fbe82290a4851ad6aef98a6c442a698141f4c9301065cd1f24d0105f18e75e74

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.2MB
Sample260716-reybcaaz6t
SHA256 fbe82290a4851ad6aef98a6c442a698141f4c9301065cd1f24d0105f18e75e74
MD5 11855bc561b163bfadf2396ecb767d82
SHA1 c84f52f7008ff25cd7669580faaa82631ac17e0e
SHA512 205b25102cb8915512740cd9ae3941e7ea21e52cf2bf27234940e0ed3257e3ad87f9a261896d2bc42197a30e71fa35e2ff7c0f9b8f99d6c5a49afac3d0f3dc3e
SSDEEP 12288:vTsDqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1325523AB758CC0B7E52504BA81D6D22A68173D66593408C37FC76DDEDB7A4A8CB39303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4100	elevation_service.exe
4128	elevation_service.exe
2924	maintenanceservice.exe
800	OSE.EXE
1996	PerceptionSimulationService.exe
4604	perfhost.exe
2952	ReFsDedupSvc.exe
3844	SensorDataService.exe
2368	ssh-agent.exe
4120	AgentService.exe
1156	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\db445e1de62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000899ced722c15dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000df283722c15dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa7bb6752c15dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
4100	elevation_service.exe
4128	elevation_service.exe
4128	elevation_service.exe
4128	elevation_service.exe
4128	elevation_service.exe
4128	elevation_service.exe
4128	elevation_service.exe
4128	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3160	2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	2952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2952	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4120	AgentService.exe
Token: 33	1156	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeDebugPrivilege	4100	elevation_service.exe
Token: SeDebugPrivilege	4128	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 2248	1156	SearchIndexer.exe	99
PID 1156 wrote to memory of 5644	1156	SearchIndexer.exe	100
PID 1156 wrote to memory of 1720	1156	SearchIndexer.exe	101
PID 1156 wrote to memory of 3540	1156	SearchIndexer.exe	102
PID 1156 wrote to memory of 2680	1156	SearchIndexer.exe	104
PID 1156 wrote to memory of 6044	1156	SearchIndexer.exe	105
PID 1156 wrote to memory of 3668	1156	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_11855bc561b163bfadf2396ecb767d82_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2924

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1996

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4604

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3844

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2368

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4120

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2248
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2752 2848 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2736 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3540
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2736 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2752 2848 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 70b04fc67844e0742b9b82bdc26fe1d5e4ef260a85eb0f46f36ab1306f3d599e
MD5 92022ce84baee96ea353ed0a26e89e43
SHA1 2c23fe3eac9f1a371f4af96a4545e3d16d7bc991
SHA512 4ca35cb2126f6b60e12b08b3dc5bc85d39ae9c9b3e0c1ff6b5200e65a07d52fba8c1b6a94b289c65a93c0df73d4d607c1051117d9f5b3cca7f1baab359232e25
SSDEEP 49152:Zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnODmg27RnWGj:v3q6sjBVD527BWG
TLSH
T1EED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 430c52dd16faeab7447360f13a43e3f7da3d6e016139d5436ec1d55f41290f38
MD5 940b0c57e1ce11506fd8e4a952b2989d
SHA1 720640ec1d37a67e112dc159255d47d42af000a4
SHA512 41cc677375b69a6c2327ce44666323019b95909a9251b29ad5da4fcb4be7d0ca7da77f8dc83e3c4c86eebeeb39dee07d342a6bbd980b1dcefeace19068260152
SSDEEP 24576:9XYfDtczAlsqjnhMgeiCl7G0nehbGZpbD:otcwDmg27RnWGj
TLSH
T12C65F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5205a13f88dae9a34901c63d5eabf07b7598e768caacde518b417cf9cf99e025
MD5 f3e9b4b0a5e6f391fc6a24db1b571281
SHA1 b5c3b2684a1541ad7b8b4f97ba4a1f4161f30a6f
SHA512 5a6d0b8de4230b30c2ee7b3a20f5e77e5a3b5ecfead9918e2faffa5ba3bf9f1645fd4d7c6bad136919925b82869bfab1e7fce6d4d3eec199dd5eb143c0556bc1
SSDEEP 24576:S0Le5ji0hmxxrMCsqjnhMgeiCl7G0nehbGZpbD:SPji0AjXDmg27RnWGj
TLSH
T124859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9be8a56af6727f7782ac09f61b16705b78939103ac36657296f63fac087b61ec
MD5 1d01d79a9542fd14cc0205ffcfdb2837
SHA1 ed5ed8f0caece94392975380203f8e7fa9ac9707
SHA512 8fc2c4ff20e697aa85a2db23491015d4e94429f6c7d0357755fd60f49449dfd4662e589619a81b1e75797efbfd7451d9eba7bf509e6e6dbbbf383b259c404834
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWn6q8wyuksqjnhMgeiCl7G0nehbGZpbD:+/ezSC6vUzPveHjy7Dmg27RnWGj
TLSH
T1E4755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4369f52339a7e06c0a4ec7918581b72e105b394cc787a97f286e28957ba989b1
MD5 2990c4bfe1731aee14241df9d7d5bcdc
SHA1 a9b012d07bde1ab6477fb2947301ecbedbf79a38
SHA512 0a1b6486b5351b8c377302e9868c23367e986fa3b74e5664666c40ab3bb9888833918c48dad0280c0fa2f9177d8b971b2dc51d7bb5b7bd657b598f19cba71ebb
SSDEEP 24576:CVbqPb88hv/l+YRsqjnhMgeiCl7G0nehbGZpbD:CVO88hXl+IDmg27RnWGj
TLSH
T1E5559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7862da421b3b0afba2fe8a4a1fc653fff66b02235f3e7b831ab35aec117e1792
MD5 ece02569b0739d71e3a10c09e6d6ae92
SHA1 731525860a9c0d91ec318b15d2f75736dc15a9ed
SHA512 e38d5bd0f08dffa6c6f125c0f0fd499d5bf180a2f891f06a86be6c7421d152d55194e145e0212f0579fc8735d3e810d32043a3a3dc569b177948c7c46f56f08a
SSDEEP 12288:cLeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cLesqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D4523BF974C50CAEA7608B5C3E9F11EAC137E56982008536A637DFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f65be9248a034198389f1dee3349b19f953a942c99a576edf595197224c6bfbd
MD5 13f21cfe6707101fd595df4d133dcc88
SHA1 9ae200ae1534ad60762c2ddaaf91124ff75747ab
SHA512 563fd472b1de10493b19e5c21ca659c77f34db8b3ac814a95f4f1df0e2d1e303fd0b1af9928c7db8f935b9aa16f6969ffc0267e87356f719d3272341d1e2c3f0
SSDEEP 12288:zeBNUbTVO86U5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:zJIU5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E65CF7BEE28FCD2C27A8DB85791C600E77278314B6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7ff93fd14343ccf9af5e5ac8f6821f2e7f495c3c4c21c1ea81023a95d5ebf3db
MD5 10f9a1ed09b4259ea8ef05251283c249
SHA1 bcffcc3ed89eb4e79d650de5c463928a8c83b980
SHA512 27808dafe45160fdd30263a1659335a8d38922634e54852092b501417f176dc496da5ef1c72e8dc99fb2924a55de26b881253791e61982e95d6a70ea42959075
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH4:MQvGAdlCEL8c/DRNw5CQD527BWG
TLSH
T1A1266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c775733f224d686829b18f82f353f2c82ccdd0f57b453c45a3e743b473a79279
MD5 056a5d08fc48e2eca6f06c3d72584dc6
SHA1 6398df8720e34a79628f71b077c7a19e615b39ee
SHA512 51872ab80863ec80ee6e02a958831dca5aa1afcfb3e1404b53192b0ff13ebe002b4e3680a373359fe34bf73371574ef5d5bee8c81f884dde33912df7d0036e32
SSDEEP 12288:KAwSfxL/2Dc3RDLLmt0LDQewsAjjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:f0ewsAjjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D275E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2cdaab7c3e3390f4eb86a246e10492bc94d7ef743ec19e42a27c22da5bf40fd2
MD5 fd35d1f5ded30a2b23130d3c3a08292c
SHA1 816e0767e2173ef9447a71343ad623d3586c1268
SHA512 75d44c8d25d5063b6e8f6bf2acdd726306fb683aaecf59972ba35d0615e335330a46edb59649dc976388c68dce299aaa2e6b8bf2650bc8a38378df7b48efc666
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHPVQBWG:7UEtQevvqc2W1cpV2tI32GB
TLSH
T174474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2beb2c5c2a9cf8be9b76681152b13971e91f167478a460dd3346a92538c659bf
MD5 181324790659467a704100c6917962f5
SHA1 9dd7b0f576203605b228aedc3a0dafa023d0e9a9
SHA512 e4eea744ceae1151855e7f390bb844a3712d884f2554c8c4ac0cd8e2423fb76689488a16a73a0ea2b9ca146124728e6c7acbd0c9c20e4d95737e209a6b5b4f29
SSDEEP 49152:SCbRquA/m2yL5zTfFiV+XenmE3/zHDmg27RnWGj:3oquVjnmED527BWG
TLSH
T11DD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 554c0c6d7b13030be45c0782b4e6d8c5690fee2c575c4d2ce3dc8752efbe0827
MD5 00cb4b660678bd092ba712460a2df691
SHA1 ed9669e157975aeb457e2041e578a5455e3f80a2
SHA512 9d53bc5ce43bdbc374331eeb3c1c632c6dc4673a9531e6ea9be5c2f4e6c0c91ef3ac56127a38c0916b449a4f4a1eb89c690f0606eed5c2a4d8ee8d9b24ee4045
SSDEEP 24576:FAhGL3IFoiwtA5l7S534sqjnhMgeiCl7G0nehbGZpbD:FAMUFoiq5UDmg27RnWGj
TLSH
T1BA359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b89eea2d411e9e17186eaaceb4165c6d1e985280cf0013b0c53c60cd238f70da
MD5 943eb694a199fe1e993baca206df8833
SHA1 f66e6aa4d2d66fb85e5acefa7734ae4c5cd352b5
SHA512 c8dad6779cee7cf56f9016aaa3a25cc8581af0953fad82a70274591513f15f64b216fcc726ff23455a72f744e1e65321b59e046e527ed57ef5fe3976a71ad8f4
SSDEEP 12288:Wmw5HEjsChNVBFgl0WDm+CEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Pwu4OWHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10165F14A76A81CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f8aa272f7266730effd2d473f9043eb88aa6b718662ad466ee745e832b5724b3
MD5 b1eaeae2ec0aac91b8b522bb268805fd
SHA1 b2fe2b17d7da710f4480f6d5ae4dd9d9497ac6a7
SHA512 53f0ccb6b8b322fa3b6d5f7e75c25ebfb012ae49c781a5d6354772796a8c22982b54cafb7478c748b23240be4b7e2a544acd2d9599487a0ab38f5e5aef46f544
SSDEEP 12288:XeZ1IyzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uZuKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A5512AA239820FAE163417CC5E5D609E7337C62673043CF16665AAA6F739C44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f7de5a0d478a8cdb43ef0ce0dafe82924928e52a6b280571f87c846b4ee8d6bf
MD5 2cedf3d321892e16b252d29b78ce19a2
SHA1 2e43fd782d2d36303e3cbf0ad04eaca6a37d7ef8
SHA512 f8d9bf51a2b75435bc8d8d4ec7836e964fcec3965d62a6fd6a9e82327dae432e0f14f4d6be440e5b4e20c6a7e2d8aeece23e52f66cc4876b1fb8f8bfaa901f83
SSDEEP 98304:AQRQyi36YOcPbLvw2gAf+PN3xD527BWG:XQyiKa/X+PNhVQBWG
TLSH
T166667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d0b079ebccb3ead67e1f9fe5186fa82fafa719288daf16397ca0bba8d638a666
MD5 981dbb3d86464c829f5c710e1ee51e18
SHA1 98953fceb2845b47b9bb08e4a2c85771ef4b4fa3
SHA512 3941e7531b3b7886f96d2bed610a89a466f1f5233a311bf0c4d3f4a7c7fd900a019fbdc4d34478a883fa0bb1cdee7129fa7e49d169349ea21346903ca67fe552
SSDEEP 98304:eQRQyi36YOcPbLvw2gAf+PN3xD527BWG:FQyiKa/X+PNhVQBWG
TLSH
T1EB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 43a9faa574a53f67c32ee2fc65ca4a348913c5c9ed08d37ee34f157dea998bef
MD5 e5a0b62fbf0150374bba1f5de742077e
SHA1 f37b859dbabc2b92e99d91e8ab1d4ae2d29f8b09
SHA512 39757989abdc520b043853f81ab2267f4a476030d55373fa6bcd505c7a782031ded28f26ce6fddfb724b649a3870403f3a5cf04dee14f711bdca3be401f7b895
SSDEEP 24576:SwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL06sqjnhMgeiCl7Ge:s68Qg55nhceWu7PNU3/XDmg27RnWGj
TLSH
T119B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fe70496c02976c9a4b99596c2df050569d6dffcbeedab2b9d2c2f60b2c819504
MD5 21305d6aecb06d8a1da3568b75646b16
SHA1 19f3d10a429956aa5468542f70721d571a8cf848
SHA512 e7e9ef044db6ea8cd02e1e31de491ae04a9645dc71c767bc8f4ff348ecd191d9aad365bc4ce7a585c60a7855c270ce58987c8cb2dfe4352ffd2dc86ebd8b660a
SSDEEP 98304:Xy5112gYy5azzVvt69nLKnhZyD527BWG:qLIHEWhsVQBWG
TLSH
T132167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 aae92a0e41cc13a0e0a400791c925e8a9426f6b781de0a4835df3fb619b13c6e
MD5 2851dfd0b0837c6c35bf03ddb387d8b2
SHA1 8b5b506ca23e6930c4ec0ce47f449a4604644265
SHA512 0e42a6ae50a70aa561be8cb8f1a91c277caf4e9a4d750f05ab9b9b2b8b6fd0cd89c337abd49cb02cfff79252b386a9e036b370a8b7e97b83544e2d7a306d5934
SSDEEP 49152:2B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glJDmg27RnWGj:Eu6Jmdxd2dJD527BWG
TLSH
T1A5D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a36a27a595cf35e7261d5d0a9a1cb9ef033bfa040f5e94e224286e0ec8f0b37a
MD5 e48a3d65b21a823ad15e0292b7f10403
SHA1 3f53063992e013b2ff604f65c649cd27f8e0cfa6
SHA512 75c3be30bd08060fc046343fbf19d15bc6a4054a60197e13ba58f02e1ef6c893f3076f5120e941a05260790879e34b602deed0f9bb99e8c7ff6f35aa774c594f
SSDEEP 49152:a1hpsNoJpF1A63U44CwH7R4xdDmg27RnWGj:amifPWRED527BWG
TLSH
T1FBB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2e3caab349f64befc1fb5c0fc1481059da5584fca7b434abfd67ecb23d3e1137
MD5 114c756b97d1af16b38150d3ad80308a
SHA1 de6b4b852a09705e708f2013888f8543330c4542
SHA512 b3c5dcbb6bc0255ca303bd834239d27cab7e9135bd7fbff49b3a61968808af14b65d08bfb7db436db234df2085f6b7ce9b7d3a9b92ada9279ba020e0d4b835aa
SSDEEP 49152:XSuZQIY0Be2KcRVtOnks6NMHqeDmg27RnWGj:N5dKii61eD527BWG
TLSH
T138C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7c2cf0673bfd07c45849cf8adb4864005cb07e09d7e0b53e270024f21598a70e
MD5 e16e867132eeb36e69cf08f790179225
SHA1 a42db02d2fbc37a4e93769914e2090dfc4e90599
SHA512 9130dc216fd0de54633fb8baff92258d1fc74e5b437f92fb1d218711b36d16bbe99171a53d8a8f1954acf3b11b9bad6db7177a25e11b62586a51f6690cebf482
SSDEEP 49152:qhtSn8EApI0fig3giDn0AP5wZDmg27RnWGj:LX2imphYD527BWG
TLSH
T1C295BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5cd675e4cfce0886e635d58fe71c07844f029e98c911caa1ccb8882e4dc44aa5
MD5 81f081fcf2e6b7cd9b64eee9b3f12558
SHA1 51e6af617cfae389ab245bb693cdf971b8475b88
SHA512 514ba34725a14b07f8cfdffd8afd54e2fe0784457f362a5755396cf20dd5a910e14a0d8ed139b8e9bffb4eb2a43a21dd4c43be1cb091e07040105f503134be3d
SSDEEP 12288:wGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F74523BE964C51CAE52644B5C3E5F10DAC073E5BE92004937A5B7CBEF7B28984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 bfc75d66395a9fd4f9f5d25b39c3cb78932f4bb14390bce5367c8ec62c3f26e2
MD5 375ece844230a3a18a94e57594ba991c
SHA1 2270b7761b64fdc83ee9a0ec9214f66fd0a6a0b2
SHA512 1790729e06b5bce4c7a5b2649eef3e02fb0b889e568a222b4ef6f9142257e0fdfe918dd3c064094be5b0752798b51862fa463919adce969cf5768c454aa4bd7d
SSDEEP 12288:h/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:h/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E74523BE964C41CAE52644B5C3E5F14DAC073E5BE92004937A9B7CBEF7B18984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b2f1cb37ec5c652b44757ee5f454e1c8f475fb2ee5839312057ba07939204a4c
MD5 67bf7f5d2108b2547de1bc9774537b03
SHA1 c2a6417074db5d594dd5bedd0371bbb94881c3a9
SHA512 3871dd20675535120c7dd25c3a66829cc72e00bfb3ae42cd2bf63dfb48fe626a6a8e7390e98ae32ccaf48c6e8cab20c3054c006954ff8f087bfdd0f523823b4a
SSDEEP 12288:jBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1944523BE964C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B28584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 fd313dfd71bad1a15d4a201e59e3f578cb434a694eeef2855d8975e2a1461c71
MD5 336f4525e60524aa82d7a5c740c115c4
SHA1 e83cf56dcd84165b5b24ada577a23d8970a2ca12
SHA512 d44fb76ed8134e5cc3b8d5d666b08e231a922be55b14b5fe89559741bf7298bb3711582d27675fcb7ad294236ad6362e9a33de30e608748819f5786d96828abe
SSDEEP 12288:cVYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEw:FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13545236F675C00CAD83285B4C2F5E11DE8237D96EA3005DB6B532CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6c24141624d5a6b427a4bcae0dfc3728a311ea28569ac398a029dae8ecebebb6
MD5 47dfe8b9d93288a010b3be45eb18eced
SHA1 f619ff8f03477892f1f61a6a2309061943777f0a
SHA512 3a5a91ba88520169f418dfcfa59273c29da2dfa85466033051e79a7a76ab5c15ae9df37156fbcfff8c09217ab82e4b6b3a8e34b1cd327e0a5dc9b66e6bd5307c
SSDEEP 12288:cQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1334523BE964C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF7F28584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 22678f75698b33d85002cb772ed3682b23d6efb8ba86a06844400ee4be9c7e24
MD5 31102b2c8e1d44e41a74ffcd0aa28595
SHA1 32c31f84573411a5017331de1db6b7b2a4a7136c
SHA512 dc8a23b2056515c820323ae209da77b5adada578b9d451b7a4378e8fc77700ddb6018366cc460c8dd3e36560370834c286d817a95ba5a7f9f367e3f43f558a10
SSDEEP 12288:wrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15B4523BE964C41CAE52644B5C3E5F14DAC073E6BE92004937A9B7CBEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2a80416f8f3fcef491b8e307c2b7c49ff923c0988b8ff310adf798e9e3debcae
MD5 79538241e745036da35e970fd73e6f42
SHA1 799817caf010f63f0afd542e65527f35b0c8845f
SHA512 aefeafdbac29d923981edf3bf28270a33d224ba14d4906c5d30764b67807d4cc1363d86f1ea3e6435ed6a2e698d8c08d69f22b00804ea4c982513cc5b9174eb2
SSDEEP 12288:X3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:X3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1394523BE964C41CAE52644B5C3E5F11DA8073E5BE9200493BA5B7CBEF7F14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 dee9aca4965d12aa226e3a2f1200b9bdf06da4c0421773422587b8463c2f5a38
MD5 3185f35e503b43c4999d2b17dc7e9a2f
SHA1 edf56d4eb6cf1df9938f9ddb28c1d5c5b8c5e119
SHA512 c67a50e50f1c6f0174daddd3ae3fedd46054eec48bcf363e5f0ca61d360f5178cd3128a98d17709f1f35e759d2c68d4e5a0db73abce9a0f77479be25665b75de
SSDEEP 24576:NZMRzFVSOfsqjnhMgeiCl7G0nehbGZpbD:NZMRzfvDmg27RnWGj
TLSH
T1676501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a7e8cac34eee69d9e4b5cf34a574000e77974d315dfec9b4c68ac08c85c48bce
MD5 0ca473bdfc84de3247292b76a5883794
SHA1 bc23ff68a4fcb6fcd22c923bd282e17124e73958
SHA512 7150515f86587633ed7994d0be732ff8d5d52cc7a2700557d8483edcd0975d668d7e5f1cac097cb0689fc4109f2eab834132a2c36109a49cea9d8327f972be9d
SSDEEP 12288:vaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A24523BE964C51CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B28584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d5c41768929355356cffa7d6b01410583fa22832ffb58bd2c8c53a7abd4beb1b
MD5 bf18b1c39da9844780419d063ebdaf7d
SHA1 424f64bf7b6ff6f620996af26b4e5e89a11e70da
SHA512 ddb7ac8bd3e4cbedea5102ce54babaa48d25b26afd12532e3fd234b89350b2bcbb4e2c13b81039d8556d9342795cdbf9d688a526e44377a8bfa9fedd98ce84f1
SSDEEP 12288:NuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NusqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A4523BEA64C41CAE52644B5C3E5F14DAC173E5BE9200483BA5B7CBEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 6395b008d2085be06e4bf38d9aec3fc4bf0a2d3dabb27bace5851c866436d6c0
MD5 2b3191485e421d20ada4d92ffc187593
SHA1 815236965faa5c5ace5e1c7a80af98bb51de7678
SHA512 e2471cedcc56bb40a327ad96d92d198544542106f0fc9b8057a6faa09291a45121c940cbe10904419682ecd0bdc44c750f4261bbe815ce4cb237eb9b7f4d5541
SSDEEP 12288:IyPz5L8zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JzyzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17355125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f3156fd5265ff88975586163afd8d80494457d3ad27026686f67c1920f23196b
MD5 bd06f9292f3a6f70e68adbf19e8fdd87
SHA1 53bbf4702e32d40f18b245d62f9a3b1cd4d4d0cb
SHA512 8eb1f752a1ff7c2c20347c14a349501174c24b5cf4a7b5c4ca68bd2fb895e3183ac119055368497e7a1d17cec01d3d810ae6c705eae1d7ab30cc2309c9b6bf35
SSDEEP 12288:FaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1024523BF964C51CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 edb3dde0a8a69e6302c0f2e8f1eb1f980f326cbf4f5498aa01e464eacdc90c62
MD5 8778cd59dc62e0730284b5ac0df194e9
SHA1 27c14934fc45c16cb2292a444ad1fd302fe75b5c
SHA512 9c9c05e85594926bab738389db5da6a650a1ef482fa1ce017eea4718d2bac67c9ee0340e7eba0d9a570d15d4bef0e846ef90c64d17d0647490a22dbc8e918f22
SSDEEP 12288:uaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB4523BE964C51CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B28584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 c1e6cdf144649487da6bd2ed10fd31884ddb4c39768140b49c7937174186d2e6
MD5 2ed5a3d34e13c7651817b8113e72b4b1
SHA1 58ecf9748e0bd1ca5dc2a823efb9a3b73bcd2b3b
SHA512 befc2f5488b9981a059eb743d2c333675270ac804dbb604c1925875ac09c3383fc346e356a141fdcab7d28eda4ea80b6c02b4f6c2d5ffeb432b22bb97a959c7e
SSDEEP 12288:nyPz5L8zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KzyzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF55025B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 574020f5505ee66ea829a3b18a101b4e86d0bdb528383a38bbe9bec02ff66aed
MD5 4f430f95234a8b2cebbf5698b9b0abde
SHA1 97eb595df36ada197668d040da7d70fd38e08dc4
SHA512 c098e29f050dfa32ac05280dc0123c2224e883fffc641559405c78e118f430e0e5d3c99177a39f1e25874700ebdd375ca0a8fd8e605a3b709903d389cf819450
SSDEEP 24576:0TDaLl3z0zDxsqjnhMgeiCl7G0nehbGZpbD1:0TuLljADmg27RnWGj9
TLSH
T1CE6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 da6ac11625013e6eaafb308df0a93ee4d4d881d17401de61d8380d6ff8ed0c8c
MD5 4e2b87d48366e057185bad348c78f599
SHA1 75f7ce496845cf86196d957b4e98dfe3b1703a8e
SHA512 ed3d3cc3655cc8771d1b655da76c435608a09ac4ece9635f38c26b44f17478adda30e5e2ce08e367c9a4275a844554e0e3e737773217c2064a63b02c8c7e9ffe
SSDEEP 24576:13vd9CHKy7GZtsqjnhMgeiCl7G0nehbGZpbD:Vvd9CHKyavDmg27RnWGj
TLSH
T10775CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 61d36cfda5a4f4ff8924235f6e25a50de740391ce1d1c25760c5c396d0a52701
MD5 0660d3d235cd44534c91dd3a0ddb98be
SHA1 9e5d55dd904d170ae3d2d4ee73cfcae61b600efd
SHA512 eaaab0a053e13aa1dc7a1ec87fc7065273f5a85565974cc73281d14b0463f9d8eddffafb9af5f94fd96abe7732d16f82375b2385fe10c4d52c5a45d62953850f
SSDEEP 12288:fhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1214523BE964C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF7F28584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 764570b202922dc4bb5da4f05cbdb73d8344e0f912e12aba993ced88e8ea869b
MD5 0bdb67ebf48efc3d22bbdd5f431b9e8e
SHA1 0f066d05c1fbb4a0a904b34073899de28ad30143
SHA512 5b84c7401c5be748f8e6d9c9e63e519dc99480683eac76d0818f085ed7584b0d297d925cc049d374f6b21de17f1959d3ce9c1cb47f168c9396a78c8dc26bcfaf
SSDEEP 12288:9TXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9TsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E44523BE965C51CAE52644F5C3E9E10DAC073E5BE9200483BA977CBEE7F18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6248da8d2a14403abfabe5c96b728c0294ef3dda503a7d5b2264713eef392a08
MD5 72540f5de227e9457eee7c59ec316689
SHA1 8dea7e1c48d748e1bb502aede2640067acb57a29
SHA512 66df5522c4b450fd565a4e3bc77553c61a469c249a90a8512ab6c9e192815dae0ad173e3c921bc1f47ee2e93fdbd84cfd60892fd842a474f0b2a49b7491bb38c
SSDEEP 12288:a8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:a8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18B4523BE964C51CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 bf0c3d9679d6f62efbb91542e38d513b533ce2e77977e223333085bccc75dc29
MD5 25e2352e32cbf95574c0eaac04a65215
SHA1 70f7d908ebb64bb7afc3fb475f63401c52c7a1b4
SHA512 c80da8f4e7726a9cc2bf868bd6f170c08b661f74a2cfab158b4acc9ea1de7cec811aabc29aacb2d79656204a6b3a8d640010ffc991e793138635c447e02e823b
SSDEEP 12288:zaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A84523BE964C51CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 3c75f897c429de13ef189c25fe725ef25885ab7f1b86e58d1c84d004fbe464fc
MD5 f3eaa88d0fde1e25aa9bd766a05d5a3b
SHA1 d2111b87d436a9a4723e9129f15923b12fb9f399
SHA512 1d3567835f160275ff5081021a7d9642257ef7020632dac0cacfb77f54b240f10677769772d5f5232ea53550baaf69c63df22889311e80d08c9454c4f361d289
SSDEEP 12288:+hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+hsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A4523BE964C51CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a1c70c30ed093d12da9a7f5b3848a7f29a0f47e99bd3e1933c66c7b075da4791
MD5 4848a3f209c60530f2a67a1d8f8d89b8
SHA1 baa6dcc169c8409a983ba6f4e9cc1434e5d9e009
SHA512 33f35b3db785bf3e693b31ae18af65fef8dc0096649d271aa95a00f3868d7f07f7ed547bfa839b434ece7c0e938064b8917a94c64bb911c4d7965fa691a32236
SSDEEP 12288:IyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IysqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D4523BE964C41CAE52644F5C3E5F11DAC073E6BE9200493BA5B7CBEF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 568472cacbd109a22258cf5067c622cfabfb65d1a009ac6d78d00aedd9d294b4
MD5 a0666f65f15653d08af31e87c66a9b78
SHA1 eabbb1ebaf145ace904378ba7c3a32befb8d0c29
SHA512 b287fe7bf33bfc1dd33fc9469ff29f9a8793f5e6eb4ccea2e08e913a6cd38fd6c117af1f014301da5d9a759a5f8387bd46870d5f4f89b4c7c0a5e3302ee5fb6c
SSDEEP 12288:WQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14F4523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7F24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 47c4d4f0bdb7c05a1076373e08d6908859cdcba6e27f1b7397978b1c81effb9d
MD5 c332fd5cfb650d7c3a31521df0a4ca6f
SHA1 c1977f7360379d54fd9ac4670062d191a4e77ee2
SHA512 7e393994f1ccd71a6a39d35594077be720453ccc0d8502300e3a923cf9234e1a27615190190b88fa490392707b7e0452b0fddf57fc4fcc513c9888661b4b41cb
SSDEEP 12288:gJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12A4523BE964C41CAE52644F5C3E5F11DAC073E6BE9200493BA5B7CBEF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 922a9f86532617ec0d24bcbd38322616f6bb6b743efd5e2c28a850c68f9d2ba5
MD5 c7941eba438f44a8697e0e6f74c960cc
SHA1 0fa2a6453f2bd184895299a244730f843729c97c
SHA512 8786f4e43687630524378c10927cf29fb67d6dd4b5cfa5840fb483ef3ce319b603408ad3914235dc16ba97f17e439ba62046fcac4af0a93c0494f3f35a7860b2
SSDEEP 12288:LQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F74523BE964C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBF24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 727657627c82f7a1ab62d3b49680372a49658516025a8d5c18cb51a24b3918e6
MD5 433fc491bf86bfd145a71a165962f413
SHA1 0faa7956acb49978d060294b6c5ae16fe55298c8
SHA512 a36984d6147b91104d201304ed4aa2376e2e503a5cd28c0882e3e2fe0e8f3b5e3e8ee3f4326ea2ec40922440cb95e7b7cf27c49429ad8809cbb1b6804828e7a0
SSDEEP 24576:qfwvUk9RX6wkyAI+sqjnhMgeiCl7G0nehbGZpbD:6MnYISDmg27RnWGj
TLSH
T17685D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8e3b51a71ff0ae3343e3f2c067347fdcce284e3e00a0ee8278a7a85473a3b738
MD5 dd6a9656546cc44622755cb0ec2de392
SHA1 db397a47d72286d889ae31de48c1c16549d1f29d
SHA512 25830b6f38efae5da639e79a587e70f3c837616912d540ad090aa79ba499b015fafcf5f7aca45dd458e24182bb32f27c7656755f570f4a25314a663628b9f15a
SSDEEP 49152:TYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05Dmg27RnWGj:mySzPRD527BWG
TLSH
T110066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3952e91d50fd6ff2540e59b78a7891dd011ece1d79b0faf83ca9bf61eb9f873f
MD5 78c9618c2ff6b6102f35ff2f4a046a4c
SHA1 ccee93bdd145b4dd3de725ee774882d8c2ca2867
SHA512 4cb6491d3b6c7cbdc287d2c9aa7efe1da94e3668d835c1f8ccafd650506765a14db70217437d4ce088e68fbc6f0d4120e2d86fd4ca1a28a8ac2aa5073bbf07b9
SSDEEP 24576:K47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYvsqjnhMgeiCl7G0nehbGZpbD:K47JUQjTirIhCnDHUPfF/JDmg27RnWGj
TLSH
T17165AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 7eb06540ad51d8c34fe2a435ce559fead0dfeb70b62a4ecaa2d9a51abc281a26
MD5 38e0cac42435c093c8e7ba86e50a021f
SHA1 7f5a370334e7e4d7014fb3f03d2216d49583a687
SHA512 9cf7aa1fac0f1a415aaede90dccbeb3d53788569db244abc95cec730f6e24929761d7a816e1b1341724d200756538f3087a4d9a2bb5cd57ac843b3586e59b462
SSDEEP 12288:1bsfKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11455011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 e87bc7df569a0499fa8b9df7be8bbfde490b49b16d5a169ce9522fb8597c562f
MD5 38a1fb2f30774226d062cb08ca3739d6
SHA1 0d7ebdc80affb08b23848a24e926eb2007782b05
SHA512 d1ce3c14d09c985eaee37e3d0b042a226c591526e9b4adf378662c4b701207227f5e67c8b054da60843b3ebeba238c4ab6230614b7fbe1cdb1427afd0501995c
SSDEEP 12288:8NXd1U3fPFH0/lWj4a6pyiJ+OAQ/ZT0NX7vDJZ0:8NX/UPJ09JTJ+BQ/ZgNX7vD0
TLSH
T1F5451640762AD78FC6A950325E36D6CCA7707D01FE05AE0773C8473F9876668B6F6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 959bb0182f63708e34e4ae456bfbd0c420c1960918a6b3ff8b418312908b7d2a
MD5 8d7e092b863c75cacbf3751fa777864b
SHA1 d2fd9cdccd7251b8db1d3b53e5c32af238a49c91
SHA512 7a8bad965fd253b95d7e4a60dc1581f8c2fbce3106ad0fcf3d2bdea1e0b8bbd312290ff13f08dd46a9fb44c1d599a8e1e092671daaf70aa04ef1e3eba2dd7afb
SSDEEP 12288:dNRPjbh6ncOMXddvJDp3goc9H4oRozJ/XSb65J:dNRPUMNdRBf+RopCb65J
TLSH
T1F5451B41A5A7E35FCDFD90370732C68DABB49C06B7452B0573408A3C9867A7EF5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 692086db8863ce1f8974a678bf8c4d5df10efb7fd32e1c549a01c04124864acd
MD5 dd286692637bfd4de930d2c9c3280de0
SHA1 db671508390cbeb7aeba6ec1b3c4211605b45939
SHA512 da93cda37c5577ff325b8358c55ff854a24fe36c9f1ba5ac175d2946564e4b2c40cdcb910218321dd907c659dec6b80f7b5aed3239d525bdc64257ca5acaa3b9
SSDEEP 12288:J07iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aisqjnhMgeiCl7G0nehbGZpbD
TLSH
T13345237B934C518AF93605B482E9E12D681B7E669F2044C3B90778FEF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b40122d8584fa62e5dabcd40fdd29eed051751e2cfdd0ed5eeb012fb58c4a036
MD5 2600c89daf3b256e17ef900b19eefae1
SHA1 87b2605309f9b377d31a8a57c56842c66a9ceadf
SHA512 fc1cbc6caa2ab13c8f6b6f4853e017d96e5c9e22d09d085151c1a404d78e6c95ea6ed214241056b12cbb9df821224364dfb6301da0ba578434c9d94e8fdc281a
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYksqjnhMgeiCl7G0nehbGZpbD:Ngb4mBIBhGFTDmg27RnWGj
TLSH
T19E659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 f4a8d83eb28d089391c48c378cf6e306c4751d2790d543bdbd7a085148664cb8
MD5 77dad6210c28a3065f75d3ef54c03511
SHA1 75cf2c4c1b3f247d771425e783815f7c00be5bd9
SHA512 f76bb64b91475e9f80110e77e63fe7863328cc454bf8bf49629acdd469fd6f52afd731535d9660a033244a53c0cdcabb975d4708bbe4619ec02fa200b0856353
SSDEEP 24576:mG88u8FpJqH1bzria7/mfsqjnhMgeiCl7G0nehbGZpbD:t7ZFPqVea7/IDmg27RnWGj
TLSH
T12885016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 66bd7d09237006c5394bdc9b60c5126d0d32a03d657bd1fd9b929c8d0a960c16
MD5 cb5d28e58c7655370630792c6aee324d
SHA1 f52c954b91de7ff89dfb8eca2948e953357a7e58
SHA512 cfc8d53bdfe9e4f4f678d7b9dc7c1ea3ceb37dda98ab565afe768a0b0854da83418d4e8eb2371f97d69a01553e36f331ccbfde2439b2e548d330bc477f5b24b2
SSDEEP 12288:iHvUrBFrEjwaQ7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:iPUr+NQ7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D65F12F62AC18E5E676A17CC582C70DF6727862171192CF02E1817E5F63DE8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f755e89e0aa1d35ec4741b745f092ee1f6dc3851b4814dc379b511bd6d435803
MD5 7c885ee41efab9523d6ded86f40969a6
SHA1 27908c7e3876712d4c54b6e54d1e4559d95a51de
SHA512 2ea6e94736fc32871295b3dd0b6c6b6cd8215803799a4da5a9715159a5d245f70caf27e1f1cdf43463b797a245bf8c73e1f9fb1d9f7f0b5a51ae0a8b36bf7e37
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjfDmg27RnWGj:jG05lO43baD527BWG
TLSH
T1A3D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3e40a7aac61c58dfb35ae46fcfc95f1419dbf49f48b2eb322ca4bca52f97f865
MD5 ecc00cde9c9fb3e54f788a292d604e43
SHA1 e84f3c279cc8b0c33316c36e0755c2f82e94a4b5
SHA512 97a6e0f9188c3e2196dd64c12626fc10236d1ddca30eab7749a1ef6de558422b9c664dad251a4c58831f5e3e7c31c589145a0256eec11437816905c4366d1b42
SSDEEP 24576:Sfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnFsqjnhMgeiCl7G0nehbGZpbD:6a5POZ3BJt2pasx2+mXDmg27RnWGj
TLSH
T1E365BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 45d89940df708a7466494dd8ebcf585a8fe5b1cb6a59df3ffba55e74ce8c2663
MD5 f5b2bc1070f42b545f9a8bca787aec10
SHA1 210a0db5181f4b6f42aa05214b2c3bcd6991b422
SHA512 00a2799af7e54ad9b84e2b3caf312446cdd264b1777616fc949ebe7f41dba3db5da46a46495f8cd26324f926e3fa6593e109d6e759f93e88eb8cc17f67f0a372
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FknsqjnhMgeiCl7G0nehbGZpbD:4Nc/zEOVHFoDmg27RnWGj
TLSH
T1B9857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8074c0eda83c735852dc82648176cd8e86d1b23e1a1d76e6d23e2902a0897e40
MD5 519120e172d01ebb26543c6ae8be112b
SHA1 d6b3f704973c5ecd7dc27614272207b4d5548eec
SHA512 eaadb62d92be65eace24d8d2b0263fd455bec88a10b6a395dae473fa36efb9537c32133f2c4fcc6ddb5d3155c35b03446e9389330c195cc2d97c71319b4053ce
SSDEEP 24576:ZTkNvNnaFeYhJNtmZBmJsqjnhMgeiCl7G0nehbGZpbD:ZTMwBtOmNDmg27RnWGj
TLSH
T15555AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 dfede0d67836761dfe37b5659d981d0ac22ccee3287057b9a929726d427b9310
MD5 2f8de698a61ddede6280b3217257e926
SHA1 2acd814ec9736cc117ffe838f14d7cb6588ed095
SHA512 0ccd397e70a55e1deb5ab5308e25159c5bd610f54611f525885fc9cc7963cb2fdd11bc163c3ce218b444764deb2fe91879d431a3a5e51087508b7dbc08823662
SSDEEP 24576:QD3FHshBIYQgAmsqjnhMgeiCl7G0nehbGZpbD:QDVHeBIAAqDmg27RnWGj
TLSH
T1E275E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/800-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/800-61-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/800-55-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/800-214-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1156-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1156-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1156-363-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1156-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1996-67-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1996-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1996-73-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1996-254-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2368-108-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2368-362-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2368-107-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2368-114-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2924-47-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2924-50-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2924-39-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2924-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2924-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2924-45-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2952-366-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2952-355-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2952-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2952-82-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2952-368-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2952-88-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3160-253-0x0000000000400000-0x00000000005E0000-memory.dmp

Download

memory/3160-0-0x0000000000400000-0x00000000005E0000-memory.dmp

Download

memory/3160-2-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/3160-8-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/3160-77-0x0000000000400000-0x00000000005E0000-memory.dmp

Download

memory/3844-361-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3844-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3844-95-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3844-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3844-358-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3844-359-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4100-22-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4100-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4100-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4100-14-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4120-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4120-121-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4120-127-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4120-129-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4120-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4128-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4128-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4128-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4128-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4128-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4604-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4604-343-0x0000000000400000-0x00000000005D6000-memory.dmp

Download