAH8CzQgAqvuG
TLSH
T12485CF90F3E414E8F1B78A358C764612DAB67CA91B71DE8F03A4255A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 b751913560da79776414dadb297624c796c8b424ac609d898a2301bb4d9cd588
MD5 4d259f09cae305be5ce59c4ebf54423c
SHA1 9310cc97503ad637f351b5ea095462f28abd9a4f
SHA512 01fe19f1ab5cbb0a93136161e7ad34f1b47fe9f2dd25f5caefdcc57eb480c23a2c455626b7a61f1c233e6e35df49dc3af2dd9a311f693032c69a720f2bb49b22
SSDEEP 12288:SVRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:SrzQPI9hAH8CzQgAqvuG
TLSH
T1B455234BF5A806E5DF4F0BB6482B5FD1086D5DB43BC1A36B123318628F7F5D8690A2E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 3f9113d5a9b792bd1712a3eb9f42c84359a55486f152ebf27a44f172d9f46876
MD5 c30c6dd0424cb540fb705b5ecbc2ab95
SHA1 f15cece1ef56461d2ff36a1d6e435989b6ebe0f4
SHA512 38490e65c7795b63fe16297a4a83cb05fde5bbc37bc97dcea91d6af0bdd4649715f60b0780f4635fbdcdd9fa249917652dfa16d278cb8d2dd67b76b7d5a898cd
SSDEEP 12288:inRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:iRzQPI9hAH8CzQgAqvuG
TLSH
T13B55234AF5A80AF5DF1F07B7486B5FD1086D5DB47BC1A3AB133318628F7F48469062A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 38a4f0ff69c4ee782130551771223656a6d568c0f75e568e21f365f53f91aa88
MD5 134297b4d47b75cb628de4bd9bf1dc44
SHA1 7619a7b677f44ce42a564ff3c53f7cbf18d46305
SHA512 fb82d4229c4c2697aebda2c9b96952b652385e5dc9b917cfdeecd88209959fb67ae08a5f417c21de44f473e6e6a1529f655513bda09c8b872d745a3175a49232
SSDEEP 12288:EIRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:EuzQPI9hAH8CzQgAqvuG
TLSH
T1FA55234BF5A80AE5DF4F0BB648675FD1086D5DB43BC1A3AB123318628F7F4D8690A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 afc8cd571003edb86ec83083e5c776c46cad1534d4abe639bd8bbb3718961226
MD5 31c001321bb0955bab3f3306afb133ea
SHA1 20f2c2d2fb9779bbdc0ec2a451377e0c42f6658b
SHA512 feb8b41916fa5a2198d9a4533ed9c32b768aeb1975ef9a802ba375a2193dc20e05414d8e5c6d5c9bd41b16b6e95f75f25875fdc358bae6f7f613065667fd1140
SSDEEP 12288:JGRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:J4zQPI9hAH8CzQgAqvuG
TLSH
T1BA55234BF5A80AE5DF4F0BB648675FD1086D9DB43BC1A3AB123318628F7F4D8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 202eab57da16df4a48ac11f69d1483f13d495e365ee5ec4a76bd09e9433c014e
MD5 c65f133e6d156930b4f9c99546ad0489
SHA1 f3c0c653a34920ec02a255c769505c3e589189b8
SHA512 32e6d0ac163a8b18dbcb3ef1dbd6eb1651cf58d02824c973c81350e244bfbe2cf200048d2fef4ca1b18c405b2ea3f188efdbc6616c33556a9d7dd9dd1bb2f5d0
SSDEEP 12288:EVRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:ErzQPI9hAH8CzQgAqvuG
TLSH
T18855234BF4A806E5DF4F0BB648675FD108AD5DB43BC1A3AB123318628F7F5D8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 51f594125ac8677f636d79a8fe9e6fe9eebe7637f3d5e0d73fb4c83fd521374a
MD5 65a153d22c3cba0c6fb219b0adfef5d8
SHA1 feb2fe76503fc8b6c8280111de3945824f6bac46
SHA512 4714549cd662cd0ec04dec5b9f6578800eb45b114faea589bad606e0af5d955e80b7066ca5b32b731a50e952dd6d7362e234b15452b6f1235299a03759d6ae16
SSDEEP 12288:VORQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:VgzQPI9hAH8CzQgAqvuG
TLSH
T1D055234BF4A806E5DF4F4BB748675FE1086D9DB43BC1A36B123318628F7F5C8690A1A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 6f91de32f95fe201846fc3607985efc583a28cdc30a25fbf507053155e2d2267
MD5 82514e44166281b0d7637a3e60d1f907
SHA1 952edf695e5c95a9c3a2532bbad57f14b4909bda
SHA512 575da2bb11fc178cf83b09e86c363311344b4bfb7d5c63f00c881db5b0e67b65d31ca98e407b5247aab6654e8b580363f19a7728af92a75d8c63bd1945723e06
SSDEEP 12288:48RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:4SzQPI9hAH8CzQgAqvuG
TLSH
T10D55234BF4A806E5DF4F0BB648675FD1086D5DB43BC1A3AB123318628F7F5D8690A2E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 f17506fff36eae84dc94ecfeea6da22163a4e1f72d6ef4dadac7bb5621cf6b2d
MD5 8a31a35d8ab0db35bf0dbc466790ae64
SHA1 0a3142963baa2260bbd43e217238ed35cf458532
SHA512 cd311783a8268d9d965fb73d68f1343e60fc4ebc8a9977e2fbab62e172cd6636a6f23d7ee4599ae7085467db3417f095764a7ca29d3092aa7a25de1681574f36
SSDEEP 24576:ifwvhk9RX6wkyAI8zQPI9hAH8CzQgAqvuG:XMnYI8zQPm6YgA0uG
TLSH
T14D85CF29EBDC04E5E177923C89B7464AF6B178691B31C2CF025A53AD0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e52af3dae7f4e9bb5e65d8fc89b27607537afdf2d7a03838450f72fe980ca3cd
MD5 f7585957cc94c8794837ae34f67e775d
SHA1 ba3939a7bc70930b714084fbfcf7543ea42c2471
SHA512 6c500f6762a2ad02bba80b2dac4718534f956d4b3928c6ec424aafec2596cc75b5c49e1ee49b083729e0d45733792dcf4eed79a36e3be5930533bd37f8ea4f46
SSDEEP 49152:EYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0PzQPm6YgA0uG:zySzP36YgAn
TLSH
T157066C56A1A801D5C1B9C1B98F1BCC17FAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2d86caa138e1b13601ad6f3b75da668b7085aa4d91fd2be586ec29a90bb1552c
MD5 7b16fddd4f835cac9eab27c91f3f12d7
SHA1 58922d4fe17b3c19a5b8fff89f5c55daba28329a
SHA512 371c5e0d512c02b18abdc82a9fe49b7f99d7db661ab4e60d0d7d04fe37c7f76ac814363905e55d6179643568cbbe0fefa0f86a2e26b350a13a95648fb5e02584
SSDEEP 24576:m47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYNzQPI9hAH8CzQgAqvuG:m47JUQjTirIhCnDHUPfF/fzQPm6YgA0V
TLSH
T18E65AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2818a7119d73a8786baf0573cfcbfbaf13b3349b093d6266bcd2ab8b221ec682
MD5 2b2b4272fcda2a02754851e34cb46205
SHA1 3655977c5d413052f0e96c9cf3d4038a33c249a9
SHA512 41a608cf2347f5153facd63470e610a264c61142d5e09d2f23bf18ba70663b22206ee189205e2e36ab54a4daab4e63956ee114cdde42df281c1be717f0998115
SSDEEP 12288:bPsfWRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:CozQPI9hAH8CzQgAqvuG
TLSH
T1BE65F10AE29802E8C56E5276CB564A81B3377C6457E1E3CB13D0F47E0F7A590ADEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 aab8847975f56e44ad90c04fe31594e23b83ee182edba075c441d3472a0f3ce6
MD5 80486d8f317c413157414f8c5ef13728
SHA1 f8df1b7ff7bc93df7f1ac2a9e45e447de63cc1ab
SHA512 d7119753f54450184ccbe49837725a2bbe5aeb6bf1f2795c11a7991e40284750e52678cb1b0f87f867289b672d9b1f3d0bbd593e7c0cabde1b99323dbe3ee34c
SSDEEP 24576:abEhUPU7WMW9mHynz+O0hMmnOgqEIt/p+SBMRktQuBjKZBe:nhU6WMWQHynz+O0hMmnOgq//p+IaktxT
TLSH
T125552840762BC79FC6A940325E32D6CCA7707D01FE456F1773C8873F8476669BAA6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 7c8a7b9cbea816f113d85e8717a5651f3ee488b8f4441805710d7a7c05ad4661
MD5 e90d3ddbefab8ab325cd68ac1577344f
SHA1 7d66bf825dd89e2c1a9816141927dffe4a6c8bce
SHA512 facf6f986f964a15be4ba8ed0a0e07b05b8d30d99fca20d944d9bfccca6b1f4245bcd41fe617411a1f8245f565a950815f369bf89a656118e78b8ec35098cc56
SSDEEP 12288:RkE0hjtw5ZVg8HHX9SlMSgOuO7wFLU/5toNr44a:RkRBCDKg397OuO7Z7cr4p
TLSH
T15555094164ABE75FCDFD50370232C6CDABB45C06BB853B0573448A3C98679BEB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 adcb6d66dac7653b4a517400e169e28042076fc80b9da5fc619407ae96d19ed1
MD5 6e3db7fb0b6ee4ba420fac88a979f2b7
SHA1 a6a45a46c8bb40309bcaf1993a7babf4eb21d22f
SHA512 bdf85e58a7295bf095790b929d7a6ccfdb76e11bc1be9f544e6da46bac1af69efe973f0489c1be951b5e0087646c80633ce294873af930836fdb2a196f310f27
SSDEEP 12288:bo7eRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:8QzQPI9hAH8CzQgAqvuG
TLSH
T1AA552347F69C0AE5DE6F07B1486B9FF1142DAD743F80A3E7222218A18E7F5C4AD25352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 67461212d6ccaba86df821dbebb6da26fb99b514c1d35a13c4029ef7f2033707
MD5 dca39f8bc3bc70211ac93fe481971a37
SHA1 1347e0affc8f40fc6da05ea103988d38fb7725fe
SHA512 07bb2ecdbe510dbbef2eafb6c5dcd108d717d3b8cb5d24e45a395a23b1648ba8a5048b83dc49e6ea0e5b0a1e11f08c4fb38cb3f073146c09d1562e735700ae1f
SSDEEP 24576:fgb6bmBIi49WNNFpg1rSvFv7bYmzQPI9hAH8CzQgAqvuG:fgb4mBIBhGFNzQPm6YgA0uG
TLSH
T19565AE1E22EC02F5E0FAD2B88DAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 f41c4fa418cecfefedb4f45b0cdb5d7bbbe5d79ae04ccd26e8296478e4572f5b
MD5 56ed6ec8cc2397c3e1ef8ed0d901f323
SHA1 8d5d17a4a0f2ab661bf89e988a5731eeb8a28aa6
SHA512 f65b9fd7433dad8ba83c240ef097a0f829e40fdbf4a4217de06a0076c90e6cdc6eab08baa99c032d9730206d678d2ec3948eb61d5bf7c2e2f61f396cadb478e1
SSDEEP 24576:wG88u8FpJqH1Hzria7/m9zQPI9hAH8CzQgAqvuG:j7ZFPqVaa7/OzQPm6YgA0uG
TLSH
T15695F165B6E001F0D47BD13889474BA3F6B2B8251364FBDF07A88A511F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 c402a903596b09ddcadb99511525a96d0cf4f385f4dbb86f7e082a03d6888947
MD5 bd6dd99e7e5f48a6d99839b23887d809
SHA1 edff1a38e3a22d2571e3dc415044808f2d784bdd
SHA512 775b5fb5f9fc9287f3f19c7266ba855a86250ff70e1bd029bce88ff566b1d6b8629cef5cf169d4595a35ef5104444bbdc7199f9ccafe7a93ad350b15392707a2
SSDEEP 12288:xHvUrBFrEjwaQ/RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:xPUr+NQJzQPI9hAH8CzQgAqvuG
TLSH
T16975F11F62EC18E5E67AA17D89828759E771B8621311E2CF02A1817E4F77DD8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bc9f5e8be2654fab8afaff516ed7265b589642a380e92064f31034ed5bcd5fd2
MD5 f122708d54d390dcfc9ba30751257653
SHA1 503e2ae5b2c34125572c16bd95b2e7ba9a24e5f7
SHA512 e468233303d21ee1f99ecb446c03565af0d1bd6fedce3fbcb81370274c6fbf5ea49981948cd738c2828bd6b87e355606b0dc576d040927bd4c3f31bf673fc053
SSDEEP 49152:wBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5zQPm6YgA0uG:rG05lO43b+6YgAn
TLSH
T150D5CF6E62EC11F9D1BBC17CD9C64A0BEBB23825032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9a464a8939d36a353360afbd284a92c99a740b5dea0a78b433ac13d3eb7cad27
MD5 11151982fe7c295a5e5bf7c749cd38bb
SHA1 05c4f157c96aa3d4d14e93e5a7a89edc80a474cf
SHA512 1d2adf3df9de3e2dea0ffb02f0b65ad13127af6e53be341f3c089c46cb256151e3cd51b290d646f0aa5a0a56a4ed87fdbf4a6db50386532ca080abf900531466
SSDEEP 24576:Sfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnPzQPI9hAH8CzQgAqvuG:6a5POZ3BJt2pasx2+mRzQPm6YgA0uG
TLSH
T16465BF5EA6FC01D5D5B9D17DC5838A1AE5B1342153319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f31135cf77654f1d873e31acab30b8a6839f44fc9b94a7627802fc8c0fc09182
MD5 2204da1bcdbc801414c314665492312b
SHA1 2ad77cef316c3ad49f59053372f5938af2c3fae0
SHA512 b698be331ad08671714efbf0b9fca8627596c72d086f3fdaad51138fc9c3fca5469887d65313c9004ee11dd21fd630082fd77918165d4746fbeaa0884b8a2c67
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7FkVzQPI9hAH8CzQgAqvuG:QNc/zEOVHFuzQPm6YgA0uG
TLSH
T1DD858C1623E901E4F5BBE1BE89779A46FA717865133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5c917c89d618f7779f918b39e1181fe976b6705d1a032cca923bed85829ce854
MD5 e7e6f54d5df2b31eaad1d88ead490835
SHA1 88f81027ee74d1275133034f05a3cacb86876078
SHA512 095f21c6cee87f884d59d236e0080e820d182e56b37c50079159301599ecfe33f532c430938b1ab37827765f4ad1c7f9fe5c5f856a619bc20e5e40a467a2c473
SSDEEP 24576:hTkNvNnaFeYhJNtmZBmDzQPI9hAH8CzQgAqvuG:hTMwBtOmDzQPm6YgA0uG
TLSH
T14755AF6EB6F806E4D1FEC6B58D238512EA727461173293CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 330525af99cee6996752856ddf9b68503afcdb79f6fd5b217a184cd843935592
MD5 9b19135e4de99af409267c42781d64ed
SHA1 ddd769dce2a22030c4c96f8fa7ef809e0375342d
SHA512 f4a1c629617ff992d91e2f04be844f5fa302e3600120546e1c80e5a50fe921ee214c97ff248545c608e3cf0a80227c2364aceb09dedc7c1d7e0394af4b4a3c7b
SSDEEP 24576:SD3FHshBIYQgAUzQPI9hAH8CzQgAqvuG:SDVHeBIAAUzQPm6YgA0uG
TLSH
T19285E27EE69C04E4D57BC2BCC9638A06E67138B9032166DB029081B65F6BEE47D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/824-115-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/824-108-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/824-109-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/824-305-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/1720-60-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1720-248-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/1720-53-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1720-59-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/2020-76-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/2020-6-0x0000000002220000-0x0000000002286000-memory.dmp

Download

memory/2020-1-0x0000000002220000-0x0000000002286000-memory.dmp

Download

memory/2020-0-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/2588-120-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2588-128-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2588-126-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2588-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2588-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3400-77-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/3400-298-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/3548-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3548-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3548-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3548-37-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3548-51-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3548-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3620-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3620-88-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3620-320-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3620-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3620-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3620-82-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3760-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3760-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3760-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3760-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3760-106-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4152-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4152-100-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4152-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4152-306-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4152-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4616-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4616-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4616-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4616-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4756-73-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4756-65-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4756-280-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/4756-71-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/4780-80-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4780-12-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4780-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4780-19-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4780-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download