12e64343c6bb6037542c4c17aefef33a495d42337939f48d3ced4557f26a858a

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 12:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
Size 1.4MB
Sample261102-n7n2laszgv
SHA256 12e64343c6bb6037542c4c17aefef33a495d42337939f48d3ced4557f26a858a
MD5 ac296e423e237adde1f4ef5ef45e6b59
SHA1 12398e1957fb377e78caf7743a5d5292a043ab1f
SHA512 8f0dd4f759dd9c3d3c3684e7d7de94cfed34bcf43ce3bd4e411ea2ddc32ae56aba1a6aa4adab76e101a94de7814370c7a9d4d8ae91906508d782b25062cc50a7
SSDEEP 24576:FZhtWw61OPgBpRM3Rt1lBAnWdCN/j2GLl3iFSE33b9:FZhto1KgBpR0lAZN/j2U4FH
TLSH
T11665CF503BC0C136C1A1317286EADB745A66FC604F39ABCBAA503B3F5F365C2597531A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6140	elevation_service.exe
4072	elevation_service.exe
3772	maintenanceservice.exe
2572	OSE.EXE
3292	PerceptionSimulationService.exe
2452	perfhost.exe
3364	ReFsDedupSvc.exe
5056	SensorDataService.exe
4592	ssh-agent.exe
764	AgentService.exe
1300	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\34f65ddfb68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d353416c26add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ef536617c26add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c353fb56c26add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047251516c26add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da318c19c26add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
6140	elevation_service.exe
6140	elevation_service.exe
6140	elevation_service.exe
6140	elevation_service.exe
6140	elevation_service.exe
6140	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
Token: SeAssignPrimaryTokenPrivilege	764	AgentService.exe
Token: SeBackupPrivilege	3364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3364	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3364	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3364	ReFsDedupSvc.exe
Token: 33	1300	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1300	SearchIndexer.exe
Token: SeDebugPrivilege	236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
Token: SeDebugPrivilege	236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
Token: SeDebugPrivilege	236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
Token: SeDebugPrivilege	236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
Token: SeDebugPrivilege	6140	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
236	2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 4872	1300	SearchIndexer.exe	99
PID 1300 wrote to memory of 5532	1300	SearchIndexer.exe	100
PID 1300 wrote to memory of 4156	1300	SearchIndexer.exe	101
PID 1300 wrote to memory of 4996	1300	SearchIndexer.exe	102
PID 1300 wrote to memory of 3260	1300	SearchIndexer.exe	104
PID 1300 wrote to memory of 4920	1300	SearchIndexer.exe	105
PID 1300 wrote to memory of 1148	1300	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4072

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3772

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2572

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3292

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2452

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3364

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5056

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4592

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4872
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3fc7a0b62e4306abbc19da5d163ce96f5ecf2e51db1f2c51e9befe2ee75b9abd
MD5 5ac24b6a4eaec4596ee0521190c57f27
SHA1 047e1bcdfd48fc31e9adb63dbeab8eec9632c508
SHA512 ead148f2ad988a199e2f9e7bf39c626dbc88eb89e5a6b864f02bf36ff37708ebeb4524bdd30daf4a1e901e7111b2a6392dedf5f7f3650a00e6b471cfd4092330
SSDEEP 49152:ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxnSN/j2U4FH:M3q6sjBHj2jF
TLSH
T12AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 df7de44c1a776ea72badfe782b9ec9bf2e0a4a70275fdb8081d1c7e51beb5bc9
MD5 bde29bd6f5956c66ae25bb400cc0d10d
SHA1 32e8f1c43b3a7b8cc6b505759209b9cb4eba0953
SHA512 88e9df379bad5187335b58eb9a659b1af5c059446f430c37e1e44f3824dc3296e0170d516af6c18d40f45d56b927071983caf8bb260f85b7d35128826ee20128
SSDEEP 12288:Q1XLsswWkxy2lRq2czAeJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:GXYfDtczASdCN/j2GLl3iFSE33b9
TLSH
T1E665F128B7E049F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 0f264ac6e99a1f7f6be0e217af78fbb79b774bfbfc0bcf561db0dfbaca3dc825
MD5 925b7283f0948e129dbe43f3a2eeb2de
SHA1 56f497eb0ac14cb5e817cab549f551dbbb009bb5
SHA512 10a9a4bee9aeabe0df88351b48656fd40d42c05952e0701c8a92e205aacaa4ed2d6ea1339818ecb89d5b271e1ff39d14cbf9c5a3976626b40dd7918fc7fc2096
SSDEEP 24576:H0Le5ji0hmxxrMFdCN/j2GLl3iFSE33b9:HPji0AjHN/j2U4FH
TLSH
T1B485AE26F6748335D073C0B9C5D2A69AE93130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 36eec1eca5e4e74bd887e6ec928243246324bdd479dc3aafcc15c1e59bedab6a
MD5 dc3633c81356fcf88338ea72773d2bec
SHA1 531de2254debd6c19e8ad27a6574a71aefa2a645
SHA512 2aa3c05344d559ee871e75d4e2728e58bddfa01e879074813ddd3b04af67e831cf4226461dd71e3b5c048d8fe0e9d0c052883e80f312a1134215e282bab8ac49
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWn6q8wyu7dCN/j2GLl3iFSE33b9:r/ezSC6vUzPveHjyDN/j2U4FH
TLSH
T138755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a8f826bad83573aed665d7f098b56e51f7bc9dd642f241d8e575068918f9cf93
MD5 dffe30d3a68e7d8538306675e8ceb491
SHA1 061822fe20fe9a33d8059d8a448337692319aa43
SHA512 6a050ce806e251de44449ca77d38fe6f4202814c0a95c018d4bd1da88a24aa24ab425e147867fd3128c30849617a31680b5f46d277621d5e1aa618c1c707bd98
SSDEEP 24576:0VbqPb88hv/l+Y2dCN/j2GLl3iFSE33b9:0VO88hXl+wN/j2U4FH
TLSH
T121559E66F5748331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e55bbe7d0081f82825bca538b63ee3699909a1b75ee36d4e2be6474c4c9d98b8
MD5 743b114ca4dd918057294a7772d202bd
SHA1 2b96173fb44d01926123f2f2cfb75df2b3bac458
SHA512 0f465925debbb7865f3bc306f0ab615e3c1feb50189261f72edb9c9d303d8d08311bff8f2f8cc8a85154adf9ec2f85c3a709483bef48baf5237036241c9980ae
SSDEEP 12288:nLtJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nL5dCN/j2GLl3iFSE33b9
TLSH
T1C5452360DAA5F565F26F837903ADAE615600EEE8E525884785913FEF527CFECC032063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 558c252705090d8d7b1b02a615981392a48be45a61a7deb22e1b639c65949aa0
MD5 ebc2845eb5eccc7f025c0ce5a60bc4f5
SHA1 015c20f2b6aa853880f7a7360d402dc44ac3f3df
SHA512 f06c9f800790ee842d748fdfd7ba2050c08a8c19c55426fc4f2e9e7c244752b1430f90456fad8925a99b317fc613c0acd2cb13c9ba4ab45b4a506ecb98afd864
SSDEEP 12288:LeBNUbTVO86UCJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:LJIUedCN/j2GLl3iFSE33b9
TLSH
T16B65CF3BEE28FCE2C27E8DB857918600976278708B6293CBD165834EDE235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6e817d79b5c74faeb3a2b7cc55c204a872ddb9d529a391e36d32a10f60067958
MD5 f457450b63fc3c79fbe76f30beb2fc28
SHA1 b5630f08c9cf35a9130fcb8484d34f43cbbc9967
SHA512 8b16ab3c2bc663c1c5d06d1aad6a65885c0b6ec05cd24cdaa6694144c3c443b6faf337281ae997711c9e921ad02233cfa6240326abbf0c2f9a86eb4a17122360
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THg:KQvGAdlCEL8c/DRNw5C0j2jF
TLSH
T157266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 31e8219161ca6b93681e59547b4349943c7b714813b800580b07af181d93c315
MD5 bf02b0a3fc541aa05083242642ed4d9c
SHA1 ec7a4b444f2200c70c5d974c47e276225aad973a
SHA512 169010d97661e1b3b8be91c5d1f77b06438a44a3781836b2035bbb65cee2d924145f1f362050f00f30e75ee3188e461bf51f580fa667fa06196060453ecbb778
SSDEEP 12288:9AwSfxL/2Dc3RDLLmt0LDQewsAjkJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9c:u0ewsAjMdCN/j2GLl3iFSE33b9
TLSH
T12075E031FE74E036C27F0DB61B36D716142CBA608B6119C3E3E84E9E59346D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f046e7b236d785a26a1c3c94ec91adc425cf134ed8589ad6063b305a2dbe3e09
MD5 f02f2895eaed31064901aa54d9b1d753
SHA1 3eda051824195ee769dcae3458ddafab5b54cedb
SHA512 8ccb88d58f2163bafb3713eef8cefbe3c0793b0da2bb31a178470f3ee6bf16130659e14cee202982afa214230a32f392a49d31a21dd180002fd939254ade0ea5
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHx8F:SUEtQevvqc2W1cpV2tI32x
TLSH
T164474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5a31641454e3233595da3bb3c1d394ee66dd1f90e5e06e53b99e72f25394fb16
MD5 5d9ae632dd35a45c9cf6ece569352437
SHA1 b89143a0a7b92776f0e5fcc4409658cf44b8a4bb
SHA512 8071db37d06539dcb0f8ce9b486478c6bb61d5316cea2bb736f0e54be56d95a6528e35ff1581e4aedb4a4c590c56ef9fd29e6eaf7519eef87e199329dd135aee
SSDEEP 49152:OCbRquA/m2yL5zTfFiV+XenmE3/zXN/j2U4FH:joquVjnmIj2jF
TLSH
T1D5D58D0976B8C2E4D1F6C77886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1a89668ecff7c444910d62c54317e1f5fdfdcc06baeda4fb1d20ed28fd79a31e
MD5 e52fc54d477b508398896a90d19cf646
SHA1 782afc605a4ab882b217139cde38fc7869133d63
SHA512 10d4f730a333693fb95030159b58a73e71014b5e217af4f06287bb2062809a546ee1e1768f13679a73dbee40beb6b8b61a1e92392edd0b0dea2d308bdd6acfca
SSDEEP 24576:mAhGL3IFoiwtA5l7S53XdCN/j2GLl3iFSE33b9:mAMUFoiq5UN/j2U4FH
TLSH
T1FF35AD80EBF955D4F5B3AAB899B69571EA72BCA95E31C20F1150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 9dc9d5d58eaf57e34a666f07c5c3f745609fe9c2d8e84dc174aecc97b8a94564
MD5 5c6d416810aeab418ea30fc4b5386c43
SHA1 6475de0d7a230fdd24cffc1e3dd541146ad7d44b
SHA512 94f973a7f17007b738c819a82c55ce23e3f4a2a6a6ef8b8a0a29b9bc316186678a0c9762f272df9279abe054ba8b1d24b234bcb1504d52a14603814dfc544b47
SSDEEP 12288:amw5HEjsChNVBFgl0WDm+CjJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:zwu4OW4dCN/j2GLl3iFSE33b9
TLSH
T17B65F14577E41CF9E56782398697C536F7B2BC512A21CB0F03A0C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 dbf31e6c1ec63d3724588900d8159f7c350ff92bf2c2bb61422991797b3143ff
MD5 c68ef475ad7941a640169919fc1a5dd6
SHA1 7fe90c960d223e3d76c0531d6fe5da866605168f
SHA512 31874d8cd218cc0024702253d918d305f9410203e7bef4b2f9391813d939f251bd8ff62e72e9d6d97ab27683000e09567228682a81abc8b3c97da32f3cbc9058
SSDEEP 12288:VeZ1Iy0JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:gZutdCN/j2GLl3iFSE33b9
TLSH
T1B555125937E471F9E1A7823C8AE59A05D321B8A5A73243CF025047EA2F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 094c41686bddb72da80b78cbe3094dc03278028827b57b4c7db8ffc4a50fe5dd
MD5 9a8231fc3fcd9cbf1b5832c15b466f49
SHA1 45f0e8c47eac7086b328a9c3bcfd696ee59815b4
SHA512 280526eab0de57908f17571b5bde732081229d50371694ada985b5ae75a973ee145e529388e901019badbdac49a2cb2b96d3c0dec99a3725066e5a15358ea9f3
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uc:HQRQyi36YOcPbLvw2gAf+PN3zj2jF
TLSH
T10F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f8e4633c61a6e46a4e255e5c05dcaa7ce31eaeadb0e228bcf01c05dff83b5220
MD5 c5dbafb9533267297460b5584869fc0d
SHA1 c8554f4fbb07ae7e23525e5c4826df6fe594bcf0
SHA512 6c28787eb24950335861075d9c73a07679f98c5c5e8707d23552740dfcb6f631415d70f611a3a31c630b0d81a030a80d6c0e65ce5852b91eec3fdfee3229ca35
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uc:cQRQyi36YOcPbLvw2gAf+PN3zj2jF
TLSH
T150667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bd00291c8ed8956777f87d7963db3ae3f300851fa25d2fb1cf3b4ef8f6505209
MD5 e30be54a47d0f7c75b65131686f1a79d
SHA1 adc8842464f880083f63c6af45652f3963be5336
SHA512 632a9218390c85dd28c3adc35a996c649c3a8e47e79c025d5d61fed1bec5645bb7b679192b3792a5303394870e61f56f9366bde578332214fd8b6930d8d95407
SSDEEP 24576:dwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL09dCN/j2GLl3iFS+:Z68Qg55nhceWu7PNU3/HN/j2U4FH
TLSH
T113B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fcee73cc8ffa4e8f4fc09d1b95d1c5b9623f9d4d6cecbbf1cc6bc1e09ded156a
MD5 35253a504f8d309ae60b8752b6700bc7
SHA1 4f88d81fe330ce102382644d011e4d7478301934
SHA512 5e771880b1f2da305cce8c90526c46d8ba9e73190a80bb20ec390fb86238f64a975d5cfffb37de69478ebefbebdb2c5758f3c996cf2c530d2c03a9640d0dee9b
SSDEEP 49152:33aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99+:6y5112gYy5azzVvt69nLKnhZ2j2jF
TLSH
T113168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 68f42646d7dc9b7c87e7903ccb8b5dc40441a14c64353f174c8cc08546380525
MD5 6a4675dba7967320d5bc74b4ad45430c
SHA1 0b6c5922230e44950382019736fa45e570b1b5f2
SHA512 193e10627c4536c7313919e8c01b679c95dd294c88e0399ad13b9bfd44b86223713f700c1f1bc87f92b71eeaa76fb5e696039ca7eed584230172cf72eb1e8b57
SSDEEP 49152:KB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gllN/j2U4FH:Yu6Jmdxd2dLj2jF
TLSH
T1B6D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3def6407980a78ab610a016577c91169920da4f90a44e9a602971bd17879bf2e
MD5 a8f3f1acdad85c8b9cf83c376b5fe640
SHA1 a836f3b518f56198b088d78e27dcc5c7f08cfc09
SHA512 449ab28a1a693c0e84f82978eb14e2691a3fcbe49f71ba3f3609697f1e8b551ccd858f43a4ef4807ab7ff465fa19243fa6677e3b1d565bd5f2f0e80c6ef24373
SSDEEP 49152:y1hpsNoJpF1A63U44CwH7R4xBN/j2U4FH:ymifPWRIj2jF
TLSH
T12DB5BD13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3fde0850eda9bfad02e6a7dac13b06a095c12e9b0eea1094b23c8564385bc75f
MD5 62a89011fc846fb8c2c4ea0fdd2c4a68
SHA1 f27918340539b97a3953bd3ab7d6cf191c8ad4b8
SHA512 c2e489592cc7839b373075c1cbf29c17ea5c39961492ebaecf29709e84bef9819283f35a7b5ac8201d4ddd03a0397dea79f04f5295a5ed42578cf4bebe10cbe8
SSDEEP 49152:JSuZQIY0Be2KcRVtOnks6NMHqCN/j2U4FH:H5dKii61Sj2jF
TLSH
T13BC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9d8464d09c0eb64dea8ce44b31e67968d8c8dc6b5628a16d480bf942c2221863
MD5 0a03217bf8c691a0aac0ef541a0b4e27
SHA1 ca6d1a045df5283ba9d864fe4b8e33a2084a1f57
SHA512 572daa8d1618f88cd09daae5832bff53b9af141021273007ab685d2609f76204ccca4ac3f5792b92edf91b28545a96bb4af2e2ffcc56b5c96bc078d22d3e3469
SSDEEP 49152:nhtSn8EApI0fig3giDn0AP5wVN/j2U4FH:2X2imphcj2jF
TLSH
T1BB95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 88a666797d74419ebcc6b58f3468f781aff43af22e5967145252352cd82c8fc7
MD5 d44e7638ad1df9cb2a5d0fea39dac0f4
SHA1 ffbe17588930a1fc8c489fe84b3c02904e5e7334
SHA512 e67eeb7846557e086c997ba39b21038d98ca31fe8c2a2e054eb415250ab800870a862ce045954c79c327116e96102da633b0f909ad95109647445597618f6490
SSDEEP 12288:3FJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3BdCN/j2GLl3iFSE33b9
TLSH
T1C2452364E9F6F669F15BC37D43A9AB555200FEE8F6224447828116EB637CFEC8032462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 724e7d2cdff441c9020c089f740248ac257885e2b65c3501d5fca231f2595683
MD5 bababc1ed1eb5c8926d5272e970bbd32
SHA1 6a2c601479cebee80c47ff6be85d6946735919f7
SHA512 2fcdb20f7ce9fa7cc34ad4999042d419a46891440eb376752d73a458bcdfb77077ec11430da397f3017cd203c0663f87d96b2032f4e6e0443e3e1ffdc95f1b75
SSDEEP 12288:1gJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:1QdCN/j2GLl3iFSE33b9
TLSH
T180452364E9F6F665F11AC37D43A99B555200FEF8F622448786815AEB237CFEC8032472
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 83b9c55978b167a1d22b91d4a3c895f10a4d3f7732401a69aa341997e495448a
MD5 27895111eb8a751c089c4f3b265ba187
SHA1 0ae00a25588067781e809e5015b76ac50b957c7f
SHA512 1ad290cc75aa5ff65a077e456ab250a9ed4f13515d312ddff841a6927ce07202cf2a117af00a0da387438070cb9239438d6df4cabfe2e19592fce30f8ab6e520
SSDEEP 12288:66JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:6GdCN/j2GLl3iFSE33b9
TLSH
T183452364E9F6F665F15EC37D43A99B515200FEE8F622448786C116EB637CFEC80324A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 eda294969e004b88d74c51743e85c54f5e4e916704fcba698406daee29973694
MD5 1206d54ea28d2eaa46a1f84e9c3a9827
SHA1 904fc952b91c0520519789aba14d22aec86745ce
SHA512 1e4bcf93aa121c30100f9515b7936fe8d4f4a33e5e2bb0c4b859ffcbdd26187111bce9e693d05762ea807fabe1d90a4fcbfc154bd5908c6b35f8624581ce39ad
SSDEEP 12288:bVXJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:tdCN/j2GLl3iFSE33b9
TLSH
T1F9452360ABF5A1D5E06BC37D83B59A11E320FDE8E732458F87401AEF1B74BE89431562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 315392a8c520e084d5f70a29bfcec2a83daac214842156299bf4c378793a22aa
MD5 54293f1afea056b4c6f2033827023258
SHA1 01d0a12e662be9b4e1d8ad46eeefdaf888ca5924
SHA512 2846dadc42920e79885c2a84b117ca2f775298bac31109654848130044b4d618bbe7bcf612149c20419aebd76381ab12c268328221dfb796c19157beb3e3567d
SSDEEP 12288:F/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FvdCN/j2GLl3iFSE33b9
TLSH
T11B452364E9F6F665F15EC37D43A99B555200FEF8F6224487868116EB237CFEC80324A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4027141258b63d69d4e1d1831f9674815eb0ba4acbe8adc192c95a02f4b91843
MD5 d9bd7704c6d0c457855480011ed36d09
SHA1 afe9d97d405c72a8ff0ff8525c4e7ca5a0d97a9a
SHA512 19c73ab4090619e77f3ccd4b7f3c78c9107d3c12b2992116dfc3f456b8236d2f813d1d5298f10f44bdc1fd378993e7cb0c1a338c5b5a098d8227ef16fc84d179
SSDEEP 12288:58JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:50dCN/j2GLl3iFSE33b9
TLSH
T1EC452364E9F5F669F12BC37D43A99B555200FEE8F6224487868156EB237CFEC8032472
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3d7c7d759782d7293f6fd51cfe0f8756c5098e89427cb8d6d928e3b06f22e32c
MD5 7af85f5d4a257f868b95ff916af43b18
SHA1 ecfa63a5f16ce4edda04a65597ab11a91576a144
SHA512 165bb7f96044af8d28d6922c17e9c88f1d49de6938e29899748096a63c665ac3963964e3fb2d11ffcf7ecb711c12c92ab28d53f302e969e92e30eefed0068999
SSDEEP 12288:ioJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:iIdCN/j2GLl3iFSE33b9
TLSH
T100452364E9F6F665F12BC37D03A89B555200FEE8F626444786815AEB237CFEC8032472
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 99a4a08d8b56efe3a0bf053862b68f728a7ca2da304922d25f3139d7dbcc6ffb
MD5 cdb30df24c5a9643f960a9b4082722c5
SHA1 cae01c03ee64783e4e2bfe081e7e167db528c8da
SHA512 0f776ad6c50a23eecfb5e5104250c884b59335adffd8c4eee1112b4b3481c3b158593e8f5aa738955584a63f9821f482a14a693df9f0fbf3383d1e30a92162f5
SSDEEP 12288:biZwbVzzFEoS2cPvyAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:GZMRzFVSOwdCN/j2GLl3iFSE33b9
TLSH
T1556502A4B3A058F8EC67823EC9658916D271BC594770C60F03E4366B5F377A11C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 231216424f1bb25c99b96ab6807dd2dc11f7c2e93c717439b4ec2c52d259837d
MD5 2b2034d41709bafe9dfefd6af53590fb
SHA1 783f60ae4dced73ca26c5b1805fb42178a2139d1
SHA512 b3718a468256265a5e7c417fe01febbc20824b816050fb5fa6db74931ed89faf6306aa4124cc50b083a33a072c763a6900f7b47cc2432628229950bb008a387c
SSDEEP 12288:U5JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:UddCN/j2GLl3iFSE33b9
TLSH
T183452364E9F5F669F15AC37D43A99B555200FEFCF622448786811AEB637CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b0b29853ccfeef6e2024bad591876f2923cd5876e9fad384c2f95ec85d4ef80d
MD5 6a28079a2d8e8a43b8a0946608b27dcd
SHA1 6094e8ce2f1a9f541588926ea21c064392bfb5bb
SHA512 b765cd25ef15e0cf1c79d84effcb43d7571af662ab407b7a1cfc4ee326b924510190235038610a019e3bd72a804f2294921a563ec9631240292ba77f13f36b43
SSDEEP 12288:g9JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:gpdCN/j2GLl3iFSE33b9
TLSH
T134452364E9F5F669F11AC37D43A99B555200FEECF622448786815AEB237CFEC8032472
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f10230712c8d6f6293106defb28d195ca456614890becabe91de6ea899ddb598
MD5 7e8075a6c7864c67ce80ebfe75588118
SHA1 6f4f1dbb940dad89e75432c90451a8b71344a35d
SHA512 be804c60df1769f39db9e035cbccb759b2d5a2b5b398907f8bdc119d850a7067b126588a16eeb3b32ef1b7ad6572835a8d4c6f82845da614b893be6390160336
SSDEEP 12288:oyPz5L80JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:pzy8dCN/j2GLl3iFSE33b9
TLSH
T16D550217B7A131F9D177823889A65A01F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 645733ef7053910032bb3f93cac4bdf80c6fcf7265d1dd1c5b57eafcabfb484e
MD5 93551d534a23b72a60d0b8581916da0d
SHA1 31f907a574150342216a7c3bedb873d3d7722c5a
SHA512 09272491290507845c1e21d898e5d2ae90bbdd37e6eb0738cf5cf632a620419201d3993f4f4d124b021b28e181cc993157f43ee97d01aab6b015c38a8d892b6e
SSDEEP 12288:h5JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:hddCN/j2GLl3iFSE33b9
TLSH
T14B452364E9F5F669F15AC37D43A99B555200FEECF622448786811AEB637CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c6b1de4aed05890e6ef64077763d451f275e33cc8dc3305a25b5617dc34bbcb0
MD5 ee2597a5c3de3b8628dbb1186c2ca46e
SHA1 abc3cf8f4c9d011b1751492ae8c8567f1182632d
SHA512 719575ab7ff00c7be5a8903fb88e45957a624f6c1ca3923af105a7a46ecb3d609ce96bc7a573badad98b75a465fef9504850d9b31573cc314550d25d99b28659
SSDEEP 12288:55JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:5ddCN/j2GLl3iFSE33b9
TLSH
T18F452364E9F5F665F15AC37D43A99B555200FEFCF622448786811AEB637CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 8d368957d5a04686c59d90a778758942a3b552d26bd1c251e64aff763e8fd78f
MD5 4633c59be2ea9a61f4d78e36c9f1ef31
SHA1 4e3f204af638d4d5e47a103c27f27ec71ef680b8
SHA512 51383749cfa07f3bcb53b8368a3475d58b2817e4ac6d5437eaa6969be1d5ba198cefb2c86ff531dc23c524bd19bead16d1a6f689e6e57a867faa914c41e5ef5e
SSDEEP 12288:wyPz5L80JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Bzy8dCN/j2GLl3iFSE33b9
TLSH
T13F550217B7A131F9D177823889A65A01F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 84b75c3350c6189db763157ae3be16e8117426113b007613cc35922d657243c1
MD5 26eb37c6a8adbd523069db35ad70cde4
SHA1 3eee65b780758b96193ea1365d6e2443680fc971
SHA512 795b42279f1ebfa646733aad63dfde54c507042bacd923bca41fa1fd2bd8ec2f6cfe1d0181170f7cfcd5c61e9ca19ca74467c1a888ae3b2d4934ac80a168122c
SSDEEP 12288:LCd9CWYoaLHF3z0z04PDvhqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mTDaLl3z0zDWdCN/j2GLl3iFSE33b9
TLSH
T1946502A4B39058F8EC67823EC9658916D2B1BC694770C60F03E4366B5F377A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 5e377c365ff1d78916217e29d89e30facd404ebe349282ac7dd13c3eca211bf2
MD5 9fa4b59c33e9d417045301eef62b6077
SHA1 4b737841181e3b19e269f43085a999f9327e0490
SHA512 e18014d79716e19f4b90016d00eb61d990bdee49ffd60647d3160b4d3c7c465a33e7f9f9ef6c94b44f0acab2b0421f338dcd600d6f439f00d611347aaaf3b053
SSDEEP 12288:9i4e7KRdTfgwCHKy7GLbbdIvLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:93vd9CHKy7GZadCN/j2GLl3iFSE33b9
TLSH
T19575CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6637379707f6e8763874f93604c5364902f40ca9071066b808a43dc634232b26
MD5 b81f3e6d7fbeca972389f4a90c6321ff
SHA1 1262fe427fdacfbc7b0c14cf3a991205e67790e6
SHA512 50d0dd209e6050e6e4e2f51cb42632adcb23144b5d665ee7322120f26fcc5f1500b49b2899bb5586fa63681579017618cb1d8c178f793b16b6efc5b1d178fba7
SSDEEP 12288:XaJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:XmdCN/j2GLl3iFSE33b9
TLSH
T1F7452364E9F6F669F15EC37D43A99B555200FEF8F6224487868116EB237CFEC8032462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0edca61aefef6714d6c3b7615ae2b956546ad3f6ce18bf364cfac3ebf26e03aa
MD5 1a1e6ca4a186d2f224e8c924d13311ec
SHA1 2b9383c59b5b94b14f480436466fc4bd44c52806
SHA512 040587640ecd1dd72746a97d86e2689b607fbe46e96ebe8aa9633f3f3198492fbed4df92f5524945b1f2844ae7bc336decd4155eb3361773c3f32fdbce1962c5
SSDEEP 12288:HUJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:HcdCN/j2GLl3iFSE33b9
TLSH
T111452364E9F5F669F16EC3BD43A99B515200FEE8F526448786811AEB137CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 194116b95a698ff38fd506b3d39a994594359a78bca2634e06c38db045c7b793
MD5 5a87535f41196b7e14eda55f2182e348
SHA1 f8fa037e26f79561c9b21b69cdd04e057ca0cc94
SHA512 3adb6a1da35dc19647a3c49e5b2ee8e69030ac4270d4871671a351cb7784b224055b98a53361fbb5e688547ee344b6d6a65be3c081d6e30445cdce8e69252074
SSDEEP 12288:eLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:eTdCN/j2GLl3iFSE33b9
TLSH
T1AF452364E9F6F665F15AC37D43A99B555200FEECF622448786C11AEB637CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 6bcc0ddce34013bb8fc5de6db4d7bef9579ede27023f004b2ea3dd5873230d14
MD5 886500518a2f0279430e03a928aca298
SHA1 66112926a94a18184fbc7539b6c4081feb812fbd
SHA512 3595e9ab97ef132f2f0b44db64ad35fd0705259ea6578f9b0bd0dd7a970b46812bde1f0bf94bbc6bd1ffb12f27cf1fe946802c0c737c5c354be7f69ee91bc9b8
SSDEEP 12288:u5JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:uddCN/j2GLl3iFSE33b9
TLSH
T1D0452364E9F5F669F15AC37D43A99F555200FEECF622448786811AEB637CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9b232c9451f1e478a8c7e09d3a8fe3fceaa356947c43bff2cc19d951cd1a645c
MD5 59fd7a31e80f936bc3756a0f905dee09
SHA1 e3717e3140b5ca09f545e5fe7623f7588ca1d999
SHA512 321f994be4b758577f4d18fee815e6a1fe552a4df60c308dbaeb0f18ca57f424a9f4a97ee5408ff69002f0dd72295155b546026b660713abacddfdb5c4f45e81
SSDEEP 12288:SaJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:SmdCN/j2GLl3iFSE33b9
TLSH
T131452364E9F6F665F15EC37D43A99B515200FEF8F6224487868116EB637CFEC80324A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 62c56fa6bc7a3734ca919b7ea1ff0e5845d738c378adba7a1a5d2e4e072d4b7e
MD5 58022e02f44797088b8d97f9c4e5f952
SHA1 eaf17fe3ca5b863cbf44b627f9eab70cff145463
SHA512 a9f02760f9dd6cc5e03a36ab490941ee4e77dd13b29052418395f68caf2faf3a1389fbcb1fe9fc17cf2198d91302ebb709c5215e0483aef6a86e1a15da5e6c0c
SSDEEP 12288:JhJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:JVdCN/j2GLl3iFSE33b9
TLSH
T1AB452364EDF5F669F15AC3BD43A99B515200FEF8F522448786811AEB637CFEC8032462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 d7f47b75df3ad2737ab9e1d2b00cda5612822777ad363f2bea595e610cb6f8dd
MD5 8e69ca374c2246324e1df53a87f536b7
SHA1 5e634ef86ef4fe4e88e166ec37af4cedfb8885f1
SHA512 25aae4c6f307900226b222c8914fca3e33a56eff1daa35a14cfc2a44ada5f321236535de742bd0e31a4606d2fb4f5ab689915e916f934ca1a0b507fc677e5fd2
SSDEEP 12288:R/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RvdCN/j2GLl3iFSE33b9
TLSH
T1D5452364E9F6F665F15AC37D43A99B555200FEFCF6224487868116EB237CFEC80324A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 3ba10b0ddb567e0a57997deb641895d8626fabf05fcbb3a631837f3a0c500339
MD5 5ee013076034e367eb2d5b536759b48e
SHA1 07ae9d8942c28f6257b69295608ab123fb53be33
SHA512 b1b0fbfdd7f541e33f07d0edfc36e27a27c32566011a103e5d75132eb9ff03c13127c0f5e67400837e360a1fb21133ed16084a733fcf972abc6b222a3201efdd
SSDEEP 24576:nfwvUk9RX6wkyAIZdCN/j2GLl3iFSE33b9:1MnYIuN/j2U4FH
TLSH
T16885D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 014be5244aba249731aface3b8e10e3d954e089a68fbde0d8a70397c955f858c
MD5 ea9eaa1ec415341fa8878f86e8eec7a1
SHA1 795ace3672b55065e1c5e7f851224ff425762c1d
SHA512 de8d12327320deba3b2849940f5f17523d8ca9e067eeef060397a03cf1122e060a8bb4b50a515afcfd07b59d394543b50bdb36bc9a6e83843b04a0e805c0fc34
SSDEEP 49152:KYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01N/j2U4FH:xySzPTj2jF
TLSH
T15E067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e617058fdc1614f0c8086e2190c4d9d9fd41e200b444bd0300af84670c2c60c9
MD5 fffb0c185e05e63d1b3865c8944b5e5d
SHA1 f6afd407c76185b31872d76b9a6ca3b509dc23d3
SHA512 7ff003d0caa754712d4646603c8bc87f4f3786a52541746f1508ad526a1acab911af99ec10d27472a94b98565069816b5112eb5f4c8c7476670d4974b52b1c6e
SSDEEP 24576:y47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYgdCN/j2GLl3iFSE33b9:y47JUQjTirIhCnDHUPfF/lN/j2U4FH
TLSH
T1C365AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 7707071a1c3a8f5394ecb1c092b33e11afc6499678923876a041eefc7d9ffafe
MD5 64d6a171917ea76c1e263b9ccafb3b1e
SHA1 919d438b799040f07deb0eae10868d051f91236e
SHA512 50eb2cea6cb1c68d7504b8acae254ae7f945c156d97d494767614fb51ebf8e53d19837373ce239b76404607f0639e8162c5a4be1c8a4b1d9a1c44ecba9ae5377
SSDEEP 12288:IbsfpJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vtdCN/j2GLl3iFSE33b9
TLSH
T16B550119D2A452E8D06E9279C7558A41B323BCA493E1C3CB43C0F5BE1F39AD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 cd4831a0ed197fdb20e0fbb3e375949c77f4a65ceb19e571a51011690fd62b4f
MD5 78b75d9e112518bcf923ef7b285c6de6
SHA1 f2a5a55406b62c090e38c5f1e043997590a7736f
SHA512 56402035f7cda26ca13a069236d01462c64c9030f8aabedb2869b2ec35f9b4648c90da09296514cdf15aea1489ebbeb367bd47535e6b0fd45b05f1a051c3842d
SSDEEP 12288:0oSMMlgBj6V5eYTAeVetVT1uT5UtRBn5IPsM50:0ne2LT6ncTaRB50sf
TLSH
T1443506117666CB4FC6A940321E32D1CCAB707D11EE45AF0773C98B3F8576659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 8f01619f500dc0f56fed3ed97c8f8c91ce6596c1d48e55ec8967bfcfd4eda939
MD5 b1cb80bb26d540235b2f047535acb12d
SHA1 9bcb0834a288d827131c63a7ef88da875194127c
SHA512 ee7cb77aa60c3a63b6be0fc6f743de4a3835e295e852202ccfbb45e4afb0a5886124222cf193d895e17dc70694b5d0428b46f89414cb6bf6fd02e7b81daca801
SSDEEP 12288:BRgVlJOdqzjmZ5UelVJo86KCy7h4jy97HXlVZ9m2aA+nw39WWJa2:BUzjmV/Fcsj1X+nwtWaN
TLSH
T1696509816136A6CFD1B76032072A5B8C7B68EC07BB055F2677C9453ED82A712A0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 81e9eafb8244ed2091fc728f7774e83eaef1fc2cb09f9d4d89a55b9540aea165
MD5 10151ac7bf8604eec08a90fb67b1faa8
SHA1 a74905ee41dee38ae4ee7b45319c7517f2119a3d
SHA512 e94566e2d16144cd4bca77391f49282249b2aa1b5f9c46600b054337b9f4799b6a3cf15e055d366cc3027f1c70b76d7008909529609e383a3e303df6370b272d
SSDEEP 12288:J07RJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:aldCN/j2GLl3iFSE33b9
TLSH
T19D452360DBE5FA65F07E837802ADDA256200FEF8DB1184C7C54166EB6278FD8C932563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 abc12ec9144152d41cabb1f15dab551569f102dd5c648c3fa8713351a9307c63
MD5 dc113b9ce3132263c2e6af238e3fb162
SHA1 2483fe2cde7b847c2f1dac4ed111f2d930ac95e8
SHA512 8a96dff9ea078847020ad17c285dcb5a5d6b2e5b268d965fd1c293752caf643e855c428a2f9d4c1ab5891d4b9a82e3be90ab712eade1b07f5a25fe44746f6601
SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bY7dCN/j2GLl3iFSE33b9:Ogb4mBIBhGFrN/j2U4FH
TLSH
T1BE65AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 753d25cc680e38e81c9b3e7ba6723131d9ff50ebb57d38942c75be5386e04119
MD5 f3f9bb1c5ae651f37af00e2bc5420cdb
SHA1 ddde0790323ccbbc011115336e9130bc047fc2cd
SHA512 a5718fcbb204a05f889598196be358fc1a57d07448f0ad8df4e2c30d23e832c03fdba6029e9ba947ce632871cf63e0a2f669667c3a3cb6064388c01b77215169
SSDEEP 24576:YG88u8FpJqH1bzria7/mwdCN/j2GLl3iFSE33b9:b7ZFPqVea7/wN/j2U4FH
TLSH
T1B885F16577E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 bd6ec44a0d2ad2382405783eb27c4e23e488e8dd84885f542fa59dbcceeefbc3
MD5 fab7e6c684a391d6c6d042bfe28456a5
SHA1 afc68ab0b5393e658df4b95f46077a771f3f6802
SHA512 1537d5810715374787722421fef0ed7b05fa914f8ccbca9f1f3363182592d403a978a242c4dd1c43e8070b1ab45109117c131cbdd101a91337b92ea6c9752ace
SSDEEP 12288:EHvUrBFrEjwaQMJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:EPUr+NQkdCN/j2GLl3iFSE33b9
TLSH
T1B065F22E66E918E5E67AD17D86868719F731B8615312D2CF02D0817F4F27EE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b3e8e289910e187e5cd6f51da9f4022b9b784ed675e25dc5813aeca4d0a73d3b
MD5 fef763793e6ad7bf22f1b52de87df7ef
SHA1 b1f9766764c1abfec88a6148efa42030d8a059b1
SHA512 521a92c69732f13f05f31d85271deaf2e0f5cba71823de6fb627245b706acde3093e8b3be0551faa14e466723ec2f8e7b302c75c043964acde5a3bf21f83b8e8
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjfN/j2U4FH:bG05lO43b+j2jF
TLSH
T1A5D5C06A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 64b0e9503ff81cd53ff88727704715b572a655328169780df64e54cc3973af1c
MD5 67013ddc338a6521bb103050ca7fed0a
SHA1 19fe328e02d36f87b06e21a5c64708c733a55db7
SHA512 f583f202db30fcbeda8714016582e581c3bc4d5e1b80817d463b23b9f8de893f3867a15bd87a54ce14962d9b9baf671c20bc3b31431738b89383882e01dd7db2
SSDEEP 24576:Efa5POZ3dpuWVM50JicR2hG0lasx2+47eidnydCN/j2GLl3iFSE33b9:ca5POZ3BJt2pasx2+mHN/j2U4FH
TLSH
T12465BF5EA6FC01D5D1B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 48163336cdfbe71aabafb3f6d99036aca63b81e0dfc71c2863fd12d3d21503fa
MD5 0d8b480a0e9b0b0e9a7aefc5d3b1090f
SHA1 92ecff11a718314daae5c7b75f0259d937b73efb
SHA512 7f49c7450299b674cfd6bd00bc8fd4868d6f9ec4f0221933cd7427d24ca4fc98cef8b2570339aee29fa0853db3f61e4e5e013590f275504e9dd8be25048660c2
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7FkYdCN/j2GLl3iFSE33b9:hNc/zEOVHFQN/j2U4FH
TLSH
T1E0857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 495289c300e2962f1471b4b6a3b901038619cd8ff878a6a663b589ea1556fdc5
MD5 00362dff4939f34d45ec88f74ec57e0b
SHA1 71cadf26ab4e1b0f255edf101330e980b4caccbc
SHA512 fad8bd6ef537f064acf7dbb1ff823f5eb220af06aa5e83a28799d0b4e54f7f79d7c5a0dcfb279bb4dbf50157f1c8beb01b05a64d087fcf89494ad5ed2ff8e5d0
SSDEEP 24576:QTkNvNnaFeYhJNtmZBmOdCN/j2GLl3iFSE33b9:QTMwBtOmRN/j2U4FH
TLSH
T14D55AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 85545590571cb2d346b149c2fba75ffe29d27c8a3ddd38a4d1ddc02dd0348d2e
MD5 6348bf087e0444c0626b51597b92b324
SHA1 f99d63fca5e94c20565d2733337b9f106c587897
SHA512 15b0782cbb15dff858492a7da65eb76344d694acdbbb886f7db274ea65ace4636d6c7b6535ddb3c5dfd5fbc8dc732a6e7e09e450181b79c33ca18e1168f4e5a2
SSDEEP 24576:MD3FHshBIYQgAhdCN/j2GLl3iFSE33b9:MDVHeBIAA2N/j2U4FH
TLSH
T13E75E17DE69C04E4E57BC2BCC6638A06E77178A8433255CB02D481BA5F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-0-0x0000000000400000-0x0000000000564000-memory.dmp

Download

memory/236-6-0x0000000002320000-0x0000000002387000-memory.dmp

Download

memory/236-1-0x0000000002320000-0x0000000002387000-memory.dmp

Download

memory/236-7-0x0000000002320000-0x0000000002387000-memory.dmp

Download

memory/236-77-0x0000000000400000-0x0000000000564000-memory.dmp

Download

memory/764-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/764-125-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/764-122-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/764-116-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/764-115-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1300-140-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1300-305-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1300-133-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1300-134-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2452-74-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2452-275-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2572-58-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/2572-211-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2572-52-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/2572-51-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3292-70-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3292-253-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3292-64-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3292-62-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3364-318-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3364-79-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3364-78-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3364-85-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3364-316-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3364-288-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3772-36-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3772-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3772-37-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3772-43-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3772-49-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4072-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4072-25-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4072-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4072-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4592-111-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4592-304-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4592-103-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5056-97-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5056-302-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5056-298-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5056-91-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5056-90-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6140-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6140-14-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/6140-20-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/6140-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download