77fabaf7c45936a73b8110f566fdaa3c3d80787196e0034878e38398f0cbe5f6

Analysis

max time kernel
149s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
Size 1.4MB
Sample260705-dv3dcagy8v
SHA256 77fabaf7c45936a73b8110f566fdaa3c3d80787196e0034878e38398f0cbe5f6
MD5 fad3631c25ac4df1fc2f1ef38f839e61
SHA1 a104fddee20086b38f21c26e19f32465cd6b7ef2
SHA512 08c1a6331612abc996ef72c94444baf66563c251a23681d5b03260392d3e5630b07c6dbc625b4e81608b2dd6d1d96e291edba5be8d4fe81005d020fa1f65f144
SSDEEP 24576:FVZpkVXRxUdeKsqjnhMgeiCl7G0nehbGZpbD:FV8VXPUFDmg27RnWGj
TLSH
T19065F06173D49072E1B309708ABAE7364C7FBC766970844EB3953A2D5E72BC08974B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6960	elevation_service.exe
3256	elevation_service.exe
2856	maintenanceservice.exe
6996	OSE.EXE
2340	PerceptionSimulationService.exe
3000	perfhost.exe
5556	ReFsDedupSvc.exe
2992	SensorDataService.exe
5492	ssh-agent.exe
1360	AgentService.exe
720	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6a5f61518ee34577.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_125484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009cde908b2d0cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080664f492d0cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004796ff8b2d0cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
6960	elevation_service.exe
6960	elevation_service.exe
6960	elevation_service.exe
6960	elevation_service.exe
6960	elevation_service.exe
6960	elevation_service.exe
6960	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe
3256	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6200	2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
Token: SeBackupPrivilege	5556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5556	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5556	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5556	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5556	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5556	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1360	AgentService.exe
Token: 33	720	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	720	SearchIndexer.exe
Token: SeDebugPrivilege	6960	elevation_service.exe
Token: SeDebugPrivilege	3256	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 2652	720	SearchIndexer.exe	99
PID 720 wrote to memory of 4116	720	SearchIndexer.exe	100
PID 720 wrote to memory of 1600	720	SearchIndexer.exe	101
PID 720 wrote to memory of 2672	720	SearchIndexer.exe	102
PID 720 wrote to memory of 3672	720	SearchIndexer.exe	106
PID 720 wrote to memory of 1744	720	SearchIndexer.exe	107
PID 720 wrote to memory of 6096	720	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_fad3631c25ac4df1fc2f1ef38f839e61_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6200

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3256

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2856

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6996

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2340

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3000

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5556

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2992

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5492

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1360

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:720
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1935666426-3801330415-1166019131-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1935666426-3801330415-1166019131-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2652
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1600
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 73202762d6e2bf2853ec35a06ee518d64fee5c33812f69cd4ada6e84cac3017a
MD5 572eae6339bcbfd41e2d1ac216f6fa78
SHA1 9ad3c35770507c4a07d22456cfcf4e94e581d724
SHA512 b46ceaee28f2f36c28f82ca16b63cfb998b2e1bdb81e882bd9078d379f6dd621b803143a1418a9ffde86ef95aff57f8252cfea8eaebc6629deb090aa832cffe3
SSDEEP 49152:Gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnKDmg27RnWGj:43q6sjBND527BWG
TLSH
T134D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f4346a7f82243711e2becbb5ad2e49ff240c087668ae13355a1cfb89e5614b56
MD5 ce1467c468d387d99a2be87ef94c1dec
SHA1 47d1ebedebb50b25944fa21fd90be6ce5dd133a9
SHA512 df7446e319160303dc26d8ef9ec8f8f36a7b413da928e9ca666ee12c4b12da8e4f4898071786831aab332021d061511babd9ae78fdc17f78b84002d13e4fe78b
SSDEEP 24576:+XYfDtczA9sqjnhMgeiCl7G0nehbGZpbD:dtcYDmg27RnWGj
TLSH
T199650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 905471de975415d6ea9aa432634d15cdebaff1c7d185906c2362f3f48601c9ed
MD5 52a79356f7434764d09d68d859d0a850
SHA1 2e195dbb875ad46e2482c0fa920ce70dc1e800f7
SHA512 fd98e4ce379df48b809b8584f675ab3d8128bc9ca12fe2f3ed5a3c3c52e7134b0c059e31a63a26b01c266aef5d175b426f021f40b3cebdf3d7fb0641d86d2605
SSDEEP 24576:m0Le5ji0hmxxrMOsqjnhMgeiCl7G0nehbGZpbD:mPji0AjDDmg27RnWGj
TLSH
T135859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c86632ea3d51ea306fd9fa421baecaa44eee0f75ea602147c8ab2e27994b9f26
MD5 790c3513c26572fe96f4a53f0504c28c
SHA1 2b42d6e43b79e2889db60785ce9292aa99b9dadb
SHA512 6f1a1833884ff4e376f5e69b522a24dd6c6e31a4466db6ab2fee8e4f6c3c538f1191130e883eae2542e2024050fe4d7a5934b9a90f5ddecd2afe2cc747e863e3
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWn6q8wyu8sqjnhMgeiCl7G0nehbGZpbD:E/ezSC6vUzPveHjyXDmg27RnWGj
TLSH
T1FC755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4800e10b2775bc558cd34b2008925487f65aae45486261490e38df45d9857fdc
MD5 838f5aac613146e6356cbf48641da6d3
SHA1 dab1d324a487b96e848be6fd5085272a4f589d6e
SHA512 000cef2f0687a42309916868510ca354f98bee5bc65c23a8b8d2dbfc6f4b6f25bbcd8316ba19edb11b6bf47b4eca4a33c3bad6a115250299b6a56cadea898e3e
SSDEEP 24576:yVbqPb88hv/l+YZsqjnhMgeiCl7G0nehbGZpbD:yVO88hXl+wDmg27RnWGj
TLSH
T115559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 68f5b7e883330676d59d77f1017ea4dcc29cc6241f7beb74cc2d569cd16bf898
MD5 c0c1068872fc8e05a54dc2bab9ebf1ae
SHA1 9da2a1af73f9b207bb72ec12a4fbd60af7bac853
SHA512 eed23002f1e2e8416a90f1cb38085283df04b62ccb0c9888fc0e33f1d5ff45afb1d35e8db20492c49c29cdaf1c19452066dd392f05a1c03f6d2cbe340a578044
SSDEEP 12288:sLOFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sLasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1824523BF964C50CAEB7608B5C3E9F11EAC137E5698200853AA637DFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 81e73f82e6b08ca0c4cd3f3a9ec7bb91a0383179fd01aa40cc72a5836e3aba85
MD5 8192d098d060292f3fb7c186c9850778
SHA1 9f1cb2be4ebc1e0b0ef7ce87a78256ea304107ca
SHA512 22b08e679acc1ca22bf0f2172b488d4edec737f6f7f0e591db02568c0df418f8e1ff9e091872eebdf435145cd5c680b7ce453ccaf3ca2aecd6a9ced0be3e3e42
SSDEEP 12288:/eBNUbTVO86UzFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:/JIUBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14565CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7d61b6a5cf1bad7114a76a2e7855e82ffac4caa6c933cdaa4bbc432e1dd48b04
MD5 49bf92d86bfabc3c04b4b58c75dd15e0
SHA1 130abb7c64b7d006e8edd8503cbea2f532804de5
SHA512 e418ad2f309464a622c802c5ee2cc915b382d887c3cf875b954d7b3cf9aeda439abab8a522856fa5a3d63b7d2449e761db8f31b1cbc821ef3318b5baef771d66
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THw:sQvGAdlCEL8c/DRNw5C4D527BWG
TLSH
T182266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 43b25c6de26e78d783d17bc820d8fddd6b0a7e0c6221148fbf4de71cae6e3bcf
MD5 d0e79ffe1a047cea40a7fd5aebd0465a
SHA1 5c47e0c92e05a9f496c0f2a3d71f2488627e468b
SHA512 f72425dddb00aa97fdede7373f47f11a05ff30c9c2259c560a21a476bd395e8bd047f9e31343fc153759d39f5144b593d879cdf5c674676556d24d95137db6dd
SSDEEP 12288:iAwSfxL/2Dc3RDLLmt0LDQewsAjpFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQK:n0ewsAjvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13C75E031FA74E036C37B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 694e77e42b891d1cc8a6b9960d1e8b85ac3541873b0c6eba8e5118bd2065af9d
MD5 89804670325e901cc582a3de24304722
SHA1 089828a0fee84f9d6a7f76532405ac6b7dead268
SHA512 30944936cc7013b2856e96992683d4a19d74b1152df7c64e98b2044c653fe2648dc576fcaaf4b5c1c325aa44417b448eb03c5a28d4822265a585c9954dba4d5d
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHbVQBWG:XUEtQevvqc2W1cpV2tI32yB
TLSH
T166474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 772de606a0aa6580e18dfea13f98e26341c0d69709c06cff2fd06197e0217921
MD5 774732f177c8bd0f76a1baebf35ae80c
SHA1 7d39fd369fd2cdbb3fab912255e290f66cb6b24e
SHA512 c919ea7d41c56d0c7bd59b53f1055f238d2299461ada642e9360e653d1e7b83814e5662e8c33e40b3d172513eb0f08c63802d27589cbab164b5b21c263c98e31
SSDEEP 49152:3CbRquA/m2yL5zTfFiV+XenmE3/zzDmg27RnWGj:goquVjnmsD527BWG
TLSH
T11FD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8b6187209d94c354636cd3adf1ec83cb3cd9c57ea3b540d952a50e22435e78dd
MD5 5faa4f6bdf4874332767d0262c43e3a7
SHA1 692b047f130ee711a37afc271f83139f2e1d8d4b
SHA512 9e1c98c2ebd6e5ef402354b0cef8a19f0fec915ab713e768236c70409147f941b735d2f649a51e1873b3817f65885c2b24af60760fab0ba112a6fc199a913e57
SSDEEP 24576:7AhGL3IFoiwtA5l7S53QsqjnhMgeiCl7G0nehbGZpbD:7AMUFoiq58Dmg27RnWGj
TLSH
T17C359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 14390d559055a9f038467c1740abcb7a638785541fe82184e9983441f1d8d5d1
MD5 9502237fe06783b6696a4623a46f5b37
SHA1 4d23ef33e10e5022fb0adb8e5a36d6f530b78e59
SHA512 c461178d3e1f4555d60a3887743cd135747a645bf383cfc2e3e83cde4ea57b351e80257335940146593176692af087a82900227cc7839dbb6350a5cd6272f476
SSDEEP 12288:nmw5HEjsChNVBFgl0WDm+CoFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83i:mwu4OWzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C065F15A76A80CF9E9674139C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0818a88350a165cec49ef6e82f50bf7f2cc300957c29eb989eaf381d4513b543
MD5 4c8e34a4828ac85cafafa8818fa02bae
SHA1 935987e143268dbfe095c6615f2df074b270f4d3
SHA512 1b24f3600116a20e47392167917c25dff6773b0cd5013e921faf56e28e49d175339acb12062138944a3de085006ad72ba3362a3331b4a26d0aaba414a6a749ef
SSDEEP 12288:2eZ1IyZFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rZuWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1415512AE239820FAE163417CC6E5D609E7333C62673043CF166659AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 65b67470b12c84ec48db019e22fe59a1e30cf09ed8872e03491fc9d42c11d42e
MD5 a484cb700464be346ee4403e008330d9
SHA1 4ab4c4d56c67b566642a41cc27bd6d6dd98dccd5
SHA512 97ec31b4c0188278355c4de445f9e50da2fc0873ceddc0546230b6c5afc12ee28923f45f1f4b0047203f52cab6a33395b0df5a779700bd142b24b3c93cb4cf86
SSDEEP 98304:LQRQyi36YOcPbLvw2gAf+PN3ZD527BWG:6QyiKa/X+PNJVQBWG
TLSH
T165667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 084aa1513eb14ec2694e3274ba222308812214cf3d9fd81cfa89ddf862723303
MD5 2b68717d46eb7f1bdbb0e51f78369e7c
SHA1 f14ee48e418e088b0f5f2be3f629578593570908
SHA512 919bfefe9ef39006e59c48913c06814b2ca9f35332ff2d3f73e2c002e37a0129028c944db9f106ddf7499064bf7b918555332585c9794ce4feba144f4c69ec9f
SSDEEP 98304:ZQRQyi36YOcPbLvw2gAf+PN3ZD527BWG:QQyiKa/X+PNJVQBWG
TLSH
T1EC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d356beff0e9879e6d0d785867de320bc2980080ed99a249161ef27836063dcf6
MD5 ee659e2067ee70fc20faa9ac543273fa
SHA1 06c242a76116f49d19b28064565e7142c823b4af
SHA512 d336e93a50147b93f98fd4f59fb5e582dbee2fadf9231676a5041e8be48e0ca4d183edb65c9e203a6b1b425810e5f8eb1a6cc7be3c49e50822695e20ea79c994
SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0GsqjnhMgeiCl7Ge:y68Qg55nhceWu7PNU3/DDmg27RnWGj
TLSH
T1C0B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f76fe86a1c8f866c7402fe4dba11b3ee700c62a6c6ef9b428744a054349371ce
MD5 57e94586071723625f19f006a7c071c7
SHA1 445d472c0eaa5cb8065233fd1f41e3c44afb2d66
SHA512 ed3b675c8459211dd315b94de04749866a85415f8c95e6eada763d33a3e0f3a7d2565c73085d50241f628e170ba4fd1807dd21f964c0576f19fa4fd510b06fcf
SSDEEP 98304:ty5112gYy5azzVvt69nLKnhZuD527BWG:QLIHEWhUVQBWG
TLSH
T192167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7d1209467eced3ba2fd754029c70077be7b98d7fad258b6e42a9dc6643af6091
MD5 4d8b9b74bf84781453e894f034429f64
SHA1 63437dc3f37497039b4056a311cdcf0f5d9f3ea1
SHA512 214ec61f305c07162e92a18d7f4b1d96f4b3700ee712456bc9a5742122ae684e8017ff93c696ce9ece9aa230cda76296fa07b45ae7984c793c46fb5a3498b1a8
SSDEEP 49152:SB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glRDmg27RnWGj:gu6Jmdxd2dRD527BWG
TLSH
T1C9D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5c21a780a6955518fe75980acaa84ecee59866d7d2db20afc33b7b59171a5b12
MD5 0d42e496bac147fd3f40805a0db4795f
SHA1 b0f7836c80cde5c784fb0c7a7c9715fd7f72676f
SHA512 69994d96a3c7507a4eefda41fc66945f31572dbafd5cab531c14dcf3ee4bbf2c003df4946e7d61b90c79b512797a3806ce8da74155c6ec1ed18dece4786651a8
SSDEEP 49152:+1hpsNoJpF1A63U44CwH7R4x1Dmg27RnWGj:+mifPWRsD527BWG
TLSH
T13BB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 35c7acbdffdea4d2116f2618b8f084be613e77b2361b6f5b3bbef48144a04bf6
MD5 e33f81c8e6bedc27862328bc271aa61c
SHA1 6632a3023f9ec6a4b9dd7341da2ad96e4450c68a
SHA512 0fdb5b0a6fce72ad55fc64e5177fa2a6baef76422e8a8eea354410b67b3fc30c4aef7181da867bb97d3bfd0b47861c31f883eb739fbc5c3394ca433a04bdb906
SSDEEP 49152:8SuZQIY0Be2KcRVtOnks6NMHqaDmg27RnWGj:+5dKii61aD527BWG
TLSH
T19DC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 10d599e9f1bf693f4627049d7e9481a7f46390f09bd10d2b49f6be5106662907
MD5 34aa53c8bc45ef8e1697d8ae0ec13bb9
SHA1 72832597a561a9e0b61231ba91d8f40f2b5449d4
SHA512 b7ee097d4547909ebc2e01ebae842c961e44e1decf7a1fd67ca5c0945076880014a8dd582bcd47f5a3349965f50e697d467eaa9e7e66e41eb8cfc838b0774e59
SSDEEP 49152:7htSn8EApI0fig3giDn0AP5whDmg27RnWGj:aX2imphAD527BWG
TLSH
T1EA95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f5233f8bf4e00988f736a29e471d7f5eb1074cde362971e430c69100c54096c5
MD5 7f5a43f667a462cab13f88eede929815
SHA1 3984b642d2b48a2be6fb33bfc10e9a0b56c4c449
SHA512 f59fd1468ebd679fc75cb2d37b24dca3515da3593ac246bb34c4c67b2f0dd4d7f5d6232e9049bdd0b037d0df1fca9129d59b18b60fa1c8d0932239ff8175b5ed
SSDEEP 12288:G2FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1354523BE964C41CBE52644B5C3E5F14DAC073E5BE92004837A9B7CBEFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 d89f442b778c419d4712fb4b0e2ae7be6a814ae3904dba9896e1d63bd2e9690b
MD5 633bda3650e59b024ae0c05a44609c1d
SHA1 8c51c7bd25d62dc4ef7f07b026b76fb13f99ea7b
SHA512 f1335c711185716e9b9ed32c349ba3ead8f08fda166abe1f3dc9971ece86a145fe2b6440f3dc40aebd879088f4a76750ef0ce88b293b51578877ba8de7577975
SSDEEP 12288:kFFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:krsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B64523BE964C41CBE62644B5C3E5F14DAC073E5BE9200483BA9B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ebc2cf406e76e358090129c7b707f81d88a67203a39804398c85043d3b29d118
MD5 769f6f91c6157777f34f3d3fe3ca9b82
SHA1 b9e1be9076ddfca3ae1bb45b81b351c556d5d3a5
SHA512 0e16b81e82f04daa161e5de9434b6ba48410f2d5dc6cba257bdffb9a72eaca8653a91987c963ac108855b747f6057862cb69a35a8d5a88f32b59726c7d534ed0
SSDEEP 12288:YbFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1124523BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 5cddc27a9071d63eb533a41f4174adba10bfdb36767bbd7dfcadbecac675c02f
MD5 d1f022a9de44da7e47da74e900c95500
SHA1 eb7857b042ba7a1a4cd188ce1d5f0abfe020f08e
SHA512 46cf560f27cc9763e84778f4394cd0829ebe65cf624a72d01e576d512a7708b727329fe99a74be05dbe89fb534e084c678f2e72975dc5959f710a7e9a2c083e9
SSDEEP 12288:lVsFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F45237F675C40CAD83285B4C2F5E11DE8237D56EB30059B6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7ccce03652263171cbff6ef83ca6c09c65ff86165fd1f638f8cefb55354ca802
MD5 d7690ac14fb37e530285891f9c413cfb
SHA1 1e3c81c34675eb88277c95680eaf64fffbd7c41b
SHA512 ac08158bd76560283bc00212188bdf9f17b5520e91babd6d6891b3f50fc86857e2135b48f1c226a48a54f0806ddbda4827ce99ce43324a5a731608caf195ed47
SSDEEP 12288:ckFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A4523BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3234ca2db1f86d960d878f47ac6c5533757f515ff73a3a2b9d51b0898edb81aa
MD5 335476081b0a85922315be35555ba645
SHA1 f1fd9b745cb0df2cd58b02e99f040aa2c9828388
SHA512 feb55f97792447acd5345fcd5a66a2370d43059ca8a4a66850f821e8859d71e83f9b909dd0e17d3cb316bff739e4de4402262d2362b7adb481f1f11a89509c9a
SSDEEP 12288:OxFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1704523BE964C41CBE52644B5C3E5F14DAC073E6BE92004937A9B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 dbaff6196bc1fd0acbbb25961292a8acb93f0493c7b17db9a87b1142c16663f3
MD5 c82c729fee0c728a0238ca3b01b9bf0a
SHA1 0e610d456f7a10a10c42245c2b7ec001a6aa435a
SHA512 d9e4bcb8e1cdc31400853a5f800f583c67ca80a412bc425c95cc9e1833f99d52c95302853d2e85f5ea5a4a22cb396866112d31afba33ef82a631d0718f55e4ea
SSDEEP 12288:2dFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2jsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC4523BE964C41CAE62644B5C3E5F14DAC073E5BE9200483BA5B7CBEF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 3f67c2ff318cdc27c0bad319cfd97d90ac86fe8395c60a34b102c9608ef38237
MD5 562d5ee9530d8b2648d550d537b36051
SHA1 46c0b94fa80958e3277dcd73ea78f2429aff636b
SHA512 d2cfd0c968b1c82ff896bda7713f6f9a3413e6f45d44d50df4b318fdce3db1061aceb0c5ba797c165e9924d3b2c341c3b11d47787e9314d1aef2ae169307ab83
SSDEEP 24576:XZMRzFVSOLsqjnhMgeiCl7G0nehbGZpbD:XZMRzf7Dmg27RnWGj
TLSH
T1366501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9b59ebf1c2423425f64249ee8a9a01dbeae80b92378904989f9ed260e579ff26
MD5 af4f20a8428093510cd30c2402299b93
SHA1 551e2c5640075383b5eddf04fd4e843ca2742b33
SHA512 1fb42797f6e44d36f72658f8e6447dea17031416cd61c3858ed27c54aad7177178d0e15464d6fc62cb534d474fd04d999018dc6df39d143d98b4de3dc71ef28e
SSDEEP 12288:RKFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1014523BF964C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3bfd0a9719e7479fa146f685b50bb0f265b46e8beba9febeed33e9da28437d4b
MD5 7beddfcc555a0e580452ef2b140afc51
SHA1 1f2fc7da829722b4af4b6acfefea4108814a9f9a
SHA512 9bc6e7cb7b49ce6fffe601e891aa311de7c713a48bf32f9785a88b697e28121de0f6680da744421b0503bbba338a65f55186ea006c91bcd7b3b91f75bae8831a
SSDEEP 12288:H+FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B04523BE964C41CAE62644B5C3E5F14DAC073E5BE9200483BA9B7CBEF6B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 ff0db66e6d748d6447b92cac7b978086edcda6c498ce7ca4313aeb9056b7518b
MD5 19f9df05e31cc908ca11f54a7d2e4387
SHA1 4884bebf2c95965c32a1fba578b967851e7f4a16
SHA512 c532675414875787bbc27e4a2924c5e0866b5de12e83c598352581dfd2c1e2547c4febc687c8e17b667cc42120d6ff82d913059d3de96460196921ea6f2b116e
SSDEEP 12288:AyPz5L8ZFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xzy/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7e19c54a13569bcd8f3deb8b959a63afadd1b23e515bbaa4e0902dd351c089fd
MD5 2163d23199a30bdad1cdc220334e1426
SHA1 6509d495208945590429ec30c3f3eda264da3633
SHA512 309a5c63f9ec07018c5188c042e2e94745555e7e82a59262710ef82b0ede9180400b25cd146e9ed85dc590e6a6d75404d5fd0ca6e128fd04b9d95a3e6bb20270
SSDEEP 12288:fKFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F64523BF964C51CAE62604B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f59ab05bccfbae3ea342d066309d99288fc1ac479f524b2635124b5324a27c65
MD5 22a26316c689b0bf7b5bfa1b5f0ec917
SHA1 94ee6598c6d1dd3c39f10cf0be5b4321bc3967cb
SHA512 13e2a20631c96f94bdc285842993fff118a20ac1eb3fdaa4ad20f97450b7c58b265c8715b5969af61a2efa3abe0d8fd54a962954b6cd459ed5e169be0dc2d5e8
SSDEEP 12288:TKFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B34523BF964C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 ded04dc2df7f92211b4a8c6a775266e4a423cad2b936ad6332b3298825028e22
MD5 962485250fee77ed5e3a30562f25cc36
SHA1 0f1f916ef6a2e6a88a46ce8456b16cea355b6288
SHA512 016d4ba0d8b16ae0061f727be53b4f356d8e828eab351e2a90cfc3abc171ea304a9663c0b0ed1b1117ea4e8a34b592abdc3e88bcee386e0b9b10b7c053142ec6
SSDEEP 12288:GyPz5L8ZFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7zy/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11255125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 e1224434ff8463c6fac7efdf1e7d47ac292e313763e56a9016789533f53a82a4
MD5 b5eb32944f2638a134224e88d6c1e585
SHA1 31b2a39bb32f3b05eb9d1eb40c4cf5381f467173
SHA512 f75ccd4087552a4a67aea3d900a03ab81b65b4449c33560fa6979daccfb90bc1eb39211138a4b1f75aae2cee21f1022def93aeac1436410277261605c017ef6b
SSDEEP 24576:cTDaLl3z0zD5sqjnhMgeiCl7G0nehbGZpbD:cTuLljoDmg27RnWGj
TLSH
T1416501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 a1bf93ac0f2281031f935b559846c6682131b2503a504c09f65a839bd0598d92
MD5 a5b7a3910513af19d660762d4fdab2f9
SHA1 baf4463d6103037fb51a947276bf900ff9067bb2
SHA512 8ee3ff1bc880b2aa8f688b1cfc7a5540a2fee8a9cc3fa5f1b226ef90215175ebd5ded714c6e26ce0986a13c9abe82fb061abfacc802a9032198cf82429e9dc4d
SSDEEP 24576:h3vd9CHKy7GZFsqjnhMgeiCl7G0nehbGZpbD:Rvd9CHKya7Dmg27RnWGj
TLSH
T1F875CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 a2ef54b872217edca9b81edb4d2f9be7592d05bd29d6077b40727011a381252b
MD5 2e17280ebdd2d3895e86a59956ac8913
SHA1 ae85bb911c3c896109fdcf2a285bc33fac8ad61f
SHA512 ad1bb737928c2939a12cf9ec304603a7108f648b9f8c77357377f367055a53f92f3f3e4b06479359f4c5c3ab4ce82bd0d984d5ff0f99cdb8bf0ad7232b963690
SSDEEP 12288:g7FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14B4523BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 77193ac2b0148c9252d2ac3ce977822848dd3ca44f395b162672abc616fe1454
MD5 76c2d35a4447c2f0a5bb0c0c93521384
SHA1 6a7ebebcee461a4166f2a3f3e2b2ba0f664c3ccd
SHA512 c4acfe53aeeb7f182c571618ff76d3d978fd03b8ed9be71789b660fdf6d660fcb1d41b248bf5a20d8464d37874d2570f80f249c3c5e0e2caf9e4e0b3e86b93b1
SSDEEP 12288:U5FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1984523BE965C41CBE52644F5C3E9E14DAC073E5BE9200483BA9B7CBEE7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 11b8b3f6cf8779379a0b37144fa3c6ac82edd20b27f46636027c3cc37b95b689
MD5 85b8a1b6186c962bb4c776b6ccb659dd
SHA1 d6d3f46475220f97314bf66bdce05db74a82b738
SHA512 b956931a15e55c4a166108bb2962857b60999126c089edcd430c5cb79e086db039db77ff3c7024b94b6c2184905a1f36be036d4a8767766ae5d5a5986dd014a4
SSDEEP 12288:DAFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:D0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A4523BE964C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB18584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 271aacfe2c9a724d96be9cffc9cbf4b7d8726c926cf227f1bf8964eaa4ac2d66
MD5 380e529bd1ae3dfe5b1f8d60ca58be60
SHA1 7458f353b65c75302c96af879b111dfd408afa27
SHA512 269514abd232ffb5d55d5a7c8a104334044a7503c5bf8d032094c36ed79df6fe27f55a06dcafb71cf55343e988bd6ad0742ec946048a1123b6adadd9132dbf72
SSDEEP 12288:DKFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1304523BF964C41CAE62644B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 8ebb578a4aa02cd8d6f1bfbc9a14b7f116e31ba3ecc0b34027fe3b0e697273a0
MD5 55a4d2cd815fc83acad11e6604b90323
SHA1 5ad0b23e0410bc1254f3e684695fd4d5f05af760
SHA512 99dfa0fda97ea7ec2a49f8606d21220a45ef7bd415759ed2cc47266d268c15ae91bc7936b6f3c12182cf0b87fd008fc7a731aa56d3aa50d4daf6efaaaa2a2e40
SSDEEP 12288:T7FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F4523BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f509020cffe502c38b5d3ef2c492bd26c86f4acfa76b1defc460cb138ccd518b
MD5 f7ed464325e0a75660758b6a1365645e
SHA1 d71b2aafac450c62843b19ce1d298afdb99a551d
SHA512 f89364066081fb583d2a4d89b55da446a71d38fec030b6c8fcd2ff0b45f7acc19e56c046c511a51f232f2223a906ad60e631b1324419719c6c0ad5581e71c9f6
SSDEEP 12288:SiFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:S+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE4523BE964C41CAE52648F5C3E5F15DAC073E5BE9200483BA5B7CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 0065bced5bff386f34ee1c90a03c55957556acac9b5307541eec647b488d3e9a
MD5 62757562a528c860e814233c7d1cdd00
SHA1 694dd2873a7f90586be76e61c8394877088f6ae2
SHA512 46325303535121d750c7ac28304c87711498411daa2937ae6edb2ed3db3b3613be8c980bf8376be2464c86b6ab69a46dd97596adbeba5ac60de249a2922f3b4c
SSDEEP 12288:IkFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE4523BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 b3027b3bbd7b2204ce9eec5d261832249bb2741cb49d78013cdb906478525f44
MD5 9bf387f2273b3c62819a3184c1d81039
SHA1 6b23e8a932fafceeb44d9b4b797e6536df50a4ce
SHA512 795550ef88493c1cef7840fd536974cc2e50d91c85d1c0515008eb77dbcc7cd0ce3e9a903464dfbe7910ea4c5ef4b7790a967467be133e46c2acf6d5f63fa3f7
SSDEEP 12288:EjFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ERsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F54523BE964C41CAE52648F5C3E5F15DAC073E5BE9200483BA577CBEE7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 7f18ee1b14dc3bafb888466d668291d834173b2e0cb2e7dd60c8a6734c40e71b
MD5 935209969914f7065a7c7f57bd78dd2e
SHA1 f3262d4bdb485edda1374d6c591a960b3345243b
SHA512 d127d6d18b2d4a8919a13a302c636b3178eecfed5ac9aa56d7d0dc836ba839eca73151ff95e37231335a56096bcff0fea3c1cced9e5536716086736591c3f7d5
SSDEEP 12288:NkFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D4523BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 3729e859f163f4b1b41ecfa5fcadd7aac9afd8e559774420a26d1c54c5491df1
MD5 d0fdc9d89ebafcfa1300a3f073c5e227
SHA1 f2260fda9804f2ca167574f0c5255ce408a06d2a
SHA512 cc9eacba0fb96a399b234dd7c454d177563c33b2fd785cc04a45da70942f4febebba0c2af1f40368656287369eec33555bcf9f0b0989cfa6a96bd11146b5850a
SSDEEP 24576:YfwvUk9RX6wkyAI6sqjnhMgeiCl7G0nehbGZpbD:MMnYIODmg27RnWGj
TLSH
T19D85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d869ed3cb5695cfbda6ef04430b4a67114d4678af4ba83295ef94e32cebf9872
MD5 0fddb75800a000733f5af2e3dffd2890
SHA1 3ecf37ca213524f4fe8042e6a2d60ff59e316171
SHA512 034647415b171cabf0df67e96cfc44c800c2d3fd07c21ca0333f56f01181fa3637fc56199aad5c066c3d652506b89de4d245d0179b6470c7d5c7d75e38c740f4
SSDEEP 49152:/YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0BDmg27RnWGj:qySzP5D527BWG
TLSH
T126066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cf2753a98541043c5add86d481d368898680ad65f722f35b2bf05a62d00f8b33
MD5 beea4b342dc6fb5209027163c07254bd
SHA1 a2174d7c375b500762c2e829a42ec28183df6d4e
SHA512 d84960f2a9051d65cbb8a8f9f070f62468b7a0d235c502e4ce26cc6699e7886402a9b53f0cfb763d78d8ede15fd8685c3ea887f2a9f2117967bd04f6d595ee91
SSDEEP 24576:547Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYbsqjnhMgeiCl7G0nehbGZpbD:547JUQjTirIhCnDHUPfF/RDmg27RnWGj
TLSH
T15265AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 99ec6ec4549b596d846b3b24f764fcf8bd6bf1ae888a28c3f33bf4b29ea57621
MD5 07e33358c031418ab99e52150b49e161
SHA1 0b29dcb9cecf10e6a3a3e9aee3c53ffee1470600
SHA512 011a730ee452130a81e9309b7c0c9fab203c0d097afd92213bb2f85c0c8ca12438537461f51c051006f69f7ce1c869df821e197f1ac892ad173c3cfc95789fa8
SSDEEP 12288:CbsfaFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5WsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11255015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 912KB
SHA256 d718c850650078b8c6a75b4d10d9e8ba891132b0ed0b790aec696261e3d8ce55
MD5 39e87fc3fd7b391824e4f17c53c33ce7
SHA1 249713437d8cbb6bb2b4b0a19c50a757a1c702dd
SHA512 9a4be84b0193507ed6f310b324d4a9acd3ec933c47253ef46da6c74cf1769e0f09c09889e7665e0bfeb1e200918e470d11d6fbd6966e41f01d0fe9aa74ecebaf
SSDEEP 12288:r24jU3ftA8p1d3IRw5WwFj6nW06KiXFSAFkgKcXa:r2mUPTfKRQcnW0PiXFFFkgKcXa
TLSH
T1E0150600B666C65FC66944321E33D6CCAB707D41EE45AF0773C88B3FC576658BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 410KB
SHA256 06c8234429e90174f32f0f5eee84548359be95799a556d407c0a3918101acf09
MD5 e387423727789de81b6ee276a93ff9c2
SHA1 c0fc6a2b0cc097bc7b9ab96fb8ddb256b3f2c714
SHA512 7029c75451366d2e30a146428012dd5c646d70a60e5bb815953d581a57798b1d64bbdaae25007748e1fc845499656fd8e5eb868be16294433d160af8cbaaafe9
SSDEEP 1536:6lzVzaDEEhK6dVDaDLSNFTEt1V49dAJU6InGjn8q4XQxzqoMHie7SUrxgSxXnZID:p3M1sXQxiHhrRntG
TLSH
T12D941906B719D75FC1AC403B853296CD9B79BC269F5127033BC81A8698F224D7AE2FC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 09dffbdfff46878c31ec4f726609c2522c31d0cceb1556fdc7802c8794887bd0
MD5 57df00ea85e9acb0a6aac81022f3b7ab
SHA1 423b60495d8c75a7e0cd1b79cd84cd255a87bc78
SHA512 ec8576ec910fb053f40b62a40b8b2c82bdecaa24fdfe230dd9d96d208310e9802c169cfa62503204e4e869f1eb0127ceeb4c895c2e7e70697125246f36ca7392
SSDEEP 12288:u07yFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D44523BB934C518AF93605B482EAE12D680B7E669F1044C3B94778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d35e43ec77c885387e78519ab516aab3f74e487a58fc03fbb263a02008d8c68e
MD5 a53eed8e57d4be4deaa0b41ee7202bd2
SHA1 5f046eef298282b01d389272252f88e0f89fe623
SHA512 29f34c9fced82b35a0e4b51a45bcdc81a98273bc1860b5684f8ec794f6cf1de17a3009a373de8c34d58506b28bc0054b059c160e4857874ea14a632da9f56f35
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bY8sqjnhMgeiCl7G0nehbGZpbD:1gb4mBIBhGFPDmg27RnWGj
TLSH
T12A659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 346c46db5acfc00e3a7181b7b83930a2564c79c6ba6ba0cabf49f55797b557c6
MD5 97c6dedda96d2e982b03dd02e235ff0d
SHA1 40727ffcb5a200e05ab8cc7fde6336493610c079
SHA512 5c567647e4071c0854facf46d24e8a6fdbab2d307bd709b4c0a8b47ac89079a6b61f5c68ede92f9c86439f51a364dd9b91146d534a54b39b31c961d9292bcab3
SSDEEP 24576:5G88u8FpJqH1bzria7/mLsqjnhMgeiCl7G0nehbGZpbD:s7ZFPqVea7/wDmg27RnWGj
TLSH
T13B85016577E401F1D477D138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 7cb717f28a25f1efe7620e0f43b7045ee88c21de8404b2807960aa85b26c19ed
MD5 c3c7ecc8e4fa1ccbaa88ed40c63d8bfa
SHA1 7369d78aaa1d5d71b32c983c0a9a1e06c239ded0
SHA512 c4834070356866cd7b32778474e1cbeaf13fc9c2e260705fe329b7c0b8a5416e305f7e26a3316921599687bf246dc5d93ae233038e3eba4985582c86f120115d
SSDEEP 12288:YHvUrBFrEjwaQhFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:YPUr+NQnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15665F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 64e6b44da09fa2402fc000b41c2a854e78764ac4b7f0823d955bd8ff9e45aed5
MD5 b049ec63bdefc1059d721481b8661d19
SHA1 9ffaa173c93faa841cb22d8b1281a2cb2074e30e
SHA512 006b1239c73a2bc3f7a227203b8ea641cfc5e281eecc8bf5327e890914516eb00049fbd6505ba6ca9385ab08d4f8ba15040304f541f57b8fdb9a4c43bd41b6c4
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjrDmg27RnWGj:LG05lO43bWD527BWG
TLSH
T17DD5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bbbe9ddaf9be0635a52f36f599902ba1c359baebfeb4030239943dacc9fcb25d
MD5 d79cbd6248044cd1bb8581566fad855b
SHA1 d134a3a10a0be54fc568508650e74707cd154664
SHA512 78bcf93752f0481044689fe177b96d1e9fc6c35c147d7b53d2923c1879e6e260ee1430c24e150bd4db24fe9796507df6de151956a88c5c9f2a8a2156cb4aaae9
SSDEEP 24576:Afa5POZ3dpuWVM50JicR2hG0lasx2+47eidndsqjnhMgeiCl7G0nehbGZpbD:4a5POZ3BJt2pasx2+mDDmg27RnWGj
TLSH
T19965BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3d99d48f529bc2e22023aef9303b1ff7eed90b89b5b2331d558813ba28b34cf1
MD5 2a860f638d5f691a4c0eae59927c05fc
SHA1 937925bc6c03a100bb41143e08b6f4ecea8b75fa
SHA512 a6b47baa2eabd0d0677f37eeca57b9c764a70f0e0867bd8b56dbc0ccb8db5580e72d2cfc77d5564dd580d1ca235cad8c91e069976d34896d1f3f5f6e9d702464
SSDEEP 24576:+NcwHdjbyQ4nLC18lb/EOjowL7FkTsqjnhMgeiCl7G0nehbGZpbD:+Nc/zEOVHFQDmg27RnWGj
TLSH
T18E857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 293e62b2e83d9e8ea7101b4c817da917454ecd271f05ff5e8cd989fbd31ab01d
MD5 33c03ae6d0d1890dd8ac78f72e339319
SHA1 f2bd1a95292b2cfde625102f90f396fdbdbbba26
SHA512 e1199199822f8e8513d52555d61b2f821528ef299cfb9b535a89ce960d1add1b320280656675e71cd36ad50b9706fdf83f61df98624ead3f368ed2bcd520c194
SSDEEP 24576:qTkNvNnaFeYhJNtmZBmRsqjnhMgeiCl7G0nehbGZpbD:qTMwBtOmlDmg27RnWGj
TLSH
T1A355AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 34d3eab85fd5680863ae333bc149511e5edd399c1e626c1f90eda5f6f3b6e157
MD5 3845d8d5d2760bd3b450570530464330
SHA1 b6d08ac7d01d547889148d4271a2eb1d3159c1eb
SHA512 78d3b56f9a5a29ce876f65da65b88b1451f5e445641a51f74d7ca3597903e8f5b1e1ef06e9716468455184f3427966cf84bf244f8168ef5c23a01d9827ecd038
SSDEEP 24576:dD3FHshBIYQgAisqjnhMgeiCl7G0nehbGZpbD:dDVHeBIAAmDmg27RnWGj
TLSH
T19475E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/720-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/720-361-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/720-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/720-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1360-125-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1360-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1360-119-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1360-128-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1360-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2340-72-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2340-66-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2340-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2340-271-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2672-380-0x00000192DBF40000-0x00000192DC5C0000-memory.dmp

Download

memory/2672-400-0x00000192DBF40000-0x00000192DC5C0000-memory.dmp

Download

memory/2856-45-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2856-44-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2856-37-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2856-38-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2856-50-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2856-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2992-93-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2992-100-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2992-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2992-360-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2992-356-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2992-358-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3000-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3000-286-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3256-106-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3256-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3256-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3256-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5492-114-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5492-357-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5492-107-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5492-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5556-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5556-381-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5556-81-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5556-355-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5556-87-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5556-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6200-6-0x00000000024E0000-0x0000000002547000-memory.dmp

Download

memory/6200-76-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/6200-7-0x00000000024E0000-0x0000000002547000-memory.dmp

Download

memory/6200-0-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/6200-304-0x0000000000400000-0x0000000000628000-memory.dmp

Download

memory/6200-1-0x00000000024E0000-0x0000000002547000-memory.dmp

Download

memory/6960-80-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6960-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6960-13-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6960-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6960-20-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6996-53-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/6996-52-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6996-59-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/6996-239-0x0000000140000000-0x000000014020E000-memory.dmp

Download