1ebff7b6c3103c28b66dd2e329919a4cacf71ebf2e1e60e09158269c1cf419a4

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Size 1.7MB
Sample260703-ryhd8sa15w
SHA256 1ebff7b6c3103c28b66dd2e329919a4cacf71ebf2e1e60e09158269c1cf419a4
MD5 0cb618ce6638bd0761f0b92228f42059
SHA1 69671e2dd0a3a58e4a123a38c1c29b66abcedc63
SHA512 e61ccac26e9e573f7863feb7ed8fd76c159be84478bbfcabfc8bfd65993c42213202044280fc5fad6d01640dc1df45cf0320b75ec8f6c6f52e243ea252560edf
SSDEEP 12288:QN7qBUJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PBcdCN/j2GLl3iFSE33b9
TLSH
T1BA85DF727251A799F33812BC6D36D6500AF5BC77DEB102C7B9D232AFAC30709961B219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5704	elevation_service.exe
4712	elevation_service.exe
1760	maintenanceservice.exe
2996	OSE.EXE
4992	PerceptionSimulationService.exe
6212	perfhost.exe
4460	ReFsDedupSvc.exe
6308	SensorDataService.exe
1412	ssh-agent.exe
7144	AgentService.exe
3408	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\92795daf8ee34577.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_125484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_125484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_125484\javaws.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003562998ff90add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a401c4af90add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005897b34af90add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e3b6d4af90add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8e59d8ff90add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000095cae8ff90add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093a22f4af90add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3903f4af90add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5704	elevation_service.exe
5704	elevation_service.exe
5704	elevation_service.exe
5704	elevation_service.exe
5704	elevation_service.exe
5704	elevation_service.exe
5704	elevation_service.exe
4712	elevation_service.exe
4712	elevation_service.exe
4712	elevation_service.exe
4712	elevation_service.exe
4712	elevation_service.exe
4712	elevation_service.exe
4712	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5984	2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	4460	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4460	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4460	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4460	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4460	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4460	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4460	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4460	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4460	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4460	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	7144	AgentService.exe
Token: 33	3408	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3408	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3408	SearchIndexer.exe
Token: SeDebugPrivilege	5704	elevation_service.exe
Token: SeDebugPrivilege	4712	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 1720	3408	SearchIndexer.exe	100
PID 3408 wrote to memory of 5244	3408	SearchIndexer.exe	101
PID 3408 wrote to memory of 7120	3408	SearchIndexer.exe	102
PID 3408 wrote to memory of 4976	3408	SearchIndexer.exe	103
PID 3408 wrote to memory of 6412	3408	SearchIndexer.exe	105
PID 3408 wrote to memory of 6184	3408	SearchIndexer.exe	106
PID 3408 wrote to memory of 3004	3408	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_0cb618ce6638bd0761f0b92228f42059_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5984

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4712

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1760

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2996

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4992

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:6212

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6308

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:7144

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1935666426-3801330415-1166019131-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1935666426-3801330415-1166019131-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1720
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 1756 1760 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:7120
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 1532 2456 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4976
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6412
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 1532 2456 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 1756 1760 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7c66ce6c992da05482f0f44460ef8c10517ae4bd90ea1bd7009df4dd60642fe3
MD5 f3c76d42588dd00ff8e7fada335609a6
SHA1 66cb148332e1a5f62ffa85bb75a89d336a38ee0a
SHA512 6cc44561963835d67e8699ed8f0d5a8fe570048650904860166e84019b9f8eff8de4664168ab1196afc22daf88d9e03e9c7d9680aeaef794d8a113645254216c
SSDEEP 49152:8b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnJN/j2U4FH:m3q6sjBuj2jF
TLSH
T13BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 5fdb3bf01258ee3ccbdb19f6f12769c3229bab320f29fcee25da0c874b2db0c6
MD5 2e8620bbc04078c4354f881cc8ce0c55
SHA1 d19922aa15cb169c61a1482101e0256aec62410b
SHA512 647b6ec2a202a518ebcd8b78783d0b8579fafdd69b274d579138f3866c25d446db5634433aaae3e8f413ef5d58a3a59e7b27ed39d89920f87fc7f7cda191a2a4
SSDEEP 12288:01XLsswWkxy2lRq2czAJJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:SXYfDtczANdCN/j2GLl3iFSE33b9
TLSH
T13E750228B7E049F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 f3fd6b1eaa2600f14d52d0568b2e31871c1254a99994e4e026723b4b049c3cf0
MD5 d1beb55ea651065f8dfb11c3d5d271db
SHA1 ca7d7a92519119c8f8702d788bea4b02343a4eda
SHA512 fb30b3cdcea82145877959337814be9e69acba8f7e554cd9b0a38faa3330ecfd881648eaec45d4990313e9d487381c9cc92aa62164eeca8849a58b7edf2f2924
SSDEEP 24576:b0Le5ji0hmxxrMOdCN/j2GLl3iFSE33b9:bPji0AjEN/j2U4FH
TLSH
T1AC95AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 29ba70865aa5406792d6e37d3079bdaa5fa1d0f49e2f9b98954cc4b0699bb3d1
MD5 af23c22d0f9bc60da2212480ced5aa9e
SHA1 ecc0eca624bb2a0b0a74ffd24f84895f3389eed8
SHA512 19e1680d71c4d2a10f3852f20b0a0289e013465a80a2d0ebd0e16486a2f026d9721d7e6954b163879e6ed81ab81481f6580300aad7f440c783a73e07e0576d7b
SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWn6q8wyuMdCN/j2GLl3iFSE33b9:X/ezSC6vUzPveHjygN/j2U4FH
TLSH
T199755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 300969a3db63872e0d574df1a011208adbf0edc4292f7dfba41c9d90fd1b683e
MD5 04aea924295314ac551321477e1d9746
SHA1 1c57370c4efc1b4de4f9bd1d00b06f7b05626956
SHA512 01919078fb62128a8517a6e3de03ea142c5ec9b7e29701f02a5b80b1bc060e0d33b4a47e390829f3172b4cd384b4ee9863a239724187b0b006c51d0d6c3281ab
SSDEEP 24576:0VbqPb88hv/l+YxdCN/j2GLl3iFSE33b9:0VO88hXl+PN/j2U4FH
TLSH
T17B559E66F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 5829cb40a897462a1c5245fdfeaf10801059bf2e0f37e1e0fa1eeac2b86e8ae6
MD5 eade3544e5251ee7403cf3926f8d0b4f
SHA1 af250d4a5133a6d53dea9d3c4eb987afc4c24a38
SHA512 949c58a01399a5f252206120d0e74ecdd2e9f3eede8c33779f5e7ee49e48e58ae0c9033b5f8411586e360badd0ec13c18a1a17b486129121e979ff58790d4a19
SSDEEP 12288:rLOJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:rLidCN/j2GLl3iFSE33b9
TLSH
T1D3552360DAA5F565F26F837903ADAE656200FEE8E525884781917BEF517CFECC032063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 74fef7666a24a521afbf840be049eab692e6108493dc3a219ff66e4eea964e57
MD5 f1a2fa4412cd555b33eb338bbb1523b7
SHA1 d2050616c10687eeca4e8e18a9aee06cce2f5de8
SHA512 ef75e34b15de3f901c959cf4ae227dd30674fbdb572231699e83e12ab76052f85df7fe46986f2849e051f3163bb7805c6e849baf345c4ca17edf29ab8d8f56c9
SSDEEP 12288:OeBNUbTVO86UtJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OJIU5dCN/j2GLl3iFSE33b9
TLSH
T15975CF3BEE28FCE2C27E8DB85791C600976278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7e5aa671a48a8503d28a4e00bfaf3b17328c140faf4b0ecea09b07114ef834cb
MD5 1cd300b4dc72591dfe4db3c6bbceaec3
SHA1 fec7df0473bc072963d7f653da8b041c6ac6823e
SHA512 6a436666b975feead3b91eb6c605b45fcba9d19dd541f2df2c3cc162060326f45b46f92769778a0edb7b9564087a41f4e3d19f44985bd5d1e68b7678705eb678
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THP:LQvGAdlCEL8c/DRNw5CZj2jF
TLSH
T151267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 3bce38a858e0685cc22628a6ea39e92804e219bed136ed61a1add98e25fca594
MD5 16d0c0f4a123ce59aa730156190116ad
SHA1 fe9b6c09a830652db4280da49eb8edd1ffa1ae8a
SHA512 c20d6f8bbe2b1934f0e1826f3769d5128ea1b38c7c7ae69355a7b8eb3c1711c947c60049746523bc08d3ce6e91b669e962b92d34d3c7312d1cffb0d033fb2262
SSDEEP 12288:kAwSfxL/2Dc3RDLLmt0LDQewsAjnJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9c:50ewsAjndCN/j2GLl3iFSE33b9
TLSH
T18C85E031FE74E036C27F0DB61B36D716142CBA608B6119C3E3E84E9E59346D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 59343d1eb2cca3df6e0b52a3401eaf1c1686c328b9ccb7e8b5cd538a7ea26e04
MD5 90601f8c84441648a547d1bd4ec43e8f
SHA1 334761a83d1e491422373f4c2db2c622527fde62
SHA512 39bd4bf8f3604a779f07d103ccf5e9877bee5e5338f54ecc99143172529b6035980bae88d1ffd77e240b9acedd8f9d98234dd03933c02af1737667f383420e89
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHA8F:wUEtQevvqc2W1cpV2tI32A
TLSH
T164474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 91759a393087087eb69ff9e3cc01ce7842c1339b81491ed2894f3e0b4f804de8
MD5 fe57fda18404f899e0267e3dd8466a08
SHA1 f6b837c1db65cb7b62c810aee2136499ea9dc430
SHA512 949577c016384bdd3a0162088bcd3f8c7f047ec372401a328716af73acabc26a53981f2b728d461d8f7a81b398b94c2dd215d6f41df88c3a0949000e039aa2f7
SSDEEP 49152:aCbRquA/m2yL5zTfFiV+XenmE3/z0N/j2U4FH:voquVjnmNj2jF
TLSH
T160D58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 70454d66ea33eae0909c8a5faf5a952576d4c9230062e14946a22460714adb4c
MD5 a96fc3fbd867e29f6d4f0af7d78d6b43
SHA1 568cec5565f88f3c40727b159a35687d87c847d6
SHA512 7479054e7415efb61f138ae99a3fe1b146adb05dca22f3d4fb3e3011bc0c97ed106fbc1d3e5d1a1bf74c2cc9064f991d1391be5004888648de0bcbfbd4fbd0b3
SSDEEP 24576:9AhGL3IFoiwtA5l7S534dCN/j2GLl3iFSE33b9:9AMUFoiq5TN/j2U4FH
TLSH
T1E635AD80EBF955D4F5B3AAB899B69571EA72BCA95E31C20F1150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 4dc288e3930bed3d281ebe6bd52c261fccd8d9f2b8a7dd752f212ee89813b106
MD5 7655105422441e1dff92fdf292c3490e
SHA1 07a5fa2a73355601914d2eae554afd5ce42be7db
SHA512 1f4ca6a2359c72e38946cbb69335ed66fa3bef9aff39d7ca4cfa854b8834ba424321e85c4a58e626c2970c6ba2c20b06e65514515ff37cb06cc0ad51758528a4
SSDEEP 12288:Kmw5HEjsChNVBFgl0WDm+CEJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Dwu4OWDdCN/j2GLl3iFSE33b9
TLSH
T12D75F14577E41CF9E56782398697C536F7B2BC512A21CB0F03A0C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 5515e97f58df92290faaa529670fe8c99a24064f95375d610ba58e9d5b28213c
MD5 58f46083453509d0a06bb1897ecb1385
SHA1 4f6ace526259c0632e007ae2d7755c6cb86b9e18
SHA512 459a9bc8f927d06d7c0c81ddb222f3c53c89fe7f5718012fc3a795c5ae8e0feac9f937df0a93cec3f35981b5ab5a550837560243ef2ebbfeaeb940164b0f5004
SSDEEP 12288:veZ1IyXJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:2ZuWdCN/j2GLl3iFSE33b9
TLSH
T15A65125937E471F9E1A7823C8AE59A05E321B8A5A73243CF025047EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 74bc276ba340f550a077e9c2c67f2f8e5ecbd5cb27b210abe9b94bb8c0298d15
MD5 b06fd19860ffd7fc6b24112ea576fd93
SHA1 ecb4155e2ee611925923ac1d7c43990055858ede
SHA512 579d3244c753e17ba514de5013244987ee68535fc0d291a94d12051377387c0658927ead7f9cbb98bdc5aec7b8276c86df28ed8f5e4731aa51834124e12e8b55
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ub:+QRQyi36YOcPbLvw2gAf+PN3Kj2jF
TLSH
T10D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3883355c6bd77ce12993e2321d55449704d3612d87a2a53e67faaf2ed7a0d371
MD5 db450990a03367f5c056a1f4405ba473
SHA1 0a5d5dbbbe046bca6f1b11f90e23f1bb404c70dd
SHA512 018984f948a78a47336c4db45304e127daf80e23e6265ba9d3a18d9051fd4f943cbd72d31f4be4dd081bbdf87084bad8c8eb3731b5e562bec115189bb17371de
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ub:GQRQyi36YOcPbLvw2gAf+PN3Kj2jF
TLSH
T164667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1ffeb4d3fe31d3677ebeae9e4938a529b2fbb2929c8b3885c9b80ac475cc305d
MD5 f09c287c64a4d9a6f1d550fc85747035
SHA1 65116cdaedfb8dcb7be6184ef24cc26fff0d30a6
SHA512 cc478fa80bf7bd0cb2329b2c56fb20a9faaf1ee93bad9982b83c95c969500f47a9164571b7935bbb635e9b15d29f446a1356ae4f1e762e5261aee6d253e9c41c
SSDEEP 24576:HwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0GdCN/j2GLl3iFS+:v68Qg55nhceWu7PNU3/EN/j2U4FH
TLSH
T10FB54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8541725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 26fa89b305db4cd243cf82b11a2d45a3ee6967e5ebf72460167564a839b8961d
MD5 2e79ee2a4336d3fcdea0be5bcf5688b7
SHA1 e83720fe4842755d11881f3c4c12f108da21962c
SHA512 9bc15d002952a164e77a5982a83e5813d652b97f692518c27cee9f3ec66ade16c2011cb1f4493ab82f6f2eebcdc584532871fb80e12c1cf2c33a3faf6b10918e
SSDEEP 49152:O3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk991:vy5112gYy5azzVvt69nLKnhZLj2jF
TLSH
T174168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 af6fef4d7ede2e494080e4dcab67f4430a924b04c9e5244567c11e734049951c
MD5 71546d628e186edda383c2265f1a6688
SHA1 33da18028322e6ab3b3fbb81e9f8a90fd2e13be2
SHA512 1c4f6d8a3846482643b231fefe2c75839d7bae2587e5a82decd9a1b4568c7cf94f029bf5b5a68983e4f6dcd0d3a8e81ca7c2cc7ed616c0013aaf181fd4d09f37
SSDEEP 49152:vB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glSN/j2U4FH:Ru6Jmdxd2dij2jF
TLSH
T172D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 72a6a694aa1361ced075895a54c671497895c80a6121b464ff8e0a8a6a3e2b26
MD5 72d4b89d4291f9db02e1fa3b8e020945
SHA1 77ff5565398b9b7c45fc9e947327e033a272423e
SHA512 1b0e5d50ef9c8832c2d1dc9ee1ce9cd8c30a789bdacec61c0690c2823da11c4adca28dbede1aff348e42082691aa83be037c312434ae532abf47fac5c0eaf30d
SSDEEP 49152:N1hpsNoJpF1A63U44CwH7R4xuN/j2U4FH:NmifPWRNj2jF
TLSH
T15FB5BD13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d3815974ee8f63fcce8d52c903f817de86b504a596d4c2b6e560d4ec9652853b
MD5 44abd80100b8ad7a95cb2c0a87089a70
SHA1 ac62259aafeaf57d72fab399d96d337794e95ba1
SHA512 608b28bb08268999c91a5a2e6fe25a0d27f54398af2c514d3c695b3169de5c1ae5918d0f5902dfb4c0f6a6a33745ee3d7fd37ee296288f4cc635dae7b0b4036f
SSDEEP 49152:SSuZQIY0Be2KcRVtOnks6NMHqZN/j2U4FH:M5dKii61Xj2jF
TLSH
T106C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 14a1e989fd6ff3741fa28c6a25336a86ed228a1aeabec96ada7c3c85f2a57b24
MD5 c395b35d3b2369eb1b47baaf91a07a45
SHA1 0df400248bb69b560c7339b1e97285a27ccbf3b7
SHA512 a8bb61eda8c661267aa9c252cbed9fd568b24b12a6c4e181e4afaa2dcad596007b5ba0637dcee8adb6af5c79277f82af1471af60ea6827b2fc4e1ee4903b580d
SSDEEP 49152:7htSn8EApI0fig3giDn0AP5wiN/j2U4FH:aX2imphhj2jF
TLSH
T19295BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 7eba7f8978e05ae5068bbe39e81820bb4cb352cd471c34bf3f64cf1b043b7c0b
MD5 6db5f70e682595a97ef32caf13b53b48
SHA1 5359feb6df0749467ab74807eca3e3a2a3074dc5
SHA512 75fd8024e32378dd9a9d52ae5be463425b6f75ea1489b46fcc1687e8382e6c01925ce0b3b976a634f697a47e9e765456b5c8440140d77e647139949f36cefed3
SSDEEP 12288:OmJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OKdCN/j2GLl3iFSE33b9
TLSH
T18A552364E9F6F669F15AC37D43A99B555200FEE8F626444782C126EB237CFEC8032472
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 2cc8d7be60f945c92c7021fd964437f1eaf1545fc6a8e10a7adc048bae58326d
MD5 9fbcca7ccd82070c20d372b1ca7a535a
SHA1 d45b8bec5c98cce3694f8cdf97f0a962bbe17e7a
SHA512 4375c6c69126cb7939b42e15c223abd2a20588f836e731f3d68c1d7b20391e3232dabfa1e3d5ede1011b0db8bbf61341c778cb46d1c8cabfd93f065255f8414d
SSDEEP 12288:SDJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:S7dCN/j2GLl3iFSE33b9
TLSH
T1D7552364E9F6F669F15AC37943A99B555200FEF8F622444782C11AEB637CFEC8032472
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 89a3e6bfd93a895e01d9e7cbe06c895c4ca91b59f1dacc1ddf6f2aee84874c35
MD5 f65b7a5f3b1bf673a0798bae0c23f2eb
SHA1 d0f7db5a4aa591ba0adbe988dc522996a1a3982a
SHA512 648b2adee2dba197123a26749ebb44ace1f6bf762f55fe31178ea322e9706295d5a949b38dc607b15e3012d96b469583d5502d7b2e173ec8b0a4594641203aa2
SSDEEP 12288:8lJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:8hdCN/j2GLl3iFSE33b9
TLSH
T1A3552364E9F6F659F15AC37D43A99B515200FEE8F622444786C116EB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 b79c3167407968f3d4b513bf3c1b840c7e8a90a7cfa22b11ca17303d260bd632
MD5 0cd2c002cc04645f221595bbe15bd7e9
SHA1 c4c0a4630a3efb248e305158327b99fcd38ba11d
SHA512 d7c45a7dbe403afc7b146e74f7a7e0202ed670207b12922b7577ae3156bcfaa5cee62582fe06ecdb073fc8c07cd278f861d1b9763b9a7373a2f37452981397f4
SSDEEP 12288:FVYJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:YdCN/j2GLl3iFSE33b9
TLSH
T176652360ABF5A1D5E06BC37D83B59A11E320FDE8E732858F87401AEF1B74BD89431562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 61805259213001d544d9b3f0765977da706311c0da9c2d73dd9a43b55a5116e8
MD5 84dffadb56d6e7c0877306ca71061774
SHA1 5f444c4d5094556ae3e7718b4ecccf078af96f0c
SHA512 7192dc608da635265948d429cf2a1e28431795a67b59497822b033e0a82d766d7c8c92276e34049f265f1ec853a644ee8c0f9601b00536213936024698c44b71
SSDEEP 12288:YAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:YwdCN/j2GLl3iFSE33b9
TLSH
T137552364E9F6F659F15EC37943A99B555200FEE8F622448786C116EB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 abd8e3aa16f687c32bcd9f72a85e41f004f91e8a068decd53e87ce48357adcb4
MD5 68549e847c123f62128eb3b8f66a1113
SHA1 8cd91557e7ad23f8eb47420115ec5320657d6415
SHA512 cdfd4d78d8e77e9924ff819eed3a49c6cdd72d299e8b5d5e5bde9ae2237bf9a7b1c4a1636f1c2a38a6492e724464445c18ed568714b3601d739bb56f39096e56
SSDEEP 12288:UfJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:UPdCN/j2GLl3iFSE33b9
TLSH
T1DB552364E9F5F669F15EC37943A99B555200FEF8F6224447828116EB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 2d2aaec3624a88374aca122806207ec8a2208e61b976015c6d9d759304599343
MD5 4f9ea809e2cb501a96adb30252823a5f
SHA1 7ccd8c22fbbeee2ded29ed295b94f9580e32dfef
SHA512 4e864a6d043dff35c6845655012d9465a1278fad19c228b43e1778326bc11b597981fdea0683c6dd72ffdb32a840f36e4d0c893a91cca32e8951f58e54c98b5b
SSDEEP 12288:vrJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vzdCN/j2GLl3iFSE33b9
TLSH
T1A6552364E9F6F659F15AC37D43A89B555200FEF8F6264447828156EB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 72fab2f53776df29776aa7cbf8c6eaa6acbdca8905281bdda39078f4f8d707b2
MD5 5b95d31e634a63d330dcc8aecbc58865
SHA1 23d881eae402544fb40732b00c6ffee69a88e578
SHA512 8c7efebcf965807de8cae4f2e59f3edb9bcb4429dafdbcce149eb3ac3230a79cc9724ab76b3a6d9048093882013618fe6d1bca5dd5a95548b8963133b466ea37
SSDEEP 12288:yiZwbVzzFEoS2cPvyjJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:VZMRzFVSObdCN/j2GLl3iFSE33b9
TLSH
T1F87502A4B39058F8EC67823EC9658906D2B1BC594770C60F03E4366B5F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 2b005f2b2498e4501f1d180e413d631f13b78fa1f52f7bf9efd89d41eab76a54
MD5 0865b9f3984f1786e8f6f08fc572aa61
SHA1 4e919616c019ba53f832a015af1390cfb2ebb1f4
SHA512 4aa5e93d60a73b8e20352be9ebde3d972792ddabcc43670b1763402b2d71484934c258a7e06a678d48969b2be5dcc2be5459304d64654e463f73c4a31dc66497
SSDEEP 12288:8aJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:8mdCN/j2GLl3iFSE33b9
TLSH
T117552364E9F5F659F15AC37D43A99B555200FEECF622448786811AEB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 2da7d5a097c8d61f51d895deaa52dde5b1f218a626d3e92eaaa0084883777003
MD5 bdf3246743ca8ddcde304ee6a691ba4a
SHA1 25abd3df5efa4510fd6f705de9ba2a364c035273
SHA512 a5e10acadf951e22a92abae80e44183395d7e5a73685989d27da0ea232beeff057439afe0278567cebd6678ff5f25e0685df10f4d8a23669dbbc1057f7e656df
SSDEEP 12288:Z+JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ZydCN/j2GLl3iFSE33b9
TLSH
T1AC552364E9F5F669F15AC37D43A99B555200FFE8F622448786811AEB237CFEC8032472
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 36c526a21ad93d091c36aebe89b20a7e309ffcd130bb2f2549eb4a49ddf7482a
MD5 cf75e761d67a53bbe33302084a3b558a
SHA1 45cd3aff08f4f0af5ff05505a6ba8d0e8678cfe9
SHA512 fc3be822a302ab7894777cf3741b9687b9a0fec55b36ac7c025f64b78afb9d8b172a5141bc429acbf7998371a0a285a22549a46f9432a84d79d559fc4fe31db6
SSDEEP 12288:zyPz5L8XJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+zy3dCN/j2GLl3iFSE33b9
TLSH
T1C1650217B7A131F9D177823889A55A02F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 a3d3cb3e0f2d840ba0e5103a06411eb9989ed4f42e23bcb057dde58d948e5aaa
MD5 b8dd1418ea64df81bbb44a5854a7ee4c
SHA1 f5594dd618c5d677b308b02a8a5ec4045216f68d
SHA512 bc271c91eb768d6822259f55eb2ea91eef11411a1a8ce8ddfcbad33e0cbde52db5c91e0ecae6bed6a2ae6b6dd61b35883311246509533e2251fe554168fc4abd
SSDEEP 12288:JaJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:JmdCN/j2GLl3iFSE33b9
TLSH
T105552364E9F5F659F15AC37D43A99B555200FEE8F622448786C11AEB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 262ffa1b04e2df8ae7372cb2b2ac087dee7fb8dce1f100defb4c2110b43018b9
MD5 8391d54eebec061238de6497138f399d
SHA1 93c7ccb7b5b97c5f4db982d95e7355d2f0ff29ac
SHA512 d7c493b934daa87d0e28b6401a985ca095dd7989397fdb1deb1e95b2d72c47abbc66780e5bf341ee38b4a5d2d760a9b754ea67b17fd89d25e4dff5e1703fffe2
SSDEEP 12288:vaJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vmdCN/j2GLl3iFSE33b9
TLSH
T141552364E9F5F659F15AC37D43A99B555200FEE8F622448786C11AEB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 e66a905e130f24e8d7df2251b65522fe937088a591aef9e0b7aa74abddf34c2d
MD5 bd3fbe13d32d5115ae46a5a999b0ae27
SHA1 b0df7755948600f2ffa71640b82fd162196c64c5
SHA512 0d6ab8224f1353a559a75c55ae4b377c825e182f48965ea8c3113804c1a02812dc02d1cd8d6c482d8ef1e406452a4ec80648a61c1dde713db7c9be0539b7e213
SSDEEP 12288:KyPz5L8XJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Xzy3dCN/j2GLl3iFSE33b9
TLSH
T110650217B7A131F9D177823889A55A02F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 1c0a7bd838e0c4a4383592d47347009246ed341942f27bb871897756e437265b
MD5 1705993e744ae1ab326fda689852dcd5
SHA1 d4cf8c930df1a65c70032a7b0c324305f0282cda
SHA512 5dbca18800c8950db53194bd4999c0de61590a9c6027fb470dee389b8f839714157298a068a054343c51a6000d388bde096e185ebb9388b9b333de65dc77208c
SSDEEP 12288:WCd9CWYoaLHF3z0z04PDvh1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3TDaLl3z0zDRdCN/j2GLl3iFSE33b9
TLSH
T16E7502A4B39058F8EC67823EC9658916D271BC694770C60F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 c35745a16a233cf4a97b7e6064fb6f230305bdef4315d21a533d0ec38382d43c
MD5 315d4501769fc3eabe46869a52ba52fd
SHA1 219208fc2280365a7541cf36e8dc59327cbbf1f0
SHA512 f0bdb214931561bda16a3d1d9772c7fe4021928741463cf3cb7cbe7df68a7c436f23c8d6852c6287ee548323ebed40469d9364892def85b787d1ef2afab33a5f
SSDEEP 12288:4i4e7KRdTfgwCHKy7GLbbdIvsJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:43vd9CHKy7GZVdCN/j2GLl3iFSE33b9
TLSH
T10685CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 948808bac14eff10fc9c66455c397a98467a94004bcb28c015726d8187ca18bd
MD5 cca5f04d83fb96fe60c6dd767550deb0
SHA1 b1473252348e4b3714e2e08fb3f7123eeff2bd47
SHA512 263d8f8a2bfc56590dff4b29e247fba290d6489edadbc8c69d14374f87e064b6939a05699c8f57a189041271fb50b3782c4ece39e445c2c7e5cca583cb1b30f9
SSDEEP 12288:rFJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:rBdCN/j2GLl3iFSE33b9
TLSH
T1F6552364E9F6F659F15AC37D43A99B555200FEE8F622444786C116EB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 859fca7b0c15b0ee6e0781b8ffb5f232c46ee7e4452d55e95876bd4e64c38233
MD5 39881736dd8d7025cc5c7e92b7053feb
SHA1 6bc330a6c70c2e00bb71fc84f18faa2739256841
SHA512 59a580f54210b59f03129a24914a7c897247f1a80d012c5e3c616e4783a8f6dd30d7392bbf420149c8d8d77d2b34d0173137c5fdf2a499ffffbb601aabc61849
SSDEEP 12288:R3JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RXdCN/j2GLl3iFSE33b9
TLSH
T120552364E9F5F669F16EC3B943A99B515600FEE8F626444786C11AEB137CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 97664a091b465d1492656d6ef713b9e80e5224f04f74fb70f5831fc1a2ee65ff
MD5 dfd6fbbc60013621549d7146fe6c64a0
SHA1 502223cf0e3dc4808b138faac899ac18521d82bf
SHA512 9f3b72a4a254f70a777285696dfc64e67d59780b25cb318094ff7ef3268d26cb9784ef5a9b57c6b197776dc46b89052c4be94083cb70014bfec786c312c13352
SSDEEP 12288:TsJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:TEdCN/j2GLl3iFSE33b9
TLSH
T13C552364E9F5F659F15AC37D43A99B555600FEE8F622448786C11AEB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 02d4ff9e5ba2d66a9a3ea23b89205866af0f0fd7567f8af4c2ee6f0747ee7e17
MD5 bfe2aea0e72b81fe58061f890a4cf02d
SHA1 1f3f913985481a7e0f5b940b4b189411781bd09e
SHA512 cf7db5cb2d0b92bb94a06448003152ec0d82c3f93febf048dc46eca0cad88bb114ee9f8d621f8d148c3157eab751992a6043c611fbc604958596260f6c87dbd0
SSDEEP 12288:faJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:fmdCN/j2GLl3iFSE33b9
TLSH
T118552364E9F5F659F15AC37D43A99B555200FEECF622448786C11AEB237CFEC80324A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 e26434bb421338daa5babca856f7edf4fc67ceeaee2355279ca7b9ebf100f719
MD5 aa731b6b80d89438705518bef311158a
SHA1 a0c315c0b5eaa0b9cc881744e73d46b648107b8d
SHA512 d27f93949edf3c274a2652d7670740cf2a153bea373c5d114fc0c0bfbb2c25aca7840df1ef0d0c7a8aeb9a83dc5182b508d6e4a582e1ccd24ff3a59529588dec
SSDEEP 12288:qFJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:qBdCN/j2GLl3iFSE33b9
TLSH
T120552364E9F6F659F15AC37D43A99B555200FEF8F622444786C116EB237CFEC80324A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 03628fe11adb21220068259590f7fa8ef2625e3a54bc974113449303907dde29
MD5 f08840b2dc2cf5bbe2dc5daa906ae7b9
SHA1 b8673f17a6104fade958dceadc27f43dd6592e2f
SHA512 fe057883c3ad9871b4c89ab9e93353a7ef295dcbc3952b6ecd276b387026e19fc2fa73abb0274941021facd00b0beae2d14531783a11b59895868b577348b164
SSDEEP 12288:miJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:m+dCN/j2GLl3iFSE33b9
TLSH
T1FD552364E9F5F659F15AC3BD43A99B515600FFE8F622448786811AEB233CFEC8032472
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 02ec8ad912d7a0e79f93d2a31dc4edc076bb7e8dc7c832452d448c7c1a3a995d
MD5 9dd423f589861f80e1c81b61443ba54e
SHA1 21a6891ca564be6fcc809cf5724b4f18bc0b3803
SHA512 7bf13bc97435e3a82f0229064217c535ce7f38a0e07d93b473a0a54684b04ca15be90993284f05a5412dbec45ed176003a05741b9267760f598d5d4887b9ab1f
SSDEEP 12288:eAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ewdCN/j2GLl3iFSE33b9
TLSH
T17B552364E9F6F659F15AC37943A99B555200FEF8F622444786C11AEB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 0014e55a21a75662ec2f57adfc5021daa5e148f2979f5c2eba45bb426b226e5e
MD5 2e53f2e2e6a0b2a5d0ef4caed1836d6e
SHA1 318b945d21d0d975ef1ecd0b18718350e213137a
SHA512 b8a0774911fd88c69f25c5e178bb5f9f81f5916b554772bb3ac91595a9e6e7b87387e22019190839c35ff52fd76faf345332d9bc839b8caacd6baba6892ff3d2
SSDEEP 12288:2dJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:2JdCN/j2GLl3iFSE33b9
TLSH
T144552364E9F6F659F15AC3B943A99B515600FFF8F626444786811AEB233CFEC8032472
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.3MB
SHA256 dbae336f1da6abe6bd8b2e46e4014166ee70c64aeb9e4e1116b5dd51ceb184c5
MD5 0def6aa0c213e562b6d4005c70e665b5
SHA1 6c737eadcbe3ca1f8097ec3129e08ee9c1787411
SHA512 a77b979ce289f6372d41370beb222cd883ae341862dee1d244da7305c960c8f8f86a78ac8b25d264ccce6058a14fbb6bee000e4d8d6980a1ba5a29227a83364a
SSDEEP 12288:pAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:pwdCN/j2GLl3iFSE33b9
TLSH
T15D552364E9F6F659F15AC37943A99B555200FEF8F622448786C116EB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 e354619b5a2e122b14b05e44aff7203564b27ce8f1a88a363a45f5cd7fa55f7a
MD5 a30b107e110fce3a93296c0d3cd1680c
SHA1 65180ec049f29bd24c26a5e48dffdb6e73a58961
SHA512 e273670dea92b539a0c806d32e58578a329084cb4b48a7c039b7573aab54588a2aadb4c7665ea4324c7d48e5de9b5d0e15383080b12d90dc644bf129db43a9b6
SSDEEP 24576:zfwvUk9RX6wkyAICdCN/j2GLl3iFSE33b9:pMnYIFN/j2U4FH
TLSH
T1A595D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 735c0265e3e9279615bee97755ef185b7fa9b991b39a6cab1a694319c4c31b12
MD5 136e774167867d390ad7032d86975d65
SHA1 0c7992434a7f03127deae1395083900c7ef48aa5
SHA512 221bf15405d3dac0d44ee2ea151c45c0f8f4d65f29c816e2dea25eb949db444a61f76dec8b8a6474ffb43b1dcb74cec1c505eea53bda2d8ed0140703d0d363c0
SSDEEP 49152:TYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0CN/j2U4FH:mySzPqj2jF
TLSH
T1DC067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 01d9c12d9824630397748dbb1c383dadb2f21e52dee53b7d824fcc94f30a7e56
MD5 1ea95cbfc172a5fb7499f081ac4067c9
SHA1 ae56c1b19a0ffa54423b66b332538168032d19ee
SHA512 1fb736b83124c8e8ba585a9c2ef12aecf1f417f7c92db413fedebcfda3c737c3bef4f8e84b71f7c2e705bb956891c65385c07eda67dc73fea20c204bdb72e367
SSDEEP 24576:m47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYrdCN/j2GLl3iFSE33b9:m47JUQjTirIhCnDHUPfF/SN/j2U4FH
TLSH
T1F165AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3e77552baf8b3c69f252455dacd40a934799bf6adfcd8633698f85340e8f793d
MD5 66da5526a3db689566cef961c3c33831
SHA1 e6e28fbe6c29bb4f4964977517692bb9d335862c
SHA512 3604da6c0a60251c5118111176c153d953fa2f2e3982a0560200a26117e26b6e55dd77a5168332ee2b10a95e4ddc0b96571e8f03daf23a4a06d9fe8aefff0e7b
SSDEEP 12288:QbsfqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3WdCN/j2GLl3iFSE33b9
TLSH
T1C7650119D2A452E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F39AD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1016KB
SHA256 36c080e3560e3d71d34f7088b4ae35cd4cfd9dd11aa573bdae78428b5db83fb5
MD5 220239a63b2c18ca6a62bb0a6931951f
SHA1 232d5c7ccc4094d0e43113d3e07cb7d7849c6ef2
SHA512 c1f4afb98dcedd578848abfe18abcad749d6cceebf6f6e7de05c310c0d943d8864959417fbb16fbb733c3a58c5052005f4cb7eaeb23e5100a9df62a404d99a19
SSDEEP 12288:W+4UU3fpYwXxqqaNHntL40ZWhvVw4Cm9/:W+RUP6/b9gt/Cm
TLSH
T100251700B666C68FC66980321E33D1CCAB707D51FE056F0773C88B3E957665DBAE6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 563KB
SHA256 08a21ca69d94e6e5d6a324095d0f7df80d99e7a6e4a4cb485a7a90b884ac4cb3
MD5 a9ea4a393a44b8938570d4f55fcb21da
SHA1 9c471e1bdf6571d200c3ad908267d2181c9361bd
SHA512 5a174f39194e2ff1e574c2a63103f8e209f43ab502c3b166a0a91c396bb6981ad55148cb277c1e671b59552e6fd5d694d7e1c35e6c170ae2e96432c9f8e0444e
SSDEEP 1536:br2h2kpSHZHvoHhcE68pjK5pCCmiPsi1epCA1P6fRZfBEf017C4xRUZmViuxgYFs:/5whS75HPsVxYG8Pxgb1ZQL7uKKf
TLSH
T1F8C4F840E236E24FC5B68032463557CDA778EC13BF466F0777C48879D86671AB9AA3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 b926d7f3ececd946572d166ec8db8e777e3a70cf7c6bed92b9a5e3c6d2b666ac
MD5 6a368a96bf409ed45421727aceffd7bb
SHA1 1fc124c4f5a1af83de24c71ec71529e11f463e4c
SHA512 04755137a61a9afcd466128f48db6dff667d0c3459b84d7943b97a794b0d1862e07157c3539411aa1b369c148d8baa2c5c5655c7db5b240aef98ed0cc78cf903
SSDEEP 12288:C07yJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:TudCN/j2GLl3iFSE33b9
TLSH
T1D3552361DBE5FA55F07A837802ADDA256200FEF8DB2184C7C54127EB6278FD88932563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f0027fcf638730da8cc9a8cab6f24df8b91150a6f50e467e193539cfe111284b
MD5 a66e6f0ac82b75eac2df12c6b5c530bc
SHA1 124ffd7fad10b6e11eb143a02958fc89694a48d6
SHA512 5d0dfd76b0db6fe939c639244329f41fbb5de304d828f6e31b1b287df85d56fce38167dcadf430f435cf3876943ba248fe0b793ea64960d587365e65071c0474
SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYMdCN/j2GLl3iFSE33b9:Ogb4mBIBhGFIN/j2U4FH
TLSH
T17265AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 c6ee2127ea2d0d233bbf1e45052d7fd1d1f5617fb17d6dcc989e9723266b7888
MD5 95f3e3617925ab8048769f805aa9d632
SHA1 c14e3542023bc43961ec8ccd5d2a556d50791d2b
SHA512 26ea94fdba8031813edef6a0e0eab70cba8907f82846d56915bd228cab80bdf882caea6a145781c2e2d4f74cad1f5a2700abccdd91859ca761eebd82d275e8d9
SSDEEP 24576:PG88u8FpJqH1bzria7/mbdCN/j2GLl3iFSE33b9:+7ZFPqVea7/PN/j2U4FH
TLSH
T1AE95F16577E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 670cd07abd9e61d9f078c76dc664e9b87730117c20d2c47fa6120d620578d9c7
MD5 cc02f2e9b8af99f8534668e0106cc343
SHA1 727ca4f3a45023a627abf84160b1ce24ac4c68ee
SHA512 7079b930b0b18e366f6f771a4bf0e7c6c1598b3849ac43a85c1183eae28171ea2045ea4e6ff8a8243016f349664aba939b4646a44e85a4a61004328267e9c48e
SSDEEP 12288:NHvUrBFrEjwaQPJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NPUr+NQfdCN/j2GLl3iFSE33b9
TLSH
T12975F22E66E818E5E67AD17D86868719F731B8615312D2CF02D0817E4F27EE8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 14aa24980ddd044b1332f2fa8b3d4854538e5e56cf3ba5570e317314fecf00f2
MD5 692b8d16f128c9c912780278428d811a
SHA1 d435e91f8f6f37b16da3ea3ed4107b37161b1193
SHA512 0eb9897c5d13f35407ca16b1e73a6b19e1264934e454f21c5f46a872e79b8932924e7599ad0fb80a9c70da50d250be024d7fbfd0434c160d2aee9c88e7b2ebe3
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjcN/j2U4FH:OG05lO43bTj2jF
TLSH
T17FD5C06A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e80cb442872fa69c84ebb4a6c50e004d163905a84dbd91f3773750e745f0bffb
MD5 9acca1f2315b32178d8fa416f0e44ba8
SHA1 36bf43569884e194a4c30278764f7aa0506dc338
SHA512 2457cbe13c9d09f52a2ceaee9027c5c50216867e040ea0ea36f3b70c33fa4aadea8ab5b585b1daa2b66d93837baf9c1587105ebf2c373c3fb62ed7736935d7b2
SSDEEP 24576:sfa5POZ3dpuWVM50JicR2hG0lasx2+47eidntdCN/j2GLl3iFSE33b9:0a5POZ3BJt2pasx2+mEN/j2U4FH
TLSH
T11D65BF5EA6FC01D5D1B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6cc2a3cf381744d5a738dcc8a84c48c4430001afab557ecb1ac1e835c939cd26
MD5 507a838e102b69a0f59862027856b328
SHA1 805f379c112796b56125d5c1230afd3d9a335520
SHA512 32a52b6a2c17f77b056408f2251e139e6ecb001b8e6926ed97484c2cfd87a83c3c071c736fdc49122f7e1bcd13f484b7c14daee1d0d125d77814a86ec5d1e358
SSDEEP 24576:XNcwHdjbyQ4nLC18lb/EOjowL7FkjdCN/j2GLl3iFSE33b9:XNc/zEOVHFvN/j2U4FH
TLSH
T15D857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d507a57ca0dac9d11082fde1cee038a48faacd13decb288b9d47db23f3410a16
MD5 077812bc34cf6d0792addffb15bcc64f
SHA1 cabc5dc63c4e6bfd86f5d5aa29f82fae9b7f1b25
SHA512 4e1b1068f64d497b2feb5d0ee1da69cd2479b34cbe8400c6cea7fe29a92eee71bca7667dcd487e417c12d8374c0995a8a98a0cf24f7d134994c1059afb82366a
SSDEEP 24576:yTkNvNnaFeYhJNtmZBmJdCN/j2GLl3iFSE33b9:yTMwBtOmeN/j2U4FH
TLSH
T11D55AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 bf3765b43c9af2c3e3914baac757dca77b94ff6cd8a9d930a900853aa5a1263e
MD5 fa2296838b3a5c9e5ae147d00d8955a6
SHA1 382cc01973e4503b15f8dca98f584ff1fef0f8a0
SHA512 38437aa5057eda64434dae81bd01ec484c1c7ef0ed7a532844d839cc83a2f3194a0e9da6dd9c6b5ca0ebfeb6339160deb0a3a0143053de8200523d1e47bf841b
SSDEEP 24576:qD3FHshBIYQgAqdCN/j2GLl3iFSE33b9:qDVHeBIAANN/j2U4FH
TLSH
T11785E17DE69C04E4E57BC2BCC6638A06E77178A8433255CB02D481BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1412-113-0x0000000000F10000-0x0000000000F70000-memory.dmp

Download

memory/1412-106-0x0000000000F10000-0x0000000000F70000-memory.dmp

Download

memory/1412-368-0x0000000140000000-0x00000001402C5000-memory.dmp

Download

memory/1412-115-0x0000000140000000-0x00000001402C5000-memory.dmp

Download

memory/1760-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1760-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1760-52-0x0000000140000000-0x000000014025C000-memory.dmp

Download

memory/1760-40-0x0000000140000000-0x000000014025C000-memory.dmp

Download

memory/1760-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2996-264-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/2996-54-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/2996-60-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/2996-53-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/3408-377-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3408-135-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3408-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3408-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4460-80-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4460-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4460-392-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4460-87-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4460-390-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4460-301-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4712-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4712-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4712-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4712-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4712-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4976-386-0x0000027283EE0000-0x000002728416B000-memory.dmp

Download

memory/4992-72-0x0000000140000000-0x0000000140252000-memory.dmp

Download

memory/4992-66-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4992-285-0x0000000140000000-0x0000000140252000-memory.dmp

Download

memory/4992-73-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5704-22-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5704-13-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5704-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5704-86-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5984-315-0x0000000000400000-0x000000000067D000-memory.dmp

Download

memory/5984-5-0x0000000000400000-0x000000000067D000-memory.dmp

Download

memory/5984-0-0x0000000000B80000-0x0000000000BE7000-memory.dmp

Download

memory/5984-65-0x0000000000400000-0x000000000067D000-memory.dmp

Download

memory/5984-8-0x0000000000B80000-0x0000000000BE7000-memory.dmp

Download

memory/6212-300-0x0000000000400000-0x000000000061E000-memory.dmp

Download

memory/6212-77-0x0000000000400000-0x000000000061E000-memory.dmp

Download

memory/6308-365-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/6308-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6308-94-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/6308-100-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/6308-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6308-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/7144-125-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/7144-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/7144-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/7144-127-0x0000000000750000-0x00000000007B0000-memory.dmp

Download