6dc08c63dd583eb3990e9d394b8239f7c04fcb1a288c0a1918800f9f4523eced

Analysis

max time kernel
149s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
Size 708KB
Sample260820-reyxwaycpe
SHA256 6dc08c63dd583eb3990e9d394b8239f7c04fcb1a288c0a1918800f9f4523eced
MD5 f62c5ff91937fa0f1323a9b8d7fcde07
SHA1 9e44cb53fcbca08fae400336ce1802fb0244677f
SHA512 4dfb76556ea187330e45c56fcf56450d02e824f789244674881e365d7029af0e7aa3c5678431caf9200499c663f850fb638e79378037616797ef1df94832f457
SSDEEP 12288:1zYunorg2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:5Kg2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T141F4121735C2C5F2D2A211B04D409B99F7B9ED309B348B93B3685B4EAF7C9C50E3568A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5248	elevation_service.exe
1148	elevation_service.exe
6104	maintenanceservice.exe
472	OSE.EXE
6088	PerceptionSimulationService.exe
4660	perfhost.exe
3356	ReFsDedupSvc.exe
5400	SensorDataService.exe
3600	ssh-agent.exe
460	AgentService.exe
1652	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a6ce44d1238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003203837ad30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8495935ad30dd01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e838379ad30dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dfa4b437ad30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdefac79ad30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084c50f37ad30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5248	elevation_service.exe
5248	elevation_service.exe
5248	elevation_service.exe
5248	elevation_service.exe
5248	elevation_service.exe
5248	elevation_service.exe
5248	elevation_service.exe
1148	elevation_service.exe
1148	elevation_service.exe
1148	elevation_service.exe
1148	elevation_service.exe
1148	elevation_service.exe
1148	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4644	2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
Token: SeBackupPrivilege	3356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3356	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	460	AgentService.exe
Token: 33	1652	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1652	SearchIndexer.exe
Token: SeDebugPrivilege	5248	elevation_service.exe
Token: SeDebugPrivilege	1148	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1368	1652	SearchIndexer.exe	99
PID 1652 wrote to memory of 1760	1652	SearchIndexer.exe	100
PID 1652 wrote to memory of 2812	1652	SearchIndexer.exe	101
PID 1652 wrote to memory of 5972	1652	SearchIndexer.exe	102
PID 1652 wrote to memory of 5816	1652	SearchIndexer.exe	104
PID 1652 wrote to memory of 5460	1652	SearchIndexer.exe	105
PID 1652 wrote to memory of 4436	1652	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_f62c5ff91937fa0f1323a9b8d7fcde07_elex_emotet_icedid_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1148

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6104

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:472

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6088

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4660

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3356

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5400

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3600

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:460

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1368
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2940 2936 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2972 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5972
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2972 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5460
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2940 2936 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fe0e0f31d4d1c08624b75555e756ca82f39f8ad0355fab17f309bbb782ce3b87
MD5 321d3655172b5635a113494a410b2074
SHA1 cfe967154e9b173675e4698fea265638d581dbb6
SHA512 4f9f10d8b223818b9f31be2fb5efeda11b09a5c7850202d5285991838a98b17c85211f3fdf4aba88341338721e022e016a09a9d8369286dec521923943b61c63
SSDEEP 49152:qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnK2QCSnzFiKBd4JP40xY:c3q6HjBMQnJByxY
TLSH
T1E4D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 d2b053e9b4c607fbf2e8c9ceca079ccf654f198892321e4856bfe8339f80f457
MD5 820bc653c8d59d9f0b93347b0a47d1b8
SHA1 9fd6b1afaeba0ee9a5fb1a2a24035a287aca07f0
SHA512 aebe9bb0606533d5339ca7d36f056882545a654312aa60ad039f8e9023b779da2a05bd98e3564aa9308089eb5992935073ad5d6e83e7eafbb266dd9a9479dacd
SSDEEP 24576:nXYfDtczAB2Q0JqSonzFiKBdzQVJ526LU0xY:ytcE2QCSnzFiKBd4JP40xY
TLSH
T17505F12867D509F9ED678278C8A18501EB33BC458364EBDB03B496265F333D85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6f96c29857bd733fb11957493604821b50c041e32d7141c3e1cb64d45e2f4681
MD5 ce5d7c06f3b55e51c13ae478dfffa1a0
SHA1 d172b2fb249791499a8487f109c4a9fe401f75e5
SHA512 29c753f324786317a30737916579f371c6fd0fb6942c5160cbc1b5e2861f753ea1bb7f3f017dc0370cdbe2b9432a32833b9abaed85d8ca93b1aa3e4a9b1f3171
SSDEEP 24576:n0Le5ji0hmxirMC2Q0JqSonzFiKBdzQVJ526LU0xY:nPji0AcX2QCSnzFiKBd4JP40xY
TLSH
T1B7359E16F6748331D073C0B9C5D2A68AEE71308657308ACB4296D77C7F67AE68A36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bcf4458d7d90871aff4f6acd64c9ea239e51e6f7896823706f867be008e0bf7b
MD5 0311984bd3cdb4a626f56a8a2f50e16c
SHA1 6e3af089ef0b9688478f1729e450a6cf4b8a2a09
SHA512 4d613d696ed8f05b756c2041d8ffa1ed0d5ddc09aea8501b7dcc38202d7f02688f4567f4e9201ec39aa8436b004b0d02ce1c5b5d12838a3856b91a2e4189b4e4
SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWE6q8wyuU2Q0JqSonzFiKBdzQVJ526LU0xY:y/ezSC6vUzPvxHjyT2QCSnzFiKBd4JPW
TLSH
T1AC756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 eebaf6805ace4fcf1fc6493d3a3e2c04fb61795ded84b9151600aeef5c17d7fa
MD5 feb433068f7a71f4f0d60065b3747492
SHA1 62b4a5928d85a7c8b281165d98845453cbe529dc
SHA512 84d3e1d02430208a4d39a35e8ffac92ffed63ff623b6599e40b8ce07999fc41274cc847b67af73cedaa37cbced3520421f0fa123187c4ab0d8cfff97e9fae6c6
SSDEEP 24576:8VbqPb88hv/l+6l2Q0JqSonzFiKBdzQVJ526LU0xY:8VO88hXl+O2QCSnzFiKBd4JP40xY
TLSH
T174559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8519d128115c78a8b2a64cf8baf32b986fe2fe035d03283192b4a5d866ce2223
MD5 916716a341741a845725f51f51811d27
SHA1 bae778af2da144211cace8dee12ff8df066482d6
SHA512 a739cf077bb7a5a1feb77bcf6501bbc9413ca9ea3b82472842f81a8565208299de8c50b71f8f304a6936af15434d44a7d26975bc1c94b2646dde01ed96ace297
SSDEEP 12288:NRW2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:NRW2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T1FBC42388064A17A2F37742B0E8A06585FF35DF01F228DE9B5236F35AFE785158E6184F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 3af017b0a9e3010e7ea94bfa5d745ada178fd48a544e36b75a69a8f231f4212b
MD5 01ab5ce3fa7930552cc103e865d30c54
SHA1 0c0d587e322afe40ade35ef7a29057b110c3137c
SHA512 b512586bed64113105b89c97e50f441f9d2a4fd7f494bc57e43027405170c3b2fa7c0f4a203eba097e0a3e1194fa09b6685cc80b33ae04c2ced4acbaa54aa6aa
SSDEEP 12288:feBNUbTVO86U92iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0ny:fJIU92Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T11E05CF7BAE28FCD2C27A8DB85A918640E772B8304B61A7CBD175C30EDE235E14E75C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a0978f4163c022ada83648a99d00463c599ee77dabc9215a537b9d9fd2174f5a
MD5 95d4fa7611588de54cf7eae0754f2125
SHA1 fd3bef484ba56e8e2355e4fecf4f93ae6db39846
SHA512 b6606c73af0628aab58294c0d1de1a71a440dd02d3623f90f9851b5230902a9449450dba4f27cb0d19075ee6b24c315bacd62ea1e5c986a7732f33712b07a19f
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THH:EQvGAdlCEL8c/yRNw5CTQnJByxY
TLSH
T123267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 94d50b94fa82d127c908ba642f6d7d3c4dcaa3a5b6d8c1a828095e9feaba2d62
MD5 f53ebaad928d6096740975a1725f421b
SHA1 bccf09864f5018c8cb888fb2348fcc430df043c1
SHA512 3eed0b5b0c77c2b2b8a0c1d05713d8a1d579fd992966aa7b8f9ba99236e234ec25d9817e1851a18f97580214a7a48152092ff95a2766f3d510e480477d0a0451
SSDEEP 24576:2dewsAjn2Q0JqSonzFiKBdzQVJ526LU0xY:+ljn2QCSnzFiKBd4JP40xY
TLSH
T14E15E031FE75E036C37B0DB11B35D716683DBA204B611AC3E3A88A9D59342D22776E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6fb6ac6b89b21e7dea7e7c78c44cd8e33efb1ec533f48f8e695796bcbcd838d5
MD5 4f3fbd0078a3faf5103abc32fedd9d5c
SHA1 f4c57aa88ce1ae2848bc17ee52651c52b3632ee1
SHA512 8a8a0501867c6a7d306b004559cc5f82a685ec39eaf74e629ab550098d9ad89fe4ef360a629e8e7f01337077a012c824560b84b0aa13cf07340147913784b1c7
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHe2Byx:RUEtQevvqc2W1cpV2EI32xB
TLSH
T129474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1f7dd5c0f8dc48d68eca6b375b95913d465f49d82690b1eb41ffa3b312963445
MD5 db43dca92218fdfba3811075bd9ac985
SHA1 00eaae375b1cc090e318145a639f830fe98b05b2
SHA512 9a5b2f5de1782af170e9694d9e444544eb353c4dc9e53b28870217ce54cf8e96509da1518a2134e3ab6253568133587027ab19b77afc8bbc374f9f9eb338b275
SSDEEP 49152:0CbRquA/m2yL5zQfFiV+XenmE3/zH2QCSnzFiKBd4JP40xY:doqtVjnmXQnJByxY
TLSH
T10BD58D0976B8C2E4D1F6C77886A2C647F37178154B349BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 260242fbffeb4923eacd58e3b1a67b8a98f7b9885ad7bb9c3f6be65900f99669
MD5 a0bc1a587c0a19a21e77abe6badaa4e9
SHA1 fa1f8e399a52d1437316970123d51eb46d2a7e63
SHA512 1f162dda13533d62616f8c9bb7f6792d9a9888c16c7a77871f414b20a501758e3ff37470ddb6dd3590627b3f6625b6109a12da4397356cbac043ce9579ed1dc7
SSDEEP 24576:OAhGLJIFoiwtA5l7S53w2Q0JqSonzFiKBdzQVJ526LU0xY:OAMyFoiq5g2QCSnzFiKBd4JP40xY
TLSH
T11735AE80E7F955D4F5B3AAB899B59171EA76BCA65E30C20F2160D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 196eecda55a64012505e309ff44b6947908fffcb63f1d0b5a1e1c76ab97736cf
MD5 9f5b55f1e6b4ad2df919bf1aadb6d807
SHA1 3fd2a8597ddd4331a7452b488d71608154135d53
SHA512 6e2ed62026191109aa491dd6e218182cec8e515bdf303d36818f683b67eb00f38b265584b8b8f77144b27bc851582eb540bd3131879a0190ab210ee81e5f67c3
SSDEEP 24576:HwuoOWz2Q0JqSonzFiKBdzQVJ526LU0xY:HwDOM2QCSnzFiKBd4JP40xY
TLSH
T1BD05E14936A51CF9E6678238C597D136FBB2FC022625DB1F1360C75B6F37221AE29B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 421ecf15f01c152bc5d80f97aded139d1fdf94bd89ea53d02c63b7cba4a2043e
MD5 157cc6a307e8c991279191613f11f81b
SHA1 7c16b128cdd5dc1b0796d7a7493c980a4412120e
SHA512 24c684a5bea5b8e31fe597d2f4f6430cadc74567d5adca42ce906f7e077b6884fee8a01058a58d13ddbc0159365d57780ac7d91a76bd16be69f868f305abdbdd
SSDEEP 12288:aBZ1Iy32iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:UZua2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T10EE4128923D522F6E3A34278D8E05645FB72F852B33487CF1235836A6F36AD14E35B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 568dcf82eab04cf2a4f8af56cb1b071b353af72cedcabec227e60848a7a9bcc8
MD5 7cf480f29952e248bcaa58a85c050d92
SHA1 b2886338f5c5942e658fbac2870c18040f313b45
SHA512 478887eff95dcb588d1cd655cf69750fd4b41100580b09f20b94cd384446c40b0127d1c27e69c355b98ed7ad37e551ccbb96304f8d17577e47001d0515403d1b
SSDEEP 98304:bQRQyi36YOcPQLvw2gAf+PN3oQnJByxY:qQyiKayX+PNY2Byx
TLSH
T153667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 195fe18776c2fafc9812e1adf342bef7d74f73ef48fa01ce86e86b5359bfb493
MD5 acc210af5fa8d5c143790fffa970e050
SHA1 f2373e5f79740726c2d88378b963dc8e7c47edb9
SHA512 02c548d1dd35d49b15e3704f407aed0bb4bf0a91cef152c2dc24528d0714be41dbe2bce712c3c71773933d4ac116f4df5bf8cc44d075f91d0c6d782bd70c634d
SSDEEP 98304:+QRQyi36YOcPQLvw2gAf+PN3oQnJByxY:lQyiKayX+PNY2Byx
TLSH
T1AE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7c01bff475e580da36a5222a3c831176af4baa5adf913ff1c9da87b755aaab49
MD5 08e2bc086d05166f0f24a013463f1dc2
SHA1 41287bd0b2a38a36248e0b031da83887ea8c884f
SHA512 e88238ddb592d46abd0dbac61ae7e4d54155709e7f79d5e782fc9760340d59be6aa2952559c92c6c2ce841a04b614f13c171447ca5c2b3607514b2e8dd021013
SSDEEP 49152:h68Qg55nhheWu7PNU3/X2QCSnzFiKBd4JP40xY:fthWRc/mQnJByxY
TLSH
T1C0B54933B2F600A9C44DE1769F4A872196D27C758FE0E7DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f395c6afe29f9a1ebf05fb20e4ee11e6b1a00db697e48cf33005fa031cf56cd5
MD5 8201ce1be58d4cc8077a52a7af8240b7
SHA1 8f8fb5350df2712897c99c4513cd7bf3297c6bf2
SHA512 e6e5de4bf10c1c93b2ce2b0ceb97ed65b08c33bd11ac40dc19415b5351bff1fe4e1285841a12b84377f1c27a84df42244700a994c8f64158ff4a6d026a694901
SSDEEP 98304:Gy5112gYy5azzVvL69nLKnhZdQnJByxY:3LIHmWh/2Byx
TLSH
T18B168B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 899402a293a8c79796c5a2213583257583fd1de4d32978f492fb6129c10fb847
MD5 723177a77cbbb70bf31dfb0377f5cc86
SHA1 99c7db92193c737fc2696265b7d021527732789e
SHA512 9ec96c5eea2993a7f2b2b86c790e9ec97751b7b2a24e7345c9c067cbfa2c0c4502517e7ce4f12843e98cf8ba5d74821438aa4f754c9eb7dd7c9c94c5507810ea
SSDEEP 49152:uB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glx2QCSnzFiKBd4JP40xY:8u6JmVxd2dAQnJByxY
TLSH
T14DD59D13F1DA01E8D06AD578974A9233FA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5c47d24a2797cb010cf3cf892ca28ba1d17c75031aea11ad3f228b8e8cfba424
MD5 f140a49d4c186389e97b0b0199d1da3e
SHA1 8ff57c2eb25077f5f5158ff8e6bfd441cd128814
SHA512 2e0494f2f6be46b7cc9890eecb543d22cbc91e35015cc8dac5a0ce1a3c01ec0ab4f9f06798982b43e873287af2dce2c0d0730c63f074bc7841b52f1ecf600d26
SSDEEP 49152:E1hpsNoJpF1A6UU44CwH7R4xd2QCSnzFiKBd4JP40xY:EmifPbRXQnJByxY
TLSH
T189B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ea1121027919d34294a938d5675575740e9e38ad0953e58309aa1a2bb2300f24
MD5 1b0077e0527d493c21e46b6bfcee5dc5
SHA1 d27be25e7d7f6a26af0256fa4f0ada0a5da541bc
SHA512 8507af10d876a1af013e5544b29c68fbd4d79d6f0a866d854fbc4700aac89711f5a5ac580d36a07f90d2793d67c167890845d1fe9e7f15afe01a62ae3d5effd8
SSDEEP 49152:pSuZQIY0Be2KRRVtOnks6NMHqa2QCSnzFiKBd4JP40xY:n5dKTi61pQnJByxY
TLSH
T14BC5BE03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5309d75c96e44e0ede145bef1194e2d131134d3d5b6f32f473a028fd6d2ee8d0
MD5 035711f4aae19609aa4bb49934335c36
SHA1 87c808ea1f544b2073b4d3699d25586c5ee2300b
SHA512 4d869df5c8dab8fe4127732dad34221e0edc6054269f5da414a2ed020c1b91c9db9e1b9ba4f13c16623d292bd1a95bac59eeb0279bf0715baf7cfaf94bf32a1e
SSDEEP 49152:RhtSn8EApI0figngiDn0AP5wB2QCSnzFiKBd4JP40xY:AX2iyphbQnJByxY
TLSH
T1EC95BE13F2D901E8D05ED174C7468632EA62BC160B38AAEF0A50B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 a273ecb3a7dd5b8be59d881c7530db8cb0489cd00340c442fe348260e0c57a54
MD5 6f715466a21f99c50602300d4e00d0dd
SHA1 6139cb020560cd2d65e78dc17dc024290a237506
SHA512 56290a0c3bb927989bb33703409f889fff9ff4c3b48b044acaa18135dbc31eb565bc8819dd06862c72091a03d6d3aa4290d991bea2c495d8aaa0d40fb284a598
SSDEEP 12288:bO2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:bO2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T15BC42348154B17A6F36342B0D9906189FE38DF46F3189E9B633AE316FF786150E61C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 caabde2bc358313758548ee47953e8000afb47157691d3c8a21f2d05041acb2f
MD5 971b485db512157c996557458d676a91
SHA1 2604cf67355b4391e2ca9db4f38b44f6d291ae0b
SHA512 778e2562909242fe5425f0364cd4585aa55f6b9a875504927e256f55d61b614b8e4bed4ef6c513b41e36def17f88644a3bed52da39d2151d5e5df117fd71fab3
SSDEEP 12288:Rb2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:Rb2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T12AC42348154B17A6F36342B0D99061C9FE38DF46F3289E9B632AD316FF786150E61C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 59b834521ee7bd8d6889ef2f487e03ef229ead03813b42e6211644234189dc2c
MD5 a39b5228697c482986fca30f744aa837
SHA1 f020ad595037d6f08fe87b857f8f810132e38cf8
SHA512 f82a9822c471fbe2e8f608b33544289c6c71202267faed21484c0439efdf39caa102b8612a8e35f4a5a9a6121992c46d199a4f6d7e659604708d13a9039e9b53
SSDEEP 12288:4V2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:4V2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T1B2C42348154B1796F36342B0E99061C9FE38DF46F3189E9B632AD316FF786150E61C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 72a0f31add5af607758f8c99a59c4ff0ce593c989ea083db74f152ff9686df79
MD5 22f952843bf3eac9bdd18073ab5cc159
SHA1 3b8f83cf88de5e6ad93c07b9969f9b0813902c6d
SHA512 d3eb08f5180b715d1357ab701346e4b744b387b7750f74fe397f11a64c5f49c248a53c16b9f714fc77ee09f2e1ca493b6938873ea3839142b124fd0ce118e80a
SSDEEP 12288:OVQ2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:H2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T179D42249168A03D2F36382B0D9A09185FB75FE46F3349BDF9321921AAF747544E70E8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 03d5ad17ebf349019069ba3f87fe7710c9cb90545603f7be7eaf9086d920031c
MD5 867f3a3a668e9c86466b59439d6a1e34
SHA1 21fa2e1a820e580c313830e4c110471a8fd6f5bd
SHA512 958685a31e763a6a372876de028e52860e3f38018d38a03bfc056e427f144637836da4a80e35e3d4a74b2466108570744e57e2418c6c7f8fcea9d372c37e34da
SSDEEP 12288:2Y2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:2Y2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T14DC42348194B1796F36342B0E99061C9FE38DF46F3189E9B632AE315FF786150E61C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 6cb942ad6a257c6fa4cb9cbca79cf7b4edb68a7929f470bdb2bcf38ce8006784
MD5 d1aa1d34ebcb3726a8476837824bf472
SHA1 b6cb39a1d561dc26e066d69c6fdf9a5a5671c8e6
SHA512 669cf7036c208164543ba761db6cfb4d50f989c0dc143f768d6f7af3eb7517547446136597051ab2e4fa1df5dcf9bc6cddb08496821375644b4bd24de97528a4
SSDEEP 12288:h/2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:h/2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T165C42348154B17A6F32342B0D99061C9FE38DF46F3189E9B632AD316FF786150E61C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 fe09be1aea23f0e8bf21fe4a6534b0ffed52dbdf77148687a736980607366bc6
MD5 540348bc3f6de6cbb486d8b7d0a28da0
SHA1 235112f8380598a0a4e20ffaa14483d8190e3446
SHA512 7088713cf286627dc4c3ca052c1760687c1104814c24f4dfdadf35e8d18806584e5525f7b6c7fc3dafd6f3342172306a594a415a66419c96a6e5fc8bef9ef977
SSDEEP 12288:jj2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:jj2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T1F0C42348194B17A6F32342B0D9906189FE39DF46F2289E9B633AD316FF785150E61C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 a72a511e0b584b183c73723202779933e35251f1d19b7d4cffb278ce58600981
MD5 dc9b94cdbdd83fa2c0eece818561bfe8
SHA1 dc5fd74017c7cdeab5513fd78ac6fd113d73c2bf
SHA512 d983f2621f0fad48e31f23019bbfdd5a8dfa031d84979a02feba6b25f282d89b6b72101adfc7dd6b6a4fe348d8ebe2289e5642693046f38399c5bae7cfdd394c
SSDEEP 24576:jZMSzFVSO72Q0JqSonzFiKBdzQVJ526LU0xY:jZMSzfP2QCSnzFiKBd4JP40xY
TLSH
T1DA050199739019F5ED638239C9508906E6B2BC1A5770CA5F13B436276F333A10D3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b6f23a7b5cb3b55241870c8ef18775daf25ec21df0c5c595b072525c106d5c66
MD5 2a7b1fa994e9e2391e8ab7b969b35b37
SHA1 41998ed8775766f2d87721abfac7823ef2c3ba82
SHA512 6097bb96b08e7d1d6689c24277499b0b2d3343a7c11f292528a94e3d207e98f60eb480730e2713ec4c1fa7031cf6e76f2ef8cf506a0bf2402d048050c6c02503
SSDEEP 12288:Cq2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:Cq2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T101C42348154B17A6F36342B0E9906189FE38DF46F2289E9B632AD316FF785150E61C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 ea3d23991564ec2479fbc233e7ad9e58e6bd6ab148724fc69db0d3a6d3984f62
MD5 b961a6ba5598785e05c6efa03f1eff88
SHA1 02a292567745056bd70f608da62372d3df3f7dab
SHA512 7a2b7c6e996168b5eb187fc8f53dc9842112dc9b63d005d8a7a53fad56b31a41589d32b041bc780426755f5f7a2472a3ad314f2005ca2a869de23d22751ac46e
SSDEEP 12288:7m2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:7m2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T115C42349154B17A6F32342B0E99061C9FE38DF46F3189A9B632AD316FF786150E61C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 02625c7a6bbb52cdb0c1cf7257fea74ec086f274c921c9d4497d2485044b06d0
MD5 013032db73ae70a3795c739089de2e7e
SHA1 39b70b40a262416e4faedfbad626e7b8e515e06a
SHA512 297867c5ac7751f925dd96bbbcadb806c57f2ad0c7e16f3bf486c7ab245f10da0098ecf01c9e9e27c66b0e36167cb436b0908b6348ff86f8c62c9f9a851c3ef6
SSDEEP 12288:CyPz5L832iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:fzy32Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T174F4024B33A631F9E2378274C8A11A42F775F83253248FAF1364437A6F366914E3AB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 07e1697dce3f30cfe94a83dd524c570c3f50d4bd480be4bd5bb0b846d2d42c79
MD5 f6a007e141b17d5d7e07d72646ca43ee
SHA1 2a1c04e4d849b746396452b5eb92fbf656843e55
SHA512 da45f129b87951c51bfe830ff5c2b84922504577d6af53000b9ee99936fc8f5c691bbc62ac16882f912ced4371777b397d8ddbb2e51befc11986d5e4b4fc7b23
SSDEEP 12288:4q2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:4q2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T1C6C4234C154B17A6F36342B0E99061C9FE38DF46F3189E9B622AD319FF785150E61C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 e106dccc413d463133cd017e4d220b1a5e09a2e55ad9ba3caa0f438d377dd40b
MD5 bae3f9c210782f66f126399977922eb5
SHA1 9dd8bf616926c906f85708b24624a41297ebca00
SHA512 3546c3658bbad76a798b273ddd0ae615f606a504cbf24e095f2baa59a7e887148d1bcfa0d87dc9c6c720e1ed25e1bfc183e494f353960f9b0063684668c3e26e
SSDEEP 12288:0q2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:0q2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T10DC4234C154B17A6F36342B0E99061C9FE38DF46F2289E9B632AD319FF785150E61C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 5845ca0228cf1eef509767536edeef5bf40023479b636f541fe3ed0503af5bae
MD5 060e127b6ce358024b3352906f5a54f1
SHA1 30d64d8615a6eea694e1a1479e7c2c880d186f38
SHA512 b4bf7d2e67069a0219843b178ec72eae4decef81dc900f5721318798135e3b5c855204297fb0742719cc3700a34a7f9543dd8d713997c7a24c539a5fbf5edbe1
SSDEEP 12288:gyPz5L832iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:Rzy32Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T15AF4024B33A632F9E2378274C8A11A42F775F83253248FAF136443766F366914E3AB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 00b81808e7651678803ba0b67101a7c09294cb20615a3c2a2f8e612e738b8003
MD5 eebe0943ddc1d82b949001a9b6e41f3b
SHA1 04598d920a20332ea6a07c0abd0cf9bda037ffff
SHA512 1dce10f18c07f3ea8a0982052a1ae5d3f8d4e38c50ee1afa44eeca24fc28bc34d0b147018809b45e041583caae4b454b54efebb8e03bb7242d7cd48d3ed7dfe0
SSDEEP 24576:wTHaLl3z0zDF2Q0JqSonzFiKBdzQVJ526LU0xY:wT6LljU2QCSnzFiKBd4JP40xY
TLSH
T1DE050198735019F8ED678279C8618906E6B2BC1A5770CA5F03B8376B5F333610D39F9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 b9b058720c48dc7314a3f81bf6b9da06da2a81b243ff974ec13743d565f55701
MD5 79509b05a89ae61ed0705becb041b413
SHA1 d8ad6e9205dd0a836a8196055b47aa4a27578139
SHA512 e899f01e7f26e8d587d35290032438e62ffc9a297f5b1ed93015d3a6a5d6ed22ce4657793fc070096a77b905721de80612ba5ed2fdc83d60cbc801cc0d3dfa17
SSDEEP 24576:237d9CHKy7GZ52Q0JqSonzFiKBdzQVJ526LU0xY:Y7d9CHKyaP2QCSnzFiKBd4JP40xY
TLSH
T1BB25CF90B3E415E8F1B78A34C9715511DA76BC5A5B30DE8F03A8661A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 cdab48758564adcad07cba27e04996c92c027dac492d52972e9c2c809f5b5472
MD5 5350b5c09410a56e1d0780eb21d8c94a
SHA1 726b71e5d46f7a153633be97213041371dac03f4
SHA512 f8526042daac2e83a5aae5f9bcc92f33f087de2b9a9f5c4785edb7b25bb97e18f563054cca0438b6b8c3394beb6f728b81db96f90533b803fca24e26e72d3d8e
SSDEEP 12288:I12iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:I12Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T199C42348194B1796F36342B0E99061C9FE38DF46F3189E9B632AE316FF785150E61C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 a069657c3424f88350907847f93a4debca82472d5097d85d5307ce146d6e7be5
MD5 f2919fe5e7d54069ccbf987cf84249d4
SHA1 3fdbf90f0e232815f79ee309937b42f397698be9
SHA512 cba3b4f0264f7601b1d9b6f7bc534d94f1b33b5ee0d3c0fd80e45e2f04391b30e074a12d1cdf3ec9875bd96b9df1e42604b0cfe41396b7ffed0e81323836a259
SSDEEP 12288:AX2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:AX2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T12BC42358194B17A6F32742B0E9A05185FF38DF06F2289E9B633AD316FF785150E6188E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 3113e0f9ec0a977c6f3808adc465c6f150780df4368cfca2e015d3bae7217a88
MD5 21a099514f800aef199ccd9d81fa210a
SHA1 e23f34d92b062c7f9e941720d09aab70e1ce3b73
SHA512 d08795fa24e096d6703d45448de8db9e3e0cb20450171dbe089f9a29a0bd66df5d85604b460ab797425476b41b9b8a02edfdd8b928d89feea65e7efdb5f4c5ca
SSDEEP 12288:q82iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:q82Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T13EC42348194B17A6F36342B0E99061C9FE38DF46F3189E9B632AD315FF785150E61C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 0eca67621d4c31322cc76e4bb5f7704eb9997b70eb7c7706dc618bd857286d90
MD5 b96cc79a44d7b4f1fe985bb498fe53d1
SHA1 5ce45e59760590c39245d170677735b698514e1e
SHA512 0fef7e7ee617daf20dba794c73a67f78e0c820519c22feb3046b34555be505a3c0c75a658133bc626f4daa98ab81ff1c7cbeab3ebae38dc02a16bdf3c43068b8
SSDEEP 12288:qq2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:qq2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T113C4234C194B17A6F36342B0E99061C9FE38DF46F2289E9B632AD315FF785150E61C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 a2b49ea057a309209229d4da057b90fcb17594006a515c467759a20e01213f0e
MD5 3cf3a7746c27bad4213ebf3801c51984
SHA1 33dd6712d56a9b432adfc63bdc45e40217700d5a
SHA512 c72a6d2cc9d51b3d307325d8be6a8c6fe81b86c8faa7a6937e7b3013a52e1815aa61911c99f1daadd303069ff3ca0557712efeed00aba3a1452636c426cc6c24
SSDEEP 12288:212iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:212Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T1B1C42348154B17A6F36342B0E99061C9FE38DF46F3289E9B632AD316FF785150E61C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 0874dccfa68b81455934f310463f079f0824e9a801b9a7145b767e4650bbec11
MD5 dc35823f6e2cae54686af53d708e27bc
SHA1 2c62bad175efe025da61a35681dd902a3999a470
SHA512 16fb6ec35dc8cab528183fc75526d4c7bdafb6fab68b595855d005183fd9315107ec2e73787832e1a1f37020f6d0f9cbe360d387a6c4157abac209bd6981bc89
SSDEEP 12288:Iy2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:Iy2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T1C1C4234C194B17A6F36382B0E9906185FE38DF46F2189E9B633AD316FF786150E61C4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 578256fe9b3c5d394d19d42ea2308dc0376556fe74d8d3db279640bd91d8953f
MD5 b5688c481daa0b41d4702a01b297b113
SHA1 339d19f5471723b00d17a56e5a96cf6a8c3bf3e1
SHA512 a5c57ae50d905eb571ab427066a902a56af080dfc0c55715f1feabf80e6c4725320caaf5df430ecc1b81076dcec86ba86ba5755ea8571847d66d779e2ed1e1b4
SSDEEP 12288:9Y2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:9Y2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T192C42348194B1796F32342B0D99061C9FE38DF46F3189E9B632AD316FF785150E61C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 72f936467b70d7eea3f6bfd59c4357ab9713e7a0df8baa7ef718fb7954006fa6
MD5 138c11ee19bcf4871710aed41045ce5b
SHA1 ef58bb6f3c82f284b7244f3ea83ce1797a561a4c
SHA512 decd0b1339bffd934c383a9d0626683e07885bf2aceff12419353ccaca50b0c4533ac69c0cfecb62b2ff3f25dd784997d84dea673acc650067486f2a5eea8269
SSDEEP 12288:0N2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:0N2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T139C4234C194B1796F36382B0E9906185FE38DF46F2289E9B633AD316FF786150E61C4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 eacc919245267765c40b4f25270ecd0c46640d1462743ff804c0118eb63feea0
MD5 04a18eea8aeea5e61fd0445d908dc5e7
SHA1 bba9ae7b8d1a6dd5164eb085c344fe5e5a70c668
SHA512 ae4d11901df30fb7e5a12382458e99b4effac31a2651f3128b9a346925dc421ec2eab011ee51373d7e70d11e5939fb0f4acaa01e9fdc551c3bb824dda51794f3
SSDEEP 12288:WY2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:WY2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T152C42348194B17A6F36342B0E99061C9FE38DF46F3189E9B632AD316FF785150E61C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 995c9d455ee661b3674033e86f774e36f9d7a9256111cce9e4321546a01b03a6
MD5 e5d4fd61b8b1965903bd78aef0802740
SHA1 02ae6ac772b26060c914dbe224111242fa9982d4
SHA512 90193b446a84545ed9fffce23ef025da805a9870e0daca7cfed1b7d2dbc944bbc0ab1a39c2fecc03818b4d985d7ec3bc3fe405c3b5e91826680482cdbf86029b
SSDEEP 24576:6fwvok9RX6wkyAI22Q0JqSonzFiKBdzQVJ526LU0xY:GMnYI22QCSnzFiKBd4JP40xY
TLSH
T13135DF29EBDC04E5E1B7923C99B3460AF6B1B8591B31C6CF026A536E0E37ED45E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 921cc030becfb6e5ddd71952919b064757c7df0ad2396a4035676ecb29f92163
MD5 ed990048ed8a01679a1e9c55340d55f3
SHA1 87ee971618c9204a0063b2ecd95272b26ddac005
SHA512 43345ecf8d977ef63acb78e685b5996657709d62f9703e0d5f8f9f5af3ee88a7b85e05493852733d44cd67cfc6360a67036ef7e0c7de3ba66ab490757f0ca4aa
SSDEEP 49152:LYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0h2QCSnzFiKBdL:vySzPIQnJByxY
TLSH
T11A066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8ec6470d3036cec23d08edab41e6cd5e6caac248f3be7762daf80ad7ba6ef6db
MD5 928aa5899e069c5d433973e6ab5d7856
SHA1 460a80ff7fe4e36531e2b8500f8c195c0b19a90c
SHA512 f27904cb860b6831ccad3bc75ad67650c43b70833f18d1e3bf3cdca37b6354cb1138488ab4300d7933862ae7a116c5e696cc5ea7bad3813b113fa94fab6f5930
SSDEEP 24576:n47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYL2Q0JqSonzFiKBdzQVJ526LU0xY:n47JUQj1irIhCnDHUPfF/x2QCSnzFiKf
TLSH
T17365AE1DA3EC02E5E1BA927885154A5AEA71782E5B31CACF1270837D6F23ED44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 163731824ad6dd8455e7530cef06979dba0f9e8e0799bb6ec7dc65322831eb90
MD5 3e594a9244d914d51394f98cbf02c6f9
SHA1 1cb5dfdd06053fb6defe524875f3b4fdfc2443f9
SHA512 86d67c6c982067c1dfa023e81c966056ceca6a832671abb3e73cb30817b98a355a594431aea299faf9a51c51e7e6290d68e15b5b1ceb1363c4e15dba7fb00194
SSDEEP 12288:ONsfa2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:3a2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T1C7E40109D29802E9D26E5274CB505681F733BC2593E0D7CB53E0F63E2F796904EEAA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 c0a0b9be2522483948d3d7acc3e0dd3f413fdc5f5fdb338e4f5330c87df840b8
MD5 7c8611c550eba6288b3d83acf925cfcf
SHA1 37183ed3c691fb4ae10f015e2adb94270ab90e3c
SHA512 5e864c910bb4a757ef278ecfef8407d39a36bb8b122b539d823333d2b4cda7338a17dd83e21f0077d98571a14f471d35b021fce79c7f95c8f5abf3290a3c6071
SSDEEP 12288:OjHZ5y51QNAvYRZAFZEZdRgPR+YLX6bkhN2U7po1mY:OF51jl3gPRVX6bmN5Vp
TLSH
T10F453950762BD75FC6A940325E32D2CCAB707D05EE459B0372C8872FC57666CBAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 62635433e7c78d76aa5af1dae4042e5a04252e219e55f4d2289711ba85bade9b
MD5 cca13174a6ef22a318138cd5bdc8b0eb
SHA1 06723b43127710a484a887051136d6cf83067cfe
SHA512 4e7bcc1833dae481ab94f0a75bb6c373a635a1570320b7d84b43cc781c3400bb74a5ca076ba5aa43c898fad2fbb7861ae05cd2df0817bafc3ae6bf7a33b16df4
SSDEEP 6144:2LpAQvzQIzPQIze5IzJ5IzZizuHcQsC+9wKKDexH0fbFRrKKDexHTyHLbMrkY+3Z:cAQvRNXMZd8ZC+9wvfbFRrKynxhvd/9v
TLSH
T1A565E981A537A38FC1F76032072A5B4DBB74EC06B7096F2673C8453AD82A715B4B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 017aa61dcc41590eb7723be9565efed977799f1c3d907f4fd3bbe1031545ce0e
MD5 bcf0e933d10eac69ed6d2eec90fabea7
SHA1 05855b382c9fe43f440637e607e40cd833a1ffc0
SHA512 67ee29c039f519c1fcf4ca00be6f8055b5fe321db44e80bd3292f01e6722d139fbb88c0288ea5f88306dc7bbadf18e3f0aa9c58895cde280ad83f7b6f4b02b1e
SSDEEP 12288:0M7i2iFqa0lFlE9TS9CYZhiYbAzFiTmBdztCscgESmzlJwG2IVLU0nxY:1i2Q0JqSonzFiKBdzQVJ526LU0xY
TLSH
T109D42359068A1B92F37742B0D4A49154FB3DEF05E318CADBA225E34AFE74A814E70D4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c98b4c507ea3d4352610f51de475d05488737db5e86a923fb277d5f19c59076f
MD5 b7677b5f24c0366e0d576a10d67ddf2e
SHA1 3f06956119287cb1f0812ad770ca4b11c3b43c25
SHA512 50edd49a9f60d2815e75aadcf63911e9c1c62b3062539882cc832c435c7708f3cc42859a305cdf7c96730672d6496780dc329032a4ca344dd253d2aee1884399
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYU2Q0JqSonzFiKBdzQVJ526LU0xY:ygb4mBIBhGFL2QCSnzFiKBd4JP40xY
TLSH
T16F65AE1E22EC02F5E1FAD2B8DDA64417D6B278161331D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 7ed6804db339054de5934e364f866eeb0f3e90792c953e0936c51a2c8a6f228f
MD5 e87bbc13648b089fdd075d3b795d1ae0
SHA1 7cb27988ce0a96c188de0b971426d1023e4b469f
SHA512 bbc7cee8434f8eea9fae5b1e0578a1c22c7edc72190573cc2ba240feee774427c263300a4e48c522a47d0c8c672ff0c5067d808aa63f37c303a40d116ff8bde8
SSDEEP 24576:6G88u8FpJqH1bzria7/m72Q0JqSonzFiKBdzQVJ526LU0xY:B7ZFPqVea7/c2QCSnzFiKBd4JP40xY
TLSH
T19335F16566E102F1E477D138898246A3F6B2F8251324EFDF07A88B551F23AE50B7EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 3aa0f478204732c3301fc015fb0c148492853bd1d65c5e8e83f2b010ae799f34
MD5 4d756c38f3096aeb0459ca309e2e7b64
SHA1 a8e238dbc8aaa556d66fcb1575cc258984e40d58
SHA512 96379a99d1d939ed16b7c94bfef49f03f36c333d6d80241468d9e7a10df59b16fd396bdf77ef7f009c699d08deefb3c4b8779d8b202584682c5aec620da05558
SSDEEP 24576:hPUr+NQP2Q0JqSonzFiKBdzQVJ526LU0xY:hJQP2QCSnzFiKBd4JP40xY
TLSH
T14305E12E22AD18E5F776E17CC9818709F771B8621311D6CF02A0817E5F67EE8AD39B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6fc0e695a02ecf0e2943f0fb40249b0029d873189688c6b9cce895df1637cbe5
MD5 467a83e1972f60995829a55b750d7593
SHA1 288b961e2e809623e39234c0ff4df14a3239f4cb
SHA512 06232a373e24a06140bffc543cc72cf293b8d55809e998591fdbab1e5f60cc7d1eda992bae010c363186e81d1a375542812dd61ac89116d0d223d89cd4437a7d
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/2QCSnzFiKBd4JP4z:JG05lO43bFQnJByxY
TLSH
T136D5BF6E62EC11F9D1BBC17CD9C6460BEBB23815032556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 39db902c9741564262b36bb8fcec236a4a9a46a3d6245a278302ffc5e737e6b9
MD5 c8a74c747729ec0cc7b8a1e3eec16489
SHA1 beb8187852ebffc6d20c35a97d432ed61a4dbfe3
SHA512 dd8e15d63a61a1b1110352c61497d466da53babd7e31c6e4f47ff571ca7bb8c658bced4e3ecf54605d2d0e9543c127714b29b683575b2b262ef308434c8ad802
SSDEEP 24576:hfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnh2Q0JqSonzFiKBdzQVJ526LU0xY:ha5POZ3+Jt2pasx2+mX2QCSnzFiKBd4k
TLSH
T1C565AF5EA6FC01D5E279D17CC583861AF5B1742253319BCB122182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f43d52a2d97997793064561e4a7cea488c4dd0b105887af591e8dea2a02a59d1
MD5 f370bd2d7bb2c12944116518ed474867
SHA1 d4c07dab8c78962a1e6ad09352b38360591871ff
SHA512 c710a5f57dc28289f425842aade44ab33676fd1ad396a2f9f984e560ba6f4aa006c2de554aaca95e49335ef8940c8d93cee1e7a55aa7e9794992ff25bdaf4703
SSDEEP 24576:aNcwHdjbyQ4nLC18lb/EOjowL7FkT2Q0JqSonzFiKBdzQVJ526LU0xY:aNc/zEOVHF82QCSnzFiKBd4JP40xY
TLSH
T127857B1623E901E4F2BBE1BE89779546FA71786553348ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 189648e358d5fd9766195c24aefd082e5db521c61935917a56b5a9172dff4788
MD5 16e5d99e3162ac65aaec109c8353ee1d
SHA1 01673ee4df9820ad76ec17639b55d66f6ca1e653
SHA512 9d2a58a35951809001ff77b84e5203fa8ab7bfe6afe9b5ea0a042b6b7f6fb023e9114d19d186918ce7aff5269c305d6669e67b92aa8823e8290e823ea8026499
SSDEEP 24576:v8kNvNnaFeYhJNtmZBmN2Q0JqSonzFiKBdzQVJ526LU0xY:v8MwBtOmN2QCSnzFiKBd4JP40xY
TLSH
T1FF55AF6EA6B806E4E1FAC6B4CD238512FA727461133293CB5390C13F5E279D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 02e267ff9b0a1f73689ae3e354f86db6a8158ffd18d13de6e9431d8c7a2f23e5
MD5 194b233769bb3eda7cc88725771a9a65
SHA1 60696e838004c2e90895703c3005f5a26b2dbfc5
SHA512 71ff3f8d50c35ba27593cea8be27c6ed2c479abe4b66e620329618e6ebb6cc60530981f902f32c49627efccc981ee22739c41816248992eeef0fe2505f382c8d
SSDEEP 24576:xD3FHshBIYQgAu2Q0JqSonzFiKBdzQVJ526LU0xY:xDVHeBIAAu2QCSnzFiKBd4JP40xY
TLSH
T12825E17DE69D04E4E57BC1BCDA638606F77178A903215ACB0294C1BA5F6BEE42D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/460-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/460-138-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/460-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/460-127-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/460-133-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/472-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/472-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/472-294-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/472-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1148-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1148-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1148-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1148-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1148-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1652-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1652-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1652-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1652-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3356-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3356-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3356-95-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3356-89-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3356-381-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3356-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3600-115-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/3600-121-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/3600-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3600-369-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4644-77-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/4644-0-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/4644-7-0x0000000002310000-0x0000000002377000-memory.dmp

Download

memory/4644-1-0x0000000002310000-0x0000000002377000-memory.dmp

Download

memory/4644-315-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/4644-6-0x0000000002310000-0x0000000002377000-memory.dmp

Download

memory/4660-79-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/4660-84-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/4660-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4660-310-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5248-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5248-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5248-22-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5248-14-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5400-108-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5400-366-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5400-102-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5400-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5400-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6088-67-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/6088-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6088-73-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/6088-309-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6104-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/6104-39-0x0000000002390000-0x00000000023F0000-memory.dmp

Download

memory/6104-47-0x0000000002390000-0x00000000023F0000-memory.dmp

Download

memory/6104-51-0x0000000002390000-0x00000000023F0000-memory.dmp

Download

memory/6104-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download