4e486eb8a2edbc0785a948abb6e357eb36ef0cd2c79ef35ceb9db5887bf487e8

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
Size 1.4MB
Sample261102-jcb2bs1xgs
SHA256 4e486eb8a2edbc0785a948abb6e357eb36ef0cd2c79ef35ceb9db5887bf487e8
MD5 d5625bf15dd7137ca9505582b91a8373
SHA1 172518a6b3d6ebc30025c34e7840dc3867460150
SHA512 60cc269fa8e88f1679ce9498c5b9fc61accfea58bb73b93daf1425cd1a4eecc9b441c2728752a72967d1dbce069ec6f9ff7f7989cef30e544a181fad4162ca39
SSDEEP 24576:xBMdxpmNh4DpTt+Pu8eCGQ5KYVw3wIK8OH+W:xBMQNh41TT5CGQLV9YW
TLSH
T179659F84A5E9C093F3B6467529E4B12989B97CA1E6D0024F31E8594D3B337C1BA3C7BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3400	elevation_service.exe
4624	elevation_service.exe
4132	maintenanceservice.exe
2544	OSE.EXE
3728	PerceptionSimulationService.exe
2880	perfhost.exe
420	ReFsDedupSvc.exe
2864	SensorDataService.exe
1280	ssh-agent.exe
2848	AgentService.exe
5152	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\290646087465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\java.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4068	1324	WerFault.exe	86

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b198a1689c6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b738a2259c6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000017f1a5259c6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e049eb249c6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000586ecb249c6add01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1324	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
Token: SeAssignPrimaryTokenPrivilege	2848	AgentService.exe
Token: 33	5152	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5152	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5152	SearchIndexer.exe
Token: SeBackupPrivilege	420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	420	ReFsDedupSvc.exe
Token: SeBackupPrivilege	420	ReFsDedupSvc.exe
Token: SeRestorePrivilege	420	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3400	elevation_service.exe
Token: SeDebugPrivilege	4624	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1324	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
1324	2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5152 wrote to memory of 932	5152	SearchIndexer.exe	99
PID 5152 wrote to memory of 2540	5152	SearchIndexer.exe	100
PID 5152 wrote to memory of 1408	5152	SearchIndexer.exe	101
PID 5152 wrote to memory of 3352	5152	SearchIndexer.exe	102
PID 5152 wrote to memory of 4156	5152	SearchIndexer.exe	107
PID 5152 wrote to memory of 3560	5152	SearchIndexer.exe	108
PID 5152 wrote to memory of 1084	5152	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_d5625bf15dd7137ca9505582b91a8373_elex_emotet_remcos_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 1440
  2⤵
  - Program crash
  PID:4068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4132

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2544

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3728

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:420

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2864

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1280

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2848

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2540
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2864 1608 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1408
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2888 2920 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3352
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2864 1608 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3560
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2888 2920 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1324 -ip 1324
1⤵
PID:4628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a10bb06b549f8061c0646158f5d395eb41d5836bc5f0391f210194e01c5a89f5
MD5 b53f1de315a6aabd74ab789024aa1393
SHA1 dc56b2af0ed0be8ced7fef4c432a6296b44e3dfa
SHA512 021543d42fc72797391df6966e665ef5d8047c6d2c9e5bdf5a9ebdcf6a694943cf3a1cf28d7dad4977df7b9d9ee822e737d17b4e178d8ce6b546e29d20aabea8
SSDEEP 49152:Ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxnSCGQLV9YW:q3q6sjB9SVqW
TLSH
T16CD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 e0f899faee207c80411acce79f818c410c46cdb6f708e0abb4db9ce698211dec
MD5 44e4ad26303ff0d4576b7cd2bba3ab3c
SHA1 63475acf4c82f7c77908f9e5f6e6f7ab3b397807
SHA512 0acd9432d13a7e9e12ca5772fe992d1a634e2a4ce15cfbbed60b7469256448831b03b57d69ce37d2bd9118c0975f28900ae6f48ec4a72cf5082e4a3b3e7cdcaf
SSDEEP 12288:G1XLsswWkxy2lRq2czA0EClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:kXYfDtczA0ECGQ5KYVw3wIK8OH+W
TLSH
T11605F12877D508F9ED67827DC9A2C511E733786547A0E68B03E099352F333E89A3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b5df6449b43b2f863f6b867dbfed2a170ed3e18b6f1024b76e9e32709bb5e7d0
MD5 d929b7f954ad9f66ada0a44220ec77fb
SHA1 21a5c6998e27a9f5e1b344563d590a72a43827c4
SHA512 0d3e6e47d365d57b7303bf0045339e08d4cb3378031f929d8fe6bc503dcb8685f60fffa9d7b3e5598bac42198f4671f7ef4d329246231b971a1cb956c9dcb5ef
SSDEEP 24576:X0Le5ji0hmxxrMtECGQ5KYVw3wIK8OH+W:XPji0AjZCGQLV9YW
TLSH
T1B4359E16F6748335D073C0B9C5D2A69EEA7130821B3089CB4296D77C7E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3bcb9a19ceeaeeb3277e6595978d49df5cb571650b31d1c77f920a6b186a7322
MD5 5b2eff2a1dbf39279eb985cbdbb72594
SHA1 bcaca872cabfc1472c8ba33cd939b347854cd284
SHA512 0d649c0d21fd76fe3b6076abf25127727051af44b9d46545359886027946e827a5a99d483893a8e90d1a4e2ad985a6c1164ee5488488c1bb297e5da49c643133
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWn6q8wyuTECGQ5KYVw3wIK8OH+W:6/ezSC6vUzPveHjytCGQLV9YW
TLSH
T17C755B15F5788323D0B2D0BAC5D6BA9AFE3230465B3089CB4246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2b391b0bec6e170e50ff9e6f3752d077310455811db097a532132c0fd2817dc9
MD5 da2cc14f1212436caa03225f66710c77
SHA1 90028d5eb5742896ddc74f8d38673d2d86878b56
SHA512 3afb231734da9831e1ca8e7f858fc8824d005c1117f6cd58b080eb15707f882a05f8a377b8e173bf8d76d480c58c6667de4581caa7f717ee92dcb078a7dda585
SSDEEP 24576:3VbqPb88hv/l+YAECGQ5KYVw3wIK8OH+W:3VO88hXl+YCGQLV9YW
TLSH
T12B55AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D72C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 4c00da6a656e0e114d27ee1eedf209a20141d283c712ff27015dc05537cc5430
MD5 b25d0666356351a6e3f27521d98e3c1a
SHA1 1856c280c9a8bcef74286421e74f6d55a0501c32
SHA512 f0694cbc352375a4dff66058a6a559b0ceb41da790ea79952de53ed9f187fee2e299eebab302ccb73378e43d8534a136caf506bc28862558e9f311d0506d542a
SSDEEP 12288:YLJEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:YLJECGQ5KYVw3wIK8OH+W
TLSH
T176C423422E9980F9D39B87767331F139A71A5CB419A5601FD1F2BD3970396F4D22A232
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 54bd523a1bbba94b9210c5243afbc703c261a826561bd8019fdf1816b1821e67
MD5 4c133cdc34ed8472c6ed47e92a223b64
SHA1 5512a16d8af513192c3aed1893cdc148c5df50a2
SHA512 968499632281fc0f6a01c210b3e1967dbb4f787d0617039adc2980c44e67c259cb470f7be9ba792228a7efa1fe011037142e3536c462cfd8207730dfca8f9bae
SSDEEP 12288:deBNUbTVO86UIEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:dJIUIECGQ5KYVw3wIK8OH+W
TLSH
T1E205CF3BAE28FCE2C27A8DB95751C600D77278704B61A3CBD175820EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0556f014c6b9babfbfcff91ba686eea4ce7ce6ce340e09f6000574f9bf930a0c
MD5 3edcbe6e4988cba3b679e93244bd105b
SHA1 302d892f355663d7959fbc6e9089f181a0299be9
SHA512 d7a45682dadefafc4b1db363da92a7d9cf9ef45df20481f56a6a6df1003f08ea9a67838e4c6b8e7ab9132457156823f9179dc15bde41eb9254bd87988fcff530
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THY:8QvGAdlCEL8c/DRNw5C0SVqW
TLSH
T152267D656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 a101e7102a2db94aa7dbd17829d3bacfde068b3ad95573183071888e2f97e83b
MD5 889ecdf7ae03f2eae25f63c052e7b135
SHA1 c752d4e2524e832a81265a513f6f9e58006ff010
SHA512 365aa193ab12ecbb1f11271d63c6fd32775e7c26a476817788dee2941533d78bea59a3c3d1d341ea6701a41010b3987e9b5a6eaa18c78a6603ada5b050c58a2d
SSDEEP 12288:zAwSfxL/2Dc3RDLLmt0LDQewsAj2EClIC95IZofBDrf9XTE+eSNZI10DgOegvGUR:s0ewsAj2ECGQ5KYVw3wIK8OH+W
TLSH
T1DE15E031FE74E036C3BB0DB61B36D716142D79204BA119C3E3E89E9E59342D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0e7ae5b8b2c25d1d30a8e600c448da1099b320a2a09da3bd7753a6f218fed17f
MD5 62dd5873d71a8fbb09151b9ca69a352a
SHA1 b4f4b3a1d1c13af838053b4720d49228b36c4e97
SHA512 bb06e672d7cd86e7b101075c94280b4f330092787f63d00ea605d646c0df8d9687baa11e20424a15a1ad3ce0cd4ed7469d76c60f308a0297fae9d2038c6bab1c
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHDa:kUEtQevvqc2W1cpV2tI32e
TLSH
T123474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 230f892dd47c5a09f82666ad8303d38335dd0cba8a8c11f65b4d973312efc003
MD5 c10e395416d59dcf799c47f93d2205d9
SHA1 76926524d69a72a04ab86b307e0a1b8a15d63b02
SHA512 866c51f5606966dea27d2811c3dbb733b0804df3639fa95a71a09e75eab65fd66785e6718eae38afe71b7587dcfbb62d2db23697fccc83a6e932593b94654fe3
SSDEEP 49152:sCbRquA/m2yL5zifFiV+XenmE3/zJCGQLV9YW:FoqHVjnm4SVqW
TLSH
T193D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ce6ac1ebda623798788c329594d174806ba996e98e9e24b7749c34aa98c837df
MD5 4da5b3f900c3ba93c38eb84bd1f3de5f
SHA1 b940d749ec312ce0d16dbff7461b607ecd413688
SHA512 2c1b081b5cfc3e84bc6a36882205930f59728b127254ce67c1a2f507541d4124c2d73d149aa43f0fa3fb9761cb5227ad6f9d103e784d421fa90ac195ee69c564
SSDEEP 24576:BAhGL3IFoiwtA5l7S53nECGQ5KYVw3wIK8OH+W:BAMUFoiq50CGQLV9YW
TLSH
T1FC359D80EBF945D4F5B3AA7899B69170EA76BCA65E31C20F2160D11F1E33A50DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 a360838d89bfab81e3a91a71def8d532e23903d4b4ff938929eca4c82dd80f16
MD5 e27d62278d0c2894c9dde6b680cf48ce
SHA1 c79c59876f68dad9a56be2bbf82c33ab7832984b
SHA512 41ac525c0c0673e0bf8ed0d8f6f97977d949281d40250edb6c77c5089a843d37f692138c4abbd4a6822f14027fd9cf6a44485c54d02f6a96dfd4e4effb86807c
SSDEEP 12288:9mw5HEjsChNVBFgl0WDm+CzEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuw7:4wu4OW6ECGQ5KYVw3wIK8OH+W
TLSH
T10105F14636A50CF9E56782398653D136F7B2BC112A21D71F53B0CA2B6F37361AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 94278800349a40f568ad3bdb474aa500561abbfabd287325cc2fbd1b682d9cfb
MD5 68612ddb76cd1cacf2b0edfb18c1efac
SHA1 1392317005739a72cbcd19b668d59ca2b287b49f
SHA512 ae2cb158848c28aee4cba674ff0fbae62b80cf4395d6f4d7fffe7564e7cf7bc037a8c02fe135bbdd7a539dee8ccf2169a72ff017b2d8211614f45ed66503a68e
SSDEEP 12288:KeZ1IyGEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:HZuVECGQ5KYVw3wIK8OH+W
TLSH
T128E4124637D860F9D297827DD9B19215E3327872277143CF51B14A292F33AE19E3A332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 79d75981646d7ee36616cf16c4552f593ed2e4de35221e2511eaa8a2367c9dd8
MD5 27c911cd97c775d357a6f124ac54698e
SHA1 e3368c3b4bc36309ba529639a16aa07ab23d7ab9
SHA512 b55d3f9693ec018b12d146ec52a0bded1b438308b986ae52d0945477b193c548e0de9ef72fe830009d98e4f6f61072a2ab47379e18b7a3adea47ec4cfc0fa9d6
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U0:fQRQyi36YOcPbLvw2gAf+PN35SVqW
TLSH
T1E5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 506dd755acc251dd387904ba5c4f1d7313a4eccd7d428b1ad1765995cc10f06b
MD5 5d7e679ad67145f0ab480ce9562e96ec
SHA1 8b43a104b0d6b500c339d3ac5a45a206fb493765
SHA512 e4e5e6026a52814f5bd326b4dcd88f5c265cca9d0ac5b39108f4b16501b66e2f6197c4fd3085dac18d54098c14a2c4e5feab03b0568b02c45316b4942c1c4b5e
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U0:iQRQyi36YOcPbLvw2gAf+PN35SVqW
TLSH
T17C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fe11cbc7f91aa9f6c5ff3187af37e744e5f0de8fc939f302a60374539caa8cdc
MD5 703f3c97a30695fb8d27ad3b4dda4081
SHA1 6bee06d9aded30df919e615f975a793313ce0618
SHA512 fbd1d45135841540633cf0f667790df615b159c3bd35c92971219add514542671453b936dd69e241f232159faec51cf546f6d868d49bd44b7faf19d606fff390
SSDEEP 24576:iwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0FECGQ5KYVw3wIKT:c68Qg55nhceWu7PNU3/ZCGQLV9YW
TLSH
T137B55A33B2F600A9C04DE1769F46873196D27C758FE0E3DB8551721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6738a8a6f098be825ead05a51d54e13002178ace2f265e9f7db5d3e13fdbf667
MD5 9cda06de41c23b6ca39d4d29455d0d88
SHA1 d5662276cbbdfe0ac772a5f8034c76015e725fc8
SHA512 ef333ccd7a4238f6b1488f7a7fbf190d5415ef55e9aa740384a11d148fb8e9a347992efe8735759476d3562109e296083b1511ec6f6589ca5803f8e35a8d5bd5
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk992:my5112gYy5azzVvt69nLKnhZaSVqW
TLSH
T15D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2a1b3a64bd3fc0b32cbea0bcffbd3d521e0e29452d490cee6888aeb8d1761d3a
MD5 e776a93a4625950cd1825d1a4730f99e
SHA1 413e1911815ed1e57a6059428b943f5b62158f50
SHA512 54019c028eaa4462da6ebc4ed4adc5c536e7b56a82d3a81d30932d1855c1fb61d29e5b6f5084e497099a7fe9a852c48b30c156534e9a75d1dba7ecb4e4447b26
SSDEEP 49152:VB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glnCGQLV9YW:bu6Jmdxd2dhSVqW
TLSH
T177D59D13F1DA01E8D05ED578974A9233FA62BC490B34B6DF0A9073562A77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 81e50ad5bfb7ce7e110fa9cb122c325748af6f47c926a0e15182f42c19ea340a
MD5 44503e3dd13092cc50b0ec714e7cdcd3
SHA1 f84a5d0d3d621b87ea73756bd7b58bcbf71e8bf1
SHA512 0a6e4b7a72a89b6e09f22eb2776c484ee2a5ba66e16052a1a3b848ec3e59797945b5e5f2cfc619539ce6f6fa2616446f561fab8d6ba2f71c51f7a183d76851f7
SSDEEP 49152:W1hpsNoJpF1A63U44CwH7R4xLCGQLV9YW:WmifPWR4SVqW
TLSH
T1FCB5BE13F2D900E8D05ED17887569232EA62BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d027f40369dbd92564df235393f76cf3e67ee68d22fc51a5ca8d618127710ede
MD5 7563bd066bc923cd7485e9e0f9696251
SHA1 0e8eace75f7252a6cfd550a0bda8e48ebee1c43b
SHA512 d906addd8cbd78bee7b67f7a20bf3b706939e2b2817b40d91e0b4fcc0e211bad2a9ce6d2e93f6a186a8a64acc290d66d9adfb6e2e82b169d9fb416a4675881f4
SSDEEP 49152:qSuZQIY0Be2KcRVtOnks6NMHqiCGQLV9YW:05dKii612SVqW
TLSH
T1CEC5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e9743a8b7473785b6895cd197495a59fcbac21e01d707f623a554b5526d3c09a
MD5 0e411054449b89c5cc45e016359c950d
SHA1 f30d6933ac940e54415deb65a4040856a045b89c
SHA512 c7c6aadae511e6addddd8ff05a651812970927b5cfb10ada3f334c5ff70b09f144a4467607ddbbf80ed7e44dbc5d74e5825c529e851a79c4f12556c02b5d6246
SSDEEP 49152:vhtSn8EApI0fig3giDn0AP5w3CGQLV9YW:+X2imphMSVqW
TLSH
T14F95BE13F2D900E8D05ED178C7568632EA62BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 895e11fcada2ab322bd7a6bad560c46497e720bc4c127e687ae1d087c200736a
MD5 1afab71ac4fe633f980d55b50549854c
SHA1 dd32724ecb2eae3eb6aaf98aa67d02876a30af88
SHA512 96f7fbf6c3a58c3d42d344703a1bba203c51a3f18d44ca195b3cea4fbbee73df5502aab11cdfc98f60b32fc2dbe0e4f76b9a281b46b1d027a1470f542aa1d7df
SSDEEP 12288:qREClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:qRECGQ5KYVw3wIK8OH+W
TLSH
T11BC423413D9A80EEC24787B5A331F229A30E1CB67A95101FF2F3AC35717A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 19f6ac1fd57e8ac55ed9786c4c3f3c16f912959d882c34ccdbd08dffbab1eb8d
MD5 19c2f89a54b3649a3dc6ad34c5707cdd
SHA1 e46275909bf5a76167fcd7764c9824588d9672df
SHA512 d2745138f77eed56ba95f04bf92a555d3e938b71e58338505cffe4de5e767877d37acf1dd73dfc830b41fd9cee92cd2a554e74ccc322c534d38f2a1897168ed6
SSDEEP 12288:vyEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:vyECGQ5KYVw3wIK8OH+W
TLSH
T1CDC423413D9A80EEC24783B5A331F229A30E5DB67A95101FF1F3AC35717A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 00e4e12ba34e950ba76463d1f473c1d2be0dd918d2ef95532c04d14001c09c64
MD5 4613942dfef77648217d2942899f1fd1
SHA1 ebf15a023246c22a4767ea0f2255b07929691c96
SHA512 c2d0c6bc3f42d4d4a9f19ef069c72a274e0bf195ba0cf2a20eafa9d850335bd621fcd52132e6c2446e4f676d4dc490d5dfa6f0a67cdfd8cba01a35a8348aa428
SSDEEP 12288:6wEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:6wECGQ5KYVw3wIK8OH+W
TLSH
T1BAC423413D9A80EEC24787B5A331F229A71E1CB67A96101FF1F3AC35707A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 01b11ec86c3e2d39880827814f3721a207c6ae24916e76101f70cbc90345d5e3
MD5 4ec47ac19744534dfbbe14b28048e905
SHA1 d26bbf6e68614ed9894ccec81888ce8cb6d30658
SHA512 62de281f41dd2d2cfd50dc145e230ba424fe8d27452f29da32bb95b4eb6cb0080ed7851325aa521f4450e556e757415f39760a69bf57acdbcaeb0c02275d47e4
SSDEEP 12288:fVHEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:JECGQ5KYVw3wIK8OH+W
TLSH
T150D423013B9A40EAC157C3B5D631E129E32A7CB56B72611FE2E25C2939723F4E239771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 699f4835d6ac5993c8c38f5fe578d129bc7c355412a6c6e28d7542200bde5ed9
MD5 03c0c772b041349d111eee57a711a52d
SHA1 a6aef3478cb07c6e1c9e95fd71dddc5dc4172fb4
SHA512 78f869ece670a032795dc5063b80b67fccea0fb87a2026c497df6ba58ecb9048ec02363c2cc42cf1c4de7dc829fc210bd0c82ab8756442f9aada44c54430169c
SSDEEP 12288:EfEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:EfECGQ5KYVw3wIK8OH+W
TLSH
T1E5C423413D9A80EEC24B83B5A331F239A70E1CB67A95101FF1F2AC35717A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c655d4089ab8e01ab46b59d72292c2f119b0c9bfc013a61c097daff0b29587ef
MD5 d72849ff050cfa1570a4619a0275adf3
SHA1 75556e962fec2939ec72b378b2d266ee3f2253a1
SHA512 7a5acaaf6b503d86bfd5db7bd011bfc02e0617c58500279ca80b6ee9547f1016ef519def0b93160b6726b425d9d1366e38bce4331c7a07988c8849b1c8acfbd3
SSDEEP 12288:8+EClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:8+ECGQ5KYVw3wIK8OH+W
TLSH
T135C423413D9A80EEC24B83B5A331F229A30E5DB67A95101FF1F3AC35717A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 036ffbf736dbd9dca805f3786e4db1b0adf5015925471bfdce6605d32058c653
MD5 c1fd192946dba22ad959215a53398186
SHA1 ab38160d7ad80be1075301fecf9270b58cc4ab1f
SHA512 4c06bc39d77497a240bd48666a34509ab13e568b616db6184011a6284c4079089bda174710a4738d9e3c8ff0bde9a6ec3f24f5612ab5c3075d9b928f84bddc40
SSDEEP 12288:NqEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:NqECGQ5KYVw3wIK8OH+W
TLSH
T13EC423413D9A80EEC24783B5A331F239A30E1DBA6A95501FF1F2AC35717A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 b2a10c1460703ea02b19a996bcc2d1f26883fa8e1ef5f3b3f9802a8513c42811
MD5 5b201c0a4639b68c571951ee18504654
SHA1 085adfa90b2899d5d8c303e8f298eee552f305fa
SHA512 005b44f44a72cb0f18c61946ac7ff4410979e2f6b4f5aa6d6207d6e95486854d67c4afb10b7d59a825dff78d69a9a3bcc0ffbc7b926d320303e1242affe4ff17
SSDEEP 12288:+iZwbVzzFEoS2cPvySEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:hZMRzFVSOSECGQ5KYVw3wIK8OH+W
TLSH
T172050295739008F8DC67823EC9219916D6B27C6A0B70C61F53F43A266F333A15D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 fea7df5d653285b2335b4a1faf98c6ed56aea7cd17c74c461b6e65bc83308783
MD5 ca34be64aecc156ebfef514a10e6ddcb
SHA1 38ce3b3614e9493a9ab9ec6ae9a468c2dae4b283
SHA512 6b78e689d4c449255c302cf6f5e8c756c7b1b89e0356d84d8398c47b1083e248badec0709b509f5a3cff54470e1aadb91e2148d689f1afc47c84a81417ee19d3
SSDEEP 12288:AlEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:AlECGQ5KYVw3wIK8OH+W
TLSH
T170C423453D9A80EEC24783B5A331F229A70D5CBA3A95201FF1F3AC35713A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 198c32b61244639b912dbafa41d00ad31aa01a6a272c67fdcd055f97859696e0
MD5 852a04bb073560cef661ff5fa111d0ea
SHA1 f4396b241dad11207e288b01e8e51e9f054499e6
SHA512 6cf51d51616176cff0063671376e3459e32a95247cd4f506fc43dcff4e875ea026f5512ef10068f075fe5bfc69d3a421e861b9e128eaddf5a4de4cfb999f43be
SSDEEP 12288:NZEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:NZECGQ5KYVw3wIK8OH+W
TLSH
T19BC423413D9A80EEC24783B5A331F229A30D5DB67A96201FF1F3AC35717A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 9a4fdf99c0d42fde1877a14f58f00aac62c92b6fc2d7cd7dd562a29fcf40aec0
MD5 ab75fbd03005074205f81a6cf6a97a44
SHA1 05ed812893bdbecd964e0606fce27d42436b8fc8
SHA512 9820b96716a744fceec42b1d3600873810948637943886d0f2852c9faad42048040d86b88117bbbf7a50883f3188704a35478d5d12c1cbfcf0c7bbaca5f2d27b
SSDEEP 12288:9yPz5L8GEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:0zyGECGQ5KYVw3wIK8OH+W
TLSH
T180F4020737A520F9D1678239C9625A16F3367C3617609A6F53A04A363E376E0DE3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 8006344128151c31f0f2a46a8b897aff34efd922d247947daeaa710d15496ed8
MD5 b5a9cc0e5fba947dd9b4ac6aab51cf5a
SHA1 a7d1bcb82c8a9638cdf8ad51b41b41f376227d03
SHA512 41a46d9af5cf8befeccce34c2578d2a448a823d27a34f677b703c6dcb9cd3c05f323d01578922326bda79d6341f3abd698c14e4e1ec8dc7dba6ea89b48d79d94
SSDEEP 12288:1lEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:1lECGQ5KYVw3wIK8OH+W
TLSH
T1E0C423413D9A80EEC24783B5A331F229A70D5CBA3A95201FF1F3AC35717A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 b34cd61d59f9fd2e5ae62e8304b093741bcda778391a043458714ea59657ca40
MD5 26dfff6a47d997f8c5cd381161d54a60
SHA1 2a7474861ebbf8a94e7236ba45b0005945958795
SHA512 360df40bafcd762cb9dfe80ddab2b5ba523f0f50f0f1385b21bd46bed2893ddbd93c06b4e7accde0d686ac12af7bc3510bef3121863bbb81192a24439ac10e67
SSDEEP 12288:UlEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:UlECGQ5KYVw3wIK8OH+W
TLSH
T1DAC423453D9A80EEC24783B5A331F229A70D5CBA7A95201FF1F3AC35707A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 56696431bcde1d9825acbf40376dce01c7ce968d5274fa9a89b363fe2249b8cc
MD5 f6b4632a33a3ca8ddfe95083a4cd00d2
SHA1 0fe895ebbe8dbeedba421ff3f09aa9f31a95c556
SHA512 b31e2490aeeefd8cfd2aa9e213390d5e2272465a64093a15a1323c6a4364ea6bb444d04dc745c764dbb439417c199e0c9334f2321a59eafe4b7d4a2058228144
SSDEEP 12288:3yPz5L8GEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:6zyGECGQ5KYVw3wIK8OH+W
TLSH
T10DF4020737A520F9D1678239C9625A16F3367C3617609A6F53A04A363E376E0DE3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 d4122c7a477777acbb123347346c1f7893fbf36fe46266167e85c7304b7c4e32
MD5 9fa3b80b4d289acf40ce6d4fad36db31
SHA1 9a511addcdbe9c102cbd6ee5da5f066d68d8e512
SHA512 9c2f698298b2fffb0aaf0e8653cabf5d37a49518ebd51a69544926b7072f735e36560d963d45db523a68af471813b1af76f5f78af94edff9923a1aa0e8a7cb60
SSDEEP 12288:tCd9CWYoaLHF3z0z04PDvhgEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuw7:4TDaLl3z0zDgECGQ5KYVw3wIK8OH+W
TLSH
T1C6050195739048F8DC67823EC9219916D2B27C6A0770C61F53F43A266F333A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 3fbdd46eee51717ff5bfc6f4a351ac7ca68cae0038d053ad27494a657ce249cd
MD5 e27f1604fe137f645244b5e34f067d9d
SHA1 e91207f65555d63f1ad5092b0984e9c51cc144aa
SHA512 f172001d720e4e16e71ed3a26f9da232d2b3053d3d2a21e2f2d241ac1dde4f2573ce1bbf6d6e92ebfa2cee3ab7446f88c0f16dcd1c0b8ab65893a813268f491f
SSDEEP 12288:Pi4e7KRdTfgwCHKy7GLbbdIvrEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbR:P3vd9CHKy7GZ8ECGQ5KYVw3wIK8OH+W
TLSH
T1C725CF90F3E410E8F0B7DA3589729511DA767C6A1B71DA8F03A4651A1F33BE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 c5d27c4cd8d90d812a188b545a4debd6d6d04de279284da5c998e77533b31386
MD5 0d7026c5118bd41b8e2c2f0334a0e75c
SHA1 fa52df5e5913f6634a0b0d9f3fc0386ba73d1c7c
SHA512 d50520cb43ee3afbcb26fd7cb8498b50afdef36ee82c0fe3a360968960a008192781e0b7217632e4596ad7afb976362477d05a714619ad5dbc7368fe4be1b208
SSDEEP 12288:SQEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:SQECGQ5KYVw3wIK8OH+W
TLSH
T18CC423413D9A80EEC24B83B5A331F229A31E1CB67A95101FF1F3AC35717A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 f435bd84f76c48836d062841f54e07b84d7161cc69d84a48c479e456ee26c310
MD5 bf5ff20b751d0ee0e48f8303b85557db
SHA1 5e9208799545f2d6866de93e7ca3281e731b43c0
SHA512 81959f70484661097b8575ca72e48611a28998733afdbb8b0b7f4ed97ee7f94d45dd4814fc86b8d10cfc9c07291204b4b3f6bf94df336dc1138534c3d28835e4
SSDEEP 12288:+mEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:+mECGQ5KYVw3wIK8OH+W
TLSH
T1DBC423413D9A80FED24B83B56331F229A30D1DB56AA6101FF2F3AC35717A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 ceadd0bf72445c06548b4c1875ddd2bddb2ecb29768382f595118cc8891111f1
MD5 9008b85cdbf9ea4a12b06acd80db1cfc
SHA1 81ab98dfdd68b1c80ab79847d9e12aa11d9b7ec3
SHA512 fdbaee10bc1288c67857881f7e97fc1f192ea23d4b993dce872efb1b0619af6db7a34d514412cdf7c7ba4b1594b448879b87066a616f684a83ceeeed7523f1a7
SSDEEP 12288:nrEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:nrECGQ5KYVw3wIK8OH+W
TLSH
T156C423413D9A80EEC24783B5A331F229A70D5DBA7A96101FF1F3AC35707A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 79e2d66d1c5a6a7d0d554ecfae05cda66050a11e1337923167ba7c3e0e5eb35d
MD5 f86801f207f5e8497f467fafa9643a78
SHA1 f270a814bdbfb9b1252a3fa20eaee3c03fb094f6
SHA512 4a30746819c700018360721e6da8e5b09627557e31ed7e1c2aac9d0820b78dbe8311d25e8650bc15223b33f158b3a207b045a87e8c0cd78e19b04b63afb7283f
SSDEEP 12288:LlEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:LlECGQ5KYVw3wIK8OH+W
TLSH
T1EBC423413D9A80EEC24783B5A331F229A70D5CBA7A96101FF1F3AC35717A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 9be10cb779a7ac00c9fa833dbe43a8540891ab1fc1fad1bb0d067d9ecc6ed222
MD5 463bf87c7dc61e135371343baf99e8f5
SHA1 b6bea0c93755bfac704197ce5de6d9a63aff7e42
SHA512 4fd30fd94a5cf274dd4a9c484b6f75dbef1391ae75f682c8344506259a6d979c0b72874b8500c1a17a56e87da8239c4f577984461e7eb88cffd581752b1cb0f4
SSDEEP 12288:pQEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:pQECGQ5KYVw3wIK8OH+W
TLSH
T11AC423413D9A80EEC24B87B5A331F229A31E1CB67A95101FF1F3AC35717A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 d0fffd8a97168675a5a1303613ce8e7555ed6ca30956fdae5377633b3430bcf5
MD5 a675c88cf2af66f023a34d01a5ae0303
SHA1 5199ed86ae46cc53fc73260a09df32d7b034d3e6
SHA512 a0dbf2037dc6be18caeb6dc919a4f3565df07a5784c3f15baaebb391b8e97ca1bf369114df0723ae8b63546eefd129f06117bba1a4162b333f8daa28f894cbac
SSDEEP 12288:zdEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:zdECGQ5KYVw3wIK8OH+W
TLSH
T12EC423413D9A80EEC24783B5A331F239A70D1DB67A96201FE1F3AD35713A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 0d51172c381ec205fffdb0cf710e4565d432394d915c616e0ff9e90e7868f969
MD5 cfdb330bc5be48208b03b6611e09e21a
SHA1 3898aba62af637cdc93405d5c9d85d44438a189d
SHA512 84c6f87c6d570a76606c786f67a1fda06b92e27362a529166a926c8b55db2afd3d7ecedaa6ca68f7b352c67e25f8adb775b84a3d4cbee6f6d46ddb994d354415
SSDEEP 12288:PfEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:PfECGQ5KYVw3wIK8OH+W
TLSH
T10FC423413D9A80EAC24B83B5A331F239A71E1CB67A95101FF1F3AC35707A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 c72d247e1eaba3c67e65a67dca63c90f8100748154edfd182f7fd54a60a8a0de
MD5 81d8cb52a0986a6f72b4f50361d6bf42
SHA1 6f696750d3c009954db31c9c9c66b3902cd07c88
SHA512 316f5533585f0cc4253eaa1022c335760f32beb9505539880cef760fdf71d7dee38ea50427dc7a6ac9f3dd793e86306646ae857477da309531204829b510fe95
SSDEEP 12288:RYEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:RYECGQ5KYVw3wIK8OH+W
TLSH
T1B3C423413D9A80EEC24783B5A331F239A70D1DB67A96101FE2F3AD35713A6F4D21A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 83cf8d4bf2c01332b4787456b83433798de9709b59f7fe24f5894691a9b4fbc4
MD5 5e90e2da4e8b3de9d5e7cb2f92f91d34
SHA1 6be41712f6278fa617b136698297cb871ca4a387
SHA512 2409c3ca1b58d485c9d3d382ec4bd7ee398405f76900068c897831a8460d6a49dd5d472bab038abdb88f8803f8d851547f077d779e4e52faaeaf2038aa9ee6aa
SSDEEP 24576:QfwvUk9RX6wkyAIpECGQ5KYVw3wIK8OH+W:kMnYIWCGQLV9YW
TLSH
T10C35D029EBDC44E5E177923C99B3460AF2B178691B31C2CF129A536D0E37EE49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f091a4ed32a8882a8bc36aabb279f3efe61456269263327cfe0c7b81ff1ed228
MD5 78f7f403c5a783ef62227b1a79ace2b3
SHA1 20419618c4604979d31bca44e53f01637ee1ae61
SHA512 0e615ed0d012c5634a8c726f1a654a4879f3b12e03b7301afdb2fa23df9adb8b75273d6e09ebb1f4f8e7d672786cf236ac5f5bb94373d011d7977ffac1a15c79
SSDEEP 49152:bYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0XCGQLV9YW:+ySzPZSVqW
TLSH
T1B6067C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6f37fd630ff74ed6fa1bcdfeb501976419b4945dd070136c5338577d0f9d0e28
MD5 f4fbf2fca8a937133834dc403d7cd03f
SHA1 c24b9a6ecfe50009abf4e8bf5a38e6df277f898e
SHA512 718d42a1ec8c23026242b90f67001abfaae6166e25889dee3f0a65c2ed646c68f9e9ea0bc476fb93c22b686c34efc9f825c67bd0ac97871f239af77d929093a2
SSDEEP 24576:H47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYiECGQ5KYVw3wIK8OH+W:H47JUQjTirIhCnDHUPfF/nCGQLV9YW
TLSH
T17365AE1DA3EC01E5E1BA927885158A5AEA71782D1F31C6CF12B0837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 3dfa0b467afda9982590f13c5a2276fa39d2287459e22d4c226aa29c6a68992f
MD5 e40c1eeb44943ca7275cdb437e60a0d4
SHA1 987dc4b1eff130c48f015e22761603055ee731c6
SHA512 006b749f4c136a9b34ba0ee4884a11dbb7b1cbb88c61077d29862db94256569e676ef19e87d9dfde713959dc68361e4f112f2b69f9d7e4a3be76364e2e91bffe
SSDEEP 12288:/bsfVEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:SVECGQ5KYVw3wIK8OH+W
TLSH
T187E4F109D29841E8C06EA279C7519601F3277C6597E1D3CB92D0F93E2F366E09EEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 afb56f8842577e75de36f5d60479e13a501219250011e90a98289821d8c24c0f
MD5 9304ebf6fc560cc1f672b0d51d5a2c68
SHA1 c5c6f6fbb195f213798d412c126843956407a996
SHA512 e0ffdd19e2a39e9bc3d3a69742fa2df9794c8364456a486d38a6cb569b9328a29eaa283c5482d107715bd409a9ff20156cf3e1f84f6b672ab34aa85a6d240845
SSDEEP 12288:xz7j1XEU3fVOubRp/NBuYgJbI2ukylGzmYntJ/o9AHVww:xz75UUP3CXpyAzmYnLo9AOw
TLSH
T18A3538417626CB4FC6A940325E33D2CCAB707D01FE056B0372C99B3FD576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 d8843be9a8f96a53dc1541e08dc4b3c5dfdbfdbd6379cb6e94d86becf8f00e7d
MD5 375ceba7b19a6fbeae2cd675d6b95343
SHA1 3eff6360bf161dfb6ed3f458f83de9edfdf0b8c2
SHA512 1fe5295bdf8d9bcc0492b9247b83b6295e1b09b7e650e9a2df6daa36d69c71cd764d2ef4faab29bab8454c5fae99cfbbb052feb5667d477ced7c64dbcee1af76
SSDEEP 6144:H35qE4mNInMiW0uScbVj/Iz9W7NKspWHmeVQytMxJQytMxCHUCOdiSyzZJntY2bv:H35emNIs0CbVVt53tY2bajNII6x
TLSH
T13D75F9816537A78FC1BA2032072A6B4C6BB4EC06B7056F2773C9453AD86A751B0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 6c3e62527f63d1848bae3534162fd29571067618a469af6d991e764ad049f815
MD5 e498db894454897cac672b241f094db6
SHA1 d23e79443fd9622c445522e5b007b1e758a28a3c
SHA512 d94e609f4256f412cdd1f02bf95d2493c204877bac8c1bdb9239100cf151a7481e8f6aab0bd2b5ba2c332f3579d8b4d96659bafafc24013eaeb69333947e4b61
SSDEEP 12288:iz7NEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:gNECGQ5KYVw3wIK8OH+W
TLSH
T1C5D423012B9D84EAD16B97B46231E138730E7DB51F90909FF1E2AD397035AF4D63A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1a948b70f602b0d8999ce61db338e4cc86124ac24acaf74501f3aaa53b2869fb
MD5 820e7e8c9e0ff09c79b057ccfc65d7d1
SHA1 6898e37898b90a2976f3a581b2acebbeb4cd3cee
SHA512 e11df45987e894171f39d4c1045cd8dfc943355aac174de5d757757a16cc07f0e76f470347e3cdc0a3db3eee471c4b88eaf00b1dc33dd5682bc23270ad5a9196
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bYTECGQ5KYVw3wIK8OH+W:wgb4mBIBhGF1CGQLV9YW
TLSH
T18C659E1E22EC02F5E0FAD2B89DA64417D6B278161732D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 6ab16d93901b84ea9f6feef5411999ed822e712e7834aa4eee0dab1b514fcf90
MD5 fc295bea960cb0ac620fa54c30a2bb9c
SHA1 721b63752259a4f81c84db4f810ed464454803d5
SHA512 8686fe7c0d441b3becb152882821bfe8848f1d1ba3faa770cdf75e518f2ab35d06b2c1a6d996b63ec3952713d10ea206e42159e93b254a88667157eb57aef572
SSDEEP 24576:dG88u8FpJqH1bzria7/mSECGQ5KYVw3wIK8OH+W:w7ZFPqVea7/YCGQLV9YW
TLSH
T1E035F16577E101F1D07BD1388A424663F6B2B8251364EBDF07A88F552F23AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 1dcbca506ac9eba3fae5974d79a95d73117987050737f47ad2173999bad70d2b
MD5 82e6b4b22cbd97d80e979572934e1168
SHA1 89b08560b1bdb24b51b72a540a664d579e0e8075
SHA512 bbf3feae6705ed8ab8cfed4819fcb2956c2d1a811b34297d6b59dcdb149b3c6ac38daaf4784a70edd2aebb6580b6ace214dcd1fc9c309aa1217b964ceee1f107
SSDEEP 12288:RHvUrBFrEjwaQOEClIC95IZofBDrf9XTE+eSNZI10DgOegvGULvbuwB5:RPUr+NQOECGQ5KYVw3wIK8OH+W
TLSH
T13F05E11F26AD18E5E676E17D85428319F7727862171292CF02E1813E5E37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1d73e312292b717d562d230c13b096820cd77cf1dd267922b58e92fc6d660464
MD5 5aaecd103678feac07250b0d6d929c36
SHA1 7da2821ab0ef58725e822998eb2b09a529dfb810
SHA512 36e1f311e52bfe25e54011f7f0cb97a696de54abffeed323dd244bc29fe5c9e2239b5f368423f32153a2100f2acec43d032bc2ee6efc0b966831ed30ca078fb1
SSDEEP 49152:JBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxCGQLV9YW:qG05lO43bySVqW
TLSH
T1FCD5C06A62EC11F9D1BBC17CDAC6460BEBB23825033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 da8b8a19ee53dbf0c2c34902995434641a0f1de60ec02b7d15ee7d90cf94618c
MD5 46c1eef73735d0e5d504693f9e831491
SHA1 9ea93617b5bba50d4e60a5e31828c0d37a8af795
SHA512 87da7989382f27dd2c2c83f02a41056637f25f86c96dca96a16156635998a4d6c11fa21a100e2a2aad908ad52031b5a9750d32b0e4c944a2de32968e90b6211d
SSDEEP 24576:Gfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnUECGQ5KYVw3wIK8OH+W:ea5POZ3BJt2pasx2+mZCGQLV9YW
TLSH
T13165AF5EA6FC00D5D179D17DC583861AF5B1342653329ACF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 be99839af64301d014bc5553616fe40e85c158f3f0ea7c220720b1e680b9bdde
MD5 30ce484c8bce18d071ea549f33e26f0e
SHA1 7bd32f9f78ea0c55dd4a65818b4afa2f36753b72
SHA512 82cf9f6286d32708a2a5b3d606adf144535e69effe428018cdbcde2f89d3172a562fd0746cf0488914c05d8b9af8473380c9489c5ff44eaa9f118ae3351188a3
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkaECGQ5KYVw3wIK8OH+W:VNc/zEOVHF4CGQLV9YW
TLSH
T143857B1623E901E4E1BBE1BE89779546FA717869173086CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d24089e1702f85f81beea51d77590f35e7a45c0201c7f39c0bf7d8375f442831
MD5 902e71625170c7585fefe8030b8d58ae
SHA1 754155a88a98c78a19e392c09831ce38dea51bad
SHA512 3191dafab449211f5a488bcc7a836cca7b537c89852ad2bcfc14509c97d2bc6ebd7f1932fcff02e13bcc7971a7527538988c4aa27c484fe55c7008725c9916b8
SSDEEP 24576:4TkNvNnaFeYhJNtmZBmYECGQ5KYVw3wIK8OH+W:4TMwBtOm7CGQLV9YW
TLSH
T18955AF2EBAF845E4D1FEC6B5CD238512E6727461073252CB9290C13F1E679D89E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 3e3d5087e6abe8924ad11deec8ff6b3a1ae1cbd306d3931b32675e943ef7e1de
MD5 8b52073b9c14d87f493fb0cd72ff2474
SHA1 2afb2c7c8db61bd95638dd7dc048c9e5c3bb3112
SHA512 1401528d737c2a276a86ad2dcfaf2b2bd52af0fd89d8add213fa7a6a144a9788814ceec72a2ec42608f1bf8e1348907bf729f49552b5fad659c044ee710475c2
SSDEEP 24576:BD3FHshBIYQgAxECGQ5KYVw3wIK8OH+W:BDVHeBIAAeCGQLV9YW
TLSH
T1C825E17DEA9C04E4D57BC2BCD6638606E77138A9032265DB12D0C1BA1F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/420-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/420-380-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/420-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/420-88-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/420-94-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/420-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1280-311-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1280-120-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1280-114-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1280-112-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1324-320-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/1324-1-0x0000000000B90000-0x0000000000BF7000-memory.dmp

Download

memory/1324-0-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/1324-8-0x0000000000B90000-0x0000000000BF7000-memory.dmp

Download

memory/1324-86-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2544-60-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2544-292-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2544-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2544-54-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2848-136-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2848-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2848-131-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2848-125-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2848-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2864-312-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2864-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2864-107-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2864-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2864-100-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2864-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2880-77-0x00000000007F0000-0x0000000000857000-memory.dmp

Download

memory/2880-76-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2880-308-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2880-82-0x00000000007F0000-0x0000000000857000-memory.dmp

Download

memory/3400-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3400-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3400-20-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3400-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3400-13-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3728-66-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3728-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3728-72-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3728-307-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4132-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4132-49-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/4132-39-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/4132-45-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/4132-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4624-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4624-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4624-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4624-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5152-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5152-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5152-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download