43405760cc640434ed326936e51f611e3f468a49342b3fcc14bd901c7e01f0b9

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 00:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
Size 1.5MB
Sample260629-a9bbmaaz2k
SHA256 43405760cc640434ed326936e51f611e3f468a49342b3fcc14bd901c7e01f0b9
MD5 ff35b9780dae8e7b8213f54630ebfc54
SHA1 3e7d6bddec626f694fc0cd1c9795f889d1b0f38e
SHA512 b93457bd478f04dafe0e37458386fb99ee5fa821244617da3ddac7f6cda19dd297e14071f42e80a69017c375ff83fd0f643f01eb8c1778723bab94faffe8f220
SSDEEP 24576:DWo0i92ns36LaRFdGJm0Q3WKVSwdr13Ek0VAZ:DWo0c2y6KFdi2Ga9x3Ek0V
TLSH
T1F265E02137E0C836D2A235724D16D3B46A6ABE705D35834B6BD0372E9F34691DF28B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5772	elevation_service.exe
5960	elevation_service.exe
6056	maintenanceservice.exe
6680	OSE.EXE
1604	PerceptionSimulationService.exe
5320	perfhost.exe
1556	ReFsDedupSvc.exe
2580	SensorDataService.exe
6240	ssh-agent.exe
2544	AgentService.exe
1112	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8bf7325cedfdeb5c.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85015\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85015\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85015\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000389f5ed76107dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002116491b6207dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001872f2d86107dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a3755d96107dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b38565d76107dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000373d87d76107dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5960	elevation_service.exe
5960	elevation_service.exe
5960	elevation_service.exe
5960	elevation_service.exe
5960	elevation_service.exe
5960	elevation_service.exe
5960	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6444	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
Token: SeBackupPrivilege	1556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1556	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1556	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1556	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1556	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1556	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2544	AgentService.exe
Token: 33	1112	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1112	SearchIndexer.exe
Token: SeDebugPrivilege	5772	elevation_service.exe
Token: SeDebugPrivilege	5960	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6444	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
6444	2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 4840	1112	SearchIndexer.exe	100
PID 1112 wrote to memory of 4892	1112	SearchIndexer.exe	101
PID 1112 wrote to memory of 2632	1112	SearchIndexer.exe	102
PID 1112 wrote to memory of 3520	1112	SearchIndexer.exe	103
PID 1112 wrote to memory of 3688	1112	SearchIndexer.exe	109
PID 1112 wrote to memory of 5476	1112	SearchIndexer.exe	110
PID 1112 wrote to memory of 1248	1112	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_ff35b9780dae8e7b8213f54630ebfc54_amadey_elex_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5960

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6056

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6680

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1604

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5320

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2580

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6240

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2544

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2882181966-868590553-1461876573-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2882181966-868590553-1461876573-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4840
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2632
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3520
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3688
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5476
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 984958f2b26c870808feb622e387a254cbec733c879dbd184808e414da34cc80
MD5 04d945bb8efaa58cd43a27ea3a0c7e4e
SHA1 6595e9dd3bbab5a3fd63442db98dd8b3f982e5be
SHA512 a6054e659d455597337048caa5260576b4defb4e315882dd3f1a1bcd3f2e2f15e531ece9fb9f438e8cabdf863b0eae0d0432491ccd3f47e5315d92bf99078e3d
SSDEEP 49152:xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnr6KFdi2Ga9x3Ek0V:33q6HjBCHFdi4VEk0V
TLSH
T1A7D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 7c8abaacbcc777aabb40cd4b5498aa629f82f2b1dbcce81595bee95fa1599669
MD5 cf75af94fbd8f2ccd374d3e6a43eb891
SHA1 3bd73acd2a3c66b5ad97c2097283c3a1e481b98b
SHA512 fe06d83b68128366a72315ac5c33c8ac0e7936509cfa526a1c28b1bae16980f138e7953eae164305f6323f4d557d8b269b786b0ea438237d73c62e9f13d0d73f
SSDEEP 24576:AXYfDtczAJc6LaRFdGJm0Q3WKVSwdr13Ek0VAu:3tcV6KFdi2Ga9x3Ek0V
TLSH
T1BA650129779409F9ED678278CCA2C511EA337C944760E78B03E496660F337E85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e918125dd44b47f22fa7a69bb24f9c29a0ebd077ee666398df856f65fa2d6a42
MD5 856afb875ef6b7839e6d40886a545a31
SHA1 6610b60cecdfcb21b113c208f383e1a7c48ff40b
SHA512 1cab47ab7b5488b65ed05d504ff67e010021be141f4a4017cae74c859f1db17b177323592b68a44b58878b5b44c83cfe18b75f3b910302063626c3b7e9c7a932
SSDEEP 24576:l0Le5ji0hmxirM0c6LaRFdGJm0Q3WKVSwdr13Ek0VAS:lPji0Ac06KFdi2Ga9x3Ek0V
TLSH
T145859E16F6748335D073C0B9C5D2A69AED7230851B308ACB4286D77C6F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ed8d8644c81f406b62e91e91e86794d5e8c5f28b96597ad42ccf6b7c90c37611
MD5 d664019654ea42d3714617fa622e6c5e
SHA1 72e79c59763fe2f8efa84c78b8f6fd970325e805
SHA512 a19538ae921aada2430c847cd1140b28ca5ccdc3d949d9113ad077ba9ce00fffeda51a303379693c83785ccd1d5da7c8458f81c8ce59e76272a73a95bb0578bc
SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWE6q8wyuGc6LaRFdGJm0Q3WKVSwdr13Ek0VAE:S/ezSC6vUzPvxHjyI6KFdi2Ga9x3Ek0V
TLSH
T1C9755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1bb8004eaeb31312b4e6c62d542784c43dc725c2dcf50743ab559d3b689e3649
MD5 38c4d66104f1a8f152829ba145bdefee
SHA1 26c392bf4d977a38a85033090fb77d381e3e655b
SHA512 8440c0c2305093d986e90ded6359823edb6ac31c2cd05d882c76de5bc7268aef51e1c3a56031a4336c3791d34d1fd2bc18fff06ce9bf7a73693c0314e9fcd734
SSDEEP 24576:KVbqPb88hv/l+6Nc6LaRFdGJm0Q3WKVSwdr13Ek0VAq:KVO88hXl+36KFdi2Ga9x3Ek0V
TLSH
T16F559E66F5748331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C2F67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 aae80ef7ea13be2788df39c408457ac1b794f71e0f17418a455940cbea109553
MD5 1a78c2981992447bcecbe6e3cc1bf3b2
SHA1 60925636c3863dc015a7012e9cce82eb089f3a4a
SHA512 afa22cba984cc628bde51731d9ffe48ecd8e8e476f4068f352ce40f791b867a7b47b7216309817bda62e3722e7fefcf87b21e26983e61e0969e7d5b0eef1dd2c
SSDEEP 12288:KRIc6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4I:KRIc6LaRFdGJm0Q3WKVSwdr13Ek0VAN
TLSH
T178452313BA081914E7AE02B1CDD987715A16BFE82C4856494EA6378B073DFF5FC58AE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 11612e0555bf39addd722bdec363f0a9dd2bf4a320f06cda9f1dcd2eb89f283b
MD5 0657d97b798c44df3f4150fcb6bc832f
SHA1 1b1eab446adae2bb794e9f7a0cb2841a3750e9ee
SHA512 e8d5188faa0e5106f43031da5679d4eb79d758d4497d96afa72a82cab97284922b34dafe0f05fbbf0abf043003b4b375a8d9547c6c323ec7c77db02b6a05e009
SSDEEP 24576:NJIUVc6LaRFdGJm0Q3WKVSwdr13Ek0VAt:NJIUK6KFdi2Ga9x3Ek0V
TLSH
T13965CF3BEE28FCD2C27E8DB95A918700A77278704F51A3CBD165830E9E275E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f2a0ec9da09fcd1d570ed74ae0adb0ff1c512f63e23b5921eaea91e1adfb8a3d
MD5 e57336e85da5e7aa8533ade282d6c25a
SHA1 d2b9671604b06617a3791fdd867839e0bfa73aaf
SHA512 212a1677fb3f3267195621b6a8c3469c466cee87905e6c34050ecfc15d729741c3e0b6842a16aa03515c40672007c9c324ba46660cd7f18cec98c41454d6e2f0
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THp:FQvGAdlCEL8c/yRNw5C1HFdi4VEk0V
TLSH
T1BA267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 24628681e0689423feebff7a3307cc1f4fd6195c461a16e0247e819c8a4efb55
MD5 96d8dee3aee6584a57ca4c8b8ee10013
SHA1 f4543c05d3fe5d268f85d3cf9bbec8409ab7c9ad
SHA512 ba77062f1176e755da7047635e4933306f5f1f5c611eeffeca2208a4ef933477806ed3d64384dead9d032981599c9046b2da65a29af4bf599a5f85d39ae3c0df
SSDEEP 24576:xdewsAjfc6LaRFdGJm0Q3WKVSwdr13Ek0VAO:Pljk6KFdi2Ga9x3Ek0V
TLSH
T11B75E031FE74E436C3BF0DB21B26C716182DBA604F511AC3E3E85A8E59346D22776E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b951e8d60d5db302a63939f4b1fb6113eb8c926521ebbb6ebb54b7cd3f36c4fb
MD5 fb402c43a6032c8d88261298a6b95db7
SHA1 d3e5ccbdfa41cdfe7608111a0a84163b57566c72
SHA512 ae6fdd03cad3640b9cfbb76620b14fd5cff30ceb411ef3800679027772f60913089eb608c72c4888d13146de7143b5cb0a6b073a0a6de25ad0b48a3136306c28
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHsLiJk0:bUEtQevvqc2W1cpV2EI32sLkk
TLSH
T151474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 34308d0aaeac569b7101ea1e6150d6b842cc353ff964244c5365a3c02b830fbd
MD5 e61547a15a8486a4d9271ecf964b0c54
SHA1 4c371c6dc46bbf765a6ce968d66527b146019613
SHA512 12e382861e7e634e45df8e9db7727fe5440c93d9fcb6a5ecf073ac1a035b428fe1f2e33355b60b76da6209567340a34a7be2c78e635afb0065f60ba572827bcc
SSDEEP 49152:pCbRquA/m2yL5zifFiV+XenmE3/zE6KFdi2Ga9x3Ek0V:moqHVjnmZHFdi4VEk0V
TLSH
T10BD58D0976B882E4D1F6C77886A2C647F37178154B3497EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3bae8d22de921cab0623005b1a0ad488c30788af404f01604ea61a617630bdf2
MD5 eae922b2ac23d009fffc4f258925e8e8
SHA1 ee7ab7b2b3fffdea703f00b0b39a591c429e7553
SHA512 e7900ec8796dbccf9fa28f296274f0d59d07ed71c880d1d5128ea9cfa8e0b0aa85adfa92348c9c5c599c8e522b8525b7a79f14b84caabe806d5e7e70d0f06687
SSDEEP 24576:SAhGLJIFoiwtA5l7S53Cc6LaRFdGJm0Q3WKVSwdr13Ek0VA3:SAMyFoiq5J6KFdi2Ga9x3Ek0V
TLSH
T14A359D81E7F955D4F5B3AAB89DB68171EA76BCA95E30C20F1150920F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 e9fed9f1fcc07d7794907026db333bdd75c5f739efb007b2e683e08257dd8f83
MD5 e143f73e7b2d78f46dc605a80889bcb8
SHA1 94d2f6b3c8c0e6573daf64592d3320a86de60429
SHA512 ea2a482e44aa4713b0af536e59b53c8b65e55002a447d5503fea4763f44ad1668099d9b3e595cb262f270646dfbf733292239d3ba2cecf7072641f1d5b6691fc
SSDEEP 24576:HwuoOWLc6LaRFdGJm0Q3WKVSwdr13Ek0VA1:HwDO96KFdi2Ga9x3Ek0V
TLSH
T1DC65F14676A40CF9EAA78239C997C132F7B2BC512A24C71F0760C65B5F37361AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 73cade48ca868178eec0e858fc1b1180e6d193665d9635a005941da74d22aece
MD5 be6baddefe74e4986e4e7d404833293f
SHA1 3bab5d250dd1557c531e89d1ed805c56a4fa6ada
SHA512 efebcf224a3f0ffbc99251f82df277cac15366874d77ce4ea7994a626536aa8d3fe207cb1916b881b03e85217f4d3f5c1eb3e1ea755bb8f05f3ae074894b2977
SSDEEP 24576:zZucc6LaRFdGJm0Q3WKVSwdr13Ek0VAD:g6KFdi2Ga9x3Ek0V
TLSH
T15F55125B339421B9E3A742B9CCE18611E77278A5273543CF0A65039A1F3AFE16D38B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 94257a4a4e4412c5f72e95573777c5738a76d3ff536ea5fd9bb454cc5757320a
MD5 bcf63f97a9d939984411f59462cd8787
SHA1 d5b00620af05772ca9ed097fcc0b615daec6a3d3
SHA512 a87b12a85e90194b9eada066bb9ea45ab32972c356867d929ca92aabb45f8865fa8a977b54ebd296c51fc53613b14bb0c829043fa1f6c55d83c2c4e28662ec50
SSDEEP 98304:qQRQyi36YOcPQLvw2gAf+PN3eHFdi4VEk0V:BQyiKayX+PNuLiJk0
TLSH
T1C8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d8b019fde89368c2c21dfd8e03ef02d4d26ded0863214b308f4a290667725fad
MD5 dbe20783c08ed6b2c44b395d51d72b53
SHA1 ddd9b30c8e8da6d416b17a13c0c1f5aa4f8f4263
SHA512 efc7bfdc329e92007b9ca058d92a41fe9928c98dd11ee88e43e915f0da25f827e85dbdff717035fe524ff37e77c687e8fe213f509cc24cfe0ea1a31fb8178a52
SSDEEP 98304:gQRQyi36YOcPQLvw2gAf+PN3eHFdi4VEk0V:3QyiKayX+PNuLiJk0
TLSH
T128667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d99e5e8ce7f7929134fe42a64db7e0423e45a3c5c649a682134c7659b1c2e91a
MD5 5e8dc8c0e31f30ca6b161face409cdb6
SHA1 48126f31c2b48bfa405cff6f038ecba0421486f7
SHA512 c78389cd81c2406a2e4527e7f4389a287290993dfe14dff8ee1cfbddccfd189e8f38ed16e895b0355b57fd20abfe875444e14ee30e578589442df61d6be14ed3
SSDEEP 49152:M68Qg55nhheWu7PNU3/06KFdi2Ga9x3Ek0V:GthWRc/0HFdi4VEk0V
TLSH
T143B55A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB855172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 64ff92b6691308e01fd88bf5e3de244dac6842f95a9e3197be228a88aebc6909
MD5 3bc2466e8a6a4b858547edb1570a5a85
SHA1 a189b784c342eb194a9123de7e96b835e2c0ed36
SHA512 fac53ae2e9346daca08166545a5130aa43c351e78bd3db632c29c1bd8ce521d1a415a9c97271e55d8b2b5af14ef11ca44312f47148f84eb64636e038b2af009d
SSDEEP 98304:uy5112gYy5azzVvL69nLKnhZfHFdi4VEk0V:fLIHmWhBLiJk0
TLSH
T157167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fc212b7b894d0005c42e0bb068ee3c061a9f53d0a69aa35a8796cca7f59204c9
MD5 865d8cc632474f18a4fcc48ac432967a
SHA1 0688f6c888b91ef7670ebf8601ffaaddf8ef1236
SHA512 3b8a3bf492f1d7e6ee15ccee18b6e42d32cd2c3c54e49f9ca4bef217aa9305869e7592f9f66161e3afa99502483676ba49833c00f596c7084133c0b615c7e2b4
SSDEEP 49152:TB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glW6KFdi2Ga9x3Ek0V:lu6JmVxd2dWHFdi4VEk0V
TLSH
T1FFD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 80fad7b72bcd69c7177b47faf805ce3434f98780e628e4c986787418118d4855
MD5 d7bca46abd0dc0e51cca94bb4d793843
SHA1 00e3af53e6a78d8ef5f01e1f44a803a3c824674f
SHA512 c43d541caa01d4e150b43eab1056c2b9b248d396cd89c86471448bb7a1af170a1f884ebb4290eaa16944b7be05ecac2c99b5bc17498defae6c5c8c16b4297a32
SSDEEP 49152:p1hpsNoJpF1A6UU44CwH7R4xq6KFdi2Ga9x3Ek0V:pmifPbRZHFdi4VEk0V
TLSH
T152B5AE13F29901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bec2d26285a86ae7a70f3066b3f1b36871eb016ca1ac24c8bc171dbe56c20300
MD5 7902ddc476d42dc37fa250e12fb4e7b5
SHA1 983434aaeafc54a4d757c8a95dc4bf0f24644192
SHA512 7e6acf6215c6fc4e5da244cf47a78bd7d28e8ca45a3839ec695d55f8186c3a0eb45973b657e992c5dd16492249d894fb61ccc08b64de5b85f6e0afa9d6a4ba5d
SSDEEP 49152:/SuZQIY0Be2KRRVtOnks6NMHqb6KFdi2Ga9x3Ek0V:F5dKTi61bHFdi4VEk0V
TLSH
T1ADC5BF03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4c27b4ab8266ad80e10dd2c79c9231600865158fa1f198388d46dc2d8702d56e
MD5 d4210dc4da1f2a5a61d0a8c886984563
SHA1 d3227b533644e04a80a7ace5718e48241c9a993e
SHA512 66c5fafc64b2e469bd3d54ff6e9b0084bd3531d74829f12397540caf641251ad53df7c9aa04324f4f0b2e2e2fb414398e2fb314149b12b3945e2434a39db23c7
SSDEEP 49152:uhtSn8EApI0figngiDn0AP5wG6KFdi2Ga9x3Ek0V:vX2iyphdHFdi4VEk0V
TLSH
T1C395BE13F2D901E8D05ED178C7468632EA62BC150B38A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f0ce68d865b308c583d341d9d507ad9b423f4788eb7f2d3ef1a50ae3fdb3b356
MD5 0c8e418451032c8a4f6b173efe5cd712
SHA1 93ffbbdaba22f5d5b8a995f79b42a087eca265c3
SHA512 c91df8943fd10010431343d137bc0f8a8263bdd65ed9590cc97dbc1e9d84337c81f6e13a016354ba8e31a716fd4bd470563b6402e242e7b94a5d270ba796f03c
SSDEEP 12288:7wc6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4L:7wc6LaRFdGJm0Q3WKVSwdr13Ek0VAM
TLSH
T1CE452317B9080A19E35A42F2CD8583B1691ABFEC7D48024A5FAA2246473DFF57C5CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 95c834795c79fb1a536013e047079f1f68c0b91f0055392e867ccda30047268d
MD5 ffe1fdee9b4271dab668370fdfd47717
SHA1 a894ad61da8c8702619312b14b179f8f9d8135ee
SHA512 8a6d7f6e74dda81513aa3ac71af8ce9bb27971674ade414ab02b682f14ce379dd6733fd95e8ddbfd1cb094987be604f37839116df1d7268c9937bce5e5f699fd
SSDEEP 12288:ODc6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4B:ODc6LaRFdGJm0Q3WKVSwdr13Ek0VAO
TLSH
T1F6452327B9080A19E35A42F2CD8583B1691ABFEC7D48024A5F9A2247473DFF47C5CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 aacd6a55d6946865b908c0dc3065d805d2e5b540da71528473acf53af7463b66
MD5 76a4029d6125e6b247b22048ca5561d7
SHA1 530d3a437ed00c00cc3387e270f2cc40bf8c002d
SHA512 17347f9f7ec7e64c87239f31b95f35a80c4de2fd1d245e85cbf31610018b40d55c3854e134baae023c5fcc2da6f15dbf78895071eeb156ef3841492ba2f6578d
SSDEEP 12288:Mdc6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4l:Mdc6LaRFdGJm0Q3WKVSwdr13Ek0VAe
TLSH
T12D452327B9080A19E35A42F2CD8583B16D1ABFEC7D48024A5F9A2246173DFF57C5CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 84523ffe07f3fe72594aa168668206396c7c2dbf0eb6d72be6e8a6443a22e5d9
MD5 9cea70b87129e2a686bd96b64bf36153
SHA1 683948896d43f6cf7f330d2e626151a84e02c8d4
SHA512 f633b126738961887956e3163b03713f875e886aaa4d78c9586fcc2647a2d6039b57ce308dbae04841a80aa936e3828f54f06c60a24b7a6ca2d9c60265bb955d
SSDEEP 12288:1Vic6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4h:yc6LaRFdGJm0Q3WKVSwdr13Ek0VAm
TLSH
T10A4523137A180585E76A82F1CD958271AA76BEE87A24538F4F51164B0F39BF47C38FE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9a358c477363a22bd5d3af983e5de406e061744b00dd93aa4cf9a8bb06094e72
MD5 9d03eb6de4707156dbbf9eb56e4ce82b
SHA1 f2e5e1239a50a156522c040d822cbedc190f6cbc
SHA512 b256739974a1d4148a20164d442a87be9d3f97160fffd4e5ddf594ae951b3111a0867c3e0139fba33925f146f45e797dabdc8dbdaec59566963d4e7c97ce948b
SSDEEP 12288:L6c6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN41:L6c6LaRFdGJm0Q3WKVSwdr13Ek0VA2
TLSH
T19B452317B9080A19E35A42F2CD8583B16D1ABFEC7D48024A5F9A2246473DFF57C6CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 315bd255b8f5e754dacdaa559bd3a35eb5bf4a04c1e5d14793c076e33261210c
MD5 456ba44b99d960fdecdc12b51dd3fd64
SHA1 daa4a7bbae612cbf393015ad181697347a6777a4
SHA512 e38a7b82f07dd6d414a8cdbed169efce5540e896ec78937e4606ec1ffb4f364332221a21238c052c3ccb92bcdae3b69610ea064add8be7916d7d9b286aac5ff0
SSDEEP 12288:Ync6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4d:Ync6LaRFdGJm0Q3WKVSwdr13Ek0VAa
TLSH
T158452327B9080A19E35A42F2CD8583B1691ABFEC7D48024A5F9A2247473DFF57C5CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 49265dbe6ec06160ce1f64a5c63a5c8f96e264b11c98de856e9fa8edd881b494
MD5 9c2ad0fd2b919f2d58c5c5f9d528a223
SHA1 2d9f69f592baab7215e1bb55f26ea6988dfa23cc
SHA512 b53ece20c2dab02fe1653d5add80bb28ab99b63ea20ab12037121e02c9bbcfbc81a7ba0ae31c4cd00d49d6f93212739cf54197a0563d199f371f19d228f72ade
SSDEEP 12288:dbc6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4g:dbc6LaRFdGJm0Q3WKVSwdr13Ek0VAD
TLSH
T170452327B9080A19E35A42F2CD8587B1591ABFEC7D48024A5FAA2247173DFF47C5CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 32a82b6ecb687f408383ee45ba5614ab075925253d1db683850bd751dae20112
MD5 edeeab33d3ac4b9e5e5ebcbffe84da0b
SHA1 1a16cfc9c83b421bf278ca4d5b33f3dbb715aaac
SHA512 d9006a9548ecb667533c0c7a793255a38b522b9bcd18446b5090af81b5c7b5645c12a9e736e695b6de99b9b6d2b53e2e99050fee711d95b452f60c4cef2908f1
SSDEEP 24576:jZMSzFVSOjc6LaRFdGJm0Q3WKVSwdr13Ek0VAo:jZMSzfM6KFdi2Ga9x3Ek0V
TLSH
T1D46501A6B35018F8ED67827ECD558916D6B27C690B60C60F07A4362B1F373A11C3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 43ec8a9cc63fe2d40420a2e0f8fc2e814276e15a4a7a9f59fde709b865ead433
MD5 368f349cc6a2a602a6f77c327ba03a7c
SHA1 b4e42a4f0ab0cbf9b426680dd27d1fb3f6c026be
SHA512 7d7dec9fc1b35b361869016496bc4cc04678327db72ce59532f91c81397debd166b1339f56e0c7a92f76c2e0a2ad00e527c705b92a375f22b11460aefa0a51fa
SSDEEP 12288:6Mc6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4K:6Mc6LaRFdGJm0Q3WKVSwdr13Ek0VAB
TLSH
T114452327B9080A19E35A42F2CD8587B15D1ABFEC7D48024A9F9A2246073DFF57C5CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4ff6d4e646fb344d85587b2c6bdc177c8d52906ffd147d082eda369950ec2223
MD5 12f26115bc4e42e5363b5ec35f7cdf9b
SHA1 294518f08718fdbbcdbd5db5714c9934f16adf0f
SHA512 a9fda59f9dd4fa4f1831585778d83aa094171035c9edf2239e8a53b15f2b8ceab0adf6d679925bf57cfc9465760a3be7d9006e5a58d417e9e434b650651be8e3
SSDEEP 12288:K4c6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4G:K4c6LaRFdGJm0Q3WKVSwdr13Ek0VA9
TLSH
T12D452327B9080A19E35A42F2CD8583B1591ABFEC7D48024A5FAA2346173DFF57C5CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 184f420b996f7e99411ef1489d0ba24f1fcb45ae1a6555689a884a54e4621da2
MD5 2411b14c9e357c7090310cc168b3ddab
SHA1 0c33791511100a6c8f15459c12c5bac56bf36e1b
SHA512 ead184225faa9cca0fd1a3043a8e5c8b1c4f37c8a63bc56e33daede9eebd4114364c6f252e6ee185c8ca88f98d2f8813f41d619c902eb30fe0da743cfa4e2306
SSDEEP 24576:zzyPc6LaRFdGJm0Q3WKVSwdr13Ek0VAl:zd6KFdi2Ga9x3Ek0V
TLSH
T1C8550217775420F9D26A8275CC920A12F772BC751B248A9F17A407761F3B7E0AD3EBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 876b9a1f7d2c403d0393de92451238d98b69cc123e43076b24e152c0c6d96337
MD5 6319cb1200fc0314eb57b0465e1ab671
SHA1 7097c5edc244aac0be50cab752d5dda7ff070cd2
SHA512 0ebf5e044bb82f4b43bff9aede1e6490414a331f6492d2d7696345e4a98df083ec11df19932729b1404fee565fc6f6c57977ce830109d30d49eb5f46147f5be6
SSDEEP 12288:cMc6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4S:cMc6LaRFdGJm0Q3WKVSwdr13Ek0VAV
TLSH
T1C5452327B9080A19E35A42F2CD8587B15D1ABFEC7D48028A5E9A2346073DFF57C5CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b87968e95537116e612cdd432faf22aab3ab9afb5000bafee4b8bf4d404e4dfb
MD5 6a6f7304602cea9e8548e982ed9a0fea
SHA1 1db9d8fea4ff7097f235ada3dbee51403a7e3677
SHA512 56d70c06f1f10744089a53b6da91605fc1f245f7a7e232f6d723df8572a1495b60630bbb8a9f79e911b3606c2ed57c479a9f004ad2081b52792972c3633f605a
SSDEEP 12288:HMc6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4J:HMc6LaRFdGJm0Q3WKVSwdr13Ek0VAq
TLSH
T170452327B9080A19E35A42F2CD8587B15D1ABFEC3D48024A5E9A2346073DFF57C2CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 d9c1d18f914fd601f945495ba939d317ecd86a0c8314abbd8fc4162fce8a3fc6
MD5 95b71ac3834b323d10f1049dc1ab29cc
SHA1 ac4af2d2dd7d92f7b5d1d66908d4723c50cd7864
SHA512 361de18ef990ec7ed2d507d58b40ef096ce8f2a8631aa5e671abb8ef80a210a0e20d34f80b64b3f80a81b63b926bb2051e18e3837ab8c3a25332af3209ff8276
SSDEEP 24576:0zyPc6LaRFdGJm0Q3WKVSwdr13Ek0VAJ:0d6KFdi2Ga9x3Ek0V
TLSH
T1DC550217775420F9D26A8275CC920A12F772BC751B248A9F17A407761F3B7E0AD3EBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 510470becc600cd9e186d6d7bee7d694695ce28b909647c1718b780e90d6b3bf
MD5 9a7b8f47709d49f80ede1a1ee4cc7b01
SHA1 64c603c1c35cafd7cd64ea550d287a9619c446b6
SHA512 c426f69d94e75a63b30611fba5b64e89bf09f4c0e2cb4328fd999195c37635edc2ce691cd7f6519f24655b0bc460e502e4df13926f614c97c765557822179252
SSDEEP 24576:fTHaLl3z0zDtc6LaRFdGJm0Q3WKVSwdr13Ek0VAo:fT6LljF6KFdi2Ga9x3Ek0V
TLSH
T1026501A5B35018F8ED67827ECC558A16D6B27C6A0B60C61F07A8365B1F373A01C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 0a437b8d79b0df0c5f053f2d9f7f5a1a41ce43cfd177ec05fa2d68e5dfe4d80d
MD5 2e6979a9cd8d3af71075d4b37792b662
SHA1 2ac4f20342b4ff8e453035e9df730ee5c254551f
SHA512 f1111d8ab868df17d75d3bbec3c04e2cc8025db325fa2c5431fbeb401b43a4c76ffbf5a01ea78e6c0568bad3591e751b76fa52d6f11bf488495f4eefbffb7c8e
SSDEEP 24576:137d9CHKy7GZxc6LaRFdGJm0Q3WKVSwdr13Ek0VAT:V7d9CHKyaM6KFdi2Ga9x3Ek0V
TLSH
T1E375CF91F3E414E8F1B78A75CD768511DA767C991B21CA8F03A4261A1F33BE19D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 284b4c53e62e454215894ce81219ad0131262cf91e6caa4e9b255653d055701b
MD5 bee50bf43b9a1d67e4adff7fdff4c804
SHA1 098b4dbde4dd2540f588cd3619cd402453f71d83
SHA512 606332e2fa78b8e5d2d7cc15bd3c7533b899bb4baf9918937e9e160158da03d78a45049b8ad29e96e0ffb5f0bb10281ee31dea9c8ed1c6ccf7057b392315e034
SSDEEP 12288:s9c6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4Z:s9c6LaRFdGJm0Q3WKVSwdr13Ek0VAW
TLSH
T15F452327B9080A19E35A42F2CD8583B1691ABFEC7D48024A5F9A2246473DFF57C5CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0dc3297d1366998ac0b1f236c4ed560c4c7f66af51ccb27a93c8c5c0abe32d10
MD5 b8921ad44a17a21ab56dcdc0cc85415d
SHA1 d705e758d0d5caffefbbc0cedc53e1a71865639a
SHA512 d8901a9624b0abd26388d5a00aa47f676e3a3e836f5e2717c22900f78cded39396b872fe679a15eea80a6b7b2f21feddaa0c4a0fcf493edb55c4a97b2bce8d88
SSDEEP 12288:Jvc6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4V:Jvc6LaRFdGJm0Q3WKVSwdr13Ek0VAe
TLSH
T169452327B9080A59E35E42F2CD8587B16A1ABFEC7D5802495F9A2207073DFF57C18AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0aed16457c3575417b9a3ec41d63776444864ff5209671f47b54041a0025a7fe
MD5 ffd1cf76b73751d860c18ee81523c097
SHA1 3b7d65d5e2908722fec73ad8db4a558e491e4984
SHA512 06b6b46fd770ace28cd60fbe957f4169a820793cbc8877fb7c3c6391f02d5151d39e2dbcbd15511148bb8fd1ea99dc27ac46ca228a412b847d1a9f932a20f738
SSDEEP 12288:j+c6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4q:j+c6LaRFdGJm0Q3WKVSwdr13Ek0VAx
TLSH
T1F5452327B9080A19E35A42F2CD8587B15D1ABFEC7D48024A5E9A2346173DFF57C1CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b83f071811dfd2d8f5403b29ef41163ccc12b6eee23fe2da1bcefa3239a855d2
MD5 edb54268f399239f84feba4a99ef4c23
SHA1 d4de5fb721f4f754339598e1a87699ed043fc41a
SHA512 402a81c244369226219d961c7eef5944244255bcff912836265d6173e7f4fdc2e2ad8552f0ffe354a70e40691dc8eb50a5730bb990869b53202be57393031312
SSDEEP 12288:1Mc6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4f:1Mc6LaRFdGJm0Q3WKVSwdr13Ek0VAc
TLSH
T1FD452327B9080A19E35A42F2CD8587B15D1ABFEC7D48024A5EAA2346173DFF57C1CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 4c4995f247e549470372219e0a733544f7b9c15ab8e145cffae11bc83716f3b0
MD5 2a5e438e0b4ff315346ed1d38c645bdf
SHA1 bc9b31cf29bfe5451f60fd2b9083770ee1e80d4b
SHA512 2f80dee2b5a070af10ad2133ca3ec913976f75f4846496d6fc6ff7b36ad0b130d5109849eb5781eebaca0f78e99117edb7232c473cecda51a95f615c31ccf687
SSDEEP 12288:49c6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4C:49c6LaRFdGJm0Q3WKVSwdr13Ek0VAV
TLSH
T159452327B9080A19E35A42F2CD8583B16D1ABFEC7D48024A5F9A2246473DFF57C5CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 fa3cc46525c1fa8be62f4ff1c5caa746c4dea91a9665244a4e51469896b05cf4
MD5 4575372d886e4815c8f6b6de8d9d00d3
SHA1 4e6767d978624ca43989d2b667bcb4030b74d3bd
SHA512 23d97d05ad3359faf88e1fe479f086a83e08d1a1d310688cb4a8596e5b9e07d170e9fca48f0e9e0b73762c05d2d3e34f8187406f01e28bac7ca906b93dfcef5f
SSDEEP 12288:WEc6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4r:WEc6LaRFdGJm0Q3WKVSwdr13Ek0VAc
TLSH
T1FB452327B9080A59E35A42F2CD8587B15D1ABFEC7948024A5FAA2346073DFF57C1CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 8b773622da90b8e8423b1f006661020717692bab78940e71b135f29536d6b88b
MD5 4dabb7a76955a07f89a9361a2fbc6811
SHA1 47ef5201c30860e1dc71778acb44d0830906ab6e
SHA512 3827e93a47d1745188b19de08ba189506e4e2333127d4f07a7c6c671157b9289480a9b61cef9747cfac744be16ffe5c9be4927404f288d9ca0973922cdb07b47
SSDEEP 12288:i6c6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4I:i6c6LaRFdGJm0Q3WKVSwdr13Ek0VAT
TLSH
T1A2452327B9080A19E35A42F2CD8587B16D1A7FEC7D48024A5F9A2246473DFF47C6CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 59eb2f015e059da354500e4124dad2812d134773c0ac75af0db5d316d730b834
MD5 0b5f34478355d72cf0a7b86088474f11
SHA1 0bb1ceabf2ee77b6770a62a865534025beb52f98
SHA512 db1977241938e0da20f09a0f73d2290b4bfb932263d82031588a6ef08b1919328b61a439dfb5691d6ff0626634f39e5980df3de26ef1cbd00fedc10150a86116
SSDEEP 12288:OFc6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4d:OFc6LaRFdGJm0Q3WKVSwdr13Ek0VAC
TLSH
T14D452327B9080A49E35A42F2CD8587B15D1ABFEC7948024A5FAA2346073DFF57C5CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 881417886b9951257bf62a284a37670d0b6413e2644679b8414229b77ea33eb2
MD5 d3958cf223c72f6af78ba89239f7da1e
SHA1 76468b7ffe9022c2ee5fae18a91efb66d35b920b
SHA512 5b0e3ca6dd74875f884ce05b6e40a9f85f007fe1a83e6386999045bee8444145d6462a1b0b82ff8cd6f3c182500d5ed1e63150cd5dbffebb189c28ea2c547c75
SSDEEP 12288:w6c6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN43:w6c6LaRFdGJm0Q3WKVSwdr13Ek0VAI
TLSH
T12D452327B9080A19E35A42F2CD8587B16D1ABFEC7D48024A5F9A2246073DFF57C5CEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 c81f49e93a130b64ba26a67d6180c37f35592a82e4a5b0cea993cab8735472be
MD5 0dd101bc049ba0f1f45d1e99e9302b64
SHA1 e3ef16ecf78b4a4e43c55582ed09d7633834526f
SHA512 b36ab1169eaba644d81ac7abfe2711ef0eed03b0e574cdf9b614c05afa4f1b0f0750f2d3406135f16a6c5cad776bcf6a5505588ea63a21b2dd1d2e7e5e5561fd
SSDEEP 24576:cfwvok9RX6wkyAIoc6LaRFdGJm0Q3WKVSwdr13Ek0VA3:8MnYI/6KFdi2Ga9x3Ek0V
TLSH
T15A85C029EBDC04E5E177927C8DA7460AF6B178691B31C2CF029A536D0E37EE46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7706e0f9c5c9b5e7c4c6bda57b6c5fd8d5699678163e7896758f2b025f5624c4
MD5 bf403b690845f7b24e6f8a839fe1be32
SHA1 7d6173fb61df715b944714eb85980fe7ceef9072
SHA512 c0b9479f27276f598215b93d4c6d074a1183dca9db4878e705d5d5cc8efdbe2f3c8e96fd68dd32921b11d0c0a2e4a068e6594e52afe7e38351312e90a2ff190a
SSDEEP 49152:AYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0m6KFdi2Ga9x3K:uySzP+HFdi4VEk0V
TLSH
T17B066C56A16801D5C1B9C1B98F0BCC1BFAB134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 104a5ae530b6aff493f9e63bf782d9f3f5397be3b82b6ad5f299b2ceab7d23d1
MD5 1a6a78463f623f487ae6a3d3869ba543
SHA1 47b21514e0b184e8b522a8b415a99319fed0a074
SHA512 62b3b5cf7afd3271d6da372c6a97838bfda7dc048e4dc12c54eb0534da9d82aecd38e167f33e4cda854a2f08fa7cb8157e10403b6f37cc656f8f601fba606234
SSDEEP 24576:847Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYTc6LaRFdGJm0Q3WKVSwdr13Ek0VAd:847JUQj1irIhCnDHUPfF/W6KFdi2Ga9M
TLSH
T13065AE1EA3EC01E5E1BA827889154A5AEA71782D1F31CACF1270437D6F27ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 812ab9ea08752fa83619419add728f4cab1849d999e8221e15df4f17caf05d2a
MD5 0dd1a1aafb454d3d42dcbf28d5d3164f
SHA1 5c0baf6b41eb47fd5465a860401e4c95ec74b7da
SHA512 227a897e5a0ff17e1f57107aa5865a4015330ea676790bbf861ba84d524edc0144a2c1df2bbf75fc0454b3a2856f574edaf1f6fa2a34d3c692b27ae0965b3e82
SSDEEP 12288:sNsfcc6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4v:dcc6LaRFdGJm0Q3WKVSwdr13Ek0VAI
TLSH
T1A955011AE24802D8C26E5275CB858651B7337C6457E093CB57D0F63E0F3AAE0ADE9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 916KB
SHA256 f5d20781c75c13b14cddb251add1da3547c336b77b0daf5d142628566eeeb923
MD5 4888f6f1085bb35e763de6f32edde775
SHA1 ced333fac190de6fccb5bffa8c581dea11535524
SHA512 11cd6a9fe0a1af15eaa0c08ad3c9085cf0179bd1a1ebf00e43cd05d6f0de1668a69c2d5a1d59c07aee25f4ca5cd4d87cd9e21bb2b901eb6d8aaad460280a735d
SSDEEP 6144:9IsBC2na9oMM5LFwZ88lotMxqUWvU3fSkvt92C51QI1nOffo+Rwe1Dru4IJehfqj:TJniOU3fJt9N51CfeeR7IMxIBISFCaM
TLSH
T1B0151601B66AD74FC6A980721E36C1CCA7707D41EE45AB0372C8873FD57665CBAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 8de7e9176c6094a1e011dcdb2945c192206c757295a076684a2b1fdb0807df0b
MD5 4e0c3d54ea8f20a089c7ae2e73f59eea
SHA1 46466a3c49a8f8281b6208218b4dbf6694526880
SHA512 a962f6542379628523e733d0260095364c065ef749533ee87f8d3f4296cabfe1fe28226c43effbc68469f0b3f254a5f81043de9cc6ba858beb26f0b5e661d4a3
SSDEEP 6144:wxkyyyGINTa5f5BPWpsjIJmeNqTpF6LGe85tMxk85tMx8aeOQ631S35TKiN1:8NhBa5f5BPWCjIJmeNqVFQB35ui/
TLSH
T1A755C7419437A3CFD5B670B2076A6B0C7BA4EC0677496F2673D8853AD826B15B0BD3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 de8b4ac4c0b99f0c4780dbe9c7cd23a9c96656bbec587d544187e2348fd6c056
MD5 21ff76de89fcfcd859d57a85bee6369d
SHA1 297d562555be0549109f3b62902440fc07a863e9
SHA512 fd43f2ce5800ee1b2df76af79b417a0b96297d3291140955be539e5707745b4920ef670e6035d2d5f04b91e810acbc80b76cb81e69db7b261ca62ae1534b9e10
SSDEEP 12288:Uz7Uc6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN48:SUc6LaRFdGJm0Q3WKVSwdr13Ek0VAJ
TLSH
T197452323B6081A15F77E42F18D9983312A1ABFE82F0441CB9E552386573DFF4AD78B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 11da138537847e7b14e7253903934b18776d4747bf6fa885c5101ba549666537
MD5 15774b62447b8abbecee18957136469e
SHA1 1425212c5623691b7d28f936640eafc7621bc798
SHA512 d93df4f4e112922e70948aa4cbefcc3b0629af24ebff913c2da46bdbb52c7e95a24ecc7f6e8231083288650322a93df8558b7ccb7e07dbc51bf66d4b34940a19
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bYGc6LaRFdGJm0Q3WKVSwdr13Ek0VAP:wgb4mBIBhGFA6KFdi2Ga9x3Ek0V
TLSH
T10465AE1E22EC02F5E1FAD2B8CDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 c4ef8fc88265b93b48eebd706329739f9e613474aae12b42575ca2280a08812c
MD5 a9b5095bb78b075fd092048f149eab96
SHA1 0a0e387e131c0023501667c6ef8b9c2c60c61942
SHA512 7eb2eff829bcf4aac4337e05304c752a12f933a3bd848f62e1ef0c3fa6568f0f0241b65587f0569c8e2511045b3f2824d579a6a3ca733be7cd025a6d5f507790
SSDEEP 24576:mG88u8FpJqH1bzria7/mjc6LaRFdGJm0Q3WKVSwdr13Ek0VAq:t7ZFPqVea7/t6KFdi2Ga9x3Ek0V
TLSH
T11D85F16676E001F0D47BD13889864663F6B2B8251364EBDF07A88B551F23BE54B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ac5b55ac6bb638a78e1f91d404f932c50878dcb665f50790011572d8621e43db
MD5 cb8593b85ec96f2168bae9e017a710a6
SHA1 6b4fc7dd38407d936ae4a4d2372b7b3e7618a5ea
SHA512 a04f6690781a67273cdb4fd6066ad6b8b78441eb57e28e964ac533b010ba796c38f804b94dfa367ce6262dad08f28fcc3fd2232594ab5fc97ab37325b60f6a04
SSDEEP 24576:nPUr+NQXc6LaRFdGJm0Q3WKVSwdr13Ek0VAv:nJQM6KFdi2Ga9x3Ek0V
TLSH
T18265E12F769818E5E67AA17D89828719F772B861171192CF02E1417E4F37EE8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6d18503a4f4a296046490010bda155742daadac62f0231630d940cb1aa8d9ccb
MD5 2c5eeef510321e5decb8946662630071
SHA1 60f8848e1fdef758fa5cf26aaa8adc7b90c98434
SHA512 2a2176a440ede2e810e6d2071181c6965e1c963dd882c2e2689de184bae4ef4b1a8fdd481b52cdf8013cac98baeda8b4b5dc24a660881839cc3d70b22928f68e
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjc6KFdi2Ga9x3Ek0V:tG05lO43bnHFdi4VEk0V
TLSH
T19FD5CF6A62EC11F9D1BBD17CCAC6460BEBB23815033556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f65fc57bfae4e424381c09504a4b8eb756b04cb4db88b9d18c0562abcf16dd3e
MD5 4ecb131cab055811b0527fbea211596c
SHA1 4033415352ff64a2a9b7627ce170d3a05a8773c1
SHA512 dd6ce7fdf46d1081dba4b4da740b1f116b3659723a8a827b2d7969108e01e830c53b39abbbcf311fd5bbc186122e9e9dc5eeb087e4761e71e82d0837b9293786
SSDEEP 24576:Mfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnpc6LaRFdGJm0Q3WKVSwdr13Ek0V:Ua5POZ3+Jt2pasx2+m06KFdi2Ga9x3EJ
TLSH
T14065AF5EA6FC01D5D2B9D17DC583861AE5B1342553319BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c837e2bcd9ed2117cf9ca8b732fab9a30835a329ee52e2c3b831b3ead6350e0c
MD5 f9491a0208d65196bad03f67a01297d8
SHA1 077637d4a0d8281a87d2698e25b906c148c7179d
SHA512 2f8a73d0258d11febe50ccad647747636716a846620b667c36c9e30cd8935518b0b7fbf42851744cb6c1eb9745613ca7686ace1e724cd2c3fa45eac2685b7c8f
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7Fkrc6LaRFdGJm0Q3WKVSwdr13Ek0VAh:9Nc/zEOVHFN6KFdi2Ga9x3Ek0V
TLSH
T167857B2623E901E4F1BBE1BE89679546FA717869173486CF0291811F1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 064940e46237f18162bfcddb9de067b5e0c655aca94d4421036883017d4e0937
MD5 72f0f811b07f188cdaf536085fc25f90
SHA1 fd46a2e4033b925f9d00037947f826605e68ccb6
SHA512 cfa58710b54aa364beae3f8df2e962a150b77978e2a01134a817a8f71b5add96b3d48b67139047bcc0b491b7d4a83f6fb9e88674ec629eecd82fb6cf2caec63d
SSDEEP 24576:H8kNvNnaFeYhJNtmZBmFc6LaRFdGJm0Q3WKVSwdr13Ek0VA1:H8MwBtOm66KFdi2Ga9x3Ek0V
TLSH
T1EA55AF2EBAB806E4D1FEC6B5CD238512EA727861173253CB5290C13F0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 66db9e3b19594fddce9742d18aadec4306c329f46dee23397e39f3bc8ab6d9e4
MD5 6865415a551efc680f9bec5bc2a6bcc8
SHA1 c41de5720fda8eee7ff9f87842f5060448e4bd96
SHA512 0feabd813dc92e8820dedf94cce17243ad9f75ce76f378f782f90e5b3b136fc80b03a5e3af08321b3cebc8c502ea92b71c29436bfb674a2e229aaee2a4f1e887
SSDEEP 24576:nD3FHshBIYQgAQc6LaRFdGJm0Q3WKVSwdr13Ek0VA2:nDVHeBIAAX6KFdi2Ga9x3Ek0V
TLSH
T1FA75E13EEA5C04E4E57BC1BCCA538A06E77138A9072156CB06D481BA1F6BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1112-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1112-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1112-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1112-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1556-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1556-385-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1556-387-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1556-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1556-96-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1556-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1604-67-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1604-74-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1604-294-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1604-73-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2544-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2544-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2544-127-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2544-133-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2544-138-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2580-103-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2580-366-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2580-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2580-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2580-365-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2580-109-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3520-379-0x000002B4B8790000-0x000002B4B8E10000-memory.dmp

Download

memory/3520-380-0x000002B4B9010000-0x000002B4B908C000-memory.dmp

Download

memory/3520-413-0x000002B4B9010000-0x000002B4B908C000-memory.dmp

Download

memory/3520-412-0x000002B4B8790000-0x000002B4B8E10000-memory.dmp

Download

memory/5320-84-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/5320-79-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/5320-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5320-309-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5772-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5772-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5772-16-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5772-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5772-25-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5960-30-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5960-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5960-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5960-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6056-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6056-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6056-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6056-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6056-46-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6240-369-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6240-122-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6240-116-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6240-115-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6444-315-0x0000000000400000-0x0000000000621000-memory.dmp

Download

memory/6444-6-0x0000000002620000-0x0000000002687000-memory.dmp

Download

memory/6444-88-0x0000000000400000-0x0000000000621000-memory.dmp

Download

memory/6444-0-0x0000000000400000-0x0000000000621000-memory.dmp

Download

memory/6444-8-0x0000000002620000-0x0000000002687000-memory.dmp

Download

memory/6444-1-0x0000000002620000-0x0000000002687000-memory.dmp

Download

memory/6680-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6680-62-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6680-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6680-271-0x0000000140000000-0x000000014020E000-memory.dmp

Download