d0c3809c942e8e5ca8668ad23e00664800e6043d14a8f7928e64bc7448413b7c

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
Size 1.6MB
Sample260716-maeafsd18s
SHA256 d0c3809c942e8e5ca8668ad23e00664800e6043d14a8f7928e64bc7448413b7c
MD5 61f5dbd1c46e4bcbdc310c9d73b9b85d
SHA1 bcba703ca26d3679122093e30f5f77e6773324ae
SHA512 4b2b551ce9fe9ba645ea44496272b16a37fa60470feb19e1d8fb39229f1ef07eb36c55877337b0dd5131447246322314f8bcf03ed8a1d85db99b6c02b3dd849a
SSDEEP 12288:MJCPwub5HCsE3FyZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:MotRDOF/1W3SEt7vRuy15V/emW
TLSH
T11585DF107696D036E8F706718FBEC529856AFD611B2950CBB7C04E4D2AB09D1AA37F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3212	elevation_service.exe
252	elevation_service.exe
1300	maintenanceservice.exe
764	OSE.EXE
3208	PerceptionSimulationService.exe
3284	perfhost.exe
3316	ReFsDedupSvc.exe
4684	SensorDataService.exe
5832	ssh-agent.exe
4700	AgentService.exe
5436	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f110ee43e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f196e6140c15dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000506d57510c15dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003782c140c15dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d16a7510c15dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c96f9f140c15dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5e2a8160c15dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078258a510c15dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac90dd140c15dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3212	elevation_service.exe
3212	elevation_service.exe
3212	elevation_service.exe
3212	elevation_service.exe
3212	elevation_service.exe
3212	elevation_service.exe
3212	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5912	2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
Token: SeAssignPrimaryTokenPrivilege	4700	AgentService.exe
Token: 33	5436	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5436	SearchIndexer.exe
Token: SeBackupPrivilege	3316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3316	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3212	elevation_service.exe
Token: SeDebugPrivilege	252	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5436 wrote to memory of 5548	5436	SearchIndexer.exe	99
PID 5436 wrote to memory of 3152	5436	SearchIndexer.exe	100
PID 5436 wrote to memory of 680	5436	SearchIndexer.exe	101
PID 5436 wrote to memory of 5972	5436	SearchIndexer.exe	102
PID 5436 wrote to memory of 3356	5436	SearchIndexer.exe	104
PID 5436 wrote to memory of 4360	5436	SearchIndexer.exe	105
PID 5436 wrote to memory of 1132	5436	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_61f5dbd1c46e4bcbdc310c9d73b9b85d_elex_emotet_remcos_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:252

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1300

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:764

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3208

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3284

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4684

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5832

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5548
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5972
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b8cd831f396694e03cd9d3d0f6ca51b76f47ce027948a39a9b6c21748dae5fd7
MD5 7720b754b55b3a6a87c609aa33816352
SHA1 130c1f65c77079bb11a5ebc578e36d4194044abe
SHA512 ba729286af63b8dcb5e1762754ea6f4dc79d6dd3aad5fc4247d892288e98b811a11090ba622d62caf8102d73f318607914593f159045f4fe62eb4e343bad5531
SSDEEP 49152:cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnDoVvxtJW:G3q6HjBr3W
TLSH
T14AD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 6d617a06444fc81fc57d3da4bc72da2bf217b69132b6aed5a8297d7dd48af903
MD5 9f4d832d00578291539ba38e72d7f869
SHA1 9570605f2bc6b9a913492d31675217685b8c48eb
SHA512 450ef8d883ca6061fef177e0132c86a83d34f752acad4b8953d0ea01272e022910203008ff39d62896e7371441c6565b72fb03a6e258afc4a66a0d9427bc59b4
SSDEEP 12288:n1XLsswWkxy2lRq2czA1ZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMu4:1XYfDtczA21W3SEt7vRuy15V/emW
TLSH
T14965F129A3D048F9ED678278CCA28515DA73BC5547A0E7DB03E49A251F333D84E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 fb47b1e888e96aedff685733a4f10efa95b267e7250c511a56e4fc71656cbeb1
MD5 6dc53493be950482d5c703bfc55062b8
SHA1 9e8f696962bfdfdbb9c95a5ce8b539db5d3a0dd9
SHA512 e7cb1cfa0941b0a3bd6ced6441e3759e26ad780963f54f0612e06400eae38e32c4f6d6cc509c932b1ece70c5d76886dea0c2c3b1b00fb454b9a3ee9545e7e4f5
SSDEEP 24576:E0Le5ji0hmxLrMb1W3SEt7vRuy15V/emW:EPji0Al8oVvxtJW
TLSH
T166859E16F6748331D073C0B9C5D2A69EE97230865B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e8574c4acd23682299e6829c6595795fc3a74ae5eb48ca7fa87ec45cb8598556
MD5 3c3647aea5dbb424566b7ff0390f31f6
SHA1 07368e1b45d1bc405984c9c96a38e931e74678bc
SHA512 286ff360a3ca02941a9fa9e92c06f1e1126ee207ffd5989d6af727233f8b088fd3fa236818e0868b865b9184a631e2629343b388eb9617cbd43f0579c0bdc8ea
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWE6q8wyuF1W3SEt7vRuy15V/emW:N/ezSC6vUzPvxHjyQoVvxtJW
TLSH
T16C755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1bb4aad95c0d23fa8b4f03aec514bf8607329fe7c923fe46eed86ae509193bd7
MD5 fc4e89e152c291d4b3507942154e7bfc
SHA1 4db3d354d021c8be807556ae61dd8e5f33dff552
SHA512 fed567b723fd96d556fe5dd82381af38a6c03ae3428dbf4a24c97ca2676862a662c27b3d6b31c3670244e5404ea5aa670367f2b79be443969643146260f692d8
SSDEEP 24576:yVbqPb88hv/l+6i1W3SEt7vRuy15V/emW:yVO88hXl+/oVvxtJW
TLSH
T16D559D66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2E777D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7a04294314513ed31b4105e873bcbbd8af518c4ce79fa982709d5cd341f28f8e
MD5 eeb7f1d4269c03a780fbce04eeb61931
SHA1 2f830a9ec1db4343bda739fae5c780bcc47b7a3a
SHA512 b5939e22bf42adea526f9046aadab0c8965da333a3158d25f8d742447161b59e3651ba0989428e240b68209e64afe63f9eb2ea017662d00ffcb99208af991dcb
SSDEEP 12288:rzKZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:rzH1W3SEt7vRuy15V/emW
TLSH
T1D6552302D250E463E7690B705C362F5CC5ABAE6C2CC5B39B77C73B48497D249C9862AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 fdb828d127787c24dcd9e26ef5c9daa80cce7313c85f5edca2643889d8b4d5a4
MD5 a19ced904710a07388de422dcf8e653a
SHA1 039a0d253f2d489106f6cadcc1e02ffe9f1c9f74
SHA512 8f596f7e3c31b1ec11307d21db9f58e4f74b716f9905c6c0dc13b1a617b43439ab41e4039f44c15727f4026ad4f5d1917b1ab161f5ed18ff2047d1688ad6a4dc
SSDEEP 12288:LeBNUbTVO86UxZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:LJIU61W3SEt7vRuy15V/emW
TLSH
T16075BF3BEE28FCE2C27A4DB95A518600D77278704F52A3CBE165830EDE235D54E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2ca0f1c66ed0a2104e56770a7f13032e107c35a5383fa306a074ab50cb9ac36e
MD5 bb76da49784bd3b8dc044d6c67b100df
SHA1 224282d291ab6d058681735eded8f29e2fbc70e6
SHA512 e4539f55f4d80c93555d1f2c2131cbedfcd70699b7a73434717a14ccc3916961b0a17dc24079950ca4821f422951780985b1bb30f23885ffdac2d49bbffaf94f
SSDEEP 49152:7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THa:7QvGAdlCEL8c/yRNw5CW3W
TLSH
T1C6267C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 eec039c4dcd735e73f3df9f2f47d62464f4ddc10bd127ce385b4a6ecc4725bff
MD5 5fb9dae54635035774274b25cf27dfca
SHA1 4d9c73927dbacb76605cad6aca998dda289b9e4a
SHA512 b0fd84b1cc844fae252be6bc9509927005d1ab2d9840261e3d4f608861b753521cf796d860195cef2f08a44224d878d388542c01c5e08862a5b3971151a08551
SSDEEP 12288:bAwSfxL/2Dc39DLLmt0LDQewsAjzZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5u:EQewsAjM1W3SEt7vRuy15V/emW
TLSH
T1AA75E031FA74E032C37B0DB21B36C71A546DBA204F912AC3E3E85E8D59742D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 66cff9a4d182b1f58e6888bd2cc97f2869f3acfeadf12ed26efb29e7088ad080
MD5 9147871ca30b9e274d787fe534c5b856
SHA1 88e6eb51ac11ce5fa4ff0caae37c3308064ea77b
SHA512 d9100b520ea6fd156094cce8083b8a8d33ac26aab28cd349e368e007893968931a4be2e81eb2190e19893773528db8a34bd0ec259fba4701184f8be0e9aab71f
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHh3:4UEtQevvqc2W1cpV2EI32
TLSH
T163474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 18543fc3187d08885d358254e971b2edc405940d376d79c61d61dcde08738fba
MD5 8555cfa845e55c52af7a19d43ad307af
SHA1 a9051461af45d2d7dc63811ec40265d49c029fef
SHA512 02656a03738734c92a6c7789007b85115956ceebf7a9dc25c850a051b9fbed2ec8edf5feac6840fa20d6fca62e2098a90dde5cf8110dbec065f78ab9b6b106b9
SSDEEP 49152:8CbRquA/m2yL5zifFiV+XenmE3/zsoVvxtJW:1oqHVjnmq3W
TLSH
T198D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 df3213546e0be4f0b13f444729647d222a4dc10266d0531847d0d5b3e0cec840
MD5 b0ce9c23c92deb5e31f66bbe02841893
SHA1 d7274f9b61b2ba9fe3f4f97f26cda7db468d287a
SHA512 5a9405281bf3dbbcd78705ec6c5c92dd5cf3b1d4babc8f661ce723d819bb8fcf5ead4f39acab3460a540b03ed6e67733e09d232829de3555cdf3d9f33af21b21
SSDEEP 24576:xAhGLJIFoiwtA5l7S53p1W3SEt7vRuy15V/emW:xAMyFoiq5ZoVvxtJW
TLSH
T12A359D81E7F955D4F5B39A7899B68570EA77BCAA5E31D20F2250D20F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 22c026345f5903cdeac9ca8d818de38fd84e7694aced2a454c661c3f8f495f58
MD5 e643efdf54f4ddd5e087b2db2bcfa85e
SHA1 18594831d430f4753701b79314b0f55599416c64
SHA512 361c74a86c8d5432ace74f6888529184d2a6f59b3db0cdeb4d9c610a458a0ca311f36bfe0d2e5ca82a6cda5c071ab1a7ab1dbf4328d0b8fe111e2c365782a57a
SSDEEP 12288:qmw5HEjsChN2BFgl0WDm+CYZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbk:jwuHOWw1W3SEt7vRuy15V/emW
TLSH
T1F665F14672A45CF9E9A7423889578635E7F3BC162A21D71F13A0C74B5F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 876fd5bfb1f1450cbbed12e189afcce42ca140d3be39e752e762b7ff479bd97f
MD5 dd1c8439eef7407f6c8b0febc40990b2
SHA1 10cbdf335f1bf06babe981955cd18b6ebafda844
SHA512 3384393a818e4b4c69a1d5e76beb8b4f5053f1263e817ed7ca05fc6b2f8d82ba87a0286838fac62bbe577da41cf006cb17ca9f6aa89ba2beb4d56ad68110ff7b
SSDEEP 12288:eXZ1IyDZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:uZuT1W3SEt7vRuy15V/emW
TLSH
T1E255124A63A0B0F2E1A702388CB15A08C7B37C6A277693CF279557591F776C58E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 afbb02767939f43359988aba3f6848f3670ad59b1ff6e8a32d3d5b9d76a138fe
MD5 09fbc2507373649451eb33d781fd6206
SHA1 c8b094f51647cdc5c190234ee85bb7960c8b452b
SHA512 f2368e21ce0b911fd68d694dc2a084d39b362f8e1cf325a053af9c31bc2938f4872c1d3201b0df6d2185adec124aa7f7ebb81723e67e59ef2c4623c1267d6440
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:lQRQyi36YOcPQLvw2gAf+PN3H3W
TLSH
T15D667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 027da55815e36ad8d7643ae99222e1574f7ca9040a3724cdb2b249a6d4453231
MD5 f2550e9fac5bcb2e558f9c509b2eb5e9
SHA1 37e1f3377c68203c86cb500abe5b8b9396ca5b29
SHA512 d173878281f85594ae043a458161f690e5444577074807f438fd3f55185ced9dffbeb35ffbe0d8230247436f06558a2761bd8c267dbc5691ad44dda0964d5bf5
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:FQRQyi36YOcPQLvw2gAf+PN3H3W
TLSH
T185667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ba5a0e26b22e20da01c6864297d88138360d357885563116d518a2caecde80a4
MD5 3cf5aca9ef3cf8cfa09ebedfa67b53db
SHA1 53b1dc0da4d78aebfa347af139fc6ac54a14a823
SHA512 433889d63b30ebe9ec948174d048b1a88660e0417fd511a4d753a576f74e5bc9976a1b0b3690b8b296fa8cea238bc3dc8e3bc003fc136a5d0cf1588c1d816f9d
SSDEEP 24576:1wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0D1W3SEt7vRuy15S:x68Qg55nhheWu7PNU3/8oVvxtJW
TLSH
T1A5B55933B2F200A9C44DD1769F4A873196D27C758FE1E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9dd593d5f55c9631da1e9a095534893760626e5930211afaaf412730388da879
MD5 8b7e010ff9f9216cdba9547af415ed8a
SHA1 925037c32c0cc5048c318813c6bba21fdd49d751
SHA512 a42c26e17cf5a42f31e6571d57266638b19a0a8d18ac149190b1fd467fb0caed26c97c3ffbcee751d0bc027486e89f4b965d1d9b2a25ebf1b4db88946ddf6671
SSDEEP 49152:c3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99U:Zy5112gYy5azzVvL69nLKnhZ83W
TLSH
T110167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d321a060f43f4ef1b9ed346a3980f5279847bfa75012192dfcd0adc1a98095c1
MD5 7d67a10961e8f037c70f268bdefefe6a
SHA1 9e605bc31ca98a15216762d8749912bebdbfde56
SHA512 1ac13d82161fb7051527ede6d024484e3133c299d7ab4f4d4d0b3e5d1f97f3d5bcb2930ac2a4da917bff261b02b8e7f0019b7b11654d064d48b4f7b0ad6127b3
SSDEEP 49152:LB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glmoVvxtJW:du6JmVxd2dP3W
TLSH
T1F5D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7a801e3f81ac378a7b8aff439d63a7a8693c50001b01e80b40583326e1eb1147
MD5 28009b81f4c085b5b776606a2f0e71d6
SHA1 211386c4553fdcbd7f98fb9d39888e476de59d6b
SHA512 90279c53ceef14afeb5bdc848fb4ab46353ce9201b8e44e160b548af770ba376a99e6909cc10c91abbd6eee40e2d0437ae7b50a78ce44069ab6d0961af7d784a
SSDEEP 49152:a1hpsNoJpF1A6UU44CwH7R4xaoVvxtJW:amifPbRq3W
TLSH
T11CB5BE13F2D900E8D06EC17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a002ce5870114cb0373a66995f6d5688b0eea1642f7f73de40cab34abeff49b7
MD5 ef17d6cf01b3818b25ce704cdd94df5a
SHA1 2a5070a8b7899486e71c09b0da0b67321cd2df19
SHA512 abc2272c9d0487bcb6412933755146ca0f13746b464106aa868a1d682540692a74494c2b3476e1b0f3c6ad5447ffad58cde27469eaa785fed0ca5d2782ebe899
SSDEEP 49152:oSuZQIY0Be2KRRVtOnks6NMHqToVvxtJW:y5dKTi61I3W
TLSH
T1C9C5BF03F2E940E8E0BED6748B669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2dcc1f84c8492ecab883f9fef7dffbc3b2f29da9f51dbb40d013fbf71513804f
MD5 4eaf151abd67761b85194fee7246fea4
SHA1 e7df09cbe7e6eb7918d9c2d171b7595d3a2adf28
SHA512 45cba2382160f62be1579edd0756359271db81f646c649cca71508cf4959b9b284597453f9c07d62e372e41dfea7eb84abd6bfea0e20d3fabbcdc5827211d6b9
SSDEEP 49152:EhtSn8EApI0figngiDn0AP5w2oVvxtJW:FX2iyphO3W
TLSH
T1BB95BE13F2D900E8D06ED178C7568632E962BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 94083674781178f197838347c0f810b065957463258625414026e74dd4156515
MD5 458061a9b8f469bae6fdf84aa82941c0
SHA1 f99be4776c21d4c7df309effa34f2fbd1d5a9ed0
SHA512 f067ebd66bb74d0ef8b73561963890f4e28f0cfe97ed9606e50f0ecdf6f7f6e4b9d41ef6962a1325cecb024a91d91633778f33a89acfce30fe69cab7966d8882
SSDEEP 12288:XyZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:X/1W3SEt7vRuy15V/emW
TLSH
T1C3552302D551E463F22407704C361B5CC49B6EAE7DC6B3DB77CB37084ABA24D8D866EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fc37a3b80a8af26d658b4c4601e2f5e632d5502e2c1ffffe41a2afce04ee74a1
MD5 bafa464d7aaedd883e50677d49184020
SHA1 fb8120114641899c2ea9604858d27fcfa16f9011
SHA512 08a54dbe5700ad7f9c12f11c52fd6edc46b00b7a4e4735a8983879004322b94c1b24be88e074b9ce8ab3fc5e949e726c3e412f04d6baec7c7a712d2bc4dd4630
SSDEEP 12288:NnZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:N41W3SEt7vRuy15V/emW
TLSH
T1D1552302E551E463F22407704C361B5CC49BAE6E7DC6B3DB77CB37044ABA24D8D865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 aba0b04389982d81173e087e0cab54dcce0e23c011ec6d18f59c8846564e17c2
MD5 d93b9f01ef4b5da604d88bfb21cabda0
SHA1 cd5ebe6ba0c21f91760c54f2db25cbf0adb167d0
SHA512 c76480cae625be2dcae9f49f2dfcee382e7035b8cb4c3a8fe3f1eca8f4b15f988d7973fb791a79cc8128b4fc768a55c6f4359885ecb192d50e696b022575585e
SSDEEP 12288:aZZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:aS1W3SEt7vRuy15V/emW
TLSH
T184552302D551E463F1240B704C361B5CC49B6EAE7DC6B3DB77CB37084ABA24D8E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 ab9f0f0fe033d4a82a36a5349c03a6ce72e43bf8f78017f4ce4c7e90385a3fc7
MD5 3d97ff8bc061940f03eed19c8fbc60df
SHA1 3e8921a1d6a824d06bc62c50641d1e58b3755fd3
SHA512 5cdbda5e8d3e26aac35c6a8c1dde5d72ad29efc5646c27f0b9299eef4ad41973145d852fa15cac334b43da0938e3e94524b0bfaaed2732acf491a3469d68b767
SSDEEP 12288:MVUZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:G1W3SEt7vRuy15V/emW
TLSH
T15A552302E251E0E3E5754770CC325B1CC1B7BDAD7AA2A3DF77821A090E763488D65BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a6e8b9fdd80393c6e8a7627dfe2c4c61ed717396fc82af4447343b22261cbb17
MD5 687427d155502b76dec265b7dadfc431
SHA1 6e16cd00d3d5e2e5baaa1821afaa73721b6f5af5
SHA512 bab72e4c3439910a1bdee30883b141c1d02fe68c732846b5c01c22287def86fcb6cb6a50304af5447bbe861569ed39491b4ba00dbbb18afa239e7e495e71b719
SSDEEP 12288:8sZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:8R1W3SEt7vRuy15V/emW
TLSH
T1B6552302E551E463F12407704C361B5CC49B6EAE7DC6B3DB77CB37084ABA24D8E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 fd442d197d578ab15ee79b4fd9a08ce563ccbcd30516e7b0a80b8bad60270c05
MD5 7214751c32f24d799a299edfd9652ece
SHA1 6626af6a80f5d2b5a67f3ae98aac47b6f2f5877c
SHA512 0e0a7f1c301fae8a7ec6100e1ce5541d3e611815176625e098fe71d3c72be6ddf31f60b95c385a2901882bcf0117a6fa5ad7e8d9276fd0d6a06b009160578a9d
SSDEEP 12288:R7ZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:Rk1W3SEt7vRuy15V/emW
TLSH
T1BF552306E551E463F22407704C361B5CC49B6EAE7DC6B3DB77CB37044ABA20D8E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e1c585c407684fff7784ef9e4bb5bc347d45d2e772f3bac1510d0af17f1fd9cb
MD5 208d3851fe3807be72d7852711c1a7d1
SHA1 ec36cb584bb999998805e569d4020a6188a3b2ac
SHA512 6b83afcecfc10dd1676aebcf31b877a28513bd4f49204062d677eb25aa9219c39d2190bd8ddd13a690fcef64042c0be09ef2ec9108429ba9f3e553f2824d10db
SSDEEP 12288:kfZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:kg1W3SEt7vRuy15V/emW
TLSH
T1E1552306E551E423F22407704C361B5CC49B6EAE7DC6B3DB77CB37085ABA20D8D856EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 c9ef3d041f977effffc383ca9a1b277c879a60790c7fea65f9b6a52ade830e7c
MD5 df47963f3c98cca3e684c0bb15631ff8
SHA1 28b02c4ec9874504823a5425e2364f4aad6614fc
SHA512 d740f206e89a3ae60450d56ead3cee235588ac465a5d4d32233b28f96d9f3721fd66c6b4b082ad6bd1d7edd45e9a589ba57bc8a928b7d9ca2df534d3881f6848
SSDEEP 12288:PiZwbDzzFEoS2cPvyHZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummi:qZM3zFVSOY1W3SEt7vRuy15V/emW
TLSH
T1A7750195B39058F5EC67423ECC258909D6B37C5A1BA0C75F13E4361A5F333A10D2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d985e1c48d7015ef3de87889a49081db244a6c99dbe7bf121e3bd28f334bf90d
MD5 974f90de6ddfd047ea550bc5f1a0ba58
SHA1 5e3aa20c83db89829326c06baa907535e854d2ae
SHA512 cb52bbcc39d257bb627f6fcf54774509bd9b1d382b1fb1bde9e719eeb9451337365145959b0e661bc0836fba6f1708ebae2bd092de3cc60c5ca0cc64faf9f663
SSDEEP 12288:4eZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:4j1W3SEt7vRuy15V/emW
TLSH
T1A9552307E151E463F62407704C261B5CC49BAEAE7DC6B3DB77CB37084A7A20D8D865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 eb7663bf5b5e216b7e1f5e0ac63f13fae2e51ce6dab1f114ab6744305c6bc63f
MD5 9cb5e27161cc8d99316be38754e215b2
SHA1 c0817844f97ac481d85e12e2f2b90093a26c07d0
SHA512 4f3a9fe8a25abb46dc1e2a287a27eb9165bd18f030c4c48a54c4ffa81c3471a04f319601f4aebbf038e52c918c31c1c14072b5b0d655dbbefa15535da4d9721c
SSDEEP 12288:baZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:bX1W3SEt7vRuy15V/emW
TLSH
T13E552307E151E463F62407704D261B5CC49BAEAE7CC6B3DB77CB37084A7A20D8D855EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 0657e2b58fa51323dfb3dcc4bba8363469c2da2a39c2d6fa2d0448f3a5d02840
MD5 6c24c315b4a4148adc7e735adaacbcff
SHA1 14cfdbea34c6cbce4278ac325f364a7dde7a9ef8
SHA512 602a872e4810dbba7baf5354b7b230ab94c176d223ffa171a83261421b4d794f815a1f0e6f89be71563670926fef50eb890abbf321e3645a91a7bae76fb138bb
SSDEEP 12288:IyPz5L8DZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:Jzyc1W3SEt7vRuy15V/emW
TLSH
T142650207B3A170F5D1364234CC621A05E7B6BC361B609BAF27A4177A1F372958E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7e4430d1b88c8b31a295cc520d66bb84ac99f3db1009a718ed5704e424e15cb2
MD5 aa3acfc38efdea8c770970744f8f6807
SHA1 2dca855a34cdc1cf0a3ddd63fc0762c36f07535b
SHA512 0f5da8be2b2a88a9ef17393a747b34771ca874a7ac8c45b79681318701676a191878ba7974e1129026b166d5b5c09d7fb210ce3577355909b9adcc0a7a8d5a61
SSDEEP 12288:leZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:lj1W3SEt7vRuy15V/emW
TLSH
T186552307D151E463F62407704C261B5CC49B6EAE7DC6B3DB77CB37084A7A20D8E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7eeebedab5c738d184908ee7cc3c3f3eb4c84ffee6e67bbf14d35da41a8d67a3
MD5 9b3f15397fd66c3c0bb15074b451e39c
SHA1 09d6ce4d91b220cf789ff289ebc2f3fc0c9bc37b
SHA512 a0f0a460967da46d523360843671813eda5c3564dbbabeb113cf728c6c5b920f5262b2a355ccf75838e00a0ddefad79b0dc0f4140bbe176c0a52cba6e00cb105
SSDEEP 12288:jeZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:jj1W3SEt7vRuy15V/emW
TLSH
T1A5552307E151E463F62407704C261B5CC49BAEAE7DC6B3DB77CB37084A7A20D8D865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 5359e06827763a385baddbd52deea10ab799b3939d9a9b2e17b1ca73a6a72360
MD5 66c0864cc888a59690d1557f4ab3d1ce
SHA1 73283ded052919bc5fdda5d068828359c6331825
SHA512 f82904d71defc7674f110db117dd960de562b00632b7f420e9b53c48081dd023125b752df4b242ec8bf622ce8fc9e369bf3837d73e53b0dc7845ab54b68fd9bd
SSDEEP 12288:YyPz5L8DZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:5zyc1W3SEt7vRuy15V/emW
TLSH
T1E5650207B3A170F5E1364234CC621A05E7B6BC361B609BAF2794177A1F372958E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 c41026f09f39c9baf820782a3a12a35c1197cbe01300dccfe7d776dbc0e61ffa
MD5 703a28ab2f51234ca1ed364f5886ed8c
SHA1 9c75e569c1d0701bb5e9bbd67aaa9c05ecce3f56
SHA512 c21df9fc3ffa724766978d0390a1960d71819cebe886d353293fd803f61bec81591a76568597ba24079f5aa13c22611911082ff26d8cc55fe413bd62f3232809
SSDEEP 12288:2Cd9NWYoaLHF3z0z04PDvhJZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbk:XT0aLl3z0zDC1W3SEt7vRuy15V/emW
TLSH
T1DD750195B35058F5EC67423ECC264909C6B37C5A0BA0C75F13E8365A5F333A14D2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 3808c9851a85cfbdb131a8ccfd44b57f9daafdf20f07cf15adfa969c3aee52d7
MD5 cd86f44b1590507b1dd75619e1900ba3
SHA1 16fa5e9ed581efda398c96b83167e56ddaae64b3
SHA512 8197d0f2c5c490a44aa302b02502fd6bb2be111f0f50b71e4d6b0a10710b9074e355a77aa1b9709684b3e08807d7b9b3d3881dff1b4fe5dfe54e49218492e281
SSDEEP 12288:Si4e7sRdTfgwCHKy7GLbbdIvQZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaL:S31d9CHKy7GZu1W3SEt7vRuy15V/emW
TLSH
T16485CF90F3E410E5F0B78A358D765611CAB67C9A1B71DA8F13A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1d256e977d54001fd04084cdccb6301b80f2394c489d382a7c0f67221731e454
MD5 08625458de085dbf0b91939ec2618742
SHA1 24e2ad3142d6dc645cd7c128a3f46f520b2a8cb9
SHA512 667d5e0c95d3a7e19dc07f831c656441124f8e95f60612b63a80b6bdbe8f0bafc42f36ed2e99e8999a4ba3dba3a5c6ce20141f68c82561bbe8586aae4063fa44
SSDEEP 12288:15ZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:1y1W3SEt7vRuy15V/emW
TLSH
T112552302D551E463F22407704C361B5CC49B6EAE7DC6B3DB77CB37084ABA24D8E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c8c30630e6b741d19fec94fe0aba834079b28af2009acbdd3052a899780602da
MD5 f8df2a45e8e13610b0621931497cff47
SHA1 db7134634de69ad781139f40619397038ed98fb3
SHA512 9471e8a6bd295790c8498ba453a04f2b53c069522bc09586943200d0a3c44e45abe570fe3ede48f17c2d47bc0e3da91a48d71583f6a09eaeec1558113fb62054
SSDEEP 12288:pjZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:p81W3SEt7vRuy15V/emW
TLSH
T19E552306D551E463F12807704C361B1CC59B6EAE7CD6B39B77CB37044ABE2098D865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ca5662f0625136347b90f13b03bd77c0e73cdf3f909952574af6ccd1c5f61646
MD5 617ca26f96ea67b4ba2d1ccaf22346e0
SHA1 b5590e7861d02b8d2e6770d9deebf294259c9a0b
SHA512 3694f8bb26f60bfc1c2d9b5e429f486f86d55039c44f63e22d1a61f60dcb66aa6176e5d22c3f5fff8bba4e7c0c47cc731d14c87bac279fa6d6a4af71fb0ee25e
SSDEEP 12288:RQZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:RN1W3SEt7vRuy15V/emW
TLSH
T1DD552302E551E423F62407704D261B5CC49B6EAE7CC6B3DB77CB37084A7E20D8E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2676645bd0d6b0d63590b3dce0bb1d48ed409486e75a80c76bce1ff335abf4bb
MD5 5a753f2a5ba03f11c56c9c2f50a9674a
SHA1 7ce8e798686d8932c28a651db5ef2de6938aaaa5
SHA512 b39a2376eb53f98942c9a8ad85854d21bb0033e67a965770b07124b81059602d2256dac78ddf60b008f3678bdcd25897f754aa8e572ef7ce2c174e787cfcbb65
SSDEEP 12288:NeZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:Nj1W3SEt7vRuy15V/emW
TLSH
T189552306E551E463F62407704C261B5CC49B6EAE7CC6B3DB77CB37084A7A20D8E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 07ab9df3ae9f4ad0001f80566077badd57a3e4512be1bf2a40721e401191756b
MD5 0ec8de7bf46d900f142daa31515ef8d1
SHA1 93b79db70308e2738200dfd273f4a0f5b5ce5f58
SHA512 e92fb116d55605d078db65b218e24cdce9e4013a499d0ec72a48868b657dc6f5ff7cb49a82530267bfb28a95d11dc8653883b1878f53153b89d884ed92f1732b
SSDEEP 12288:R5ZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:Ry1W3SEt7vRuy15V/emW
TLSH
T181552306D551E423F1240B704C361B5CC49B6EAE7DC6B3DB77CB37084A7A24D8E866EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 53f0fde0b1ce1fffbbcf5ceb7200a279918f2f61caa5e0feeb5bc34d79268132
MD5 eba789577a9d990b4d37b1436161af69
SHA1 791fa7d019f69052d64e746992aca39b3cfcfc19
SHA512 da3aff3b80d10553676ac81d160561434a7261fd45ceb31bea96f7c041663d2d5fd5653626cbb9ece1dd1e3a171d686e985782074b3d1a8b26d7b78b7e2f651f
SSDEEP 12288:RWZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:RL1W3SEt7vRuy15V/emW
TLSH
T130552306E551E463E22407704D261B5CC49FAFAE7CC6B3DB77CB37084A7A20D8D865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e23242bcb0a99c8f4f57adcb2a4f2a269fd0d4f0632b1b81870296230b1f1a27
MD5 f8d024322b9b8f4992883de9bc4fe796
SHA1 e4764f77679c35d689c12e36ba7d8fd573d32256
SHA512 a4b28ccc6cb17006f5f73d6352077c962efecd9b50403ff6307362eda9c6256ea88705ac381aea46236b18a075d808cddfcda4731831b3e3243c210fa67b41e9
SSDEEP 12288:psZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:pR1W3SEt7vRuy15V/emW
TLSH
T1B0552302E551E463F12407704C361B5CC49B6EAE7DC6B3DB77CB37084A7A24D8E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 8e95ae97fa7cd730dabc8bf17e751381619f966302ad01ca2ba51ae9a8121c49
MD5 cf522ec80d49c16cd33a80a555f0f9cc
SHA1 6316cdef38f94b4391ce4c0d80014ad4e929a946
SHA512 78d690b7678bb32e0c0c026a82b420039ef2d1ee943b09201d9df8cb4a2169dfb8f32f826625e925bfa7f0813054e56cf3c8637d08ae753c58668199b0604da5
SSDEEP 12288:BBZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:BK1W3SEt7vRuy15V/emW
TLSH
T104552306E551E463E22407704C261B5CC49FAEAE7CC6B3DB77CB37084A7A20D8D865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 9ccaa07341d362843c0b40cd82bba6f9f7643900bbf003b0347e74476ab16a02
MD5 2b82666639036044479fda10b38bbe66
SHA1 f20bbba82629f358603c6ae7b4fb1eaf78ddbbb2
SHA512 fbc451e3873e489346e51cf73a6170bb28df2c76db42114dffc98a670fcdcccd08af9075f262dde99d497934fb28c7a187ff18dda5f53b6af5a7a9ce01a493f8
SSDEEP 12288:/sZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:/R1W3SEt7vRuy15V/emW
TLSH
T14B552302E551E463F1240B704C361B5CC49B6EAE7DC6B3DB77CB37084A7A24D8E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 0e4009b575ce970d4bdb82d38b25d9c4061a178ffd72b7d7617b6ed6b83d2c84
MD5 d8be633aa2836c65c92a2a9cbce4cf26
SHA1 9876e2b46ac5caf61c2ef53e9204fabfda599e32
SHA512 d8b4c69e5e9e8f65fae0a69c84a85a94cd0e74e28eecbf8db2fa28f49fc30ebd75e0f8a976b4bead86b17e0ea68cfc484853eea307ec8a59a51d3444ea7c052f
SSDEEP 24576:afwv/k9RX6wkyAIn1W3SEt7vRuy15V/emW:xMnYInoVvxtJW
TLSH
T13A85D029EBD844E1E177923C8DB7460AF6B278691B31C2CF129A536D0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1a524ee2bc64e76701b77c9231fe540672a2b1f633f40046d966ab66571c421c
MD5 c24b6b3af76886425c903c169baa3692
SHA1 9eea5bdd870009f2db9d132cc356e2e737458d8d
SHA512 c5390b8d63fc855033741b723cbfa7432d3a23cc52ef59a3133b6c695fad0e8dd74bb86c0e0ad62f9b3c355f3670c3d752daee35d02010c7f5aaed036218b396
SSDEEP 49152:pYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WoVvxtJW:RySzPn3W
TLSH
T193067C56A1A841D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556835F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 149421e96f6d56035e5fc9bd2b86c5877e08b05a6045243f1974e61709c42084
MD5 8cef284493b41c9501c7a7b952596482
SHA1 542be28e51c33d4ceed86ef7edc8630563ea7fe0
SHA512 7f285aaf8a788f11caab6a771c53e5a5aaee0fadd216fdf5f2f75aa994d3e4af746952c0136c733555abd98eb6efaff9301437453754ea624447d87e48fabb10
SSDEEP 24576:m47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYo1W3SEt7vRuy15V/emW:m47JUQj1irIhCnDHUPfF/moVvxtJW
TLSH
T14D65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31D6CF22B0437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 009e77c7409afd77a372e29909e79fc332ffc3657f8ac958a0e8353c19bbcfbb
MD5 5376fc00eb9727c428c500918b568f30
SHA1 da559a7741ddb2db71c48fdd24d58f8e69f04823
SHA512 f95f2f27eb00c31bf11353251e0d3404a251e69111023695df5d334933e87af12d760b49c5ca7fe86c69c111167cd94b6cd76bb928b2c5ff25b34b72e5c7f0cc
SSDEEP 12288:JssfOZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:hT1W3SEt7vRuy15V/emW
TLSH
T13865F00AD29451E5D06E1275CB564A04F3637C6997E1E3CB63C1F63E0F7A2848EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 d557eb3ca85d9139001fe76bb291d8ef7a4607f183f52bf9c6edfe3be3f75514
MD5 93a0a4c04338e01ed34e31c3acd2c722
SHA1 a7195553e299e147d5de65bbd013c84cf7cf14e6
SHA512 b4abd358816ff598a0d3d2fa91007705389541b57380d9de23fffe7139d5c0d3779b7c62472f26b5601503ecd7601957c7597bb894568ea387d3694fd860b3c2
SSDEEP 12288:QrQ++6U3fIsaIUe9iL9E4EJZE/7zRV4/7v1PnHcZ3/JI1SNL:QrdtUPoIj89GJQzUz1PHE3/m1SN
TLSH
T125352800766AD75FC6AD50321E33D2CCA7707D41EE04AB0772C8873FD576669BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 33cbdc91ffb85ed4fdec8dd31497cb6242d99ffa85f818de64cbcd20f1fca5cf
MD5 c145656baa78db49fe74276afce6d123
SHA1 d22781dec6d5dd77ca7b680042f2f973054f0030
SHA512 b6b0ff5dd6cb66b652e27931a1b03370d1f507333d66e9e32589376b1307b41dee607a38e40bfa79724bfdd81599b16762996c3324ed26927e983d1b4e106049
SSDEEP 6144:Sa9D6tOHF23fOj1p5KZmZOfn26tMx626tMxiYQVoVeAz3sIYK:9D341SQA8E
TLSH
T17D55C7815537A3CFD0FA6032072A5B4CA764EC0777096F26B3C8553AD826B26A4FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1751bbd413957a00a6aa411a082cbe7fff63b2f128ad8f1976cfab5f01e309ae
MD5 14f487241b84036fed77162878a01b05
SHA1 cd439c13b772db2ca42218c70449ff43dfa9b717
SHA512 3b2f98316db37fc6a9f5bcad05e8e43f5412b231fce2b5aada4a183b0291dd8c34b6ee530b1114154e5adf25132bc39a5d2cd4b0e9936984fcf0512a0261079c
SSDEEP 12288:+J7GZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:+71W3SEt7vRuy15V/emW
TLSH
T155552302D254E823F5780B704C2A5B2CC55FBE6C2F80E3D7B786374859792C98EB569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3287edfd45a833ac6447b06cf026a097d9f3929d1331040795ac61253ae3f82e
MD5 0c9cce31713ee46ca0879de33309b604
SHA1 fc14548d80db1f18f3fde3034d34b337f7792341
SHA512 b6ded3d313c87425d76ce51afb702ba2658a57b5616bea7b406a2a7fba54d1df5b2ace796ed0f4ab07078900078122946600d57dee673af7c14df8b066d95c7b
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bYF1W3SEt7vRuy15V/emW:zgb4mBIBhGFooVvxtJW
TLSH
T1FD65AE1E22E802F5E0F9D2B8DDAA4417D6B378161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 7ed1e7ee15ff90fce0e889e7750142c06f36be504bff2d4929778092e6ca3d63
MD5 0e898aed17994c89decfe7db2f2b610c
SHA1 b626d03f7d1162853997f12ad1fed44e235b6ea5
SHA512 88574f2ad3f9de2ee407eb9ac11cd203df42146822fbef4a23827fbae55bdb2ee16550a19da2e10bb61b8dc2998b805bef6f965496387efad5c64fc828358048
SSDEEP 24576:uG88u8FpJqH1Qzria7/mY1W3SEt7vRuy15V/emW:l7ZFPqVva7/toVvxtJW
TLSH
T14D850125B6E001F1D47BD13889824667F6B2B8251364FBDF07A88B451F33AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a15e8774dcf330a8173d7f4f0160d2bb37195d0761b3f4d28cbc4a6b9fe28d01
MD5 4cc410e1440266b20713274bb57ab089
SHA1 43b0941e229aa768eb5be3820c5095320c99e0ff
SHA512 87da5ea4fb98c426aa65a0bc90cf52dff27a6b71d00653e25e01873746b3500704ae6993439df23109b54b61b45b8d7355836e6922bc82e92a0b61014521dcd8
SSDEEP 12288:YHvUrBFrEjwaQLZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:YPUr+NQ01W3SEt7vRuy15V/emW
TLSH
T18B65F11F62A818E5E67A917C8942470DE772B8661712E3CF03D1817E4F77AD8AD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0cb75221e6b910dcae14526e6a92c7a809f8f27e8b7ce967a7f6c918a4058f10
MD5 7f5908793fb074fd3662b3b716cb4da5
SHA1 47fea39a1553ac3672042c550586d4cb7f04c400
SHA512 6b3b74c7b9dbe0b22011c02facb6ef6c67cf0c43b3dc29af59e025718e6d9533c5e4847605a688de0370b5d13f05d8badfcda57fa5bdcfe648bccdeda61ddc03
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkoVvxtJW:SG05lO43b03W
TLSH
T118D5CF6A62EC11F5D1BBC17CD9C64A0BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1cba46698575ff00ec1dc0d3a623cf60b27bb3f6735dcb7b488c31e565fd174e
MD5 ae4f5ec15d92e9b51e24350c1d59e2fd
SHA1 9e756ae259331b4a79202c3c61c394b1b72e6f6a
SHA512 4ca61bf6791360c611a6871d20a809ca8361316cb8bd23e48df01e0b42d1aecdcf5f059992bc7d9050a7e306776978104c1ae96794b18cc55b12b74da6d6cc55
SSDEEP 24576:Lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnW1W3SEt7vRuy15V/emW:Ta5POZ3+Jt2pasx2+m8oVvxtJW
TLSH
T13065BF5EA6F800D5D179D17DC583461AE5B2342653329BCF122182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a4ef71c5f4df7d8cd8fe6318004ae51bcdd01a90617a9ac8e5f5793e39936370
MD5 b5f62d8aff68c3f9979033c4b3c2abbf
SHA1 256579400ee0a11250e3bd1cbef2b90812ab3f95
SHA512 efe589c8aba43934e6e3782059f1b44b1f7682ac865507c86901fb43c270c2b93940f291f74fa5dada95c13d3e6c112d4fd66e2b4e23ae684e1ad903a3edfd37
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7FkQ1W3SEt7vRuy15V/emW:nNc/zEOVHFNoVvxtJW
TLSH
T1A9857B1623E901E4F1BBE1BE89779546FAB17869173086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e2de64368c659fdc72831aa1b99b21926b5605da029cc4ccaa682cbdf1acaba9
MD5 d739c86258a58729dbb732ec3df1d24e
SHA1 adaf26b6234aa3ef17156feb9293847f83694bc4
SHA512 76be3efafda9a3ec82fa336f33fb650a0ebec4b9e56500444b11f12e7e72e6b5df7f6d1ac7f7489b74f86cf5975be10f98edea6a8b64a6f333354cb879b205b5
SSDEEP 24576:i8kNvNnaFeYhJNtmZBmK1W3SEt7vRuy15V/emW:i8MwBtOmKoVvxtJW
TLSH
T15055AF2EB6B846E4D1FEC6B4CD238512E6727861173293CB5390C13E0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a93fee8187ee9b32fc98bfbb6c60e25b80b63925bd8a9d6a01c20159a3a8dedf
MD5 ff6bfc8a648930c3d80cae45098e98a0
SHA1 146fd8c4dff62859983a282a61be32b8f735a3b2
SHA512 01d3f3de873094e05650f6cfdea74174df766e80763cf524d2cb81c0d6217b6b4e40d240e49330b6631d511c3c5c4fa9eebc1ed8d83c6cebd1215f069f4baef3
SSDEEP 24576:fD3FHshBIYQgAf1W3SEt7vRuy15V/emW:fDVHeBIAAfoVvxtJW
TLSH
T16175E23EE65C04E4E57AC17CCA634A06E77238AD032266CB12D581B91F7BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/252-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/252-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/252-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/252-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/764-290-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/764-60-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/764-54-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/764-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1300-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1300-39-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1300-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1300-45-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1300-50-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/3208-72-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3208-307-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3208-66-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3208-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3212-13-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3212-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3212-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3212-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3284-77-0x0000000000680000-0x00000000006E6000-memory.dmp

Download

memory/3284-82-0x0000000000680000-0x00000000006E6000-memory.dmp

Download

memory/3284-76-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3284-308-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3316-383-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3316-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3316-88-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3316-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3316-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3316-94-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4360-410-0x00000135368D0000-0x0000013536A9A000-memory.dmp

Download

memory/4684-107-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4684-101-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4684-365-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4684-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4684-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4684-366-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/4700-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4700-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4700-137-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4700-131-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4700-125-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5436-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5436-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5436-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5436-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5832-112-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5832-369-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5832-114-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5832-120-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5912-313-0x0000000000400000-0x00000000005AC000-memory.dmp

Download

memory/5912-86-0x0000000000400000-0x00000000005AC000-memory.dmp

Download

memory/5912-0-0x0000000000400000-0x00000000005AC000-memory.dmp

Download

memory/5912-8-0x0000000002340000-0x00000000023A6000-memory.dmp

Download

memory/5912-2-0x0000000002340000-0x00000000023A6000-memory.dmp

Download

memory/5972-382-0x0000021129C20000-0x0000021129E68000-memory.dmp

Download

memory/5972-381-0x0000021129980000-0x0000021129AB1000-memory.dmp

Download