58ca496dcd409a866e9900d399f03249f3a2add2b66b880296dd2fb84af45401

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
Size 1.7MB
Sample260809-w938asbr5s
SHA256 58ca496dcd409a866e9900d399f03249f3a2add2b66b880296dd2fb84af45401
MD5 4709633389aad08bf9b7fb72c1ca4663
SHA1 40fe3499029305d5c9189be0b4e9a7ddc7588d4d
SHA512 b102e5491bb37c46b3cd96ee1883ce4d556fa0aa77ebc0c4381017c96cc48d1bf7caf5433f7e93c16375064cb0d2fc9cf3f18836fbabc9afab2545ecc8e2e60d
SSDEEP 12288:qcqLkOHUuF38ZWejkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:+PN8XEnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1EC85012176D5C877E65202B14CB1C3AA637ABD616F23838B77A17B8DEE30BD11E25341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
260	elevation_service.exe
4496	elevation_service.exe
5996	maintenanceservice.exe
4632	OSE.EXE
2656	PerceptionSimulationService.exe
2468	perfhost.exe
1452	ReFsDedupSvc.exe
3544	SensorDataService.exe
5204	ssh-agent.exe
2884	AgentService.exe
948	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2fda9f0db05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaw.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000625e0a4b2e28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d285554a2e28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000086fb228b2e28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000983bcd8a2e28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007012174c2e28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001264284a2e28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0a3078b2e28dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
260	elevation_service.exe
260	elevation_service.exe
260	elevation_service.exe
260	elevation_service.exe
260	elevation_service.exe
260	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
Token: SeBackupPrivilege	1452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1452	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1452	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1452	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1452	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1452	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2884	AgentService.exe
Token: 33	948	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	948	SearchIndexer.exe
Token: SeDebugPrivilege	4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
Token: SeDebugPrivilege	4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
Token: SeDebugPrivilege	4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
Token: SeDebugPrivilege	4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
Token: SeDebugPrivilege	260	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
4520	2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 5980	948	SearchIndexer.exe	100
PID 948 wrote to memory of 5220	948	SearchIndexer.exe	101
PID 948 wrote to memory of 4320	948	SearchIndexer.exe	102
PID 948 wrote to memory of 3052	948	SearchIndexer.exe	103
PID 948 wrote to memory of 4420	948	SearchIndexer.exe	105
PID 948 wrote to memory of 3808	948	SearchIndexer.exe	106
PID 948 wrote to memory of 4984	948	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_4709633389aad08bf9b7fb72c1ca4663_elex_emotet_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4520

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4496

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5996

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4632

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2656

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2468

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3544

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5204

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5980
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5220
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1776 1780 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1752 1756 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3052
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1752 1756 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1776 1780 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 317a737f2f98ebc072d2d07193aeb4d3f6aa1c4ba6b44d6ad7f94ea41924d450
MD5 1eac84721d0ab8806df90af75db34b07
SHA1 78ad21699d80f36fdfb5a0ee0dad88d7f09ce092
SHA512 05d719ba494f84c775385957597a171bab997b7a7c73c586bf498e0338672825ca592b952ddad8675f78bba96cf09a3c26b155b8cdceafda73af62a37cf54b78
SSDEEP 49152:Sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn5Q/lFTjN4:03q6HjBdLm
TLSH
T160D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 121c2f6dc24b9181deeb1211f97f65bf5bd7dd14cf8be9f08d035cf317335302
MD5 8f75e1349f51422f79776226275c07dd
SHA1 f13d5ebb04596c27346dd804fec9fc25ebd215aa
SHA512 f7ec65975320769d28f4e70ae5fc611199ad89b37dc64efb566863d95a38ef456ebf56249bb0774916ee16b53db8e58bc1a865f5d9b66ddca54811a0b832525d
SSDEEP 12288:+1XLsswWkxy2lRq2czA2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:MXYfDtczAWnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T18D65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 e9386daa15a54ae816c39eba00f8f439a07beb71d82f7980993e17184fa4c896
MD5 79b8c26ea3ea8b1d72d994c6e935aab8
SHA1 5f2911570eb74d6aa512c2acf624a9e486291418
SHA512 182d250f1f7c8081d8eb247a747718dc5e03a2d505c490bb06f9cbb274212d5e98994954a669cddcf68a3226778c828eec033be3eb9372166e9d3320e59b57b2
SSDEEP 24576:c0Le5ji0hmxLrMhnQ/tbw/2Mkjy6Fr7g0ol:cPji0AlgQ/lFTjN4
TLSH
T187859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1bc22c05ab22bd314bd0e3c64e7e17bd64358f32eb61f6f207894547faca571d
MD5 11e77d949adc015950f17ec157a7dca2
SHA1 13ca7fe7add8cafb5df3ad3b3afd0360573bbfa1
SHA512 e22955703303c82617982a2704c17265618317c723f9a02dceceb26b234a737c76bad4cd5c9ef11cab41898a58dca5cf2f36123ace1efe2b7f204ddc629bc512
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWE6q8wyuXnQ/tbw/2Mkjy6Fr7g0o8:g/ezSC6vUzPvxHjyUQ/lFTjN4
TLSH
T1E6755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ef90a9430316052e4e041a863e60b077865259160fb0983f6812d0a723e2fd68
MD5 3a77cb8233a60e203b8a54d7bdbb3859
SHA1 deccc45a645abd2a85e42a592763b208ce001d91
SHA512 6007a7410bc91a408652a155730708024e8ceaa5e589a4a6bdf820383375bdfc72e0c28e4982a22750817a246ebd7c7f67fff3e8c2c5e6b4c46c134551f44113
SSDEEP 24576:qVbqPb88hv/l+6CnQ/tbw/2Mkjy6Fr7g0o0:qVO88hXl+FQ/lFTjN4
TLSH
T1E4559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3ec6662b6edef07ed4504415c9b3d59fd04cb4f7aaa17d3a97dfb478ebd4d58e
MD5 ddec4b075d5e81d24db1a94cab490f6f
SHA1 654e8f96e642b5002bd829d686917323ff25088a
SHA512 1d1266cecedb66e407433bca892c4a7c260c46f7aa10b8212feb943664b0b965c4a177d8e0855a7895c421eea3bae51e6a0c6b3f3f2722343858a81eb3154b3e
SSDEEP 12288:6z9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:6zdnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1BB5523696A24F897FF2B06B15CD284826B7B0EC1BFD4E74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 d0a74e51ef7395cf88a15c3196cd66c9339ac0d70a395177d79df5401cb724c2
MD5 8cf5cac1901443fbc31fa0811f3b7054
SHA1 21a06d6d21c6b0aff4f8e4590ab3091c971bd01f
SHA512 44e6012ea719fb461fc3e9d0a42e1f49dc2f345f83360b7e9733c4ca5769e08eaec0c99349a7bdd7621e30c3c90b0bafd46c1ba96881599a49cb89efd7c77f7a
SSDEEP 12288:LeBNUbTVO86UqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:LJIUqnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1EF75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ac353614032ceb0d36c0d7b2cc0be3fe957aed0a618706ec3de159f078110630
MD5 d7f283ef5daf3cc59bc27c808dde4c1b
SHA1 98ffec8dd8558264990c6041249d5af83c7bd191
SHA512 b8e646e3caf81e41a66d780434eff4f205261678216770efbdd66e8e0fa1352a2cfe7136266a6bce080d470cf2624d547151faca23029ed79df1eede75961352
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THQ:wQvGAdlCEL8c/yRNw5CsLm
TLSH
T109267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 dce8bfb0b986ee7e54f91b9e01dc1d257d6f3a25cb751d166a9d45a8c7035aec
MD5 3f1db403c14c3a0a97743801cdea6dfd
SHA1 715b94637820fde4f81a1908f4109150b0646cdb
SHA512 70639058d865040fa0fdd5ead275e3b8176167fcbd28dd163170b51cf1483f10adef4c40f73236dac4146764409fc02ef876ea10ff77ac38526379a70f53a5fc
SSDEEP 12288:HAwSfxL/2Dc39DLLmt0LDQewsAjwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgG:gQewsAjQnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T17575E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 407b457773131cdb2a291bdc1adb815bd02a27e505a767886d38cf3544835b9e
MD5 6da3e25b893f83e480b6659051e4c28e
SHA1 e5df323f34593a78eb116844fe07e29b2715b4c4
SHA512 cda46d3a4046d24b03dd00f50888ca614bc2f55db790ee54fca584498f36230d0c23a37371a7fd4365d7d566ee906bf7432ac34fe46c63fd363c0ddb667c5a0d
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHLL:7UEtQevvqc2W1cpV2EI32
TLSH
T1EB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f9737ab87b8781388f663edf99be8250f723c73bb072e74ce78c670926c20d67
MD5 a7dac30ecee7a50e0a5abcdb65041126
SHA1 a5d18f5de58f11ef036eed713f4b2fe8ffcf94aa
SHA512 aac5c9af72066afb6ea7860ae3ab7f425e1cea06039159359eb4ae5bd42252c460e0b3b028a5b96adeda89213959fcf79c7ac268bd589ceabc8c169a32035ffa
SSDEEP 49152:TCbRquA/m2yL5zQfFiV+XenmE3/zwQ/lFTjN4:soqtVjnmALm
TLSH
T165D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 26fff287e92c6fd0b9c83b6867e14b60c924736f9f29e2d1b638db1163359909
MD5 240e19c224b2646848cdbb509ec3fd38
SHA1 712b81401e47e6e0121114c419a20ee5b86e3693
SHA512 0c182eaca9387f6df1173d54ff681c35a8bbc490d558b6bc20fe0e021ddf00f055cafa6ff25a4211275ed37d4b906298fd2fb325915a100199b10d0a01c6c24f
SSDEEP 24576:0AhGLJIFoiwtA5l7S53rnQ/tbw/2Mkjy6Fr7g0or:0AMyFoiq57Q/lFTjN4
TLSH
T10635AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 7302a58294e43712c388faede1a9c8aca83b8f60b781efed0b5a34ee97a24f12
MD5 b51a4772c02090d4579b65073ef115c0
SHA1 72291382aba8f7c0e00a3313ac1fcf67c9cfb21b
SHA512 2d24cf9ffc7bb1e7985af447ec916a24371199397f7bddc102e4ed04159a7f92349925c7d33444e7d2515a007bc9d8ada31d4bf04175ad41ab5d168da6701a04
SSDEEP 12288:+mw5HEjsChN2BFgl0WDm+CXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMZ:XwuHOW0nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T12B65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 307083a5fe2c9dbd57b45ded818460ab36c138e67240a047b0b6a0f245f81f20
MD5 72b29016bcda364cb39682b67edb12be
SHA1 8d364fcd331286c08bbc34bf5b7927a6ea32d64c
SHA512 e420c3f18c899b7f5492f07c93b514db310f8c147103bf6505594008c0bc22e27c368ccb66729e895c782d5e6e742b32ff29ccc1f1829ace2cd69457073f2734
SSDEEP 12288:bXZ1IygGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:TZupnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T11255126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9a20534e7550b00635d99837930107cd80bae6766d721649a179d11744918cef
MD5 36406f9b07b6f2e9143b3c4a9956e1c4
SHA1 a193f8b4ae596bf7032ffbdfb48cb9cee68adf39
SHA512 5ac86bc5f7b4d617f665a5631d29af87379947469504b5bd040752f3aee2a6d835945e9e177b27c65ff0ab046fdaec52961ce758330b6a1f1fb04f4a1df4a85f
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:bQRQyi36YOcPQLvw2gAf+PN3ZLm
TLSH
T1AC666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 24e2f01ef41c1a9abe6383d82dacfad1f51abdc9a1512e9648718ba6665a088b
MD5 90de51f5081411ec8fa74059ca5f7f1d
SHA1 3fbfb610edff78a61f8ab63c2077b280f8c31638
SHA512 59a939c9dd4cddaace084b776ed8d2b1e5da2c43660db3ae1a000bb4243fccd2553da92c0583e936ba046aa5888d39e27de0eb064090f9d84e001c41817543f1
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:NQRQyi36YOcPQLvw2gAf+PN3ZLm
TLSH
T1F8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d4cdbd00fb51c54710ddb62bda7970b299a08d1bb6620504440c42fcaf257a32
MD5 733f3221ecc48b26041755a97c3e2ddb
SHA1 2f7d0d88b397bbc46a8c794311a7e37dc5d13a92
SHA512 fbc17ebd99a8713f6829634709cef6994950886fae0f56b8d33b20fe7727dab3ba6d6e593af5ef82a576d53718a5a917b944bb942f7ffc7cf1f70c0c3a83c463
SSDEEP 24576:wwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL05nQ/tbw/2Mkjy6r:268Qg55nhheWu7PNU3/gQ/lFTjN4
TLSH
T1AAB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d711818c7f2d2703fbe6272c326be318ebcc43ed474007924fc12584ff5c5ad4
MD5 5bd9a4ea59bfd7b44cda7f3aa338a05e
SHA1 078b45f4cf1578b34a49cef650b83f2bf1f33130
SHA512 aef602ae273572c128bdcdb66d08bbeee9917752c801f15f2e6a597c095586311b81aad748844dda97a7b66e9a1de507d96834ef4a329cf1e6082c0299401b4b
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk992:ny5112gYy5azzVvL69nLKnhZSLm
TLSH
T146167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ebd9a85b4126f95742d9692b22d92174833caa234f5538d1b7c7ce98bf1b0065
MD5 1d7b63ac6351b4e721725ab9754ae19c
SHA1 f4ee5ae3232028803e947903d820f2aabfdf4c25
SHA512 c22efa49aca499f9bbd1bc55a4ea67f602d5f4c46bc669974bd0da6a585c2bf996be85adf8d090ff2b7d0d4f4e8e43d7e9d7732065d79d7b7c83caa6d8d48de5
SSDEEP 49152:iB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glmQ/lFTjN4:Qu6JmVxd2dxLm
TLSH
T13CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 18f26669c5026ac9dc42f4b8775007dcd4825ce4c682e33371258f80903add11
MD5 648a0d26e09bfce37033fafbbef43011
SHA1 6de0096ee11c9f26fa7eca193913ba24a1a24f0b
SHA512 785c49845dd43a8e1fded9d9a2c2904cc2f40162980a54eb0f792d8d0e6f6deab41ec1fd60ce38ed8acf14dbfb6e78f453982751181555888d865da919d1b28b
SSDEEP 49152:v1hpsNoJpF1A6UU44CwH7R4xKQ/lFTjN4:vmifPbRALm
TLSH
T1A6B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5ffa5b1d70359253593b9da294de91ab18484f2000af2b55aae236c61a7848e7
MD5 47d0db953e3e30510b92633e99856def
SHA1 028445f40dda17fb6a7056fcdc0544ea426bf46e
SHA512 0bc70bf1d6c7dc4966f1f522ed04635b0dfc107f2ddbbadbee1e376842c1c4c36ed2e9fe4ad36a85db581c4dae57a7c4cb96e1212793d785bd04f3af75148017
SSDEEP 49152:7SuZQIY0Be2KRRVtOnks6NMHqpQ/lFTjN4:p5dKTi61eLm
TLSH
T1F7C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d827f32843053e84780fbff61ff7ccddf23bab6bed48e9e8b20c3491ade97fff
MD5 3727dcc7c01c3825c5eace762cf8c863
SHA1 da9e67d532c99e3b6d9f7626638067a5a6248f08
SHA512 5805e63af9a6bee69be063efde824b23b63a6a6b2803d2c614ff0b9100af7d1697cfcc05fdd65a605314096f4538ab507b0734f403e41fc57717c9c602730b0f
SSDEEP 49152:DhtSn8EApI0figngiDn0AP5wWQ/lFTjN4:iX2iyph0Lm
TLSH
T17695BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9e64e9c51c7ef9f52ec0f7aaad3073aa12f690a433a84a8bc4717d10abb272cd
MD5 a0b543344408aa0d7625feaa0a5fbfff
SHA1 ec5dca65400b6b6e06d92ccba6ca344783d60fde
SHA512 980dd03d644161ce85399cfb53446c24614e4538c92ba8ac4da4dc6d7f5768fa43295ffd5d9e6b50f126813181712cef47ef4dc290180cddc4138abf532b8607
SSDEEP 12288:7lGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:7FnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1905523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0b1109520dec650483c3d89bf040f592be7b807490bbb879f75375233285c312
MD5 50480dd8828f018bf767fc5a1c710c9b
SHA1 97b286c616bece79afb19a8dbebf78b2b93e4448
SHA512 8fbb0985f27d91f68559d43c9c979c2b0127d06578501ec09706f2c299a299a827edf24b8a349fa0d566edf43196c24d5ed883baf9ef0b31a834d8981cdd92fe
SSDEEP 12288:MMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:MMnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1E15523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 36ed06dcef50e2b2a89fa827eba3ace9e9ee9aecf73d648130bc453f63e37a0e
MD5 3afc67789db8c9c90be692ff7e148121
SHA1 d8d6282479709b2695843a5cd017cf29c3b85bf3
SHA512 ba8ddb8222bf17ba9ea574928da2fce115ae282b597d81e4224e2c1d8f4d499d8b4c7777660c69bce1ac64f39a180edb95929ef2eeb76049627383b2a5af5a88
SSDEEP 12288:lSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:lSnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1A95523697965F98BFA1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d2bdcf6f6516a6ea6916ac0c553ab2d7e311f5391b93f34f602a98b6ca047e0b
MD5 b437d6e0ee6fefbec80117b111508a69
SHA1 a89c50cadc9da5330aa3b9cbeb1622eb63982ea6
SHA512 fd359dd4477da812606e0fb640102284d6f5886eec69256c30a2a7d81c93102de101ff18b56ad741ac8c01562aa630fc581dbea3dd4b424e0d71ed2ee464766d
SSDEEP 12288:kVbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:OnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1945523693A69F4C7FD2742B4CC938142E77B3DC6BBA1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0a31fe30320d2e11f4b6e5fa056d43fe7164d7d06eee43f5810168f5b0bc0b33
MD5 de84e4b7fd43fb1c5a75b095c123285e
SHA1 c659935aa9654c5613bdedc1fa029e4f55cb475f
SHA512 a5f0b90d07c5c3627b9aa15507de999f36dd55477f11dcdc2f638dc4d84470ccb04a5628b6a35f1df81679d3aef97ed1c94ca46bb81c31f440dae1a2eb684baa
SSDEEP 12288:+zGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:+jnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1825523697965F98BFA1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 13e3fbf11f226a6b7e9a55bc064f76d817d3f43cc88d82a7cc68616bc3d56876
MD5 a755f2fc3e2555c6df8112b14351361b
SHA1 bc6cef031cf36d07797be767c3d39dfed9500bc5
SHA512 296b9aed1ad79e9ebf165e988e4886fb01e41460ea823639eb7505a855ab452148d695fbe7bb0b6b21355e7bc80553de2a431370fdd414da798d0bfa2cdd4e29
SSDEEP 12288:iYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:iYnQ/tbw/2Mkjy6Fr7g0og
TLSH
T15A5523697965F98BFB2706F14C828182973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 029aa921ec1b7382f282d3e720c1d0f50142888d57b3db8aaa3be2c55932616d
MD5 0167f6015164df2ccfa56a3e1250da9d
SHA1 2873dad47fe614a662557bad1d788d1d136a6ece
SHA512 221823ed584b565271d32b785dab5b823d3468b4173a573bf7f0d40df40e300e8297db57151d5c16e9d44a87176b34bd02dadf3408cce2836d58d67be73853ab
SSDEEP 12288:ZkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:ZEnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1825523697965F98BFB2706F14C8281829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b5eb60c7476bffec03bbedb0b4111108416773160d244708ad8ac64015325153
MD5 9e553ef5290487c479c13a6814fd9c54
SHA1 a6969ef0c75652803bb53c34d4813245185a24f4
SHA512 907b9659c989d81d49f21a6b474ba7f1bce9a227d2e9664980f381842fdaed95b748853687c87556014e74167646a61c76d9e6f0768b9060e508d94b9305f884
SSDEEP 12288:SiZwbDzzFEoS2cPvysGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:1ZM3zFVSOsnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1037501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f8618c89d8ec0b3801feb0c14143931f813774cd09aaa85acdcf3442e9368f1d
MD5 e0629371c9d8153112cb00b4dcabd660
SHA1 3cc045d041452d0b15a11e07c4ae80c9788c4b8d
SHA512 56960e8088b041307f451b6ebd565ef1dd545297f9a2787f300c2374f0ec7b2319c0517dfff4896c885cd462f05192bb13aa29d81ef6ae1d4b3eeb589f47ae3d
SSDEEP 12288:oJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:oZnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1825523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c777d945f25bf0a25395d2f25e930ccaf8b7cf496a83a9b834e27fc7ed89bffc
MD5 e084681d47fc6d653ef01f0e55c4d6f9
SHA1 2e16e562c476ff3f91ff80a0e5b5888261514113
SHA512 b0d08b4c646bd1809f4b438be31fcc4d7634db525a8dc7c594fe4d211ffb74f8602b58c5351ff9dc17d5eaecf3977f44174f0a359d3815c70ef6972533655869
SSDEEP 12288:CtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:CNnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1C45523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 2bb66cfd6ca52625670fc1104cd06a13bec3c94c4fcf8043b6790e025eec50ad
MD5 159e453e5a802d5c7cbe70aa64fdfe0f
SHA1 bfa2387532115653684ea368210a975b9a90e3ef
SHA512 b25ea52396afe9ba2ba231db29c51930713adcfebc2c30b8ec399b409567f01c5cc55f10c6bc301aed3d35b13140e5c85e8a7f28ca64b7a7cd0a8a4546679be2
SSDEEP 12288:5yPz5L8gGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:4zyAnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1CD65021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 97e9dca6ada716f6c5b4748bc285163709164c4b43c4952ff4607209bffac12c
MD5 90f8a6c62390311f4eec004f4c987aea
SHA1 9b4101508aae625e20dc11a937d7031859f6b025
SHA512 70d9ea93d69055260fa20188b3ca7ee59388165b092afee776679941d89def5e337516dc260c9d99f7162c1e34a5b57074763dc745d569d5df1404947f79d98c
SSDEEP 12288:TJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:TZnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1A55523697965F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 dbfa65c6b95b3922f35afa122210ab6fded1fad147def95950390ea8fc73eeef
MD5 1f83a4688c413374910d214713bc314c
SHA1 e81fd5092ceb0cb7a077509f3fb788ec60605f47
SHA512 2c6135cfe05d0f91fb2277d596f92c3ebf9ada890332eeef47db8c3180d1ac527ce3f5f6c41ec40da2acc8b316a4a00591be0cca97cf920d55b2de8a04920fd1
SSDEEP 12288:RJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:RZnQ/tbw/2Mkjy6Fr7g0of
TLSH
T11F5523697925F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 07361bc3bb3c412197277a29b0db807eda3bbb63d940117d70f3f565122d9ded
MD5 4e95f4b6dbac739739c7bc4930ba0dcd
SHA1 9c6b5970bb3e2d6da313394540ac97cec800667c
SHA512 7586c8a65537a6804c254713087628f475974dfe1de6c5fb28993f8edfade7a9edb7d3c5fc47b63f495391b21df55ea449b771b7ae12dbfb8b512c94884f0ad8
SSDEEP 12288:uyPz5L8gGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:zzyAnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T11465021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 9a394c42c5d6363b75671836f0d8c7d4622606ac19b92438115ac8eb49677718
MD5 17576d3323608bd49bc612026f880462
SHA1 8757a560c86f28a25b8577b7fa95afd9460cc051
SHA512 9064cceb9bc9826a5cb9ad64084fcb33e8a11b83f7fe2ada34725756a0f118adae14defc4e93bc3c8fe157350de7467b84e0d2eb23ff831eb450b155251a65b1
SSDEEP 24576:NT0aLl3z0zDinQ/tbw/2Mkjy6Fr7g0od:NTDLljXQ/lFTjN4
TLSH
T1D27501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 30c1d006f81332f1deab12636975c2d24dc7fe3a96cdd0a6f70962795764c143
MD5 3447426ddb3bf36088f35718e31d9c86
SHA1 c5b4b595f96bcb8c1fbb8e64b2b9413e7de9e417
SHA512 c19eed6f925d44d96a6402b245d18d2795aad03cfec39156052e31d2f0b7138d1c82c853a2a6db445326680d2cad40dd1dcc5a803888a9c00dca796cc3bd1227
SSDEEP 24576:Q31d9CHKy7GZenQ/tbw/2Mkjy6Fr7g0oV:a1d9CHKyaIQ/lFTjN4
TLSH
T17285CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3401ec0d76a1e5eac391f542a55bc0767f397c885e881c3d823f7e04c4de8dbc
MD5 0b2ee0c96f3fa287403a451f573d9725
SHA1 b1b270be5a7916a95f0101b16b53c33b8d7c5981
SHA512 009e7bce9c07c2b39b1059efa027e384915da53852d1e51427e8ca4ee4889fec53b342070eba80baeb9d94853e67e97ee9def716265c323c7f205962aa6e9271
SSDEEP 12288:ByGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:BynQ/tbw/2Mkjy6Fr7g0o8
TLSH
T12C5523697969F98BFA1706F14C8381829B3B0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d1e2230f2059123ed3c3caf9725c293d28399ea3b13fa3b0bcfb4a59783fc28d
MD5 5988af39af3046374fcb80e3e7379c65
SHA1 391951b546b5ef5c9db23d1ca9f2e105eb4382bc
SHA512 c8697bdfdc6df3dbf9df6a51554db7295452daedf75cd44891df2ee94f929adc53c375e1cf14f90bfae103c9ccd421f2e3b9e7367a1e1c16a0b0d805e2607148
SSDEEP 12288:pAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:pgnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1A65523787964F99BFA2B06F14C838182973B0EC6BFD1938F7B481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0c36958cdefbd7ddaf577eb4004ae07d1ef2f136be24d5e596d389c7a0285387
MD5 b66f9c5d440241ee80efc9b9c16c6902
SHA1 7044f3605e85906364ae58ce08163b5de9fb9c68
SHA512 71f8ea905108452ca3327ca4fc6b338cd5c3601b7b15f9e03bc8239f14960749e55a39142afe657323ac4c6b8135c989c0ac7d711f4b62b6c1127c4a719970df
SSDEEP 12288:9PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:9vnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T11B5523697929F98BFA1706F54C8281829B3F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 14715499c25e4f99e050cf782f21ecd615c98f74e5b1e5c879c2357977f9df85
MD5 269e626529d160c93f5ba46af87796f6
SHA1 477a9c0eb3e2160fc1923c2b83443636972acd92
SHA512 d98ef01bf3a057cf4c31ba9d6633298196b2e0f7df8684b9a2f52262bd56093c230905d74a5b159b450c3b457b8e333a1fe439729c640583708a877b4c11b880
SSDEEP 12288:EJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:EZnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T11F5523697925F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 26d1a4696f7668f21ccef445784e801d3620a1c8fa74bbe148f5043339b8511c
MD5 95bf73c9c795d859b90dd97fd821ab65
SHA1 5ba4903d1fa8ed54d4626603de3f6147ac10e987
SHA512 bead2184b383ca3876a103d106e81cc777d0e776dddcd121497ec500071d6b04d9261c50b1d390f5049e648ae8e5fa648c0603bf32de464038f22290e6a5a3df
SSDEEP 12288:oyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:oynQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1A55523697925F98BFA1706F14C8381829B7B0EC7BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 e320278f861d5af17f312cca48e4ba992a87796001f66f75ce9c56dbba699e35
MD5 803134d56ef971fb09e97ff603a2f855
SHA1 1f80b5658fa8cea67ed2e4c0c7645ea16b8b8417
SHA512 9688ebcd6bcd08f354700a7ae8b351efe104bec27fb81fb7e223ee5d8f74fa1c939a7c2f576d40e84476b4a746cac2476d188dbbb1f3cb4c49688f8a60d82cd3
SSDEEP 12288:ohGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:oxnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1D35523687965F98BFB1706F14C8381829B7F0EC6BFD1938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 df0fa7c4a7d725354dc43996df36f909d14e8e43e0fbaf90d350db876e5850d2
MD5 6fd613c3a34b0260f7fdb4820dfd3ee0
SHA1 6b7eb1f26bb2856f5270b4097f7875f55df01866
SHA512 7f82ba32c83d8da48c3a5adf6e5bbfd31cd7064cec0d6a9def0c5f9d6c2f12005b810a7fad38ecff6f480738fa7b3fef34b4a401e48f31ddf6d77f0a0f527ab1
SSDEEP 12288:KzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:KjnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1095523697925F98BFA1706F14C838182AB3B0DC7BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 1f17faba9806dcec2592c2c60b1e640b753c60ded96b40c040227a5c347b0642
MD5 265b3cfd3cff60d4301eccd3ca3beffd
SHA1 2b7078ecf919f00b5292c294d0e1f0275d8e66ff
SHA512 e11d3c97e7d0f3de8b1432eebcf61469cbd95798b19005232d70e8a92bf7b91c42a687db16d0a0ad21afdaeba8e58dbfb95915ba32b09b97a2e8aec70d37a090
SSDEEP 24576:Tfwv/k9RX6wkyAI9nQ/tbw/2Mkjy6Fr7g0oD:CMnYI9Q/lFTjN4
TLSH
T13B85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d070deffb8e4ac1e3c9ace9531047b90185f9a9ce5e29b082f17dec4748d086e
MD5 fbc349b46b178d1c619143266e868f6f
SHA1 82b98e43b44cdaf0244ba4d474da53ad39cfc747
SHA512 bf2077ea1bae91a959c8b95448829e2bc525ccc3ca4d3fa717060c3f6f91e9a57fe337cde68c002283eb68b7f757589a8a49a2e18fbc643074f9763612cc072d
SSDEEP 49152:zYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02Q/lFTjN4:3ySzP5Lm
TLSH
T185066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5e68b11f36917bae2e40da538be24c7614acf5985e7256174e4e41fadf557741
MD5 a5a66b2a76c269be9bf84b494006c42b
SHA1 515aae708401d553663429dc5bf813fec891057c
SHA512 4399c1b151d3ce77b8573910af5157862a8d2f7995bcb76eff94df84a7ff3ed45b1d08d76881095c63ddc10ef65b8a5fffe3c324ed7a1c5d8de0840d68a6adcc
SSDEEP 24576:Z47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYcnQ/tbw/2Mkjy6Fr7g0o+:Z47JUQj1irIhCnDHUPfF/mQ/lFTjN4
TLSH
T12D65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 ab43c898b8549c919a397d295cd440eefdd584c7e716feefa78c7d79456d4e85
MD5 da47fa03eb530cb4a88295ecff3759ce
SHA1 1e67a48c31c43d6e11324ccdac18938ef74048c2
SHA512 fcafe19947d63fb380f25545e3639c5171697a1f1b66226fe0a11277ac31a3011a0fad2e657bb2352c84a5424ca771bad91d8e8323db9d780481b7e5d481d067
SSDEEP 12288:5ssfZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:RpnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1FF65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 f0979439a4c95a55774d324663756e2b740c9ae7b00904d369f923ebf21ccbe4
MD5 00067ec232660471a82bb4a097e5455e
SHA1 349f24bb8439f5792c61951dc0d4996db721b563
SHA512 f01394a1f25c6a9d219a4bdbde64dd6bcea5c1242eafbb66d64b0735538fb86aa3ad217dcb2ad594ef93ec8999a02ca29c911439c3281f8ab4e2a542c38af8fa
SSDEEP 12288:5dciBKcU3fviAMFZZwOrkEfEXcmBWTRivB9Y/AAcocBKhlbzP:5dnBfUPvi5ZBHR4YzcXBKnbb
TLSH
T1EF351911762AD75FC6A940321E32D1CCAB707D41EE05AB0773C98B3FD576668BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 f182548d82c481a9161d3ed9376b2778000b83b94511b48dbe9f24a264d2e574
MD5 98d2f82bbfb3785fc04510007a702c12
SHA1 fc665a61a7728102155842456a13f17d11282120
SHA512 7b062cf4618cc3eb46e797528b92fbe8fb5c344f872a9ee9bbb461712c21bd9adeb321fa2ae1580357a699a65ff875b46a3139d4d19c6e538ca157ca12e3444d
SSDEEP 12288:NI3UKocSShMkUR+dOEXcmBWY3gu9i3l8h0:NI3UihjUR+9a8h0
TLSH
T15E65D9819437A3CFD0F66032072A5B4CA7A4EC17B7496F1673C8453AD82A766A4F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 56a77c7ed91166ecc9edc1eb5946e82f66d5b4f8cc6fc6fd8a246e577cc33c95
MD5 357cef7a25f214e67b69806b5ce43b29
SHA1 9e20144d35296962cd0dc9969a2c95a278251804
SHA512 e870f5097d25bf73c53c56a69727bc5264d22dfc21f64241f1613ec52e7403f2bacad8987da78d1ff801107fbb857c2fb0be444f821ea119d3983b1ef62f4567
SSDEEP 12288:f67xGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:2BnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1225523656668F94BFA3B06F048928111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0084979df0027f68a0818b448e501c07abc43f6351091a3ddeca1f5e8b34079e
MD5 53fb2165bfd6212a9f15414804f547d4
SHA1 3b80c4e48ae87763dce7bc1f97feccbb54251394
SHA512 1ed78f5c6793ec0d6d4b234a23b278aa59147dcccbcd5c5e9d96cf2ed8d36fc3816ae511fefc945fd69914dfaea8879c25acf8ff1a7eaa68f39fc9940a6a86d0
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYXnQ/tbw/2Mkjy6Fr7g0oy:Zgb4mBIBhGFcQ/lFTjN4
TLSH
T16865AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 8eacc1b47237ac712149ed925e8349c4ca583204ff711e49e142413510b5bae9
MD5 10caa757a2ca91a98359d266f2451969
SHA1 b4af8d98aeb6143a11e7f81ea15a1f11b3344348
SHA512 21706188c10b1498783de27fd2a5949c75af12ed88541516bc0974e546d1616332c1406a3fc7d2aa8273ec7904b616d1ac7823e75211ad3c26f2aab769c4f095
SSDEEP 24576:/G88u8FpJqH1Qzria7/msnQ/tbw/2Mkjy6Fr7g0oa:O7ZFPqVva7/PQ/lFTjN4
TLSH
T1EA85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7b08173353006dc65a8c56a9a4285ca810073e6cbfb505d08973afea0cec28e0
MD5 388629d614f1acec49a380af835879a1
SHA1 500d66a928cfe1f41e41def2783dbe32e47cec09
SHA512 5e78a358e8c3959ab434b211e6e77123bb441642c5a5caa20c634bfa3babdc0cc7b063fe45966f6b10e8d4acaba828fd11cda58e27f5ef13014eb6e151e0212f
SSDEEP 12288:6HvUrBFrEjwaQIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:6PUr+NQInQ/tbw/2Mkjy6Fr7g0oh
TLSH
T14A65E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 98ebb1d809eacfbbdd470022cf6c4ddd9686636ed25d70c8724284b5e7c91654
MD5 2300c3d0c76b59f10707f2bb1a3a1421
SHA1 1ee549dd6921dedc66b9c62e4b927b64fd2091b9
SHA512 7e7acd3e775ba306dcc6bc1d476a2aebeb85e00da6272aef218b474cbc6cd0d583caa4e055527342a3caa0f136f6030a35548fa094258ec3b0995ed121d3bfd6
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYQ/lFTjN4:ZG05lO43baLm
TLSH
T16DD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 582d9e6439a97a42c0b9cfa1cdabf5659949eb3df85c363ac2bdbaee523f705d
MD5 e764249d971597e887a0a351b06fb965
SHA1 4b9c6556e31d81bb612bb408417e181348e3f6df
SHA512 8a1534ce70af732b065ff702cfc917678a00aae1fd0b7821de68386535d8e9f304d2cdb777f0a636cd69bb7d05326118d51f4ce296fa0fd2fd0e42c9c1dfeaa8
SSDEEP 24576:Efa5POZ3dpFWVM50JicR2hG0lasx2+47eidn2nQ/tbw/2Mkjy6Fr7g0on:ca5POZ3+Jt2pasx2+mgQ/lFTjN4
TLSH
T10165AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 44f3dc0a465b7f5e13510582862602d3be9ca93c4fdb60061bb7561d436bbeda
MD5 b191a01e2ca40ea5275bb2fce7fa8135
SHA1 220f4b66f3f640ebcd177c1c843fb09ef627f59e
SHA512 1cf7d57a30b2e7d881491e8cd8da8c609fba69985819559eb6b1807f0dce5dff59596a2817ec9b38376acf3ca6f37025746da553848f3bf75a9310d7fbc0be61
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkUnQ/tbw/2Mkjy6Fr7g0oh:NNc/zEOVHFvQ/lFTjN4
TLSH
T154858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3e3d2b79aec3cfdf9a404a6d3c00b9e1405d32623e54a1fa58a01d6141a5c4f8
MD5 95890bd2ff7540a4db11d4d5ac6f1a97
SHA1 c600f96e9bd381774416f2de488db75e9aa71a97
SHA512 30a5ee85164e7bf49dcfb93f54f0bc11cc46bdb7523b12def489f6ae43bf5d9623e37fb63ebca456ac2d6d308edf5ff492574c1a545c3336d618a62dd71db11f
SSDEEP 24576:j8kNvNnaFeYhJNtmZBmanQ/tbw/2Mkjy6Fr7g0og:j8MwBtOmaQ/lFTjN4
TLSH
T14955AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9ab3ab7ea582d53c9a80eedc8e44223b1fdaf2cb47136acd9978906579157c54
MD5 b60ddc7230f9170a8e7583759e9b13af
SHA1 c67d46007d530b6fb7dcc726628394005a19643c
SHA512 e0167da3695bdbbbca5cb2a186a4b65a24beb5da857327c5f3ff41f2ce8d199eda33ea07cf01131e631d24f1daac2423b6ff54294635778282246eec43a6fce7
SSDEEP 24576:FD3FHshBIYQgAlnQ/tbw/2Mkjy6Fr7g0oe:FDVHeBIAAlQ/lFTjN4
TLSH
T10175E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-87-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/260-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/260-13-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/260-22-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/260-20-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/948-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/948-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/948-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/948-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1452-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1452-88-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1452-95-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1452-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1452-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1452-327-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2468-78-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/2468-83-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/2468-77-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2468-308-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2656-66-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2656-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2656-72-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2656-307-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2884-127-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2884-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2884-133-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2884-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2884-136-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3052-326-0x000001E508280000-0x000001E50844A000-memory.dmp

Download

memory/3544-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3544-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3544-312-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3544-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3544-101-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3544-107-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4496-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4496-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4496-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4496-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4496-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4520-8-0x0000000002490000-0x00000000024F6000-memory.dmp

Download

memory/4520-76-0x0000000000400000-0x00000000005BD000-memory.dmp

Download

memory/4520-0-0x0000000000400000-0x00000000005BD000-memory.dmp

Download

memory/4520-1-0x0000000002490000-0x00000000024F6000-memory.dmp

Download

memory/4632-54-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4632-60-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4632-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4632-292-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5204-311-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5204-115-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5204-121-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5204-114-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5996-45-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5996-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5996-39-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5996-49-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5996-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download