38ada50c235278d003e8d45d985a0a8e09a977ff929df23ececf045380477cc5

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
Size 948KB
Sample260808-p24qjade86
SHA256 38ada50c235278d003e8d45d985a0a8e09a977ff929df23ececf045380477cc5
MD5 09912266e2d00c2a58ac23906ed98c7d
SHA1 9303f14c4ee8c9761093839710dd089845703b22
SHA512 97ded43df7585eab478f038f528a5f008c2e3bd64363a06b1962d34fce1a524af450a87780ea80c70dfc5d1081f14d665572b0d23429a79e27c15b38e81abe9f
SSDEEP 24576:05m5gL06E2JrsRjhm0Ijr/eax8JXO02q3A:cdE2JrEjhMjSax84
TLSH
T1D025E002B3D3E03AF5A301715E26972956BABF921F3396C77B803A1DDD706D29A35B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1888	elevation_service.exe
2840	elevation_service.exe
3472	maintenanceservice.exe
252	OSE.EXE
6052	PerceptionSimulationService.exe
2680	perfhost.exe
3320	ReFsDedupSvc.exe
5448	SensorDataService.exe
940	ssh-agent.exe
4732	AgentService.exe
4432	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\30207f4d23e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e52ed3d53427dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6712f133527dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b924f133527dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d21dbad73427dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f3c37d53427dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1888	elevation_service.exe
1888	elevation_service.exe
1888	elevation_service.exe
1888	elevation_service.exe
1888	elevation_service.exe
1888	elevation_service.exe
1888	elevation_service.exe
2840	elevation_service.exe
2840	elevation_service.exe
2840	elevation_service.exe
2840	elevation_service.exe
2840	elevation_service.exe
2840	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3544	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
Token: SeBackupPrivilege	3320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3320	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3320	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3320	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3320	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3320	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3320	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4732	AgentService.exe
Token: 33	4432	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4432	SearchIndexer.exe
Token: SeDebugPrivilege	1888	elevation_service.exe
Token: SeDebugPrivilege	2840	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3544	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
3544	2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 5776	4432	SearchIndexer.exe	100
PID 4432 wrote to memory of 980	4432	SearchIndexer.exe	101
PID 4432 wrote to memory of 4708	4432	SearchIndexer.exe	102
PID 4432 wrote to memory of 5740	4432	SearchIndexer.exe	103
PID 4432 wrote to memory of 1964	4432	SearchIndexer.exe	105
PID 4432 wrote to memory of 2480	4432	SearchIndexer.exe	106
PID 4432 wrote to memory of 3500	4432	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_09912266e2d00c2a58ac23906ed98c7d_elex_emotet_remcos_sality_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3472

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:252

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6052

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2680

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5448

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:940

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5776
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2620 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4708
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5740
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2620 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2480
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6c011c46ffab29ab8a0a9c429f50805d67495480304c60b1310baa41663050ce
MD5 dec84a6723416c3d12e88c3c2432c94f
SHA1 dd7bdc81e0fd454dbc9739296e49d8d8a4021c7c
SHA512 5b49b7d1a67ceba79a57af39bbdc57f5fa9cfa7f088904835c1d6f3eb5a28e2dccc84761233a8d87f80e7008b8413bcb0393821decae3e84099fad39ccb73c99
SSDEEP 49152:Cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnYEjhMjSax84:k3q6HjBHQWdO
TLSH
T19AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 d66c84f2a2d57e7d6ddeaa607f424a5fb0aacb6721c9deb58a6189f56ace7e41
MD5 a86e92b4a29681c0e56ae709518fee0b
SHA1 3e24e216a0c1616703359c2a103fa5da5de88ecd
SHA512 87d4dbed146ed35f3b70eecc444b9261f0e5614cd7b3a8bb2254518ff0142e0f1790f9a1e9ef2492fbc17b0283cc0959bd529fb61c610b25bace0e42205d771c
SSDEEP 24576:BXYfDtczArsRjhm0Ijr/eax8JXO02q3A:EtceEjhMjSax84
TLSH
T1DD05022863E409F9ED6781BCCCA28505E673BC554760FBDB03A4992A1F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 f65d0ba3b5ff4a635b66e111be33a995a074376c6aaffe63e0a04dbfc0cad800
MD5 75b9824431e3e6f95184d193660482ee
SHA1 edad94b42f24a876d9acbb7cfde176309d2f7918
SHA512 39bf0da448cbc3b6db2507b9b44318e70fbe780342fc94ad1fb6726167e3b6e24ff6e6a7312e41a22c78385816d0db72d13ec2d857d5b10ad89214391bf066ed
SSDEEP 24576:k0Le5ji0hmxirMwsRjhm0Ijr/eax8JXO02q3A:kPji0AclEjhMjSax84
TLSH
T1C535AE16F6748335D073C0B9C5D2A68EED7130865B308ACB4296D77C3E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d2f36cd3d307faf23543f1b90425855599019779a52805ae3a2977b3db9aa62f
MD5 3fd40b5fc13dbcf71215026a60033307
SHA1 993cfb5ca981107239a4e1c5f4938d33cea80b39
SHA512 46c9009c85e8a258954ebbcd2c2c683f4cb5c3f4621895cb5a446fa3f134b355a2d16bd5cabd3e33c873b7ff5a86b058b1223ad6f68405e9d3feda84b1cff024
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWE6q8wyuOsRjhm0Ijr/eax8JXO02q3A:q/ezSC6vUzPvxHjy5EjhMjSax84
TLSH
T157756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3d2d8d4528fce8509f79f545d3471953811caa370dce95786a21984f027c7221
MD5 c3620d68b6f5ef20340682f44c785942
SHA1 1f01ade5171d0113a3ce68825ebae063d12eef3e
SHA512 b753d75489357360f143572441903c7d441bdff9efa34f253ece4395d3be9474e10d77321842d13f70c2b7829a090472e71999638673821d9232ebeece465929
SSDEEP 24576:7VbqPb88hv/l+63sRjhm0Ijr/eax8JXO02q3A:7VO88hXl+kEjhMjSax84
TLSH
T1AA559E66F5748331D073C0BAC5D3AA9AEE3234424B318ACB1246D76C3E676D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 38e84696024cbfed21b7a1f63dd1433c4000c36358a839d38c666015f4016800
MD5 23ece76fb12cf52ce8df87c382866256
SHA1 c06c7fec0e16403ca5ac6433d325336ce431af83
SHA512 fa3a32df23e24b9bdc1597223c9e1dcc941f34616dac8ca7331f0f9f059e21471b03ab1f555221234ad1504d6c49cb8a5ce7de853da473d4a2cd0919beefb708
SSDEEP 12288:CRNwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:CRssRjhm0Ijr/eax8JXO02q3A
TLSH
T117C4235583A46282FF07C8F09C9B1808D49AEE5948107D776622BD6E2CBC4FF965F983
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 165cfb27bb3a2ec91a803609cec45cfa2d98cd5f9bf7b31f4c0c75de45f1b487
MD5 2fc309d1c8a129e258beac4a1fa98823
SHA1 4142c94975791d55e0afd8f85db4a68648fe2627
SHA512 67d72abb845a16ba08c3d6d97f740466fc29ce8b373b37f098da2e3a87dbb3ba890ebd471bd4dabad7866066a5c7d67d856130784e3880bf2cdbd650bc0ad8cf
SSDEEP 12288:aeBNUbTVO86UWwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:aJIUvsRjhm0Ijr/eax8JXO02q3A
TLSH
T13805CF3BEE28FCD2C67A8DB85A918600D77278304F61A3CBD175C20E9E235E55E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 31f1f3ae9860907187581be51c6daa3d139f7f5d3f6af486acabbe5ecd1ca565
MD5 fb5c1f436c7a010a50daa320b78cfdbe
SHA1 74a44b540a09e297ea13b48e68b63f6520c8e743
SHA512 10caf8621b1c1fcdc91ff5b543ded9af9a11e6ae23233f44136575cc1234d79e2ad96ca4a507ea72c01e6fe0d2d048a976991c44967a3ed959c07101528b2b75
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:kQvGAdlCEL8c/yRNw5C+QWdO
TLSH
T14D267D656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 96a44ac19f5b75be2c4059d00a7a0969fa6a5d23e0a19d7fa01196315a72d19a
MD5 02486917fa0b2dd152780968a7af7fa4
SHA1 d7ef14099ac8dcc274991bc7c60d9532008b3ec5
SHA512 117e73f4892dab68ef99bd0f8caf65cd8ac0a371d5abf26cf1b7c6f14b2d6de78e58ab80dd56ee1eccb25c50d159b6b1c8776dd6fa97aeb68f4b31ffdb811cb8
SSDEEP 12288:6AwSfxL/2Dc34DLLmt0LDQewsAjAwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZ6:PdewsAjVsRjhm0Ijr/eax8JXO02q3A
TLSH
T18415E031FA74E032C77B0DB21B36C716542DBA204F512AC3E3A89E9E59741D2237AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fe80c3f199594491e25f8559e943b99f2e8af6ce334a3a188760258a653ab609
MD5 43042fac2854bd404345d6e5c25a77ca
SHA1 b3a8941089437377013e688d4cb50263548474a5
SHA512 59fd72ac738997f3b3915a959b6930679f730e8035e9be845f8b25c0a30be92231b4c7fb531cc9b0adec2e44d4ba07024e8a35e3c603f0da8d1f40d255af09e2
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH9QW:9UEtQevvqc2W1cpV2EI32W
TLSH
T197474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9792761cbd62af5a2d7c2f649f02ae427e42ef3421925cb4bf3a4d92817122cd
MD5 d59945c23f0cd3c5553c6d55d793fc02
SHA1 67d79cbdb6bd3a73651802e0002c289c86906394
SHA512 2d172c94f3fcce24a497277320de473dc7531123103374c3a355a6fc47f46b585113e02c7a6b41993944d32a3e697835d043ee40457198b5d923d21c68bf66a9
SSDEEP 49152:5CbRquA/m2yL5zTfFiV+XenmE3/z1EjhMjSax84:WoquVjnmiQWdO
TLSH
T116D58E0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ba6075b3a08edbc1004342d1f340e4f3766f6eddf9a4769938f5eb0c255ff724
MD5 d7c77fc2efe6839520a826538b3b7d09
SHA1 dd05d7c32f77e3def745247d1ff7fa0c2a5964df
SHA512 0c04d5132ede78646e767032d2c9832b8db211df02fc84945e5066a410714161f95b7a91d20b012654e4dc52dd26af4865d773758066cc2291733a893cafa74a
SSDEEP 24576:AAhGLJIFoiwtA5l7S53CsRjhm0Ijr/eax8JXO02q3A:AAMyFoiq5SEjhMjSax84
TLSH
T14135AE81E7F955D4F5B3AAB899B68170EA76BCA65E30D20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 b0c2d559f5d98a95c8010b6504415e6ef04d19f29c9808177c1f43bac4d8cb17
MD5 139f01e08229628da40eb47d419e997b
SHA1 63e9ff5a3273d919c8bba32e13a5897e48cca4c9
SHA512 c48dae30249052f3d2a2bb835b2efd617e06303a989072e84eaa4c3ef680bbcf883fee206a171473135c8a8d33d6e094ce5ce034c2dd1943ee2c7ad4150664de
SSDEEP 12288:jmw5HEjsChNVBFgl0WDm+CDwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:iwuoOWZsRjhm0Ijr/eax8JXO02q3A
TLSH
T1F005F14673E41CF9EA67857885978135F7F2BC022A21DB1F1360CA5B6F372616D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 196d78eebffc472f19cc9e53f2eea2325da02a3c45a1f2cb5518effdcac1bcfc
MD5 17a2a66f9621bb1660d5407b1078a314
SHA1 b54568d93f77c945fd7c286e7586ee594c891ab6
SHA512 39a843ab71331fdd48d31597657b04ee55d546395f84cc8c7b11520c2379aaf3c91faa3cc137917a56aa836ebd8d784927d1c803e3efd4c65ad776758522881a
SSDEEP 12288:6BZ1IyQwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+2:0ZuIsRjhm0Ijr/eax8JXO02q3A2
TLSH
T12AE4125A23E431F5F65385F8CCE60504D372BC66073153CF16216A6A2F76ADA1E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6ca85ae89493c35e0c5d337a4f74f5400de306493d2b69277ce3faf3df1c3f85
MD5 b34fabb69deca31e3e2bcae37981b9f5
SHA1 26c70138ab1ecebbb9a2b93af288abcdad5a927c
SHA512 b32bbe38a250e734e66a923c5e2d77aa5e0c60f8616889c1faa14c925c7741d27dac77914f5281ddc44b93a03bb8fc64f6c35d5409c049a9b70cf9d790739e3b
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:XQRQyi36YOcPQLvw2gAf+PN3jQWdO
TLSH
T130667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5aa63cdd7ddb651ba98c00cf4c4cf71b99d0ed67895535482b5f5e3e79c02877
MD5 17437debc61e09d2616055634f2c19ad
SHA1 f027ed0ff8d31748da84ea150c89c1fd1fc7c6a7
SHA512 6616775d2391c296565381c90920ed0e9efe3d7f3938067320d3a59c9bd98f15ef9d3988b887270fb40ff5648ced66c597d919fabccf13bf4d4227ffc6ed2476
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:HQRQyi36YOcPQLvw2gAf+PN3jQWdO
TLSH
T157667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a8be6598bb36eea30c749d1d801b8b736cf909b0688c4c899d33ebf77d68c5e1
MD5 f54e6a5927addcbaf8fce6a6fa6a8361
SHA1 27afcf4b983567b8fc7aea46c87599ccfda6d58b
SHA512 c300a342a2ffd65012c9e502f0ed6e2ac0ef0f2ad0a9ee26d8dea7288c89008352e214f6f7cd83a5fb9a5d78c5c95d8fa1b965b9413e2f676a1889c7da2792f5
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0YsRjhm0Ijr/eaxH:C68Qg55nhheWu7PNU3/lEjhMjSax84
TLSH
T155B55A33B2F20099D44DE1769F4A872196D27C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5968343bd1fc657f4c3fd73ae03ccee253f0ba8a6a5b49ce537212c19379ca33
MD5 638c8a0121e74a91016c5f1a9d2da9ee
SHA1 7a1f68862e6bb6b16e04a5a9f947ee8f568385cb
SHA512 2de0cb564f7afeb53acd4958739629ce036f5592f4512e74afc23fd6e01fbd83711668c1b13a09d3e9c17a3d6adcdf4939619237b01a9a652c7f9e950c3d6098
SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99X:py5112gYy5azzVvL69nLKnhZsQWdO
TLSH
T1F7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c33be4f774c219df53f9620ebf39877334ecf924a9d4de4396a8a908a71020c7
MD5 2d5980d6d730c83a3875115ec26b333a
SHA1 acc556aadf00e1574986a2c4426ea528c08e6060
SHA512 1ebf5faedffc8efe4796edc70347e6abcf25e70411d0c43db5483c9b6c5e2a25fa4f6baee05ff177ecfab7d0a56c3e97eea8e984853399ef50f9fcfcb1577dfa
SSDEEP 49152:eB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl7EjhMjSax84:Mu6JmVxd2d7QWdO
TLSH
T1E1D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4da1ec60fac1cdce89680385b2f8d033f01652c40192ac65f0875778b46f8721
MD5 dac67412cf25bd347b991eefedd9d5d9
SHA1 286e7413ea177128eb8dcaefb0ec42ed084c8f35
SHA512 6c2ad705aa625b41908fd9b3a46d3796d5d4475a9b130bb7bc98b1f85beda774fd9a6b1b194abc77f2003ca70350b1f6c07e608ced7488e49596d92445b595d2
SSDEEP 49152:x1hpsNoJpF1A6UU44CwH7R4xPEjhMjSax84:xmifPbRiQWdO
TLSH
T178B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8a05688802c841da0439f08e79cacdf93f4cc9b22adc3af95485703455e4e767
MD5 f457c93e38623fc09aca4db37bbfe13b
SHA1 94431258556edb96f47dc117c19b8afea6e4fb5c
SHA512 5fe7b6abe8e68c0ba289cd1a7a156899b89dd3dec248a481f6f31236a25e625b158fbecc45493d3c3be61e2d51a9a8c5f7fabc632c642e31803319990e6abc6b
SSDEEP 49152:0SuZQIY0Be2KRRVtOnks6NMHqIEjhMjSax84:m5dKTi61IQWdO
TLSH
T1ADC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 789a4fa36fd34e90399f7c4a745a57813499461f9f94bf6e92fc6f7469da7649
MD5 53a83d33cd9d4c3f96fe20abbcaa40f2
SHA1 60c7d2c025827c6c4b4b411c0a0e8472deff417c
SHA512 fc14513f7446f2150924c852749cbae5ecc4fee56717b2840175f458086455c46b5bc4e22f42cea235a0e9d68b9ec7b69ee6b11412bca0697e885f9fdeb84d39
SSDEEP 49152:HhtSn8EApI0figngiDn0AP5wrEjhMjSax84:WX2iyphGQWdO
TLSH
T1BA95BE13F2D901E8D05ED1B8C7468632E962BC160B34BAEF0A50B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d9de0af12c0c5ab207c69b0a01343411057ae395d27ffd7a0884f27b863a9280
MD5 b4672183e8982927121d8ed393a8dec8
SHA1 0403c0b3f6306b1c166853086be1f228c64f1023
SHA512 4ee305c3c56f8cea6ae295eaba5636b2ffafe3af9d43f316b40bd167b2dc7ad95b596e59e067788ef70bf9b9795f05d7997fd16206f657afe2f3f0caeda02a2f
SSDEEP 12288:PFwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:PksRjhm0Ijr/eax8JXO02q3A
TLSH
T183C4235582E56286FB03C8F08D9B1408D49DEE9E491179B77722BC2A2CBC4FF161FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 c9552e46656ac7b5f2b3728d5f888b68c649632383863e23127cf6a040315633
MD5 b7fd1ff0bd4654c1a94964c56b4114e2
SHA1 e34934926d711dcd92769ef9a78653427ef13e4d
SHA512 d635d51bc21116db082eaaa57d08434834ae28a82151c62227948e4fae0e1c047f5bb35a46b004f3b9a7746c159b3cf105c0b88570cda64248e03ae350e3f9c3
SSDEEP 12288:xcwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:xhsRjhm0Ijr/eax8JXO02q3A
TLSH
T143C4235592E56286FB03C8F08D9B1408C459EFAE491179B77722BC2A2CBC4FF161FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 4db5ce372ead78700b3e66b29573a12af81b36a12d54180b2f8bee445dca63f3
MD5 c97c34345c820f15fc44c8362282bb8b
SHA1 90f8d9e8b64fc755fd5ad8c909e52a17b401971e
SHA512 cfa4f8f31fa34d69eb4679077f4bf19125f02bf401dfb769759742fde200d321a22d559067754e90bdf4feb7b27aca11b77a252d17c1a140fd63ff62465ea70b
SSDEEP 12288:juwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:jHsRjhm0Ijr/eax8JXO02q3A
TLSH
T1BEC4235582F56286FB03C8F08D9B1408D499EE9E491179B77722BC2A2CBC4FF161FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 cbd8ee128133b3d4d4184d0a01d2342c8150407de0a23fb71a7126452ea83f46
MD5 5c30e83c173580afe313cb380369ed91
SHA1 241ebd895d0f3994afb3cdc588b0d9c0c9908f33
SHA512 e573a7c394af61c0b2ccae2e73adb6a1c5805f6ed8a5a88aab0e9a4a14f7e9ba903080a9a437612e298971d325c0cfb6332519f8f2c06c10e91c66c0be115ee3
SSDEEP 12288:oVXwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:HsRjhm0Ijr/eax8JXO02q3A
TLSH
T177D4235553B511C2FA03C9F0CD970408D1AAFD994A316AEF67117C1E1DB82EE1A3EE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 8c6866ebe323c47ae231abc634b3691d5b163a01fd7481ba3b2e5ca5586e8666
MD5 690299ecdc7c33be7edb01c4958e90b8
SHA1 e398462d77faaf8f46255f6fff117f34727e915e
SHA512 f27274928a4b3a1be23b1c3e8db74cdb9c3ad19178d67908d916e24c0d0d348a8ea62835d638681989140484c3b9de0c6cf7241b349fac7cd09bf8f6c2d7a4ed
SSDEEP 12288:B/wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:BKsRjhm0Ijr/eax8JXO02q3A
TLSH
T1F6C4235592E56286FB03C8F08D9B1408D499EE9E481179B77722BC2A2CBC4FF161FCD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 47559de1e049d620880266b58ce44fa68f5ca2c9d3aa282f1b1f68a904d9aa49
MD5 e6fc33f2bea945870c743799adc3ef1f
SHA1 8ac2a001dda1b3f05c36e0bc9d3dccf9d76dba60
SHA512 f2e0db1365a954b2eeaedf0dad936bc0598baa325583469065e2fe19b1cf184075402f4019c7f4ea8df4023fbd58518bb73f25ad79373054da3444874fbf85f0
SSDEEP 12288:r4wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:rtsRjhm0Ijr/eax8JXO02q3A
TLSH
T12FC4235592E56286FB03C8F08D9B1408D459EFAE481179B77722BC2A2CBC4FF161FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 0d7bcf48fab5315e5f5c5b4aaabc149d1f3d34375e910020c79e95f801661f70
MD5 0443b708f8811f875b6154cbf6c4dac6
SHA1 4bff89b683962ed759c8a0fb89389990dd6296d2
SHA512 32094d3ecd6f064df25eb5c4bbe8fb46adc3a990b6f232bc42c86dd9756ac395acf837b96ae7f0e2cab7abd258aeb0324bce3027fe58b2f28eb633e936bce379
SSDEEP 12288:pEwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:ppsRjhm0Ijr/eax8JXO02q3A
TLSH
T1AFC4235582E56286FB03C8F08D9B1408C459EF9E481179B77722BC2A2DBC4FF161FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 a1bfc76f2dc4c132376a74bd86941b04fa792ceb6a7b726d32a467b3e4f0ef59
MD5 c0b346cbba8dbb9790ebc0c4b89a1025
SHA1 2fa641650a8cf82a6ffb9d0473047cd04a7a0850
SHA512 1dc7d9f9d0461de80afa4d4564097ab20451279dbbfcbd4c5c824aeef1c6350c8f3237b3604f7360116a84820d277e851e7ff3877d773e108eb0c044075b192c
SSDEEP 24576:AZMSzFVSOBsRjhm0Ijr/eax8JXO02q3A:AZMSzfdEjhMjSax84
TLSH
T154050195B3A018F4ED63817ECD564905D2B2BC5A0B60CA1F13B43A2B1F773A11D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 f530d1fb5ea9a14ab2d263c37e1828f7211e40ff2b9f5c162602cc798ef68d6a
MD5 321bb59dda756d3d3115a887404aed88
SHA1 74f4f0d3a579eb805113425d624bb90c1cffe0c2
SHA512 29b143e58d1a20e4d3f824b6ce173931351e11a57401dad96d4c82779d5e11b5adc52f3ace484d4826c99a231cbcf065daba6020d667f2cc4c4f66049dc0c2e1
SSDEEP 12288:yJwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:y4sRjhm0Ijr/eax8JXO02q3A
TLSH
T1CDC4235592E56286FB03C8F08D9B1408C499EE9E491179B77722BC2A2CBC4FF161FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 32868d30a024f7459355edaf5e59858a4f3688524d11eebeec914887ea904d19
MD5 5e16985621ce79318d35db60f298c6f9
SHA1 1114f6b764defec447c51f9a2bace796640fc0ef
SHA512 4f08050c85beac5e94bb1daba1d4f647c2a08fed89b0b1a8fea0f76927c8b4c9334e3a77f005c1f769c64bd2fdbffe56938e1107efad34779090de208caeca7e
SSDEEP 12288:7dwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:7csRjhm0Ijr/eax8JXO02q3A
TLSH
T168C4235592E56286FB03C8F08D9B1408C459EFAE481179B77722BC2A2DBC4FF161FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 68bad9ffa8fc457266170d0ff00face9b56414a85505898f9b3c78845901447b
MD5 910a996661916389065d69f1dae689ec
SHA1 c81895cfd78fa169e534d38465f888091e71ed2a
SHA512 861a73a310eac3e129d4c777374a143ed1b578dda87b4abd8c421da5b9067e6fd45040d11f20b424b6ddf70c507b4c6616c2b77653cc09945bb4028510676c48
SSDEEP 12288:HyPz5L8QwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:qzyFsRjhm0Ijr/eax8JXO02q3A
TLSH
T1CBF4020773A130F9E62781B4C8931905F376BC3607209EAF17605A7A2E776E55E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 3953c989c502d7429b4848a93888c41f12d8d1bb107534058049d3b8db44070d
MD5 2c1065409481a8d2fece9fbb6e236139
SHA1 77fa8035d59e1443560266c4406e1ebf952892cf
SHA512 b7bfd069c2a094a01efadbb470eb548f44637100cb4840e1e039d21dcecbb276a308e5884f18f5ee0df989638c71e0113fb3abd0fc0e45af6bbf650691d29a98
SSDEEP 12288:nJwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:n4sRjhm0Ijr/eax8JXO02q3A
TLSH
T18EC4235592E56286FB03C8F08D9B1408C49DEE9E481179B77722BC2A2DBC4FF161FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 4c58dbe6c31d90f71618d7ccc90781d52b1ce68fced9f3ff2c8a7e7bf5ac3e80
MD5 23cd43ca6af289a7eb4222a7b2f9ed74
SHA1 56971c97e19d6c3a1e9b2235504af3880564e372
SHA512 0667803e41ba573327bbc6a9deed4be14a1a3d46ebd85cda4124385f94df3e7ba85d7243a00ca7a4e318fc2a62fe100908134f93df796d4f97f79191682bae42
SSDEEP 12288:EJwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:E4sRjhm0Ijr/eax8JXO02q3A
TLSH
T1F5C4235592E56286FB07C8F08D9B1408C499EE9E481179B77722BC2A2CBC4FF161FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 b84b708b84943a4eb174cc0b6e123f2f0bc5a7f4287684edc38e5cc49de028a9
MD5 87c9dfe1ec33baf0de08184ab23a5b36
SHA1 6d379d38d39ce1e56978ae94dc646beb5ec5b0ea
SHA512 0ac9916020a6da08ddbe9f03611c99e3c060bb80513c7730b6fa939375236122aa121c6240817e50626b6aa362743eb55eac1a10b4c3ff879ab3fb242c3f7b72
SSDEEP 12288:byPz5L8QwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:WzyFsRjhm0Ijr/eax8JXO02q3A
TLSH
T1E0F4020763A130F9E52781B4C8931905F376BC3607209EAF17605A7A2E776E55E3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 d4d978e5a280d86f959e04d777e51cdb4715bc95ca756325355867adf25d7a5b
MD5 1422d93d1378e3120f5bb2a34bc2e2b3
SHA1 03f39a704bd133ade94e55c56e7e0eb5097dbbd3
SHA512 6c4a2984490ca2deecf7566dcd0d860ff664ca05ce5e4d9604f2084a440f583b15d823cd201a5f298fa2ccdbbdb78600be57da432cbec86a3e04a69bd3d34df7
SSDEEP 24576:HTHaLl3z0zDXsRjhm0Ijr/eax8JXO02q3A:HT6LljOEjhMjSax84
TLSH
T1F9050194B3A018F8ED67817ECC564905D2B2BC5A0770CA5F13A43A6B1F373A11D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 098a0c0d35c8cfba3e35801595cd062edf7460f0a10ef83a7ee8aa60319fd40d
MD5 6ae79bdb1d5e8625be8720d317d14b04
SHA1 4290f5bcf690c3043b79c00786aad41ce783ad06
SHA512 826f00c8dec0c16d3098733fcca79415831d1555da6c364c65af5ed31d21452c3085ad2f73c943fc762816358f924599024a24c9a19ae25ab2258dcfa2f1913a
SSDEEP 24576:l37d9CHKy7GZDsRjhm0Ijr/eax8JXO02q3A:F7d9CHKyadEjhMjSax84
TLSH
T14225CE90F3E410E8F1B7CA7589764511DAB67C9A1B31DE8F03A4661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 c8edd62366ee3350ef141e2f0b270f866d6f3bab46c8fa2d4c5662a708b4393b
MD5 60e6085bf73285ef4ef3f84e6415ed45
SHA1 9e9fe27ec455b02ec7aada85e85911328887649f
SHA512 157a9b838f2f70b8862506c80922a5b83133209673b26c649925bf88025e64b81a180510c155a39ea30fc748583139b7f6bea085ed6df3199694e0a3704b8897
SSDEEP 12288:cOwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:cnsRjhm0Ijr/eax8JXO02q3A
TLSH
T161C4235592E56286FB03C8F08D9B1408D499EE9E481179B77722BC2A2CBC4FF161FCD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 be73801f485b206121231c03ca0e525c9f64d11d078d13e53020ce1b2ba98e0b
MD5 d6ebf92807d44abe4e756604c6990cd1
SHA1 f9dfadf627d5882c1bfd83bf288117a7e0465450
SHA512 0ec13f877a223e18d9a15d9d5f0e53cd1c81a8e9929f08b5d8ac0cbf0625d1d1a9fea29e42d4d6ecde7c3f6da55b108ef1d9d83d6488a48126de0c3568520bc4
SSDEEP 12288:UwwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:UlsRjhm0Ijr/eax8JXO02q3A
TLSH
T1A6C4235582F56296FB07C8F08D9B0408D499EF5A482179B77722BC2A2CBC4FF161FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 433ce12fcd18bd0e2c3a92f2a85a03f1e9bdc5ca7f29e37cd8a13f373cb1c741
MD5 fe7dda40760f033a3ed05477566aa80a
SHA1 41ef6aa31ec1bbd11666fd394d1d9e2e4b4b1f6f
SHA512 091ff0b75232f1cfe550dc0c7b967ed610927866869c49e656d750b8039553010fd3d99fe2a69b9d53d4f6e5308918173699fa9230221793713f019e73f8a97f
SSDEEP 12288:ILwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:I2sRjhm0Ijr/eax8JXO02q3A
TLSH
T1F9C4235592E56286FB03C8F08D9B1408C499EF9E481179B77722BC2A2CBC4FF161FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 8a17c5e830c6a6a136aab49236d40e91decf336ac67094637f7e3f22f5047508
MD5 0b95c951d460179b2ba86690ed56bb5b
SHA1 c2a17070fb79596c05d037234449da19f801e43d
SHA512 a7107501c9a1203e443c8208d0d508901675fd3e9c673c05ccd7193a25d19974923a8dee876ed18cb64f9ab229d872d02d7498aaeb2457758d76f762f42f6980
SSDEEP 12288:tJwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:t4sRjhm0Ijr/eax8JXO02q3A
TLSH
T10CC4235592E56286FB03C8F08D9B1408C499EF9E481179B77722BC2A2CBC4FF161FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 234d36664895adf7c766336b9507d1e8eb0a12298acab36f21bf633fccaa0d66
MD5 283c01db9d0c57de622b4c99372058ba
SHA1 8f8abbf5b37610a20821f52cd36d92c3d80d7e8a
SHA512 93c3c52a31a6d1c14e6a615d562471b44cf55cf94024687226b8ea20361f53cf430bba15441d08152d4340fe42bd4ef4b2c0b15276b8694c48735a18f51fcc4b
SSDEEP 12288:yOwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:ynsRjhm0Ijr/eax8JXO02q3A
TLSH
T160C4235592E56286FB03C8F08D9B1408D499EE9E481179B77722BC2A2CBC4FF161FCD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 5e37c5c37c485323f593f263e7dab7a9e60e92eaf549c8af058e87acc8fecce2
MD5 5e392d9b40fb434e72c8756671c7532f
SHA1 ae6fc0740d7c191ad19ca988a261f98ba78a0a47
SHA512 ce553ab6a24b4eb099d7377117eccc21062ec82f33e8213244bdbaa16021932aa15938fa3367706a376cc0c761fac586da3c3bf20ef3bce79451d529e71af1b8
SSDEEP 12288:XxwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:XAsRjhm0Ijr/eax8JXO02q3A
TLSH
T1B4C4235592E56286FB03C8F08D8B1408C49DEF9A481179B77722BD2A2DBC4FF161FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 87743c5549e800c001a212a80806568d621a057f5313e3a3d3a01d29c0ccc872
MD5 b3e209590a17167c43fc561ce7cfcb3e
SHA1 51db7bdf88c308a7bf46fb590028852c02579b31
SHA512 1af0e2245400b9a7e61cacd4370868e247a0e2a793989ffac5fcf44a55cb8880f48ee0ba48c88feac33ff8a764218cf69c2df6812be7ba70cff6dcd7640a2431
SSDEEP 12288:S/wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:SKsRjhm0Ijr/eax8JXO02q3A
TLSH
T1FEC4235592E56286FB03C8F08D9B1408D499EE9E481179B77722BC2A2CBC4FF161FCD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 786dfbf292a8491c595e2d0df1f3a979a35c2fdac9b7ca7f0fd05cc3f632ab6e
MD5 93545ac9cce028e5d82e8030c2e41ca0
SHA1 5bbbbbb8bc07e452b63c3cfef2007d099cf6c010
SHA512 e7b3b11ac97f0348a099efb678570d289f2e95ba60dd039dc984db9934db3c7fb5a2614f845e4ce4e7c40087a30925c924448ee42b38cee522489692d10d4b05
SSDEEP 12288:2mwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:2fsRjhm0Ijr/eax8JXO02q3A
TLSH
T175C4235592E56286FB03C8F08D8B1408C49DEF9A481179B77722BD2A2DBC4FF161FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 bf66ebaec1d5f1ec08553c98097be2c3a6bfd01e97e9376ef68bc5ba1e90bb08
MD5 8c3dd7c62653867bb5077d699fd05692
SHA1 c85f059816b0b006b461dd3e26fa9e97c16ba06e
SHA512 83b95b4a4caf092a33d4d993b23e34c6ffd354061f88e5f3b34fc8a3cd94120bb59ab7c9317eb9d38dc36b78a1f8e2bb5dbb1dd41aebde88e285a4b25ab62c8f
SSDEEP 12288:f/wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:fKsRjhm0Ijr/eax8JXO02q3A
TLSH
T1ACC4235592E56286FB03C8F08D9B1408D499EE9E481179B77722BC2A2CBC4FF161FCD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 aeada42c553ded23a51bc42fd444643784521eb9c3b86ef57c8e8c025d6d4b92
MD5 74cf471085209867a1a0e8e113444ac4
SHA1 d1e928b8d236d68305afaca5672ac3a9c7d2c594
SHA512 84a4660b63ce817880fb21cd05f017a16aebaf1d0744baac5095a04a569253f77f2ece12793eb3b18efd8183a8a01d6e24a11035bedd00b2e1f03523946c19d4
SSDEEP 24576:8fwvok9RX6wkyAIMsRjhm0Ijr/eax8JXO02q3A:cMnYIMEjhMjSax84
TLSH
T14835DF29EBDC04E5E177917C89B7460AF2B1B8690B31C6CF125A536E0E37ED45E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9d5f78a149445b1b94ce54955d442e98550548a8d4c5fbc4d75c26a94b306062
MD5 ad84d1b071022357ff39d923001b0607
SHA1 cccbb56993b4d4e964cf00576cfb655812fe667c
SHA512 2d44ae2087303d81f671feb4c7d531069113ad0acebc11fa1f5f6164b1239056f66dfbc0b4d9b6d2ac0aa1108db9afa20ed2600c090f98e55b6abfbab7590224
SSDEEP 49152:eYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0LEjhMjSax84:QySzPDQWdO
TLSH
T17B066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 11b9b3b98c7aefa59db50e567a8a50d72aa142fa2670758e94470d855c43f43a
MD5 0daaae38ab9434d979cdb666e5abbe93
SHA1 6f9c3ef98977466ce465aa469d935f308f69f835
SHA512 f94b58ca4f4a5f36f4dbbe42a8c85276471977041100977fcf46d6693a6a5e37b566afe8eb53382df0951a59b19253de6ce7f4cbddac7e2fcb754a846df61875
SSDEEP 24576:P47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYxsRjhm0Ijr/eax8JXO02q3A:P47JUQj1irIhCnDHUPfF/7EjhMjSax84
TLSH
T13E65AE1DA3EC01E5E1BA927885154A1AEA71782E1F31DACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 2367391832454626ecee4d57ad26c423819a5ff8e5fade95a325f1a04aad3c72
MD5 c107f97cfa0dc4f47ed75b87231f542e
SHA1 65849ec1aab28a7d18abe98a3f6128ef354faf6a
SHA512 3bc5374bf92c554696822dfcda77554fe47f6bbd22dff01ce3201a2c54780043c31426b18a3365150a717309f925a2237c7f82aaca1ec6834ec1e342ce8e46f8
SSDEEP 12288:iNsf5wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:7IsRjhm0Ijr/eax8JXO02q3A
TLSH
T1F9E4F119D2A812D8D11EA1B4CB560A00F323BC6587E1E3CB63D0F93E1F795D55EEAA43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 37a2cb4045b3fbf3427b63b0cfe3960aadd72794b8600c794538ed164b9fbf63
MD5 12998437882e8eefe48c12b043a08cbc
SHA1 2cf299c3baaa6fc39f85fe4b8362a69321388c27
SHA512 766ca21a814e833882aa9d2736d491b1f17dfdbbd65875c81c4678217a75d900d1ccf74f8a749b6d5130e3cb5499e46170c288e2d95a7be02856a80ceca1a7ab
SSDEEP 12288:vzkaU3fPuw9R7LyKJwsrqyEO1RcdZ4kka6E9IxY:vzfUPpxLlNdh16dZPka6Z
TLSH
T1333516417626DB4FC6A940361E33D1CCAB707D01EE05AE0373C99B3F9576658BAF2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 b15b62ac564740fd4947ded6b72837b1433c5fffddf24886bcdbf3bea947ef1d
MD5 60b1621e82c3fbdad26a61dc6c350982
SHA1 c7f0c3f4eb12643a854a482a3543bed45a758bb8
SHA512 5d538925531aa985cafc13716577c86f6ba3fb81a2bf472b94aa04cb1f9da2a698244fb130796500f7782da3d848b1ed5612f232a3c4dcd8a51ad9ba4326fd3a
SSDEEP 6144:No9gsMI5eNYYOuVaEsjhkQ2Ev+0yCUmPJBPDeDE/KEIhKaC+oAJu6VulnjD9tMx9:No94I5eTdVJsD2EvL0UzAJu6VulnZ8j
TLSH
T1F465C7815137E38FD1BB6032072A5B8CBBA4EC17B7496F2677C8453AD85A715A0F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HPePrint.log

Path C:\Users\Admin\AppData\Local\Temp\HPePrint.log
Size 592B
SHA256 e640a46ae19a48e22d1607784e3559f45babc1b69f87b576c2f8b33a820cc707
MD5 f937ef6e9d388c188739bc376a676ada
SHA1 0240a396528a9a3df6db9895cccf03658e56d82e
SHA512 bcab88e731c14fd09d32f5aebaac97e0924f1cfb2b5815efeeedb5a5b5f6629df404141a63254524f95e2c898a373a2e091bde327249157a04ea8f4896eba466
TLSH
T1A3F01C0BDF3192D54F7ED5022D248AC3E9D739A30C52A80C3B63827E19630E60AFE136
MD5 SHA1 SHA512 TLSH

Submit Download

HPePrint.log

Path C:\Users\Admin\AppData\Local\Temp\HPePrint.log
Size 1KB
SHA256 d5eea5ee8d3ba0ab6a8454902954683940dc3d8e905f3b34d55768ddafd5c085
MD5 4d0115e56b91c14de64635e97585ba0f
SHA1 511c1f36c0a3cd150dbc562d440751955f7e5618
SHA512 cacad0ce674b39bdb49689ec8297f7bdf3f43a8423fad85e8c4a10bd0413b3fcf2de58a5c9251cd06d2b7dccfb1e1d8a5fe1c829859f6baa37e871e8d7d0d766
TLSH
T151214C47DE2396C54F79D9412E1989C5E9C339A74C62E82C7BA2816D24630FC0FFE134
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 8501066070170c779e1d01e3c8f83576397771c2f1fba06004a2b9f9a32a0490
MD5 37edb19327e8f5145f39fa843f40f8b8
SHA1 ffd4b172210d26aae218acb13ded0105636482b5
SHA512 c6f0ba45a0e8c353a62afc0e3705840125a149fa1da91e3e82d9f1bb89f45f7d031537b841148d3fc8201c59be7737e9884ad64f1022479360dc9bff0cafe3dd
SSDEEP 12288:107hwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:eQsRjhm0Ijr/eax8JXO02q3A
TLSH
T159D4231183E86646FA17D9F0489B0018D01EFE690F10A8E7B611BD5E2CBC8EE5E7ED47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0e14b257f5646908b818d70b005926965199abc44c274293ccba4ea873be6bf2
MD5 6bd183b646a22147f49356f772bdb6bb
SHA1 d0b0db14dc37c024c2c59a60bdee61aa0f39da00
SHA512 76af020986b959fb916815fd0e314c71ed95751164701aab28b0d1df6e436c1742dd5116173f515f0aabf5336fc6a549957781e0c4e5cb1d3fa7c47c23274f3f
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYOsRjhm0Ijr/eax8JXO02q3A:hgb4mBIBhGFxEjhMjSax84
TLSH
T1CE659E1E22EC02F5E1F6D2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b9f6b8a0a46f860ddb75ad3cfd2fbe206f2ad8806a00d08d4e1feb6aa211afbc
MD5 3a756bbca68a7a22db94211ce645a225
SHA1 ed5cc32fde42cb1256cda334c23ca2c69733b176
SHA512 7d3f291a8350a144b16b9d1a4b3fbd9d0841b31002658509745341f33182787bf39c12eed6533d2e79c48d7ffef2461c6d76e9d73f3ae4c91d4a3ff8fb66097f
SSDEEP 24576:wG88u8FpJqH1bzria7/mBsRjhm0Ijr/eax8JXO02q3A:j7ZFPqVea7/WEjhMjSax84
TLSH
T1AF35F16567E102F1E477D13889864663F6B2B8250360EFDF07A88A551F23AE50B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 16c92e5f6679540e9d96e24e78b95a5cb4d31a6f686f9ffecf1fa8c251346cf5
MD5 0360e23af2421dde90f3457b295d6bfa
SHA1 fc5e9f0c18fdda1624ad2b270b63c9a8e821e3d3
SHA512 fad0e79bf599eaeeb1eff80e379109f0001e1b56a9ba8e67ed5a07cc8ab4a172094888a5d67452856d4f0fe702b5157637a0b03aab155a577b992c69de070c65
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjtEjhMjSax84:pG05lO43bUQWdO
TLSH
T117D5CF6A62EC11F9D1BBC17CD9C64A0BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8619e08cb673876eece61e51b6bc54429c5114f016e76ac9998d605dd9381a1f
MD5 3e577901c1cc36f65f70acff16418a3b
SHA1 09dd35f933bcdf6fdb99ecf182d5d6a281cb6267
SHA512 d8d134c3287f6b6cb4252a97ef1a3e711109bf3ab651de31d41cd6d1ba19954887bd1c92a67251b4df6636c2172340e6a31a17ea807488103a658347f7b456c2
SSDEEP 24576:+fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnLsRjhm0Ijr/eax8JXO02q3A:ma5POZ3+Jt2pasx2+mlEjhMjSax84
TLSH
T14265BF5EA3FC01D5E579D17CC583461AE5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4f024e54019798de043dd5011f09697a42129c183f3a171a08a31bfc75fc4a22
MD5 a520bb0ebc613405a12499a8ad9c0d76
SHA1 63571d45c97d32dcb2e662b789bceb1ea9a6db3a
SHA512 ba9f2de5d9f5caad565d089e452d9ea893047bb7749fbd19fde5be4d10cdb81e22dff12553fadf328ca5cafd5c1922a9a89a2a7fc48f58fb29453f8e6283cdad
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7Fk5sRjhm0Ijr/eax8JXO02q3A:sNc/zEOVHF2EjhMjSax84
TLSH
T145857B1623E901E4F5BBE1BE89679546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 768d94839e31eb9337bc3c3d9e073e5985e2b7405d433079fe54f0ba418f4d2e
MD5 47c9d8e283459ac0d7a65a1549e11497
SHA1 f5cb7b887a3d767a812018950543cd08cfb2ee6e
SHA512 9bcd552c18d519fec4538b0fd9abe5367df48b3aa320cae7955f937db474583b04e2d45ea04d61bc4a451c3ced61132357fb30887271166050fa40a0692d69cd
SSDEEP 24576:r8kNvNnaFeYhJNtmZBmfsRjhm0Ijr/eax8JXO02q3A:r8MwBtOmfEjhMjSax84
TLSH
T15055AF6EA6F846E4E1FAC6B4CD238512E6727861073253CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 4249a665f5a2aba4e9277f58fd85d50f59ec02803c1fe8743e709da01c58a2d5
MD5 f0ef1fa5103646fc3f20313238ec92d4
SHA1 b3ecd0dc00b192b769857e6964aec819d75882d7
SHA512 b274aac9503d38f40974684e7c635d570d76c977847116409f8839248185dc181cc5bdf63a6a5b88e6d2e41daaef169202af2b5a6e21a0d8939dd04f6dbc4c47
SSDEEP 12288:sHvUrBFrEjwaQIwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+:sPUr+NQdsRjhm0Ijr/eax8JXO02q3A
TLSH
T1D105F12F62EC18E5F676E17C8982460DF771B8620711A6DF02A0917E1E67DE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 fa52fa9bde2c94376466eb48d59633491631437021f1369ed16abdd5212d0023
MD5 289891f6abcd260d99165566a1c185b1
SHA1 e37160f1ec405f048347d73944fc0fd4d777ebea
SHA512 7c148fb0261d150009ef97ef71e2b6c47e2c0b88783d33a37af43d414429f395fea23a9f1dfe1d346a9040cd856e7bace7830054755ccc8c06fa578b7e035dd3
SSDEEP 24576:nD3FHshBIYQgAEsRjhm0Ijr/eax8JXO02q3A:nDVHeBIAAEEjhMjSax84
TLSH
T16E25E17DE79C04E4E57BC1BCCA634906E67178A9032169DB1290D1BA1F6BEE42D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-66-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/252-286-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/252-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/252-73-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/940-119-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/940-127-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/940-382-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1888-37-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1888-36-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1888-35-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1888-29-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1888-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2680-314-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2680-90-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2840-49-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2840-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2840-48-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2840-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2840-50-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3320-100-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3320-102-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3320-394-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3320-396-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3320-94-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3320-378-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3472-143-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/3472-56-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/3472-61-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/3472-62-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/3472-147-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3472-54-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3544-6-0x0000000002430000-0x0000000002497000-memory.dmp

Download

memory/3544-89-0x0000000000400000-0x00000000004F5000-memory.dmp

Download

memory/3544-328-0x0000000000400000-0x00000000004F5000-memory.dmp

Download

memory/3544-1-0x0000000002430000-0x0000000002497000-memory.dmp

Download

memory/3544-0-0x0000000000400000-0x00000000004F5000-memory.dmp

Download

memory/3544-7-0x0000000002430000-0x0000000002497000-memory.dmp

Download

memory/4432-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4432-383-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4432-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4432-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4732-145-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4732-133-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4732-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4732-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4732-139-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5448-381-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5448-379-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5448-113-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5448-107-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5448-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6052-85-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6052-79-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6052-77-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6052-294-0x0000000140000000-0x00000001400CB000-memory.dmp

Download