f6285893b37b1d6d69c5034a0546dcc4fe0b04aed18f99a515179e363635e3db

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
Size 1.4MB
Sample261104-wfdqjset6p
SHA256 f6285893b37b1d6d69c5034a0546dcc4fe0b04aed18f99a515179e363635e3db
MD5 6bd9afc6541b4f1537514b924c532a42
SHA1 d6cbdb4b316ad33d05c8da616ff98abcda24c802
SHA512 f0f7a4428f0df4c02653165418e859fd38ea89cf27243b7bde067a8433b45d64585c1ebbf09390466edc9619c588a2fb6c8cefa820af8e6cc72e801cacfc58b8
SSDEEP 12288:MunRmNSuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MDVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D165DF8A13E5048AD5D206BA79239275F7E36DEB3B29978F96C2730D5B373C0C6240B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4292	elevation_service.exe
2984	elevation_service.exe
2792	maintenanceservice.exe
4536	OSE.EXE
2308	PerceptionSimulationService.exe
4492	perfhost.exe
5848	ReFsDedupSvc.exe
4260	SensorDataService.exe
4688	ssh-agent.exe
2468	AgentService.exe
5540	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\83326d667fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000670d6e2a856cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a6ade29856cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f818e29856cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf1a5029856cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a085e429856cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052db476b856cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0800e6b856cdd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
4292	elevation_service.exe
4292	elevation_service.exe
4292	elevation_service.exe
4292	elevation_service.exe
4292	elevation_service.exe
4292	elevation_service.exe
4292	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
Token: SeAssignPrimaryTokenPrivilege	2468	AgentService.exe
Token: 33	5540	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5540	SearchIndexer.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
Token: SeDebugPrivilege	2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
Token: SeDebugPrivilege	2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
Token: SeDebugPrivilege	2384	2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
Token: SeDebugPrivilege	4292	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5540 wrote to memory of 2872	5540	SearchIndexer.exe	101
PID 5540 wrote to memory of 596	5540	SearchIndexer.exe	102
PID 5540 wrote to memory of 3972	5540	SearchIndexer.exe	104
PID 5540 wrote to memory of 3740	5540	SearchIndexer.exe	105
PID 5540 wrote to memory of 5264	5540	SearchIndexer.exe	107
PID 5540 wrote to memory of 3468	5540	SearchIndexer.exe	108
PID 5540 wrote to memory of 3660	5540	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_6bd9afc6541b4f1537514b924c532a42_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2984

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2792

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4536

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2308

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4492

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5848

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4260

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4688

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5540
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2872
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3740
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5264
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3660

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fe4b70cc2b7abdfb3648ad5f2abf5f8cec8cc8864dae1e73fbec3dde64e622ee
MD5 b5c3bbfb8ff0651de3ee832c6f77b72c
SHA1 40b23920d8e395351c42ee5b00bc966532293590
SHA512 18866ed53844ef72854d3c98f144b6f1ad6cfbc4a8e98f5123c23ed00470fa4e11a7f3298f80155936af2fc649dec55ee5d9842eff9c3a1ba398aab1a260c266
SSDEEP 49152:ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxn9Dmg27RnWGj:M3q6sjB+D527BWG
TLSH
T14AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 198b3a5b2991f940b764c15f2e1569405a1454fd056e2b1e0bf9276a46f05a49
MD5 25eb8192bfb69f453b3c0dfb6a43fdee
SHA1 5f30de8c06707c6e8099b076f5914b4c9f50fe14
SHA512 ef3eaec1e0bc8d93d271d1ed4ec63c96488d5c403016cd51df93d820d7e1a61dc1359097d376bb9ad6443ac05aaa23c383e1346d705d6f4c23e4e38b58ed6a6d
SSDEEP 24576:2XYfDtczAOsqjnhMgeiCl7G0nehbGZpbD:1tc3Dmg27RnWGj
TLSH
T106650129B3D408F9EC67817CC9A2C516EA337C514760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 9504dd77b05d60fb155ec13c957ef88a774ed9ca468b4f2ab4ff7a74f9d359e8
MD5 d8a23201cb4f86290ea9aa833db11dac
SHA1 2e19e53b32d440273b161ab2d7bf605457cf4de7
SHA512 7a7aa38b9c85f00b556acf0bad945b458905c7f1937fdc1523456230900306a44294bfe106e9a49523e583c1c77dc7985d70c80859d1cbb11497101a86f97d86
SSDEEP 24576:W0Le5ji0hmxxrMhsqjnhMgeiCl7G0nehbGZpbD:WPji0AjQDmg27RnWGj
TLSH
T178859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b857fdab9cde1ec1c0953038bd9936474d156843cfe1731a7ade1258b7c10aa0
MD5 e2b26e7366a76b054467823068a08b33
SHA1 e55b75b2bb98fae4071370b2b51f04ffbc40facb
SHA512 cd4215efc60bba876fa97c7cea37fb78795a40d275cf20be47f9ea7d7d751ebf95972be97a763e8791f38858fc4858154558301c5dd27ecba3ac3acdf473d212
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWn6q8wyuDsqjnhMgeiCl7G0nehbGZpbD:i/ezSC6vUzPveHjy0Dmg27RnWGj
TLSH
T15D755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 76d740fed1d644603fb04e5a90c867e483b9a8b7a35afe990b4f8a2c45a13590
MD5 2e928b575cc0a027df7bea37a4017db7
SHA1 baae68dd5e5218fb3d5d0b98d3e88ea17b65e1c1
SHA512 7411c56a21aae177091cad225200bf945b6962c717329b00ce3d2d6a8b7600c0f8394d58ac29233330523d1cda9bc4a97621e9598be9eb3e6b6119a1018503c9
SSDEEP 24576:zVbqPb88hv/l+Y6sqjnhMgeiCl7G0nehbGZpbD:zVO88hXl+PDmg27RnWGj
TLSH
T1AC559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 25a10aff7e816fe22f512f0d6ac10125bb1f6b837cf83df4d81d3eaed6481da3
MD5 0759995170ac78bdb066e698dab8ebfd
SHA1 f87e3a90db703371060b7a9c8d2cce9edee5bba1
SHA512 6c58645522e5d2a2966c3e8bf65a7f0b2b93c49d82a29746eaeb2b004dfa2a4368bc4e2ecb194cde65a8cad404ec1bafa93dff694294e2e6928ab30c0d6c7ff5
SSDEEP 12288:SLtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEu:SLtsqjnhMgeiCl7G0nehbGZpbDc
TLSH
T1AA4523BF874C50CAEB7608B5C2E9F51EAC137E56981008536AA37DFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 8b168f3837078d90d78516403a066314518fd202d30de75098977420d4d7b3b9
MD5 c26dea64e19b36cd902554284d87813e
SHA1 03100895002e7c170e76652fac80fac8af55f9ea
SHA512 8d0d1c88084d1b57bd85aeda001278a5090458553b1cfccf1559bce9b94ae557aa48760652b1fa75c69be5823c5bee768d4d791ac2de6eded753b6ea66929727
SSDEEP 12288:neBNUbTVO86UiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:nJIUisqjnhMgeiCl7G0nehbGZpbD
TLSH
T17365CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0338109d6ca9cb68a4711164ceeccd49d9e84a6a9d0ecee9b7e043ae90a2d8cb
MD5 4fd74e3be61642dc7ba18f819631b4ea
SHA1 410970eb36a2ba434f6ba6596886c6e2a254040b
SHA512 33a3853a638089411b3a297e137aa5ef90ae23fdff104dd676ee5577539cb7846d21e474e180a13bc24a73893151f6a216b98ccd70dccd1bd70285c7d6024c64
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THV:mQvGAdlCEL8c/DRNw5CXD527BWG
TLSH
T1B9266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 d75a9cca83049d9697db247b3930d567e1380a98b135802425b9e999ba41524c
MD5 0e4211f75672f2242f2321d70c2664b7
SHA1 b49801ac2febf79ff54222a6a58cfcd47ea07d16
SHA512 7f6ab41f3d7108f5cbab6c91fa2cc9944d1dae92463a4c1cbebc5ae30d8913fc21a20655e9213ca3f6aa1fb6ba4edcd2420e974233e6c2c99d210d85f5d871e6
SSDEEP 24576:M0ewsAjEsqjnhMgeiCl7G0nehbGZpbD5:RljgDmg27RnWGjx
TLSH
T18675E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4f580d62a87a61c34fb112ceb1d3d8e43ee1bab1477a0223c1ad39b703dbbd19
MD5 88a8f63101a7f5b6949bf3cf449f87d8
SHA1 a547246efc37f377098b92d8805a5694ed224852
SHA512 ec9eb1db0e8c2e73e9fd326296215ad452c27eda431c19000315172c0425f00a9a05b0157da5da036f3800e31c9c7fc09bd0407dadf8200b91564e871c4424d4
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHoVQBWG:OUEtQevvqc2W1cpV2tI32vB
TLSH
T1B0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 02eea533c2635f847c4dcb1891dded6f594d5aff114f797bce9953b42f510012
MD5 a90e1d7fb394bbfb0d7963deca387604
SHA1 5da641bbc8fdc81267b526a695c2e6c125e27801
SHA512 e99c45827b653001ce3ac44a936521b0460862c4422d5c7d65f9f223af318f761e93f7e18dbe2e9e2d4175a69adadb107f981594798c5d0aba84ad2c9bacdfc1
SSDEEP 49152:fCbRquA/m2yL5zTfFiV+XenmE3/zADmg27RnWGj:4oquVjnmrD527BWG
TLSH
T180D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d50d0e86fd7c36c2d906da87ca34ec14f0335194696d07c24fbd8c7b817c9812
MD5 99def05827ecaa7948f378e4c5402542
SHA1 d95d8270fe2cfc31de43446aa3c83fec045fa34b
SHA512 38d59fc3f09060a5c67b1f83edfe69b0d6fdeb14614a9c4ffa579e66941c3a6a9f98eaf37e8514a1cca1834572d04602823ea1942e2b8c19eb1daad26d637be3
SSDEEP 24576:VAhGL3IFoiwtA5l7S533sqjnhMgeiCl7G0nehbGZpbD:VAMUFoiq57Dmg27RnWGj
TLSH
T170359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 955f2c6d0c5144544db80b2a0d4fe95d6bde106c276573c09bd284fe2ae31a4c
MD5 c7219703765e189722388f219567319c
SHA1 b231fafa81282035762ec89b92118bcef3ccd568
SHA512 1db457abd35b383586e3aaf716b7e6e71fa40a54cbe07e6cfe42de1f9301f881143dc6d2a52328d74b172f837f546319b8dc541fb9e16d7c16b35f8b266f8233
SSDEEP 12288:Ymw5HEjsChNVBFgl0WDm+CjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Vwu4OWosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD65F15A76A80CF9E9674139C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f43cfcc872f1d087d2fd139d43f6aff2c867d1ec6053e2d3241b927ec5a32dab
MD5 2e481b6982f1776b9c60b319388bfac6
SHA1 d8e61fb3c3c3327c2f2a4bf63905216900588316
SHA512 9630224984dc9d71a469444d91ff36ed6189ae996caa5b9269506d6c08a4c9049997326218802c7f3cf50a931b19901718362307cf8b28b93039f347052d5dbe
SSDEEP 12288:WeZ1IyUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LZuJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1305512AA239820FAE163417CC5E5D609EB337C52673043CF16665AAA6F739C44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ba592503079093978f1358985912fd22a6acab62127058b0df95de9ac759caa6
MD5 042d92cd15a53985b2052589309a81c7
SHA1 f48f364d398b2c0d74c47420a39636ca0d3b7af6
SHA512 fa9d7eb73b8f142a7edb8533cefbf164948a18c415958726100da1e217390a312ab2146993d321879b8462fa92362be4ba9ab77ee7bcd766dd803b8e5b2c95ab
SSDEEP 98304:7QRQyi36YOcPbLvw2gAf+PN36D527BWG:KQyiKa/X+PNqVQBWG
TLSH
T16B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f064e30ae24d83296d393ee46d7d27145d8d9940143ea41142a924e86d702e86
MD5 43440bcc9711edf47a1bbf048c3e3dda
SHA1 c9d3498d6175842ddc4d8788a6c1ecf8df50b0b4
SHA512 106b76b97e8fe75d176fb351680afab2e0abfaf7eb8fde43cb406a6b4975361a65a1e2d695d7b979ee19a544bfad76cb347615f16f85da499dd7511e50ea885e
SSDEEP 98304:oQRQyi36YOcPbLvw2gAf+PN36D527BWG:/QyiKa/X+PNqVQBWG
TLSH
T16F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 798d07a25bf12e410da7a33f2e4fe98bf2a33a4e1da10a4b4b0e428ef1e169d3
MD5 3e9dd0118668892f29caf5e9f463fe76
SHA1 317600b503e66c46a421fca5f4abc750b8451841
SHA512 0f1c8e517e324bb6cdc50605b81f28e8e5aa73d4272c67f80ce54991d7849deb08a5b3df4dd2768d2e04b5b40bdbedc3f808bb90ec1a786406509db65c0b585e
SSDEEP 24576:fwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL05sqjnhMgeiCl7Ge:H68Qg55nhceWu7PNU3/QDmg27RnWGj
TLSH
T1F6B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4cb5e054ee2adb3297a8e4a23f042440618657d6a2332f912df616e0c4dbd8f2
MD5 7649d33496ecdbd33bf85f2f52fac063
SHA1 ea2a7313fe2ed11c6c0791c0ce8bf77af08967e8
SHA512 ac24ac9452b9a3d1a8ca095a77023d7390bc0fcba75c7fce52f1cdeb93792c52c7df4062a4552d8e96da800e717522eb2c077eeaedb672ad9aec15ced449554c
SSDEEP 98304:Yy5112gYy5azzVvt69nLKnhZRD527BWG:xLIHEWhzVQBWG
TLSH
T19A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ef9114db16075f56287c2228517921dda2e96531ca721327e5b7770ee6e19619
MD5 59255aff905e73155b7aff111a2c1401
SHA1 d12a89e9616f535854548515ff511b467f4dbbad
SHA512 74f4d5912e4d2cd6222fb3060c33eef1a9bb542940260a2645234903e48fd619d7a90f71f01e45235a916f2cea2f2a168b9eea30820b4ec17f7420ab801a7b33
SSDEEP 49152:hB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glSDmg27RnWGj:3u6Jmdxd2dSD527BWG
TLSH
T11DD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c246d50c33f79d6f1514943f345a5016d6419908ea61caab71825a4c228ed8a5
MD5 9efb18660fb23a3fb9465fc3cdd269c7
SHA1 6133ef75e5b620c37570a02cde0dfff9050697fa
SHA512 6fd47fd445fe6e3858c469be7c71229fa6602609b228c7cbf7fc9ba765244a0c6a26a37dc5e60082d033f8154b34766fc730a2f3ef943bfe056141850bbd975a
SSDEEP 49152:W1hpsNoJpF1A63U44CwH7R4xGDmg27RnWGj:WmifPWRrD527BWG
TLSH
T113B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f046ea8f800f9d5c7a09b3ba5196f3424ffb87a6c0cd3b3e3ad17096abc0b47b
MD5 9660e11caf6492726057bd538fc9cdf5
SHA1 1a07a1e435539c2ec0da7fdca30cabfd4aff1bca
SHA512 1161eda59d5b4b2a3ac8ed4e1f83a6b0c680abe4193bb63ed9c1552c5cc6650a1de1a353da41283077142dbf35bf278b106b566d874cf46db0b78305e983517d
SSDEEP 49152:9SuZQIY0Be2KcRVtOnks6NMHqNDmg27RnWGj:T5dKii61ND527BWG
TLSH
T1D9C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fd28cb3018e57c350c5ba7355d61e9e350588fbf1c891c86368c9397ae4f0d84
MD5 99b4b9ac0d5cfe7101b46aefe22b408e
SHA1 be8203c821a06028b24fbac5009f037edeed2830
SHA512 7b42040d0a8263c4b4e6b50ae43bbd1ed2115e716aacdc77ae36ce776e579bc7b1266a3fe060f9edaae9ad23ba96edf3f444a0b326aac3539f1441fa56ea1063
SSDEEP 49152:YhtSn8EApI0fig3giDn0AP5wiDmg27RnWGj:JX2imphfD527BWG
TLSH
T13A95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3ea96b65a5ba494b7633ee9a56789d5800ad498c86da497ce4e977fe8806cba2
MD5 655d0a134bf7dc6a98f654e3e3a99c2d
SHA1 168c7963e14b578b1537f3e399ae81b0fcce05a6
SHA512 7b2a2f54c3bf8becd133dfa8beb807663f1b235c496b4ed4fbe742863fbf435993c89cd47f9efec92668e1fe82e2bfd011313b99ff4fa4cfdaa512c8b7743f92
SSDEEP 12288:eVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15B4523BF964C41CAE62644B5C3E9F14DAC073E57E92004937A9B7CBAF7F24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 561668c602ecc025b47ec6535b849874ffb720ea314f34e2026c70cb0442f907
MD5 eac04fe59324a5dc79341d22f24853a7
SHA1 66a1d938ba281eb31de9e06fd7fbfebe6dd90ed0
SHA512 9e682a886af88da891f3ac7fe4ef70f51e43fcade7a3c41e16bb9a4545ff842989b538bd7af8271e702add232f0f7269904961ef5c170c51029e6b264091f434
SSDEEP 12288:bgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B94523BF964C41CAE62644B5C3E9F14DAC073E57A92004937A9B7CBAF7F14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4d7c03bbab3e651116ea7b78845094f642aa101b51b66c769177e5cb41f03d03
MD5 535d87743f866505d57ee75b1c4f85f0
SHA1 61a96a479926c0a79dc7921a76b69f05399241d5
SHA512 c63e4a8ffe58a5ba9d3d97bcc4c7a74cd1d6281816ebb155a28d12a8feb7c612d0196d2761777cce5a9af13cfe0325fbfd4e22766541a5d33330686e7b072c9a
SSDEEP 12288:QqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F84523BE964C41CAE52604B5C3E9F14DAC073E5BE9200493BA9B7CB9F7F24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 83954bb162ecd882a39a0db3245ecf023f661c25789050c62efdf00e548a70c3
MD5 4ee8674cfe134d18a7b7e01c7f8c511d
SHA1 bf66bcde7231cb3a45ae2fec953237886e6496ca
SHA512 26a78ed69672ec39517a5d189a7516ed762229a910a93ea9a76bb2b57d93b7517458d1c71ad41b5a00aa5a7f88eef53dbd5c2840f53558f6092b9630e05e4257
SSDEEP 12288:aVXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10545236F575C00CAD83685B4C2F5E11DE8237D96EB3005DB6B532CAE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f7613035d7f894e5adf853e72f0ad55fd739acb9ec16b29243b3eda9bac8f7c1
MD5 ca62294bb739d98053d47b2fa473ad73
SHA1 5c616f25e687b2a6ead9935ed37f9cf5a8aef9d0
SHA512 fb67384380f7758eb2f686ac0e0a2068f6ed211984f8190f800f1c718d9b66ba8313035b2fddf8cb2c506526f17121d97f1b1e2d64cb6f7ce167451c4f058c6a
SSDEEP 12288:QvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15F4523BF964C41CAE52644B5C3E9F14DAC073E5BE9200493BA9B7CB9F7F14584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 313dff46ec91bee3e43a7c366c949ab1263147ffe274d44b54785e34afa93f5e
MD5 1ff1ea4c002e7b9d0e65236fb861c658
SHA1 c2ad8b555f40a089bdf4cceb2203991adc051426
SHA512 6a3667de77120640b12c3e40f29efe89835bea00e5293b6a424ed4f52d28ce5909d450d08c2f9ece0379a0959eb85e0e9a2ffe292255de707df3a8a2ddace547
SSDEEP 12288:ZMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B34523BF964C41CAE62644B5C3E9F14DAC073E5BA92004937A9B7CBAF7F14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 506c4d1ae7d0b6c6cd2260bc935dab146efc3fea4a1f86e5cbf89bbd16888924
MD5 02f2ae23a5ef4c7571e9b4e4bedd52ac
SHA1 1c9646f9e43108c4bf252711620361c001daca94
SHA512 f0e86c3f7173f2fd52b4e0a0b8b6453e3d582951c2ba5ae1aedec242c71baa4ff0baccc455928ef8eaebb3842ff3342cea72bddf7c3dd525e99d83544eb73915
SSDEEP 12288:7YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1834523BE964C41CAE62644B5C3E9F11DAC073E5BE9200493BA5B7CBAF7F14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d747f6af8958cbb9b8344a31f04383f51a0871c78414b746c44af0295ce742cb
MD5 26091ff2fdfcd90ba5d345d076b3492c
SHA1 de3dca74b0671f0cb14bf5fe247b857a25ec9298
SHA512 bf8ed105fea4018990fcc4413419e4c3be9f97a6b635398fb3b6b43206691a219ffaab65872ea074d54269f6f9f338c3b6479e8a4fd7d0bfcc3b2eb8241457d7
SSDEEP 24576:dZMRzFVSOAsqjnhMgeiCl7G0nehbGZpbD:dZMRzfIDmg27RnWGj
TLSH
T1D96501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e66f9a0b245687683a5161d431a69f796b56d4d4d000dcba4597c11c7c6da0d1
MD5 34a56b274059c56d57c9268524adc9e5
SHA1 fc0d43609f027ffc92d200a854caab8edca3fca8
SHA512 5470048aa216b76c737d22810f09d581a831a968bc374f92314c0c815047e65ec9638b750b1b062baa62dfe170540739e3c4c6df9aa332e2694a71593cfa67b9
SSDEEP 12288:VZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B4523BF965C41CAE62604B5C3E9F14DAC073E5BA9200493BA9B7CBDF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4189ad38bb26f1c081953214083acbf6b4f3d8388a548b2db797632eb6b3c140
MD5 f3c089255a7fda9846e0f9409ed8f272
SHA1 0ab387589ec793f18a14e48ec641ae4570b09150
SHA512 6b3d561e712cb5395b6325039bc39a3534627075570fa788e068a6c9c7620aa2030bcd53602af7d9d5422245be62492cee90de766490b813788a9173dbd8df02
SSDEEP 12288:B9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:B9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E24523BF964C41CAE62604B5C3E9F14DAC173E5BE9200493BA5B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 ece163edac28cf352734ab1de9f24e3b7670c8ac20212be3c157fc845a44e637
MD5 a261800b55fcf1e821f7b6719a8f8424
SHA1 8c40c412bead23e1c36df3f970294734d5fc02a9
SHA512 7d7d2014a9eca83bde02ae3e3c2d871d7873468a645b439c80a7840c76fcfcb78f9789a5d1dcea2cfa1c7581c524deeebd94272ff007f1b2919060139f5c4849
SSDEEP 12288:JyPz5L8UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ozyUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE55125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c401356cba29155f74510ed45f035008949c914be5fe826f72ca869e09e7452f
MD5 f50200ded4a32e8157b413e65d80e7d8
SHA1 b2947aedb876ed7d86a00a3452c42be336d163d0
SHA512 567229aa9293a2d46f1a3e42e7638f1fcffcfff6b0f308ce54fed64c6c964073273bf570ef3fe9676c8f29a5b2620cf57c53cb7284fb45280849c3a7e4128811
SSDEEP 12288:mZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1914523BF964C41CAE62604B5C3E9F14DAC173E5BE9200493BA9B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 52cd763f910c9c888c78e27d81ced4e38d181c6e775433fdfa6d43671fda3b3d
MD5 b388ea8156c81c1cdc14de7bc32dd7c0
SHA1 19831d734dd2beb287862285d8cd670aa24b2261
SHA512 453424ec720e9a03a5af8c7906bc93bf5e42d0fd2b4ee9bd7e4064e9cdf175bfe8a4c2512c0e0744bdcb1e1b8c5b000080b3b6d545d2fbc2cbdaf3675db03219
SSDEEP 12288:1ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13C4523BF955C41CAE52604B5C3E9F14DAC073E5BA9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 e6e121bccf1a5ece17100569c9285518a5b94069c824e73ded5eaa46491d06af
MD5 c47d299d7adff84382c43c47fab89938
SHA1 190b9c8aa4bc657372c2747fe08008773506edd5
SHA512 052f78c3ff0bf0a1e632c2522adb69cbe02b6dd91a013354fc061e97810049a98a4d49b6fc48f135e18effc037bacc862ce60826ae393e0845392563d219f758
SSDEEP 12288:jyPz5L8UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OzyUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A55025B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 1b2de5b8209ccf1aef6cc3bfb8cb898dbf761cb43eddebcc78cb9c4e06f710d7
MD5 2109e88581997fe8249261579fe0c511
SHA1 c148788300bd4b3c976b152cf235d6403964d28e
SHA512 7e52e81acafbb2d1873a9a1fec5a06b2efbfbcd6656da24dcd728729611060e087844b28838feb7837a1f77dd794c3a920e034a7cd3cc6c0343e53dfdf4f4f49
SSDEEP 24576:TTDaLl3z0zDasqjnhMgeiCl7G0nehbGZpbD:TTuLljHDmg27RnWGj
TLSH
T10C6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 686d2694e7f80830a29c0259acc4f44bcbce9eb7e02b551c0717d69a62decb32
MD5 487d08a7d339decf75d0831e8daba98c
SHA1 480b2e5e895d581cb0eb31784cf1c5cd51d26da2
SHA512 1cd7ae547763a510821e06e2080bcdc7a2d7ce62f32cd8b5b598b135299c41992f66deba9885105875d2ffe806568e62bff3c2e831485ecddd97ce82aa482220
SSDEEP 24576:b3vd9CHKy7GZWsqjnhMgeiCl7G0nehbGZpbD:7vd9CHKyaIDmg27RnWGj
TLSH
T15A75CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 154f238e29d2ef048a9812596d119ab251abb435b6edeb56582dd4f185c683cc
MD5 e1df66f02850f99fb388a47790dfe190
SHA1 8e5881e10c47568ef25898852a23bca9b4289080
SHA512 2bc40061627a2db1d87874f7ffd49accf8827b8ce77a1136baf7ad8e2fcb4c4c20cde09fcf944b1f341152c3b714bf287bbe260685dc1d547039afadbc27eddd
SSDEEP 12288:bKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DC4523BF965C41CAE52604B5C3E9F14DAC173E57E9200493BA9B7CB9F7F24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 3bea3efea28e675241a83bc6f46d3db01d8da71bda7295502f19694047a3f6ff
MD5 a796d9342bfd5c391207a4daf0849977
SHA1 2ba251d1e53954cd7ac721899551146f0460ce6b
SHA512 25b025f324129e17dd1684acc452af7566dd392475a782ab35db5b49ea3efe6620c83fd68edb9ccf0660518de0f28359342d9d9ad13fd383fdc2aba1195ba8d1
SSDEEP 12288:l0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:l0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A4523BE965C41CAE52644F5C3E9E10DAC073E57E9200493BA977CBAFBF24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 aed056bb3f6368a19bb5490097e5e06f7e39d9675caf4f01497b503c7c775add
MD5 3fbaff3853dea65ab1d79f08b6880d55
SHA1 e316c4c8ffd6c3dabdd90c9421e68ce479e7804f
SHA512 1ae2623de49abc1dac3df248d0a9ea028a60dcc789ebb4c0a0f49468a02abb1a5676e99b1384d22bcc7bc42a697160f8a422049f525189b7cf0e447284f8b543
SSDEEP 12288:b7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:b7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1004523BF965C41CAE52544B5C3E9E14DAC073E5BA9200483BA9B7CBDFBF24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 fe48f246ad5f172c2957db0c5a40003c68107737c7d07e11a39a97fa7dd28403
MD5 422aeaee83a75556505ef4f2cc01e4f8
SHA1 1372198b64d299f976cf4bb87f6e15fe470e5784
SHA512 ef2e7955947ca3261fdfbbb43cc9c4bfc2cccc12ec65a53744be785f6bdeeadcc5c5a7496f2ed86194318d83ef10b0a6512c8b7bdae207e675dede80177eff04
SSDEEP 12288:AZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1444523BF965C41CAE62604B5C3E9F14DAC073E5BA9200493BA9B7CBDF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 45641b3011e30039f9a45246492370ef2c3684bd87eb606da1cb6471e2cbcfeb
MD5 b041db7f56c652d7eb929c9a9ed23939
SHA1 04c65502ec7b96ac2abd1a517b016cb4e337e9f6
SHA512 fdb0c91e968bf0587f85dbbe43da55f48ec6624e9589d5d2e50f164087f5032020d585ff942e91b5a9f9c2feb899fc7b2331f8605fae6616a12b1f66264c3489
SSDEEP 12288:gKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D4523BF965C41CAE52604B5C3E9F14DAC073E57E9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 56bd4f5703dc8b96c5986b1cbb3341ba1876dae4dae128b1b8f25249526d6601
MD5 51be2975a4d52aae04bb41995ad9151b
SHA1 9e7d5993b8daaf74851c60890380614fe4a30200
SHA512 da2441afc76f82789ce373f9087c3e7e26afb966fdeb920fae3acef87f74e118d29fe9d7ab7002a71ae7a8cca96b985da5a565cd2b212a19ac610760ca696703
SSDEEP 12288:ARXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ARsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14F4523BF964C41CAE62644F5C3E9E11DAC073E5BE9200493BA577CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 80c550b6371989c05032929c265d8df8ad77098a85232c484f8d45c1f5bae404
MD5 19976d2b5e0196c19b40f62094705052
SHA1 7c0940236314d9cc255bd7047a8cc4abbef5470e
SHA512 e0513da19dc9862754aa76a7886823918c269e636fd15fc013ceb81914ffacb07457fe226ab8626e1afe2e71704b1684a4e6af97d0b9f537ba4b71e43e3bc083
SSDEEP 12288:vvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A24523BF954C41CAE52644B5C3E9F14DAC073E5BE9200493BA9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 3cbb9688ff2b55341a849c71f3b9931babcdacb31173435447d378a25e63fefc
MD5 30febf797de66ce69065eefdb199f8f9
SHA1 a64121bea538f7054566e313a51f67bb30906d14
SHA512 0b211d08f24c7ef3c71e338bc824094643cde8d28cf315894bdf75a53a776d6fa77195573fe8fbf2b98d70baebb69294faff8d749482619de7f0e8a088554c5d
SSDEEP 24576:9fwvUk9RX6wkyAINsqjnhMgeiCl7G0nehbGZpbD:vMnYIxDmg27RnWGj
TLSH
T13C85D029EBDC44E5E177913C89B7860AF6B278591B31C2CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6894cd2fd2f09afabe30b6e31578935118a0afb49b5c384d936b61a5ab367c48
MD5 3713890f3cbc137bedb098f90cb9bda8
SHA1 1bf5e151e6b80a01514d87e364b974091b41be61
SHA512 76d1e3e39297a05700b09dd6a0056b934eb7336dd9f853ff1d2648dcbb457a57db69b79eb7496ca9b58bcf6c40c8e69afa2d2200a3f781e94b51da0ee8f72a72
SSDEEP 49152:mYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0CDmg27RnWGj:lySzPaD527BWG
TLSH
T1B7066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c7126a4080cfa6c25c6282c96f882661efc0c993f6a913d3ab6dbc4133db709a
MD5 72667061abddbd09219a59a99fc01fa6
SHA1 6cafcca95087e5fb64246fd62b02393efeb746b1
SHA512 d8bb6e5a4a1ef6de09d9027fc352959f15471b3c93f6441e264b4e9882e431b34df02d09e041e03cfc072cdcb57678e30aadf3139655c459aea25f4235e4d854
SSDEEP 24576:m47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYQsqjnhMgeiCl7G0nehbGZpbD:m47JUQjTirIhCnDHUPfF/SDmg27RnWGj
TLSH
T1DF65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 1f14e1c6b6e4ccf80d509ed5e39d518d75878b6833d48560cd034ed83a116404
MD5 0845f728eebbd7f929da80468b0a9000
SHA1 e6c81a112581b2f00eb415b08d26714a8da905ac
SHA512 65d50d8c7f44d03adc356c526d5fd11d6e41683dd50cfb9e1c0bce483450379b6b4f49ff684505f739e782b1df26dc5045aaae17ae9fa10738f70849f6a39a18
SSDEEP 12288:tbsfJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F355011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 f6b7feda3ce9a8a6644ebd14f42f4b1d4c83e92cb47e43e7646d174848909886
MD5 77d374ec8f2b20ccc3c6e01b19d141c7
SHA1 2a8ea624c7b485d69b179f0d8a18d5ed739931a6
SHA512 b36e3be774916456658f40ca71761da5c7ef539dbeff6e7b0c4cac83427dd00fb7ddd1a30d9804e40ed6d169d6394726cf9afc001d6de7b00ffa060aac2ba2e3
SSDEEP 12288:OcpuU3fE7HXCiP9oUe9YqFlqyxGfsW719UgBoT:Oc4UPEDCqcWqFlXxGfsY9Ugk
TLSH
T1313517117626CB4FC5A944325E33D2CCAB707D06EE459B0372C98B3FC576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 02913502953f3694fa6e9b45b951412d17dd8460a4d762a898e6e1fca81162cc
MD5 a0e7f607b52ec33915cb56561b868fe0
SHA1 e5e1828fb102f59580122b6a15ab6bd84757ed17
SHA512 5b2767d482eb0c4f5041dff8760ff6bf376d91d57a90a00fdf871c8537b38223cf45f75c400117c20b1be94afd253d9679ea22ce3bd56f87f2450f933e3920fc
SSDEEP 6144:oQBn8nxtSYutSMhtSaiWYlqWlzl4AUI1sSI1E/fhVRaiESCmFb0vJvEtMxJvEtMI:4M1MKM5TfhVRaiESCmFb0vNQTfaM
TLSH
T18855D640A537A7CFD1FB6031072A5B8CABA4EC07B7055F27A3C5453AC86B712A1B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 28279941c3689e4e37e6c0937019243373efa48d71927bd4a2b7c871c2fb1eaf
MD5 e3a1d115700576b847970dca937de5c0
SHA1 3922e8475fce41b79a1d804fb10de65524a93e57
SHA512 2b1eaaa73bfc4644db4109debd5176a86886fb258936b696c397cb8bc12b3c7296cfe58419bb91653eb74dd087338c63bbe07fff46276ae2e609d4a9bf18439e
SSDEEP 12288:307BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEW:UBsqjnhMgeiCl7G0nehbGZpbDg
TLSH
T1F545237B934C508AE93605B482EEE12D680B7E669F1044C3BA5778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 47673d3bc8c32596542e7735b253280f2df373c2aad8f397424248de0fa93d2d
MD5 36e6d5862b9e38e8c9d40b532190b51a
SHA1 c8f04415ffced15ecafce17d184b307c06800c94
SHA512 d13676d73d22648e1591f8d28c7c018b0f0b5016ef10c965a8015aba9b41ff480e62e21aaa40ecefcc2b03c82d4d5927f2755ab2986a97100dd3149911afc4e0
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYDsqjnhMgeiCl7G0nehbGZpbD:Ygb4mBIBhGFMDmg27RnWGj
TLSH
T162659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 8644c3ecda235afa83ede7e3662136955aa3efa107dc94e4d71caadcf1c9bc13
MD5 3742087de9edd401b2576b2f63459b5b
SHA1 de22abc3ced80b2569029c7ebb42677a176081b3
SHA512 36e9ae749998f599937224797a1ea850e20180e6cb40573f8b2e771fa1bde709b34e247af8f32ba28c5aaad33484fa6813dc8ebd43601cb5400b93ee88891369
SSDEEP 24576:mG88u8FpJqH1bzria7/mAsqjnhMgeiCl7G0nehbGZpbD:t7ZFPqVea7/PDmg27RnWGj
TLSH
T13485016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f2befb90f8a212fc87898be0a77fac41e9fefd0f9d297236a1bfd934464c6fe6
MD5 0529a36b2ce42474641a77cd44f6f163
SHA1 58662503e4b428d9eff8a64fea93af83d2d69e2c
SHA512 5bc0a3d3c066bfd5975acc4995e6335656debf066868ade4c7cae8cf97c2d3eeddad9666d8b9172047d0434b251f284a69c3f2fbbda54c3ade7e36d8505d6a52
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4Dmg27RnWGj:MG05lO43bZD527BWG
TLSH
T10AD5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2950e185ae209a23fa02bec3db932ec7d0f97867a8cd07fed1dba5cc969ef022
MD5 56479aa25427be131a0337551af6b051
SHA1 c668211e4116c8cf02e8eda8fe8bb34d3262a14d
SHA512 67aa53486b88a9a85c2f5135d3c67571de99bef129dd83e77a4ff12a4c5dc09fef7beb646e261b916404ad7b9fbe56240e2813545e78c44caab5270e908006f0
SSDEEP 24576:2fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnusqjnhMgeiCl7G0nehbGZpbD:ua5POZ3BJt2pasx2+mQDmg27RnWGj
TLSH
T14665BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 de5cb5a35bf82f9f8753742d8ca6b95043940683ac23a84cdb528b7a757285de
MD5 c0d0ca2922b578ff619ea80b9c9b156f
SHA1 79867f6d4083b6c5b42bebcb8dbdea3f8c4bbbdf
SHA512 f0eee834388b15f7263a0263e43c4baf511379365e353ce98353af11a47724d5128f2b159832a4232d6579282ff11ec57cd481be5deb903215bb22bafd86dcae
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkIsqjnhMgeiCl7G0nehbGZpbD:SNc/zEOVHFvDmg27RnWGj
TLSH
T1F4857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ae93bce662a8d29d43f9562ca864d292735ce7d453cf5f7ee6a5c1937a1b402e
MD5 aaf41c05c8be410182aee089505942f0
SHA1 479f74d9e4a1d195107fe346ae368ccdcac37b78
SHA512 00703c2890a72a56d1927e9951f83bd2fdb9e5e2027cfb91084fe3ad7d061b9a193a2ccd1e459136da2c9f125a026d99da480e3b00f2ea6601951bbdcf9c5e76
SSDEEP 24576:HTkNvNnaFeYhJNtmZBmysqjnhMgeiCl7G0nehbGZpbD:HTMwBtOm2Dmg27RnWGj
TLSH
T17755AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ce2c04d30241fcdc0165fbbe4095e2949e14c25255df70f4f3f475ad250ea16c
MD5 0a1dae890b8390dfbe1539821ff97eb9
SHA1 b8bc55427a59cbbaf422359e8e77e0fa6522bb8a
SHA512 d7678188827f1160fb842a896303c33b0ea7abfb76f09443d9f549254be0658dd1d4ee99ef9bac05bf74676c9584194d3794cceef4f6bef9bbc550889bb4461c
SSDEEP 12288:3HvUrBFrEjwaQcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:3PUr+NQcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F065F12F62AC18E5E676A17CC582C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 76acf2df432bb4bee0ecfae50555adc6c8d8a77a4466127ab3534573b789b6f2
MD5 7e16d7472052de907ccdfe0c1942147b
SHA1 a2104e5b4ae8cd1d7b5ac09600b32dc44319ebd2
SHA512 fcf2a3510fbd57098d4cebe74d382c7f51e74f2b9d0a4224630819a808c6c0ca06bd645198c98d4f33ffc7a6c7c5d8879651b320f8de244eee410eeb83131654
SSDEEP 24576:tD3FHshBIYQgA1sqjnhMgeiCl7G0nehbGZpbD:tDVHeBIAApDmg27RnWGj
TLSH
T1C075E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2308-74-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2308-291-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2308-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2308-68-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2384-0-0x0000000140000000-0x0000000140204000-memory.dmp

Download

memory/2384-78-0x0000000140000000-0x0000000140204000-memory.dmp

Download

memory/2384-7-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/2384-8-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/2384-1-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/2468-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2468-122-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2468-128-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2468-130-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2468-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2792-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2792-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2792-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2792-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2792-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2792-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2984-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2984-107-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2984-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2984-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4260-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4260-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4260-102-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4260-96-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4260-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4260-306-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4292-82-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4292-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4292-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4292-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4292-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4492-303-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4492-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4536-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4536-62-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4536-56-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4536-273-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4688-116-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4688-309-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4688-108-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4688-110-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5540-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5540-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5540-138-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5540-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5848-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5848-84-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5848-90-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5848-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5848-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5848-322-0x0000000000740000-0x00000000007A0000-memory.dmp

Download