d3b42170c23ee508e056e7061fca188fd6669b13faed3f34f732f788cad7265c

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/08/2026, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
Size 959KB
Sample260829-bf5h2sfl71
SHA256 d3b42170c23ee508e056e7061fca188fd6669b13faed3f34f732f788cad7265c
MD5 f60af2b393d53b185b90bdd29dfba7ca
SHA1 e739bc59f25f0efd2febe82a23e2f2047751ddf4
SHA512 b267e13568adb5a1654dfb4380e616405c723c0f981bea7aac1031f15591752a9bcf4a0eaed1293f7832b60730f048e5553734c88fb8a9c57bd5bf6b19dc226a
SSDEEP 24576:ngKgNZ9/lGGC5SYC1vHqsBUVqTkmZRFh1mtCXLoiq:gD9g/SUVIk25otCsiq
TLSH
T1BD25BE1CEA6848A3F56E927AFD528786E3733F144771D2CB722071290E735E1EA39E11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5476	elevation_service.exe
3192	elevation_service.exe
4116	maintenanceservice.exe
5400	OSE.EXE
1244	PerceptionSimulationService.exe
3372	perfhost.exe
6044	ReFsDedupSvc.exe
612	SensorDataService.exe
4780	ssh-agent.exe
5136	AgentService.exe
4632	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\711fd4838f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000afaec5e05237dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ecdb9de05237dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ada00fa05237dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067c8629f5237dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003aa2d4a05237dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000065db709f5237dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009405d4e05237dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f0a569f5237dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c96349f5237dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000433415a05237dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff9a7ea05237dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
5476	elevation_service.exe
5476	elevation_service.exe
5476	elevation_service.exe
5476	elevation_service.exe
5476	elevation_service.exe
5476	elevation_service.exe
5476	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
Token: SeDebugPrivilege	6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
Token: SeAssignPrimaryTokenPrivilege	5136	AgentService.exe
Token: SeBackupPrivilege	6044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6044	ReFsDedupSvc.exe
Token: 33	4632	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4632	SearchIndexer.exe
Token: SeDebugPrivilege	6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
Token: SeDebugPrivilege	6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
Token: SeDebugPrivilege	6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
Token: SeDebugPrivilege	6128	2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
Token: SeDebugPrivilege	5476	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 1756	4632	SearchIndexer.exe	100
PID 4632 wrote to memory of 1668	4632	SearchIndexer.exe	101
PID 4632 wrote to memory of 1984	4632	SearchIndexer.exe	102
PID 4632 wrote to memory of 3068	4632	SearchIndexer.exe	103
PID 4632 wrote to memory of 4648	4632	SearchIndexer.exe	107
PID 4632 wrote to memory of 2200	4632	SearchIndexer.exe	108
PID 4632 wrote to memory of 1144	4632	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_f60af2b393d53b185b90bdd29dfba7ca_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3192

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4116

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5400

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1244

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3372

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6044

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:612

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4780

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5136

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1756
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1984
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3068
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b4355f0f62c48340da9ce2778d8b9fca7911c07033681d8930de0482b42d2163
MD5 bb91db58b82eae471344de681c682ff8
SHA1 2bf87ae60ac010083f5a7f603c11f859c9813f99
SHA512 22b3c451bf1e1a6333b8c7144902da32fa47991b914b176aec2723e7a1aec7a974df13ae000e88e8fd1509ab3ddae09e83da0133f94d69de37a1c0c108fd40fe
SSDEEP 49152:lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnrSUVIk25otCsiq:73q6HjBsVIk25Lq
TLSH
T168D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 3de27de8ae576e45d98c7ee770c444dd2556272d68a39628fc8237e06b20c65f
MD5 953f8534bc7e30968038cc49c59841ed
SHA1 ead0a7497dc12d521e8e77d0d6804ac71644f4d5
SHA512 04b7bac0cdcfb0e3c6886119725772eb0186b890f7a8ab59878914584d6b3e6ad4023dcb9d647198ec74670d5799837d6d24954f2b26ac4e00440f242a3361d2
SSDEEP 24576:PXYfDtczAXvHqsBUVqTkmZRFh1mtCXLoiq:6tcJSUVIk25otCsiq
TLSH
T16C05F12867D408F9ED6B8239CCB28411EA7378944760F79F03A499251F377D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 323042cba4fc847d35b4a9832f41abee6b2b8a0e7dbac539716ada825b22f07c
MD5 7c9a36cbc060de23d67a440b2cd6f370
SHA1 761e85c628badc7e0cf2943b3f2c39d5d8b52450
SHA512 ecd1d2c3d3b6f8dd2fcb0c7d7b126bc69f6933f07321b91272b09efd90fe6731e379ea409a5522175451f2e2969ce5e74141498e2a036e3def7766d822c102ca
SSDEEP 24576:F0Le5ji0hmxirMmvHqsBUVqTkmZRFh1mtCXLoiq:FPji0Ac8SUVIk25otCsiq
TLSH
T143359E15F6788331D073C0B9C5D2A69EE97130855B308ACB4286D77C7E6BBE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6a439a40a0184d0aa12cd0dd6b71ab5956f13ee9ccf2d993f9e41df0fb3db3b8
MD5 cd543b0e3188ce2c97c1704a86d9de6a
SHA1 531f23b80af4f0bfb311d8ec0bce17fa2adbae7e
SHA512 96a7b4c6cb9864e0ddfa891d030d4218002f87ed749160424daff1a0087bf3e1469ae85ffa0d7bd37260d3a0403fdd78b145fcafd17d59d145b3544e1f89b778
SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWE6q8wyuIvHqsBUVqTkmZRFh1mtCXLoiq:S/ezSC6vUzPvxHjygSUVIk25otCsiq
TLSH
T1DC756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9f31c9eb1afcae9c4e9bba459678e8da2c4c1fc79a83f1c989703f41c1d67bf7
MD5 c059128dd3a6cd1750ccc73ae6e735f1
SHA1 d5980b1f6eb1125aab12b35abbf26cc74c75a0a0
SHA512 bceaa7844f44341d8ab5e60455a8e63c9cc19eaa72195d93e8462c36296cfecf1f60927985f964589684296c84e7c2b8fcdeee5641a03273a9cbbb73854f206a
SSDEEP 24576:1VbqPb88hv/l+6jvHqsBUVqTkmZRFh1mtCXLoiq:1VO88hXl+HSUVIk25otCsiq
TLSH
T1E5559E66F5748331D073C0BAC4D29A9AEE3234415B318ACB1246D76C3E67BE6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8275e9d3486dc80ec9503771e8d8d604421dde57c1d34ccaf7a592c9c7142d5c
MD5 9d43d9401295b2c12ab540a876f50ea9
SHA1 2e455e510d53fa0dcfc8aa003cba46231b87550e
SHA512 4049d01fd4e4d461dc54c5d80037731d6da2a154b5cc0b10ce00bff7b8c7a5fc52bd157c77da66587e42e74625354e9a53730b6e9b0d60bd1f05772a200f1509
SSDEEP 12288:xRFcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:xRyvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T155C423444B4C04E3C3BF9B323DB5489896A53DA8DC48B85ED9217C255C7CA99E43F3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 13ea94aa9a9f5c29c3d6e043eb0e863ebd78cddf72e5fa705f6e6e409963924a
MD5 4e2bbe3126db2b1c9d7399be8d3106ca
SHA1 5dac2d4f222f4ede3c11a585e11391e21e816f54
SHA512 9444f3a3a22cae2a7491e1dcaa02181df3fb4163644da7ce49487767fe5478b0e26f0b53a40eeb94e85ee87b9e926268a8fd85d0e47e8d66bbf8ab8435f23ff4
SSDEEP 12288:QeBNUbTVO86UEcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:QJIU7vHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1DE05DF3BEE28FCE2C27E8D795A918600E77278704F51A3CBD165820EDE275E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f8d62d3dfba748b29e0f9cdf071da7c36741f001e8f1f114b17faadb23c34195
MD5 fc18a3eef15c0372343555b4e0fe973b
SHA1 4fae823eb3efeedc11b6dd8e57d7e77ee100ff60
SHA512 a130a74df832829c337759dd7d8fbc887bdb358d6ab0e267c6b349b0efa41dcf90266e64c3029bcaaf5b52e1429aec0024a9d93bb542876ff00df46253a81511
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THs:QQvGAdlCEL8c/yRNw5CpVIk25Lq
TLSH
T162266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 9a3e713e27e4136135b91d8f02e19b9c9992288c295b3199f885448a0326209c
MD5 d8646502913470f8353c42f324a0adb0
SHA1 f955105a80da2115d60743ec6e88362037b36e8b
SHA512 f84cded2cf618bd83d77caa504446ab3c7fcb525dae227baa187a1100202f800523aea0478eb286ceef7435c78735a2a48c6a53d51a28d194b93b927b35b4f63
SSDEEP 24576:EdewsAjNvHqsBUVqTkmZRFh1mtCXLoiq:cljsSUVIk25otCsiq
TLSH
T1F215EF30FA74E032C3BF0DB22B36C716546C7A604F5129C7E3A89D9D59742D2277AA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1cea2a3e03319b6be078c437497ba555b8e95ce4b042466d6789c720d78c1bd7
MD5 2ca11aff270cbab7e5db7966905fb744
SHA1 6620b3d7314d2868f202e00c7c72737688905348
SHA512 6616bc7a74dabcf97c801db9dc9bf38c83edf165f50bfecdc333fb8dca849117d5765f63aa7df478d330d8edd8bf75cbdd1272220ae6c5dc3dbc7ab05c239381
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHu6:/UEtQevvqc2W1cpV2EI32u
TLSH
T142474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e2580b1221fc462b245df25379cd7dadff073ceb0a1dc9ec772e7e38255d82fe
MD5 6e7c21549b3f9e944126853573971239
SHA1 0ff82a07f35b31db4321973cb51e6eeba5fc889a
SHA512 b14bbf5dff92e74fe96e0c38102bd53b80f375f63e6c328258dbca426fc304892fb8cb19d197bb5fcb2b36144ba88cbd94075616450786d2ccd8ecb327361b13
SSDEEP 49152:gCbRquA/m2yL5zQfFiV+XenmE3/zMSUVIk25otCsiq:poqtVjnm9VIk25Lq
TLSH
T133D58D0976B881E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4bd4a4ed475822af109ec86c88c6aec1d023d4c96cc9be269412207909d83926
MD5 2a50cf1cf1c0aca62d94e2acfd102658
SHA1 f6ee4d9b6d5df3457bd13f35f2fc676b38591127
SHA512 19ddef0fd16e0a63f4c97b87905fec7545cdea6cb0c1dd078119721b8e819ced9bb662b1e3320591e13fd58f07d709153eb3bdc6e957678b0b278c6900287343
SSDEEP 24576:VAhGLJIFoiwtA5l7S53cvHqsBUVqTkmZRFh1mtCXLoiq:VAMyFoiq5dSUVIk25otCsiq
TLSH
T157359D80E7F905D4F5B3AA7899B68570EA76BCA95E31D20F2160D11F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 fa930ce35737e2d714b1940a201cb07ea622315fb380b6fd506247598b70aa05
MD5 43e198693223e36077c7a830b5d60f73
SHA1 f7c914491e6172937b69cb8ba296071e8f2565f2
SHA512 9968274749cc3f2d3914df6c76a56dc7d38676f5fdff61175f07a03c863f71cbaeeba8ca8d8336acf0b2e5a2b3f513ff1158be3e33200b424ebb97ef0b068dd9
SSDEEP 12288:Fmw5HEjsChNVBFgl0WDm+CTcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjN:gwuoOWRvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1B905F14936A80CF9E6A782398597C036F7F2BC112A25D71F5760C61B6F37361AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 9fe7792a322f6cc41b687dcbfe0063801ccd100c49c3e515f28adaafce4ac09b
MD5 7e67daa7f95a28f8bb58cb84d58595ff
SHA1 c7fc2b547c5344e91e1c1a951e970c88f75b2197
SHA512 f95b43a74110692f3511efbbe1541a1798e9d0fd2fc55c09189f01df0b5390b5cd01ec9b15d1bc428683ce20eec0402d8e9bc5febe33406a1720a8e65ad03757
SSDEEP 12288:/BZ1IyucvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:JZuevHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1A3E4124923D820F2D2B78639ACF14948E3B138A56B7593CF962055291F3ABD56D3E333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f25adcd923afd503dd133d69ae1569b9f5fd2ac0a9da1e735bdefcffe8a97a63
MD5 c012766b0ac55690f2912f75711eba9a
SHA1 6cb77f90f1dad5797e460ef150d43dcb3351127a
SHA512 fb3cccdc7117838ac986e0e34eb978ada83243e24b1c1a927f8eb7e256d2debe6dcf1988b1daa5efcab18716e5b5e3fe65f7777770e9124bd01854ec1562dd48
SSDEEP 98304:9QRQyi36YOcPQLvw2gAf+PN3YVIk25Lq:0QyiKayX+PN46
TLSH
T183667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3f81df9625be0258b8d74efa5a7bb6d0df20b30e1cf2953745b2b8816762d34a
MD5 e96cf2d02c7dc6ca03dc00a0f2db3fd4
SHA1 fdf9b896f85586773f2aeb0f975bb5a672fba6e6
SHA512 71e36464fbdc8d18392ebbfc7d2deb70786f5aae3d6dffa84bf6c5f67223c8b2c4ab1b7ce735f6609d4cbe83ffde0c79405bdfb2fc7c977bca9743eebcbca938
SSDEEP 98304:PQRQyi36YOcPQLvw2gAf+PN3YVIk25Lq:+QyiKayX+PN46
TLSH
T1CB667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f53ed0b98c6d7533adb051a9a37c0667edb5a0e65fc61357256de9dc143c5df5
MD5 c9ea1f7f57e6d23f116a00108eeaa500
SHA1 b7b44364d01a5a6ff00a6842732ba7cceff02586
SHA512 402fdc52aac16856c59df6cbf09581dfe9c909d634f53a4eb8b7cdbe51dd6c32f62ff56052ad42a1aaceabd3c5b860138256ce80f64f1213beaeffac23eecac4
SSDEEP 49152:w68Qg55nhheWu7PNU3/8SUVIk25otCsiq:qthWRc/qVIk25Lq
TLSH
T139B54933B2F600A9C44DE1769F4A872196D27C758FE0E3DB851172161BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 aed6e9a669cb9cbcdab66d70b931c674987557ac240a60ed68f2978bbd9153e2
MD5 dec560d5088d415dd5d8a58613b86aac
SHA1 d2fb90f248ec3b23fae0f93e116a1f36a3b1779e
SHA512 e76328b5e173a23e179dd31e87205389e0f62ff515414738176e6e663c073db76a547f326ae5c54dc49c0adea4b106a9c037d0d5a897a91744f59c8bb29d7fb1
SSDEEP 98304:ry5112gYy5azzVvL69nLKnhZPVIk25Lq:GLIHmWh56
TLSH
T1E8167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 098a70a71118d1e991d5a49beb3ec3e27c97dce69f18881889121e7936b7e910
MD5 ceb013376e9136e0b80f18ee39ff645c
SHA1 1290b33cd74604e170923819457d509ada36912e
SHA512 896049d0695dc90ab712d3d22efca7833051949d6c42294075b2b19ec34957b971f9f65aa77731edaecdc13f6989278c512da1bea992c1ff9a6f00ee043a5d02
SSDEEP 49152:9B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glCSUVIk25otCsiq:ju6JmVxd2dAVIk25Lq
TLSH
T125D59D13F1D901E8D06ED478974A9233EA62BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 05fb21401f5777f8fbddb721407995f123195cbedd2718a4c8c69a2f9fd96638
MD5 2cfe99d39b81b67580edc1473871ac0a
SHA1 a4b08de5a0d4a089540b61a45817c051502f64e9
SHA512 7e5bed7049a7d9a64d767f2ffb71bf31d91b98da8e500a0cbe8041aad1f5810f7220bbe903b825ef4bf48442eaa7b8e1ed90f6fc0cbcceb059eae219651a0a8f
SSDEEP 49152:x1hpsNoJpF1A6UU44CwH7R4x2SUVIk25otCsiq:xmifPbR9VIk25Lq
TLSH
T123B5BE13F2D800E8D06ED17887569632EA62BC450B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 00b60638246f56e6903bea6871c084295e307272d80c8402385b05846ec2c6f6
MD5 973a8c658e7b11a6fb162c779a7c1a2c
SHA1 b96b7fc442095fe99671d22b56a122c8b2a2d266
SHA512 c4455b4f904a52720b037dfebc191e8df78dcf1683c3a74d5bcc0cb83174614a8bfc0258917481c3b1f27a1f339470dd5a12a06826adaa453225d6fb2ca0ca2d
SSDEEP 49152:xSuZQIY0Be2KRRVtOnks6NMHqbSUVIk25otCsiq:f5dKTi617VIk25Lq
TLSH
T16AC5BE03F2E901E8E0BED6748B669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2fcb68f9e0e14d4105a3e5f29166b0e7c39a3a62d1443b251cbfb6e690d70582
MD5 0dce1a98d96c65012fcfbd87594ed1d0
SHA1 79f0e2a74bdec86ac052e3b3f278799dabc5bf2a
SHA512 75e9a3be0db40d1d8a9c17df526b99764cf222be13f6d1827c0f4f63aa52e69eeb0c276f98d2984f1516b53d69f52dd614a026b3d4d8feb499b268a7232d7c6a
SSDEEP 49152:4htSn8EApI0figngiDn0AP5wySUVIk25otCsiq:pX2iyphhVIk25Lq
TLSH
T18595BE13F2D900E8D06ED174C7568632EA62BC150B39BAEF0A50B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 e54ac7e871b2593fd2628f585310b6211b65cfde5a1378ec2b0cdbfdd77dfff9
MD5 32535d036893f159056b297eac6fe915
SHA1 7e2f9ffc3e53a4a3cb0972dd7bee36f0cfd6c02f
SHA512 6bd4689117453773f4047cca011a475b49a14b008c28e08f77c8c19642a5a32e5b13b7b17220c06b49ad0e4cc4fc7547f0b109fe525dd71921e647b523245383
SSDEEP 12288:UdcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:UKvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1BAC423084A4C0593C37B9B3279B14888E5A43DA8EC4970AFF91578255DBCBE9643F3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 115a4e1f87e3b9a9b814fde1f842b54abd21d5b5af6b918d6bc8e3edcb68f290
MD5 72f241db5ccdb3fafab1cb6929ebddfa
SHA1 8d946f2504d75badcc9f5618559cd3f644574af5
SHA512 0712a09b2932ec5da672204be2345a9c2c648e79e6a76b61901e415ddf935da559ce24b0e96fe1cd52b4195e3b103b41d8f58905e7cb5b893421dc33953c934c
SSDEEP 12288:EqcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:E5vHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T15BC423085A4C0593C37B9B3279B148C8D5A43DA8EC4970AFF915B8215DBCBA9643F3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 b4eeec0f02540b8dc25ef1db896893a1b945b41af267d4c6e055f069643b089d
MD5 26d25659022000132f67013306dba908
SHA1 de3137cf95fc845e77ea2ee8f0b9bd4b67106883
SHA512 2ebf3b0fe5a2054678ee2c083a9c95bc1c4b8f01f9e8643b884b2f567a584cff799a5b50dfe4d29ed60df52e1a47353ecb5ec66431a7aacf6aed4cc4226429a7
SSDEEP 12288:kccvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:kTvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1F9C423084A4C0593C37B9B3279B248C8D5A43DA8EC4970AFF91578255DBCAA9643F3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 707a2cd6c55e63f9a7169efd0220aa3b409e35eb5aec0423a214dc65ca80d4c2
MD5 a3b72a6808a5ca2d5fe15bbee2db95b6
SHA1 a3da4f7ed616994bf0c409616272d9ce34e85129
SHA512 24ee77c071a7e868c9e3891e2ac4a0ff7c4f44cb470152eaf1ba1d469f884ed4d4e63df84bbdd96e1451f015e1d953a4df98e9aa79fec61e6884233bce1846ed
SSDEEP 12288:uVHcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:NvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T17BD423045B5C00D3C27BD732ADB24498E2B47DE8ED15B2AFEA1138251D7C7D8683A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a8586195ef04048753ef3f3e25bdef9a9238585eae61d8b8878344e82c2334a3
MD5 167a2547c678429528bc249c89b70e3d
SHA1 89838d8d5691a547008d11415ce18256e5454013
SHA512 8ceffa41ebee6ef5bce751a1ade1286d4c1f31d6fc46de8f659f07261b2b984a3f9506ac48a9de125b42addf3b359e6528ce2be67224d87ca7f9542ca2a998df
SSDEEP 12288:TPcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:TEvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T173C423085A4C0593C37B9B3279B248C8D5A43DA8EC4970AFF91578245DBCBA9643F3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 cf50b49bcd3483c7dda7eb7bb79e4170213711eb61db73a115569d4819b3b28d
MD5 0f059d6f0f7c3ac2d99b81a5725874ef
SHA1 2b7dac33c91af3f80145142ab641bfb19a68b3cd
SHA512 e5b9939d65fac562b765519c621df1437540af951c7a952bd8795b91ff5b6e11508f95f5813482a164ae2dfc3b88987a16abfe4943fb711329bb61391ecc4aa9
SSDEEP 12288:iWcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:iFvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1A7C423084A4C0593C37B9B3279B148C8D5A43DA8EC4970AFF915B8255DBCBA9643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 42a514e34d916685fc5aaed2f2fd224491626ef1bb341b908ed3dbb11e77e326
MD5 5c46063294b2fe1ff94512b3b4f1a1cb
SHA1 f4f4225e834a961ed8326ea190c1b4dc76d79004
SHA512 1e49ce6241dff7c3065a5ff169c4ee996f34489f47edd1b9cd37e131c9ec26d4f7965a8da6232c36f615c5c90101728e84bd2eb01b82e1bbf981fd85c78d761c
SSDEEP 12288:+ScvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:+BvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T15BC423084A4C0593C37F9B3279B148D8D5A43DACEC49706FF915B8206DBCAA9643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 0b0387f36c9c3ba4402c3fb1502b69e383d219c10dfd67b25f2fd3baf79b4f5d
MD5 372e3c30594ce90e1cf5000801f4d229
SHA1 b2307a3a75fca826508e4bf5bf1172f25d2c0c04
SHA512 a59cf513dd94cea57895d0c8e146d7e2fdbd515aeaac0d0f10d6c5d36759d93d569c0fbf7f61e63619278c4d5536148e8fd849d714eab6c89d9505e8f799780c
SSDEEP 24576:hZMSzFVSOZvHqsBUVqTkmZRFh1mtCXLoiq:hZMSzfUSUVIk25otCsiq
TLSH
T174050198B39008F5DD77823ECD658906D6B27C694A60C61F53B436271F373A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 741dcddc1721474b72f1d88fec858e75661dd3f8639c7555d429b63fee389974
MD5 ae40e00964b62d32376d9746399a7133
SHA1 23a275cb270ea8b2a49208c52a67dc2fe7a8645b
SHA512 58b67b672fb64cf57552edd88d69fa60ccceed54ad5a6de120d9c7b1e7abe2d0b060c485e183eccc9ffbb1d13355dc25cef01d51173891da635472dad0edb69e
SSDEEP 12288:vRcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:vuvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T188C423085A4C0593C37B9B3279B248C8D5A43DACEC4970AFF91578245DBCAA9643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 b71b5d159df5d1c6653090cb8bdb96d08e5e1f12871b099f1861cdee355ce778
MD5 6e9fb3e84c40c811ec3bd5687fc28960
SHA1 e649331a1f67e1a8b9845d2d26ca2d52236c890c
SHA512 b13ece07c41b7764f486824f6911f6d1ad1c46d31fefeca8a4a1ee6567de1031d7a515d18f5932613b80d3396c93d02914230193b475f07b4dab057c4b7a1705
SSDEEP 12288:WVcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:WCvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T12CC423084A4C05D3C37B9B3279B148C8D5A43EACEC4970AFF91578245DBCBA9642E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 067ef53c3e57e589f05c7299032dd313f4eb562763fc1cdd18e9c6d4e0fadf96
MD5 9afa75ca459c05502955c6b39f334704
SHA1 5c1995e04c6b814dc8f7b64b1ad4d7065679997f
SHA512 e96d14622ec3b844d5e9c901d2ace4802bcd8f1fbf91780805511d4faf3147dc22f888220c3c300f210cf54bb78a7c5c5d01268b80e15b13aded6422dbe56216
SSDEEP 12288:6yPz5L8ucvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:nzydvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T126F4120777A420F5C27B823588A20945F3B178754B249AAF976056362F3B7E0AD3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 f96bd76bdf52b085b793a19419d7b6a95342cd22f2bb72e68b59015f9341fc16
MD5 a5714748bb1e9165644708380bd5e1dd
SHA1 ec6e243239987e0339a03ad34a0ecd9205e6a401
SHA512 b5434bbbbf09865d27b1d1dfdfce7a262f1609b8148abae585253ffc46aed8d77e59758aabb17c8a5899cf9dabd91879f429e697015cd19516d0516cbe4846fe
SSDEEP 12288:+RcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:+uvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T148C423084A4C0593C37B9B3279B248C8D5A43DACEC4970AFF91578245DBCAA9643F3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 c7a65ca13bb314fb0271f26de49b49f541221d0d3cf81af0fd5b2595589c7571
MD5 80c726fb439ef9fbaa91a26e25138aff
SHA1 86384bb16c0e7a9c131c6eb8674ef31b1df34982
SHA512 5d7b4facffd9fdbd79ddb9b05b46f47f6d72b11cd9738fd14efc4bb2e43e6f347735c206caa3a88cb3367dade4cd4f62fd8ae2f2c867aaed37ae34097bdfd088
SSDEEP 12288:iRcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:iuvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1DCC423085A4C05D3C37B9B3279B148C8D5A43DACEC4970AFF91578245DBCAA9643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f8d71ef47e0378f38c3f9bafe42b963522bd138068d568b8d6959e93472bc5bf
MD5 40d3cf61528ddddfce893a6963e9daf3
SHA1 91edaf1445d5d6727793ba83533cf6ae313641e2
SHA512 befe5b934af38281ec60789a601ae0a84557ef97a721a25b0ec2a2ad2275b74dc18799f392f633aedf47484454523c4bfefdab627a31fa7027ee7c515626870f
SSDEEP 12288:OyPz5L8ucvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:TzydvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1E9F4120777A420F5C27B823588A20945F3B178754B249AAF976056362F3B7E0AD3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 d078aafd30ebc751f034ef658908b00f04dc6c6846fb08e4b74f4b7be7ae3c73
MD5 487d1a6854c47e84e4bafd28d94d86db
SHA1 ea7f8132e9992da578ce13e50a4d55bab3cb9d7e
SHA512 e07e0dc64ae91d6b474ef58afdf4e4692ba22675f9ad356f24eaa09cb066448afdeb6d21ef24f7e733be82189e77df14d2ce7e3ce74d1521bba1352468d14aa8
SSDEEP 24576:6THaLl3z0zDDvHqsBUVqTkmZRFh1mtCXLoiq:6T6Llj5SUVIk25otCsiq
TLSH
T150050194B39008F5DD77823ECD668906D2B27C694B60C61F53B436265F373A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 d864b51b504fcbf6973441e26fad00f0b188a72dc8d6a6d438f0ac8fe7c5b105
MD5 13c8702268cf3740f6d511afb48f1571
SHA1 f3c4dfda8dd5ed87319059528d82e8158a177c3a
SHA512 a1d01e4cf59d79135422b7440271cfa777ff575cd1fab8670388b6ff962a1598cb9a2bad439b16dee56826723f6e2283c4bd3fd42e0ef2a2081e0018cd46ddbc
SSDEEP 24576:g37d9CHKy7GZvvHqsBUVqTkmZRFh1mtCXLoiq:q7d9CHKyaUSUVIk25otCsiq
TLSH
T13B25CF90F3E810E4F1B7DA358D764511DAB67CA95B21DA8F03A4252A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 458d0c0e7b92d9457e609399cfdd3c0207c605b2e0b99e4b73a54be29df10508
MD5 0020413d2427f81ba4c5cdfc6e687908
SHA1 f24e77119584ce29eb9af52bef7009aea209b7aa
SHA512 7408fd5b044ec51749a60173499f50d88d33da9339aea57621c89e0b7b1b05029fe10a664581430579ff45225b8b9a2816661c8a582bbf5eb51e8112b128a007
SSDEEP 12288:d8cvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqbS:dzvHqsBUVqTkmZRFh1mtCXLoiq2
TLSH
T1AAC423085A4C0593C37B9B3279B248C8D5A43DACEC4970AFF91578245DBCAA9643F3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 31963c8f6298cbbe4e1e05fd9347a807f5b7d449bf50d731334c2d97152fcd59
MD5 01496641c1a9a338e8f26637bd6a424c
SHA1 e6cf7218385ee326d2ed6ec8f792b482ffa8ff84
SHA512 0d1ae99192cba9a1d88891bbef7212433df07965de563cdccbffe6fb5d3a6b920c180c1d654317872201ac095ba3963acfb844b8df198faa538773b6c88f6556
SSDEEP 12288:/OcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:/9vHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T147C423084A4C05E3C37F9B3239B64888D5A43DACEC4971AFF91578215DBCA99643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 49bd691e9066f3120c0580a056191862a8a3c14fce20bc86e79484915c65aa58
MD5 13997e0ad41b8b8b3c3bd1b49c1ba2be
SHA1 f1c75986b46ec3605245a907125e4fa1bc9e6f55
SHA512 e0964bb8a8c0197cf8d15b10026ffa869953a0dba071e8669d7cccfab5e5065a153c25721e28f93778f93d3ee770d11637aa56b72c36ea3aa350d8d981f7f211
SSDEEP 12288:FbcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:FwvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T199C423085A4C0593C37B9B3279B248C8D5A43DACEC4970AFF91578245DBCAA9643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 68037465648de1db9fcdef22046bd50315ea7f02acfcbde52bacbbd9d1913968
MD5 8249789b36e8ffaaa28bbcff461ee7bc
SHA1 0c15336970918d794d8f36cb0e178770e3a3fbb6
SHA512 df740cad5f7e77c21c2a0279b6601a81cba5a8e96692f0f32b017c1be3ad9fc08b9505a70f022679662243a467efbbac4511c0030f3667c23d0c6a0507dbba8c
SSDEEP 12288:iRcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:iuvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T11FC423085A4C0593C37B9B3279B248C8D5A43DACEC4970AFF91578245DBCAA9643F3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 c150c114194cbfabeb33f8244c646ae0c1efce173ad5dc9c9ee301433d9d65b4
MD5 c8fb6e181d0bcfe674211570951db7aa
SHA1 feb2260b9a003f2afd8a29228246bb1cff055ec4
SHA512 937cff367a5bf1ad0c73f174ace8a5d72b3eb21e86a1a6f480059e71817291cef7d1ab1f1476f1b240836eebe0224236b06015205034f051e95df927bd77886e
SSDEEP 12288:o8cvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:ozvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1BAC423084A4C0593C37B9B3279B248D8D5A43DACEC4970AFF91578245DBCAA9643F3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 8b0d8a711b3df4bdf308fd4370dad17635f8c1e788e8f65e716fd13e571574cf
MD5 ba5617722a7aa1f569e84d4d97b9db2f
SHA1 5ce73a39e3f9e054029e9aa5d7ded70e82e5cf68
SHA512 0dc706786013792f6e29aa13f14cb339c3dd34cd17566a95124f4d15856595dd8fdd70de2fe8515ad334bf911b8d127abe36e3cea27e15a7da616a4398413f15
SSDEEP 12288:Q5cvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:QWvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T158C423084A4C05D3C37BDB3279B14898D5A43EACEC4970AFF91578245DBCBA9642F3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 d3482c643bf10d5572ad347b07a77e7a6902eb82e7e64216327f790857ff3527
MD5 c56451e3760da78b42b551ede2ad9615
SHA1 fb0548d554388680023a7d186ebad1c822f1b9fa
SHA512 d250d4ff697801b28cd886f77cc7d563aea38edcc0c4cad03500ec9d065c7a4349f018c844c0edd8c5a224a627ea6b3c275a7940c881ee43384316214319c560
SSDEEP 12288:6PcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:6EvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1DEC423084A4C0593C37B9B3279B248D8D5A43DACEC4970AFF91578245DBCAA9643F3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 70c045027f21359f3c9c1003900c09b76db8a7f350faad8f3772ad3b4b1c59b9
MD5 2bc2859b4e7de2ffcb5be2aefcb891fc
SHA1 12060ce9703ab8d2f6c3d2cd9012ac907bc08dd3
SHA512 048b1a7e1eebbb86c9356dabd5b4c6c0ffc919d2c950ec9f5448616d72b2bb1925611fa75a14cdc089555cf96d1bb1571e1fb2d7f5fe520c1e5a4f6ace51aff1
SSDEEP 24576:Tfwvok9RX6wkyAISvHqsBUVqTkmZRFh1mtCXLoiq:1MnYIPSUVIk25otCsiq
TLSH
T15035DF29EBDC04E1E1B7923C99B3460AF6B178681B31C6CF125A536D0E37ED46D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cd554a6d4cb3dbf0bbde479737705062c894add2ce1fedc00077432c4633e8d6
MD5 7733cd620a76b44679cdbd5ad8fa139b
SHA1 0784a3255ae695a0d8c398ebadfbfbefb8b5e24f
SHA512 6b0defced99b40b67293bd412b3eb84873deebf2fadff385c19068a349deb3e626d7c49af223a0ff6746b1e9ad23e38fd186e68a9f0aefaed3855465177bf077
SSDEEP 49152:HYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0SSUVIk25otCsn:jySzP4VIk25Lq
TLSH
T19B066C56A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 276dbfcd1908c9c2280f3c0913866b80b8ff65c280a41b73c84c695ae69dd415
MD5 6b9fbfa022943f1d4fd28d7708be2bfb
SHA1 4ded9e622c7c5ec2fa0bd638464ba796482cd9a7
SHA512 f3cb637753dfedfcb216a2c9cd19ac396e749f0452d934d04b59076ee657b543bba927670fac5ab2205e4eced9833f8a4a0e97ee926fbcb76bb97a85669c1ef6
SSDEEP 24576:P47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYpvHqsBUVqTkmZRFh1mtCXLoiq:P47JUQj1irIhCnDHUPfF/CSUVIk25otF
TLSH
T1BE65AE1DA3EC01E5E1BA923885154A5AEA71782D1F31DACF2270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 d77c77f6063db3b1643d6df5d36735d5d1998ce0c45caa6cb140c53dd65e13bc
MD5 f0df420bf8ff562215320cb3da754c11
SHA1 cfae750c81ee42acc3745363bfcee26686fb65a1
SHA512 77314419272cba0c15c94e39dfa4ac116ec316cdfc6eff1c08bacb7fc8500cc00b32683018cf5456c6f85442ca7cf0e252e0d8c604dbce56c5d9ccac6f8262c7
SSDEEP 12288:ZNsfBcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:eevHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T106E4F109D29802E5C16EA235CB624A40B3733C6497E1E3CF96D0F83E1F796949DEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 497a734b0888661b80b2fd3afc20083d9e13cc5a719934ef321a25da3a954e67
MD5 e3002d1b6246c0cae24cabae963de2eb
SHA1 a366346875727d4f807469bbebc8e096754f4c3f
SHA512 67123e4641f87b7eaa0b7e5ea5ecb8b517ef6a1d7fd177620993b30e8e26ee0133c5f7d956c535a81ab68b961bd33aa33080d593d99920a9dae9233760708d1b
SSDEEP 12288:kwD80WU3ffHPNPyQ6lxqdDaq2Rc2eLKKMnMnxEksAMaWF:ZwbUPXruSKKMExvsAMXF
TLSH
T1C43528017666C74FC6A940321E32D1CCABB07D01EE456F0373C89B3F9576A59BAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 d9af03ef05e4c46c371f73f0c3b7d5299b751dbba67c5cccce687ccb71fe5342
MD5 9b627077307baf901bdfbd3d12a6e854
SHA1 a726a28fbafbff499350b61a2af18a1aa16e9018
SHA512 36f51d4566046d14b01fd802e3c4ce532aaea6276bbc69d36fd20f3aa3c0bca3e5ac4816282f3c1724fdad9dbe7641e55af9e4e3879d240a72866f1be5910b0f
SSDEEP 12288:ofaq2RctxHx8xFmEaq2RqJmHmVUMPFxIUxnWJKxW4xaLxGxExIx6xwxrxlx5x6uC:0XcN6b
TLSH
T12F65D8405137E38FD1BA6032072A5B4C7BA4EC56B7096F27B388453AD86BB55A0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 62ffa1f9f4ab0e3187a7178fa67869dccaab7807aaf80f1b5f66014b526f5493
MD5 b7d3ea332e0b239844a48ed12846af7e
SHA1 30fa319f8ab0e5de86f357c1d72015d72f1cb9c9
SHA512 318d05989c1a4f3da92cf0f8feb7e2f04c7ed9c8e88351095341d8836910f3f963221f34af2fae57c487caec8f254f41d10cb5b9c3d3f6a23c5ba8c4227af77f
SSDEEP 12288:CM7pcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:/GvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T137D42304874C0493D2BF9B3138B68468A6693DB8DF44B0DFF91178256D7CAD9AC3A35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6aef88c3c9f2d57fa12657c5869cbfa85f7d2c241ebc0846947ca8ec1aaf1260
MD5 ad4520f59aabe6a6405da2bf4ff1544f
SHA1 68b6381ff3979372a24c188f89c0f0fbd7e1a347
SHA512 2d54b312f44e7852e6134693b298d905e075dbe462d1fb2920738e0a055d9b42fe584ac652cd3c31d1a216776d4affb61d81c14090417d22826fc7e7bbd3c055
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYIvHqsBUVqTkmZRFh1mtCXLoiq:Dgb4mBIBhGFYSUVIk25otCsiq
TLSH
T16965AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b7cadbc5e62b3ba24db6fc39a9e65f1beb8414ad73ee3fbfbae09de76086ce01
MD5 cf3fd0251eecca64996cbfc773d6355a
SHA1 e7d4c2c753698e62fa1631323d52d21824db243a
SHA512 ce25a5654e0e9a1f3fa16009dff21d5df74493526d490042ae15b467f15a31fd120184e2866df7c343bcfc6db94d5006802584bf78d6a2bdb0139551897afbb3
SSDEEP 24576:rG88u8FpJqH1bzria7/mZvHqsBUVqTkmZRFh1mtCXLoiq:q7ZFPqVea7/BSUVIk25otCsiq
TLSH
T1B135F16567E401F1D07BD13889924663F6B2B8250364FBDF47A88A511F23BE54B3FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 33056b81ca0443f114dcdeea29c9c1ea09f6e26a48ff094e5a304817688452bd
MD5 541f81e3e9bca492eea60768e2ca3afd
SHA1 46b66ac239bbc55cb93fcc7b6181d7405680c2ef
SHA512 1025e531e0f82fd521e9f7c4b1fd4bcc56cfbd57fd2aaf53e3d9e16ff0933e2f4770fdfad546188a4c9e8babb44705f58f560ca31377c15a270101818b157e28
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkSUVIk25otCsiq:QG05lO43bnVIk25Lq
TLSH
T11DD5C06E62EC11F5D1BBC17CD9C64A0BEBB23825032556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c0903a2672eb2d32f28491d236af9896a13827e06d67f0c57bd1833b47d01fc1
MD5 b4eb7917a7f4a230126ba5c2511c4202
SHA1 4853d0d5d44a4ac7286d2969cc24f78cc8c2a79c
SHA512 e1495a40450c48c0f1a0dc1a8e5d1f0ec4a9e8c1763d30bfd6b8c4d02b45b18139bf8898edec94b2e3f6c0718dd71aad3e449e65fa7f137043858ebefbbf179c
SSDEEP 24576:ofa5POZ3dpFWVM50JicR2hG0lasx2+47eidn3vHqsBUVqTkmZRFh1mtCXLoiq:Qa5POZ3+Jt2pasx2+m8SUVIk25otCsiq
TLSH
T12B65BF5EA6FC01D5D1B9D17DC583861AF5B1342553329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4966449de60fbc8c9cb317681ea41a754ad2883f6b86ffdca368e7d5035c9d90
MD5 d553e737086ae88050488465566499ca
SHA1 8c950d289d8acb1d24db0c7c92e79a280d5d0a5f
SHA512 51ad4ea60f74a76f00d7a7ff83f2308a39bdaadcd75180662c00f3bf11c0f0dcecfe63fee323a295960c23a3689839494884a4913176d55087146140b03c61fd
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FkxvHqsBUVqTkmZRFh1mtCXLoiq:4Nc/zEOVHFhSUVIk25otCsiq
TLSH
T180858C1623E801E4E1BBE1BE89779546FAB17869573086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b52f0711fd32631096e122c996278c5b85e0c72bda12e8e453e6e3f6934d9660
MD5 87004d253e32530c04abb37699078b09
SHA1 baef9f2b8fe536064bec5266daa788179342648c
SHA512 4cb0b5fb3ddee97fa910748a326caf65506465eaee5057fe7ac091d39342a00433ad4a1527b3b5e345cc0853b80c399375f86492079ac9352d25cb0db46b5d33
SSDEEP 24576:H8kNvNnaFeYhJNtmZBmLvHqsBUVqTkmZRFh1mtCXLoiq:H8MwBtOmGSUVIk25otCsiq
TLSH
T1DE55AF2EBAF806E4D1FEC6759D238512E6727461173293CF9290C13E0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 99991ac531f1acc8568cb371fac823ab2ebf2f177da0234f7d1edadaa688fed7
MD5 09d6a17b0d757f18b19950d9757d4544
SHA1 392d8a2d65b6d6a4b41e0d36d0c14a5fd0979b24
SHA512 970c96d07fd784c500856d8f99b5ffe4cd1726c90765889339d11de63e6ac7213971ca8881f090cdfe7f20b383d7b42f386275249fd5a9def6b1b2b76a43e771
SSDEEP 24576:qPUr+NQVvHqsBUVqTkmZRFh1mtCXLoiq:qJQUSUVIk25otCsiq
TLSH
T15A05F21E66DC18E5E67AE13D8992860DF77178611711E2CF02A0813E5F67EE8BC3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 03f4e771ec2332d136019d0314f698d5c220ecdcbc05eadfbd31a89e25b91be6
MD5 c6692537d1df2e6a0a92c6968d3b06df
SHA1 95781a80b8976fede1a5387224753eb3d4149c1f
SHA512 a30587513f2b7758a53ab73d2eab40608826500ee12f5cc71428fa9e3d4fac3bf822f84e56466cfa4d9bef3bed9e59ded5b8ec7ed1f14013b375545f8c504db7
SSDEEP 24576:zD3FHshBIYQgAqvHqsBUVqTkmZRFh1mtCXLoiq:zDVHeBIAAnSUVIk25otCsiq
TLSH
T1CA25E13DEA9C04E4D57BC27CDA638906E77138A8072265DB0290917A1F6BEE47D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/612-107-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/612-312-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/612-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/612-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/612-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/612-101-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1244-67-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1244-293-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1244-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1244-73-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3192-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3192-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3192-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3192-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3192-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3372-308-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3372-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3372-83-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/3372-78-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/4116-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4116-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4116-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4116-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4116-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4632-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4632-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4632-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4632-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4780-115-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4780-311-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4780-121-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4780-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5136-137-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5136-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5136-132-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5136-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5136-126-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5400-278-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5400-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5400-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5400-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5476-16-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5476-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5476-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5476-23-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5476-21-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/6044-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6044-326-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6044-89-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6044-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6044-95-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6044-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6128-0-0x0000000140000000-0x00000001400FB000-memory.dmp

Download

memory/6128-87-0x0000000140000000-0x00000001400FB000-memory.dmp

Download

memory/6128-9-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/6128-1-0x0000000000980000-0x00000000009E0000-memory.dmp

Download