761e51f08b7ba720325d9494a80c10d4e06b2a11d6054be3423f7af985645257

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
Size 1.5MB
Sample260802-rx15ysvekc
SHA256 761e51f08b7ba720325d9494a80c10d4e06b2a11d6054be3423f7af985645257
MD5 426d97f7d8821178d91bc5d281848376
SHA1 cb4a3e7cdcb9b79870fcec39ee8c0c011565cbca
SHA512 3b6ab98dc3931c5d5bdb9f54ab72ae78ad1ca34fbe8ed393822fd490e9033a92a789de0a02b7efc4ecf55bae5cf5b68f766ed2dce88a91a43a7f402683133dcc
SSDEEP 24576:1wgwLPGJY/sqjnhMgeiCl7G0nehbGZpbD:1lwxjDmg27RnWGj
TLSH
T1EA75F012B3D0C476D5A20237CD66D22DA3AABC516E3192477BD23E9DEE706D18F38352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4200	elevation_service.exe
6808	elevation_service.exe
6736	maintenanceservice.exe
4304	OSE.EXE
2864	PerceptionSimulationService.exe
2904	perfhost.exe
5916	ReFsDedupSvc.exe
4436	SensorDataService.exe
4976	ssh-agent.exe
3044	AgentService.exe
6980	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1c448b25957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be379f2c8c22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043e1cc298c22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058e4e92c8c22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073cda42e8c22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
4200	elevation_service.exe
4200	elevation_service.exe
4200	elevation_service.exe
4200	elevation_service.exe
4200	elevation_service.exe
4200	elevation_service.exe
4200	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
Token: SeBackupPrivilege	5916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5916	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3044	AgentService.exe
Token: 33	6980	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6980	SearchIndexer.exe
Token: SeDebugPrivilege	3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
Token: SeDebugPrivilege	3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
Token: SeDebugPrivilege	3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
Token: SeDebugPrivilege	3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
Token: SeDebugPrivilege	4200	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
3888	2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6980 wrote to memory of 6320	6980	SearchIndexer.exe	102
PID 6980 wrote to memory of 6704	6980	SearchIndexer.exe	103
PID 6980 wrote to memory of 7048	6980	SearchIndexer.exe	104
PID 6980 wrote to memory of 4892	6980	SearchIndexer.exe	105
PID 6980 wrote to memory of 4468	6980	SearchIndexer.exe	107
PID 6980 wrote to memory of 3736	6980	SearchIndexer.exe	108
PID 6980 wrote to memory of 4928	6980	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_426d97f7d8821178d91bc5d281848376_elex_emotet_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6808

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6736

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4304

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2864

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2904

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5916

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4436

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4976

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6980
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6320
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3004 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:7048
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 2972 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4892
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 2972 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3736
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3004 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0b4111845fcb1e4ec85bc6857198db789799df3d6823eefc2a63be1b54768ccd
MD5 c8db20acd1a837aa1f22c9b08f7ead27
SHA1 d97fdc4f69a60c5526f3abf25129832b2a2c0bea
SHA512 3d78c37c7c6edbd35c814fba82f88a7c3c19cd3d64f2a7a879bc0d9489c20c7f5c840ad080f5b0fd5f6b718a19f26bf2e8ec5be18a13e868e598fbeefa0fe998
SSDEEP 49152:yb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn3Dmg27RnWGj:U3q6sjBsD527BWG
TLSH
T151D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 25d85a81e0e28480bbf93366c33b4b225a5c85a5b598eb16e143c421a946d275
MD5 e04504c3c7bed7609fa0e175fc4b4057
SHA1 567a95d96f2945f18dfd32d412f7096b7acb491a
SHA512 f906c57827e62ddd5a98e5421a56e52889ca4fdea1263129936fd051308356c93aa1a3c8b84aa8cbf94d0870b2a1e1f054e2a9a6120f5897ed013ec5d5c4124b
SSDEEP 24576:mXYfDtczA0sqjnhMgeiCl7G0nehbGZpbD:FtcVDmg27RnWGj
TLSH
T171650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c164ef5eceb043cfce9a7630af8733dcacbb582754619aa422f60b0f05f57dc9
MD5 31360e87d645499e60c4275c0c3100a5
SHA1 d2de8df665df10d0f2619f9f19d4fc25bf70ef57
SHA512 7b7c025dbc708db03d80db7663d291ade806f0127503d533b50e044e280943b5c84deaa503c99ac055558bd516ec1d9f9ae1c1081d45f0bf343be3bd53035060
SSDEEP 24576:i0Le5ji0hmxxrMrsqjnhMgeiCl7G0nehbGZpbD:iPji0AjyDmg27RnWGj
TLSH
T1FE859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 84fe62b85924f8c58eb10fb41d49db8154bba0d7864c2b182972bef4c63f915a
MD5 48834a24d645dd093351a24337ebb59b
SHA1 9728802b349f27a3581dd0a777fe195a729c7f24
SHA512 bbd7ba86df406fee761c264f165ad20e67bf3be6bc0180f6868943f12e1415c75a628d4dd0cbd044a23bbf3bb17310dc34a72c20bd1b043b5f6b4c96c9fc0c01
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWn6q8wyuRsqjnhMgeiCl7G0nehbGZpbD:f/ezSC6vUzPveHjyWDmg27RnWGj
TLSH
T1ED755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6775d17f9579b42f4ae3b0fb860b64ab5ce70398ed75e0699a1923079ed4b0d1
MD5 e2bf6c0c79ad307596a372869c5404ca
SHA1 50a1ea9c730b7b490c6adce2b83118c6992d2ac6
SHA512 ca31604d59e46f4cc2e4ea160984ebfa8343fc585c1e06ffdf8a6ad6c7d0fe75c0a4909dcf9598ff214e249785e4c6f39fb08881bac6cd34b4f069a5a9325506
SSDEEP 24576:lVbqPb88hv/l+YAsqjnhMgeiCl7G0nehbGZpbD:lVO88hXl+dDmg27RnWGj
TLSH
T101559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d0435ad1380d5c42ea0251664e1610817d7b99094c6f7e745a9645dee6a3c691
MD5 cf5240dc249e621325d53d0a5759cd10
SHA1 a682e2697a41056c644b7303244a885e5f91cd0e
SHA512 68db644678f1dcb36c83104a68c4fa7dc71372d96c1875bf63bcd182de8ce762442fe5c21c0cfd3b7d33c7aeff32ef2c27ffc167b72a1ce634881b4d30fc1744
SSDEEP 12288:YLXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YLXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BC4523BF964C50CAEB7608B5C3E9F11EAC177E56982008536A637DFDE6B5458CB38023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9d80a1811390ea628636507caaafdb30541963ed65d6f3d75ffdbd3446cd365b
MD5 3d807d2e28db8b5abd5f8f497c73d517
SHA1 f09c566a9a33cf675d12c12fec12ef7caf1b3de3
SHA512 01d0b7fd1ad05570be70369328cb4ccc0a101137fc41c0ee8164604332b1823e265e6ba4061b9932b574908f78bcfabfaa666905bbac337f8dfcb156280f3075
SSDEEP 12288:DeBNUbTVO86U4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:DJIU4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD65CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e3585cef61ce0fe09973ea89be43d6072afda6f503073457a143c3b64703af94
MD5 43e53017b4d47dfef47b43381de3d558
SHA1 b52a1eb165359bd5affc5e470fb6306831ceee38
SHA512 688a42c5a0786e752226372347770d35633ade61d44a45dc6ac61175e6cbad123ef7ae758e7a812d09515b9c28fba2f2d507ba91422beeff7ebdd78fc44bda57
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THn:5QvGAdlCEL8c/DRNw5C1D527BWG
TLSH
T13D266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b2c6ae8228711bc6c5781a0ff575fc36387d8d96e9215b0f2f6e4acae0786152
MD5 a8b9b8295d52a80016655eba30754d56
SHA1 fabd189187a1fba6c280b1ccf60284beba957e28
SHA512 cfefeda2f425768142eda46d87943f0d89eb1343675d84fa67c171fc5c08f215df77473723603f707d0442c34fae7583a908b855e32c514deaa359ee175f42fe
SSDEEP 12288:mAwSfxL/2Dc3RDLLmt0LDQewsAjuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:70ewsAjusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0130009a3797bce823964b7e456d9c9791b1af318505ebfd3b04c5c7c1cf237e
MD5 95224c3e2b17bb91f14daefdeeface6e
SHA1 025dbe2707c91d95068d111ae8302b143f442952
SHA512 4bc09d117871d270344e6f6e609b86f022741fed8ecc5073e022a3f50a2b25272e1ed4fbbb860d230aaedd75559d442a462ff104cee11dcb50c244449624f1e3
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH6VQBWG:mUEtQevvqc2W1cpV2tI32NB
TLSH
T131474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f74e7b02bdf0e19a73cb01859ef0f8f2ed344abef85fe5b736acdc18426d5883
MD5 38341006628a5ef552d056cef10220d4
SHA1 7b2473e2082088c01dc133117322d0ad8043e902
SHA512 549a623d8bdd154526fb4e58d4cb7ed3bcb3624b00b16540c437e55aa2669715481594c41898a9ddd9434d6690142e078ecb8db1da56fd7ae2d1d4c52d287296
SSDEEP 49152:fCbRquA/m2yL5zTfFiV+XenmE3/ziDmg27RnWGj:4oquVjnm5D527BWG
TLSH
T16DD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d302fa87d78351bbd7eee5e6361e96b72e69ba7672be0a4d7ea74d072270d1e0
MD5 1a458c64e22cdd7e2a373d03c4c3b2d2
SHA1 55644dcae6811f162c213001c6c03abf4a3b536f
SHA512 11ac999a55c60395ddd9c4c3eaaae433b4902275c173ca399327398928351ef0dd1ed411540cafb2e4228051b3f44561624616deec719ff9dca032ad651449fe
SSDEEP 24576:9AhGL3IFoiwtA5l7S53lsqjnhMgeiCl7G0nehbGZpbD:9AMUFoiq5JDmg27RnWGj
TLSH
T1E2359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 32257cdee96f482c9b9697ab5825a3237c9271f7989e8083e2c2475a612704f0
MD5 759b99a21503d658d0b1583405c64363
SHA1 5bbea576b183f1dd69ddd93101d8a21928363ee6
SHA512 85cab9f6907164a2cc766e8b0f65db2f6dd0b1db878421892de54d5b998bf88a950b405a8c255fd53f76a71df4f6a6bfdeb41480a6c3cb35654b8ddb7b1f9ce6
SSDEEP 12288:kmw5HEjsChNVBFgl0WDm+CxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Bwu4OWysqjnhMgeiCl7G0nehbGZpbD
TLSH
T14C65F14A76A81CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 751bb34b647f496de814ba3fa4ac477ab1e0762a512fc660ce552a2efc11d093
MD5 d4bd0b7448f74aa8b99b0b6dff105a1d
SHA1 723bd5f8cf12ea8c2f08d870d4d762d58748c3cd
SHA512 d2d3689f6873bac2232bced795dc73069609175da33e186a8626821fcbd900feabdd9ed48be0e6f53a9a0b65a2da11cdbbffb60c2465a9ea8b7b13e96559cdae
SSDEEP 12288:teZ1Iy+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IZuDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1755512AA239820FAE163417CC6E5D609E7337C62673043CF166659AA6F739C44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a87ff34bc7339115bf3978049cfb2218d66b4f3bd62debcc61c0c74fa7d7ae4e
MD5 983f4f0ddbecf16c06ccbcaff3727081
SHA1 d4e2a2ffb760fb05dc18d78994c15d3d4b20767b
SHA512 e0c85dde9d1ff8f265522be665d5ed664c1591e9c5379fdf731703382b99ff9edfeeb29e689a51468dd8c59d7d3dc0d024195ceb6a1e8f4ec74584e4ec213571
SSDEEP 98304:nQRQyi36YOcPbLvw2gAf+PN3YD527BWG:2QyiKa/X+PNIVQBWG
TLSH
T1BF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5d0615b9c67913b76e9b713d0840e86efc8d2ad722614b46a10a3f3cc05bc254
MD5 1c7a04bc3f4bcacebcb3ae3d07875829
SHA1 b1fbe343224e7dcdde6d163d4fb8d6d6c1f6e31b
SHA512 8f097581e4479a5db6a6fe38cdef3b85b35ceeb40ec762c51423c1b0c0b886bf0f6585f4667c3cd194f4ddf67b289adeda85a810640587b776715020319eb645
SSDEEP 98304:KQRQyi36YOcPbLvw2gAf+PN3YD527BWG:hQyiKa/X+PNIVQBWG
TLSH
T198667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2a3165bbf478bf24e70fe895952bd5f0ccedfbd23da6147172906b63ae184d1e
MD5 3e7d4049753ab85bb93294836647d7a9
SHA1 260876291472dd1165a40633c6b181da1a45563a
SHA512 9dfc141d22fa2cf3084dc2e7f066cb18a9efa800ae94df47a9207ce53f6587bbd7f4782db72939a723a89c3252539d501e1abc11617a13e0ae6061f06c8fd723
SSDEEP 24576:swvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0zsqjnhMgeiCl7Ge:S68Qg55nhceWu7PNU3/yDmg27RnWGj
TLSH
T15FB55933B2F60099C44DE1769F4A872196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fbb44f53969b85b74e26213e8ce943aa881f4d50d41a7b7cb03a285601034ff8
MD5 8d2ad8decf3b132bfad65c71e4d6c2fe
SHA1 e85902c7cba236c9fdfb58e479c7bd2c07122076
SHA512 b6255ad09b46276d0aa3eecb875b5ebd1fefc30fd1a004238bbe0ad6b391c0fca7af86d7e5b097e58225cbe54914ba84a33a336d5bd0b1c31bed1d6ff1815b0f
SSDEEP 98304:ey5112gYy5azzVvt69nLKnhZrD527BWG:PLIHEWhRVQBWG
TLSH
T133167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 311dcb9f28bc3ab8e400648ee840a4867662b64958327e5e53964ca0d2173169
MD5 51a5f354f250f7f9ed1c0c4f838f3fb8
SHA1 2a2eff404ed95e1a04e8d131f7f14a4870d9b281
SHA512 e3381784e5031587b620be7617e20bbd3800596c1801fbbbcdfa9a93b8781563f8ce72faba01091e6083407352c00318759b1dc5871c35b8d773c41892b464e1
SSDEEP 49152:WB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glADmg27RnWGj:ku6Jmdxd2dAD527BWG
TLSH
T1A8D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 160a320b52c1e8b9f8be91841d245682eb41a0b13c1dad2ed65507daff7083a4
MD5 4c92ba349195ee4ac4e0789c70732403
SHA1 8e56fdab422df877c7b0ee3b58fbf1e3162af94a
SHA512 509a6c0a862b88ab6662455a46143befbe4b6182ee7cd97787f759e2b6f1ad8dee988e9cb22cabc6a5f72fb10e78cb89cd6167d68972971c496cb3d3f78ae1c9
SSDEEP 49152:o1hpsNoJpF1A63U44CwH7R4xEDmg27RnWGj:omifPWR5D527BWG
TLSH
T1CBB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 31e57a551e42a20f4ee13bbbe9cb6c1d0be125061a970480b718f956e766e9ba
MD5 22c407dd15113eb627221d94815b6309
SHA1 c3d90e2d476d3a00cddb821f00dc35a6245d7faa
SHA512 32d40f15ded0411503ebefaae820ffa8f3179be4bd2ec5683fa33b1a9a7718f86b13b630bfd507f2a0a9cb5663885887bafff219b782f4da310793f591453be1
SSDEEP 49152:fSuZQIY0Be2KcRVtOnks6NMHqHDmg27RnWGj:l5dKii61HD527BWG
TLSH
T137C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e5d424e995f4ffbb018c0a8dacf9336d0621d73e1668ed7aa3fdbf0ea78b4a38
MD5 fb1d2b069544b351b16fc2a163b7667c
SHA1 42cf40c3c0a35d3b2b6157a9267126ae94d6f8e4
SHA512 7111cffa0afcd06e76e270e5e39b763fa2927ad2138228308d31e441f1844034562e60a25995f8473062a68c27cb7c0452bb833a41763c3f44919b4043793554
SSDEEP 49152:ahtSn8EApI0fig3giDn0AP5wQDmg27RnWGj:bX2imphtD527BWG
TLSH
T1F295BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 cd429ad7e591951b58d60ef456fc3cd27d58aada884d474496714260085f8908
MD5 f8c18e4cb4f7d66cec67bacf1dcaa294
SHA1 53e7aff5d1db7fdbdff11131dab1ce008e92bdc2
SHA512 d9818dfbb3966a83ef0249b9c7caa6c6348d9d8031b82d9a6623302548c1abe3e31f69924f0295fdbf97c904a8d28b4cba704ae7e195df2f5105b0a1a2e9855d
SSDEEP 12288:SvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D44523BE964C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CBAF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a511f32e7adf14c98cd4866cadaadb71d2e6a2d34124acba285c5fba38e4fa59
MD5 c8ffc521ee70021559ef9a5bfd2dc753
SHA1 c82eae4dc5138017a98a569c08387e4951341705
SHA512 cdb889798885f2d8d2979110529dd48bbf4772b9f22c7605e7591b00826ebfaa8baf6fe5af85de9e603972bbf00cb44b51b04fb7b6bcfb2c1c3736e95f7faf9a
SSDEEP 12288:OaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A44523BEA64C41CBE52644B5C3E5F14DAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f72f10b48d77657961130a6ad5b96e85e95df406d2d3b0de740813f5ffa5b677
MD5 fb34f80325c8d441e09820e015437289
SHA1 21226b40c3727228984338313f020400f762f088
SHA512 37f980007745b8379998fb4b93c95eb467c8aa0d5900d1cefdc1308a1b3b4c7e96331fb4c2f86a456d50610ba9b420c827adadbe18e4b9194ad2b981079d6595
SSDEEP 12288:wwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1344523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 c72cf92bbcbd596f52d16c9b52ce8cada3585d5f48c5d1da95cf332fad58bc76
MD5 2306e7fdc04a6c20df078b90452fb855
SHA1 3724df521b5976bfaeb83ea08af801a9823433c8
SHA512 469f4de331eed5b5d11b88d702c9dcdab247e62aeb5fc90b22b294f05dcc8a5092cefada7cfc8c170e7e9798c59302aa2e9f4646b79482d65fb6c74fdf80a3a3
SSDEEP 12288:rVFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A45236B675C00CAD83685B4C2F5E11DE8237D56EB30059B6B532CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 81119a978743a58d5a597aeff39eb9eea4f1b65d5e9619b7096a252e7113d122
MD5 3543d79d8c3009486005f9bbc0184315
SHA1 b7a8ae22c158f59e9bd72056f0a500aeea5f96b5
SHA512 1b327005cf5a703b0359c1b879cf21eaafed32713b94f972a27e83b3997538327f1a09ced6f2ee5bca14a9cc99ad011608a3c39c155da3de338e37c8754e2920
SSDEEP 12288:fNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F4523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 87de6ec4e7b994debf4d5d3b99ef7b7ca3dcaf14c04ff5e462ba3b3e99555d8f
MD5 377478437d4ae40989a072273e4ce645
SHA1 d7a9d6fe455244e0bf84e3f1f56855293e0b332b
SHA512 c416911fa7906e6f0730b3db73f6e1d437c8982833b3e23563288afae6f83b0b208678b73410a7843767f0904dcb22b77876c9771209afb772abd340f2fc618b
SSDEEP 12288:uGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17D4523BEA64C41CBE52644B5C3E5F14DAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ffaf409a4c0d019560820318de6906f2af948172f0f736182375d5775ef94218
MD5 e7d5efdf0fd32c5008350f7a85974d28
SHA1 c756de1b8c1b8ffdf2e95e4060d22c900ab38ee6
SHA512 205df46380bf58b51b25c9c6df6c98a97b1972a3f6bf94f7f9cfc3eced032144228f21adb2a67179c8540dc728e4d607ff7469be9c69d6e771f63ecadb6f5fae
SSDEEP 12288:7iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEJ:7isqjnhMgeiCl7G0nehbGZpbDf
TLSH
T16D4523BE964C41CBE62644B5C3E5F11DAC073E5BE9200493BA5B7CBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 c04a241524d435812f5e42f0bd9a81764e31bf5ed88a9859033a3643d8e8f7c5
MD5 0650d2fc7066a932596921a107c2ba1d
SHA1 671bb5968da3d66987f52abd0b10550dfa97f78d
SHA512 819b3877debf75f9ae9b11eebefcc850b37d2650558113039002ca3425272e1fee9be3f1d058758675b277d30a9079082a1c68dfe482d32a3bae568747055709
SSDEEP 24576:fZMRzFVSO6sqjnhMgeiCl7G0nehbGZpbD:fZMRzfaDmg27RnWGj
TLSH
T10A6501A9B39018F8EC67813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fe87fc4ef2f496dd5d0ab64631c6d505e9eb7c154bd875cc08a0e3a1ba01d57f
MD5 d30743afca66894bb458bf9e894395f8
SHA1 692cd1ebc40baebe7ecb5168857301de3c147f4e
SHA512 c5c4609e284c41f3355b9b5d966ce9aabce2608ecb0426b761cd9d5d3369044c4e671e89efeb20eca987fa8af3bf0f58cf8ea2d63998524c265dfd397b6ae130
SSDEEP 12288:KTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A94523BE964C41CAE52604B5C3E5F14DAC073E5BE9200493BA9B7CBDF7B28584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 bf1adcdf05af8bf82f0f6cd53b836ee969824a4710d36341e3c2cf475c3fbbe8
MD5 f2c28dead0ddf90dbdd935acfd53d026
SHA1 0df553ed8cf46718abd673b1be07d0e3b886ec67
SHA512 303a43f6a718229eec9e91c7c23c74bd107727a1a98bd68abe9079f579cd5ade89372bba8f2263b030426a393cf5e3181b02ff18cca5e3743320e5cc3867ee3a
SSDEEP 12288:vnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD4523BFA64C41CAE52644B5C3E5F14DAC073E5BE9200493BA5B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 fa762b5fa9d8084f587e8702d1fc0e4d0fe870bd8dea00cf4efc544c9078e48a
MD5 e0913cd4a3085b2e5dd9d2e59be38044
SHA1 13fb9a143ecd32fb794d85a021ea0fb27617c6d4
SHA512 6cd1cf5489e91b4ef1389bae3f7e439595df50197970ff7816429c48eb9a3736838197f6bc70969558b26b835d783ecdbfa12c622667a5560155a599a3da27cf
SSDEEP 12288:hyPz5L8+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wzy+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13155125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4f9c7db2f63b7c3b746cfb86aec1c271e4946863faea4cf80313872376ccbbc5
MD5 2da1f4b70d3d084a5d1a1bd5188d8728
SHA1 587a8125f897d035f33ff7299a7465dc55e155f2
SHA512 a54193cdc01b22b91ad5b3f2b47fbcdf0da40e45727ee70afc5f7f36bd828db4c2881367282a0e4df3c11df3cf21ebe21407a55da3d4d2e8cdd17d069985199a
SSDEEP 12288:TTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A44523BE964C51CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B28584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a24e2188588546b6cfe6c3fc3a494445353626d9e08afd2fdab94da1d193e703
MD5 cc90d5a4ce5a6894ce4134ea9066ee28
SHA1 e20f04f349c99fc94ac36a1a263b649763cfabef
SHA512 dadf0efaaf9c4db7b89b010feb81d60afce2fdfddecf29bdf3c9f1959f0cf67f13bcbfd657e79b4bd02bf49c1ffead03366fc8d99f387710d6c9be5eb114c5e9
SSDEEP 12288:hTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C34523BE964C51CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B28584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 5aeb9b15cdd3adb794aa115f7ae58d5dc57305c84463d321acf931c02b6f471c
MD5 9dc30934800da3b1210e4b297c329ef6
SHA1 c483c63744dd04261c3844eca9f53f91c3e0386e
SHA512 dbe93fd8ab0c390bbea6528b71c1eed797a19204b87762efc9f6d0b3e29b49801d58080e9b488697f8a5d426e5287eff71bf8b25451d80153f3ca57722e4bca5
SSDEEP 12288:zyPz5L8+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+zy+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 4528b86759600d87460ec99b769f4678972ad33e0405be2026ebdb2759156e83
MD5 1a63ea848d55263d3f462f85cda633b1
SHA1 4de438b26f68707f7691116386226d95ff924dad
SHA512 bdb6a46439be68db95ca24b93d1cdf6e33e31a9be1a462f91c3a05dabc6d95169015739cc08238c109ab0571642e6c0c1d285f6e8aecf647f3e9162fb26763f5
SSDEEP 24576:ATDaLl3z0zDgsqjnhMgeiCl7G0nehbGZpbD:ATuLljlDmg27RnWGj
TLSH
T17B6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 78ce3a5814785fc390a8e8de7a051bcb76ca5a13020b014f0561af1477a577af
MD5 b9ee212f28fe5993ea6532e838a8c58c
SHA1 ace4d0eb0721e173b155b1cebbb65ea97835951e
SHA512 b911dcee7ac7d788c90116c751333d68994f19e6dd23eb00acadaded655aaf0fee6362f40d2d4631e25751331199d5bf9845ebcbcc1a74236fad584e8c7e92e3
SSDEEP 24576:N3vd9CHKy7GZMsqjnhMgeiCl7G0nehbGZpbD:tvd9CHKyaaDmg27RnWGj
TLSH
T1B675CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 80de20972cd84cd9b97ab4ac4e08038858a89a45f648227d5f3f657c0f37480d
MD5 17799e3f4a5582929a3e1b91e24352a7
SHA1 fd00b6b37b698fa7b19d31f52cbca19dd131b7c2
SHA512 1d6fc5df9234af0435c484718f8037a12caaeffae5f780d0217e252c5c081d747730eefed46b93bd4e48e85057f87c0783913980542afe8120a8cd7ed60e2d61
SSDEEP 12288:qQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1694523BE964C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c4391fa572a6ebb29985c0463f39f32a7673251fbcbfdb0ba7a7828a127cede2
MD5 6964070e6d18041cf9678fa216ff1f98
SHA1 f69c6e7e0e62c17534f25371102756df32b8a6cf
SHA512 89d2dc44357fff2b55f583dbade9cafe719e2f190ddfd97a9b0ac7d11066c89f5ca9faa2ed601d1c0d346de04ccd3c1e0a47e0b229be4fb30b6fb7b6bc7f7f7e
SSDEEP 12288:HeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HesqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D4523BE965C41CBE52644F5C3E9F10DAC073E5BE92004937A9B7CBAE7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 4ee4638b5b915bd1787ea2e3574e2ed8571a9d17ba218396656ce03a238d03eb
MD5 6716c38ab0cadf986f9f25515e36d2a4
SHA1 a0465c88e563acf71d6788eb99f7aba0d7588757
SHA512 08b47b9ec982bb04a12bb871dbf64fa727c7f0f949061f35d525e0982e49a57f244fba2b61ea63394fb89ff251e83ed69f4eb989bd8a5b9984ba3512e15949f8
SSDEEP 12288:25Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE8:25sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1374523BE964C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B28584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 16b0e1217b82800f72734911b5547e2724d84371bb428f97848aba8c97ac197a
MD5 5d14ff6384bdf40a46d9d410efb73da7
SHA1 2705a506de7ccc88c854262b34ee3b2339d080cb
SHA512 bf03c08f71df3872066c131fda8b5aa28ec14c53528fa44738babcbb9db385b251ea18ef09baa2df8a70fddd9bf2355919f65848c919efbb916f7129dc6a0857
SSDEEP 12288:PTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D4523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 d84f961a22fcd98bc9164514fbb5826510cacceb0c6e290e260046d405f893b1
MD5 a337f0e761372969bb0d729ddcffbba1
SHA1 cce6ba9596c44c159b18a2f2e562870f19828ffb
SHA512 d7759c7bb8e2e5292423f1be887be6db8f605954489aabf669f6464973a959a3d5b7bc9a00de627e78e53c37e8666e1ffd8373135cb1adfa7ea16b53c15e6c1d
SSDEEP 12288:XQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E44523BE964C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDF7B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d2855ea2d734f0defb0561f504d55021a2bc961eb6d6c555ed824adac7298618
MD5 a4c5d175d6a418ad6ba19cf5486e7167
SHA1 5a7db8a26bc2d2059f823a097249a1acc05b66d4
SHA512 a31faf402bf0de9e983f8f7f3ffe04aec6f09b8ded1578dd8a8c850933e8e79929a7d996931dc81d144880e3ddfec1fb1b88bb6e02d63320c6514e36f8fa9c52
SSDEEP 12288:4bXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4bsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F4523BE964C41CAE62648F5C3E5E11DAC073E5BE9200493BA5B7CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 02021a99435cf38247114ae14dfbca9c9a7b92eafd2f5bb9101fc07f2ca71df4
MD5 c9a73b456a284210f1789fede0a7972f
SHA1 b46c49a4d4f6e9ca5b2366d2219cbb4f27bdca24
SHA512 2bf48c62390e5e1c4549e87cb9901fb896d559f9fd388bbb436dbc5a928e6396374e75525012b9c8d8cd106929820e3472545e8e517e79431141503a908ebec7
SSDEEP 12288:3NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E84523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 36ae78c868426cf74b02807a1b779b30354145494be16db1b61eeba1fff0f19a
MD5 faa8ca87d029befa44a051095f6488a2
SHA1 935af5bb63efc7703354837c6406039aa57d0022
SHA512 2b0d729f2d0d9a3c28f3c4445db10bfc5361c3904b0db6a574cc548da087ef7effe2a1af76d18a2b5d75f500ba83845b1f7d5f1f30bcf8a73a8c7372fd829397
SSDEEP 24576:nfwvUk9RX6wkyAI3sqjnhMgeiCl7G0nehbGZpbD:1MnYILDmg27RnWGj
TLSH
T17185D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cd3ceaf2d128f35bbdbf736c36103042bcae292de34dbdbd3b28429b3c741a52
MD5 8a7b37462ed5d2e2bd27d46d29b9dc08
SHA1 d1fa124e91c2f7ab3fee36c11e9aea723c68887f
SHA512 3bf67345d4c76176bba02dafb9e10699685f876c7309a2532a614a080f765262214ad3638698588f2afd7ff7e44c22a8d9f0c0605fb416642eb5ff56e56337db
SSDEEP 49152:tYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wDmg27RnWGj:gySzP4D527BWG
TLSH
T19B066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a35b768012407be697bfb306872182c24b23b63f4a2c38c08aeec2bc4da443a9
MD5 c632c92509a1833ecb464d27b10bb4e8
SHA1 5c0434008f48d62f735425db83714db6995bfc93
SHA512 9e9bcacaf166ffa1479253ec6910086cc43999fa87eb74903d2d0fb716c9c543dd53c28c438990e824388c2cbbab37fec5c93dc3ec754bbe4b091aadda8adfb3
SSDEEP 24576:K47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYKsqjnhMgeiCl7G0nehbGZpbD:K47JUQjTirIhCnDHUPfF/ADmg27RnWGj
TLSH
T15D65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 5d6149836ea58869fd7cacb4ea92956fa88797b9a40ae53dcd85cd0ce9f7e3a0
MD5 60556c7b1c9d4b66976407b7078434eb
SHA1 c290a5664ce280ba5697ae3083061aa3c5f12a4a
SHA512 b6c07e100ace785d9cd02e607f0d32f941d2b676ca77a9714d425e40b8fb77d263f11e23a35ebe61bd32d53520f6fc15dfa1312c2a26f976a815b29a56193349
SSDEEP 12288:ybsfDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14D55011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 948ae11f29650f14124e9971d83d00f4fe3da6b6cf92b0f0a43e207a90cca1d5
MD5 3a2ae41d834491371b0c5ee169d2961d
SHA1 6e6627317152f82a47ce21ed5ef40ed1252ecd82
SHA512 dd7e888050e19683bed6a93274caa71b41150682c285bf33430d9666519132da68b741c14cd0c276d0f6fe4bb371f2ca2b1ae60ba46cf97f2d6d18ad45d80a13
SSDEEP 12288:eSBpkU3fpawaic7FZXx5wM1lYVnc/bCS8q1W4DiJ76fP:eSLkUPpvSFGBc2S8q9mJy
TLSH
T146350751766AC74FC6A940321E32D1CCA7707D01EE45AF0773C98B3FD576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 a3430bafbff5951c54e93318ac8fb4345d2995d300be440ff4db2702e85cc4d1
MD5 834ddcd812ed2daf4f98d33bbd6b33f5
SHA1 bfff2e5e078e6a3292d200deae085db99c356bda
SHA512 daad55f8a793e262904cba9c2adbdf128d4bfb53f396b313ee81c1e3d28555fc70165285b93adf2a42d359b036bee86eda9ae36b0cc5ba835114d7be38318416
SSDEEP 6144:vl7yXDsTxzfx+MyEdnPptMxnPptMxZUgzMxEA41hc6Xb7ofjEFqC7pk:cDY+MyEdR1h6fB
TLSH
T11A65F881A137A38FC0FB6072071A5B4C6764EC46B7496F26B3C9053AD86B765A0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c2f35e3fceae688473e4660058004a97a72df7dc63f917cb98dfbd8ddf3c784f
MD5 8e106c757d30c925b1af672323812597
SHA1 83fcb313cce6e004871ddbb57c3cf3c4116b5135
SHA512 c013c1b69dcae684e8ab95f54bc702bd75876bc7e411311ac4dfbb728b9b5e7bde3e397fc45b8b0a18b5e0251a78896aaa614e9d7999c29a80a42946b6337a11
SSDEEP 12288:C07LXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F445237B934C518AF93A05B482EAE12D680B7E669F1044C3B94778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0043ccb52eb1ed0f4854640f859157603b818b18334d7767b49caf7089efa7f8
MD5 c801b6d3cf54e60665a71826e518e4e3
SHA1 fade3843bf26b9f33192fa59051021a466c33ef4
SHA512 52433958463923e3d528305b2c9e7b46ca7cda55d8402176116ad6f440add951ecea980f002021b2ff658af87000bd7ff61c97e35796a8f2388ca0ab49fb5556
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYRsqjnhMgeiCl7G0nehbGZpbD:Zgb4mBIBhGFeDmg27RnWGj
TLSH
T1E7659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 f5257f430ffdf6bce00fde7d812536ed74690f802f986d1eb1dfcf0cb7fc584e
MD5 4fcfdc950a3487ddb7137f428974b4e9
SHA1 a31c4158362f1a84dcd1482be73b0fb6c2094d33
SHA512 0e502ec42cf411b30a589c26a99d86d7d568b097d9f20269dc8f0fec6d6b72d5cfbb5475371608cfd1626388901f4c8c3f76eef308d1defff43e0d390b6d7583
SSDEEP 24576:LG88u8FpJqH1bzria7/m6sqjnhMgeiCl7G0nehbGZpbD:K7ZFPqVea7/dDmg27RnWGj
TLSH
T1B985016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 876e2d584bf0af50cde6e5bb4213a29b9f6477786f633de69a9d40946af66802
MD5 25bcaf03c8d29d3d39b5f3bd36c57aba
SHA1 5029ffaf44083410933ce8bfea956914a19e1eeb
SHA512 ae9cc57b337a753780adba08dc85dce42cc940420d46a6cc06c80ac7bba97a4d455d4a4085877841fb3fb3254748037b5f8cf7c58efc8662391b8154706ea5bb
SSDEEP 12288:5HvUrBFrEjwaQWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:5PUr+NQWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C365F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3125b0c015d93c707b921c553cbc615cd5716a945ff7b37d01642d2c8b4128ee
MD5 bfeb9715ca26445618cebdfce0e6676d
SHA1 953fb1b693f67f51cb0927bb135c9781cccd064d
SHA512 4bb82fcaf963ca5c77cc659ade1d6b1aac9c9a112f2a3b2fc87039a7f448c4a69abb46a656ad9f20d2fa1aaa63eb3f9524bc2cbb91cdcd2b27d56c864f0b829b
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKDmg27RnWGj:VG05lO43bjD527BWG
TLSH
T1ADD5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0e8dff4d205eccb49f9bb22fe7225e36057656d832862a498d1e39fe44e61b08
MD5 dc2ea45944b6a17d10e1c560b1b515ce
SHA1 f1d20124d012cf6d3a64b73311a41755b7fe329a
SHA512 625c5977c1de04fb95567b688bd139216d3336abce0dcda625a2f88b67e43a105dba2178b8bb6f43ff4f509421043b8e255fbde4f9849587e26aa67687928b05
SSDEEP 24576:Kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnUsqjnhMgeiCl7G0nehbGZpbD:Ca5POZ3BJt2pasx2+myDmg27RnWGj
TLSH
T1E065BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4ca8a7f22dcd71e418ea21823800a030d31d52f66111655f33699db70a71777e
MD5 d343937bdd297a0814af5c6083ea21db
SHA1 3acc530ea6ce7d69af8d29bf412806f3d7ecc689
SHA512 965e36fa695dc8f8fad0a3e16eb33737d63ee19a9edbda285764e4aa3801e635221c8d97c78e25a3fb4c4ffabc23692e15c473d37383ce8b4506b4f79c575535
SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7FkSsqjnhMgeiCl7G0nehbGZpbD:8Nc/zEOVHF9Dmg27RnWGj
TLSH
T166857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cc90cad023eb8ef841b068da5aada15d8db9bef82cacab101f017ae4e5aa421b
MD5 727f538d876ad676159baf68621108d2
SHA1 26363547eb1d146adf9fa8111ceff5c42107e01c
SHA512 0a8e882529b09dce3573d332453923e86493d6cadb4e790b7c64263a6bdb6bca49c6574f66050888d2e45336a26d2f4d5973a5dd0f92980cb19be5e5582f54fc
SSDEEP 24576:5TkNvNnaFeYhJNtmZBmIsqjnhMgeiCl7G0nehbGZpbD:5TMwBtOm0Dmg27RnWGj
TLSH
T1C655AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e4023cd8e4794d703028a7fc3ae526490665b67315663a2c1a452cf646702142
MD5 e258a90da01028fc9163df878984e6ef
SHA1 912517a5872f7bdae4a81a83c44afe5c0769b88a
SHA512 c0c22b929c52fb8b0674f68e076e3f0407362814c80a2dec45ca5c2dda761030570356a1f79431f2bbc887bf6ca1848f8bd1237a85505b61bb1347db41d00516
SSDEEP 24576:RD3FHshBIYQgAPsqjnhMgeiCl7G0nehbGZpbD:RDVHeBIAAzDmg27RnWGj
TLSH
T16375E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2864-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2864-231-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2864-66-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2864-72-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2904-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2904-265-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3044-131-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3044-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3044-119-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3044-125-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3044-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3888-1-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/3888-7-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/3888-0-0x0000000000400000-0x0000000000623000-memory.dmp

Download

memory/3888-77-0x0000000000400000-0x0000000000623000-memory.dmp

Download

memory/3888-6-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/4200-22-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4200-13-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4200-80-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4200-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4304-59-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4304-51-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4304-49-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4304-191-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4436-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4436-305-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4436-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4436-100-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4436-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4976-105-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4976-113-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4976-107-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4976-304-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5916-88-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5916-82-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5916-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5916-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5916-319-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5916-298-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6736-45-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/6736-44-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6736-57-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/6736-38-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/6736-62-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6808-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6808-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6808-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6808-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6808-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6980-135-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6980-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6980-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6980-308-0x0000000140000000-0x0000000140172000-memory.dmp

Download