6d2e1b237ff51ec826dd1b3334aa00000fa4e98379aefc65e87a8c3015d9a1a9

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
Size 1.5MB
Sample260729-nd3mwssfla
SHA256 6d2e1b237ff51ec826dd1b3334aa00000fa4e98379aefc65e87a8c3015d9a1a9
MD5 20caa46c8cdb22429bafe93c42649002
SHA1 d09625e762ceb3f32f535342aa4b4fcf2a1b3114
SHA512 26663c889d26a9d85cd0b7163df60a058352db8abba20ea143f51651014b80c9b84f6bff8a77d3f55a18295fa4635f343df954f9c13ef9e1947c542a5b19d62e
SSDEEP 24576:h1Q9VABbGz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nQ4xGzLNiXicJFFRGNzj3
TLSH
T1CD65F1313644C033D5A711388ABAC7799A6DFD66576140C3A3D8AFBD7E346C28F3825A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3360	elevation_service.exe
4796	elevation_service.exe
2616	maintenanceservice.exe
5056	OSE.EXE
5720	PerceptionSimulationService.exe
5916	perfhost.exe
5604	ReFsDedupSvc.exe
3520	SensorDataService.exe
5608	ssh-agent.exe
5004	AgentService.exe
2436	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9bddacbb8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059e643f24b1fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003ddf43f34b1fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dbb324f34b1fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d41e21f24b1fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7f980f24b1fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3360	elevation_service.exe
3360	elevation_service.exe
3360	elevation_service.exe
3360	elevation_service.exe
3360	elevation_service.exe
3360	elevation_service.exe
3360	elevation_service.exe
4796	elevation_service.exe
4796	elevation_service.exe
4796	elevation_service.exe
4796	elevation_service.exe
4796	elevation_service.exe
4796	elevation_service.exe
4796	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3176	2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
Token: SeBackupPrivilege	5604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5604	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5004	AgentService.exe
Token: 33	2436	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2436	SearchIndexer.exe
Token: SeDebugPrivilege	3360	elevation_service.exe
Token: SeDebugPrivilege	4796	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 4556	2436	SearchIndexer.exe	103
PID 2436 wrote to memory of 2056	2436	SearchIndexer.exe	104
PID 2436 wrote to memory of 108	2436	SearchIndexer.exe	105
PID 2436 wrote to memory of 3748	2436	SearchIndexer.exe	106
PID 2436 wrote to memory of 3740	2436	SearchIndexer.exe	108
PID 2436 wrote to memory of 5700	2436	SearchIndexer.exe	109
PID 2436 wrote to memory of 3260	2436	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_20caa46c8cdb22429bafe93c42649002_elex_mafia_rhadamanthys_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2616

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5056

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5720

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5916

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5604

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3520

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5608

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4556
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3000 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3748
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5700
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3000 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 06b40a5e776dce1eeb2fe8113f81dd2d1d7d35baa4758ddd6124963769ab7bb9
MD5 254b877704ca6e6e1d864e7d57149ed2
SHA1 93df08f9774d4ca81dff34f69674a001559eae6d
SHA512 b8671f0a3a914247210e0d504472b08079a3b1dbbb26785900f4b7fa068a9e156242cd40409926889ffefe0066ba4873541c2874ab13219dbe77100335ac254b
SSDEEP 49152:Ob+632BuPkFKRrdE6ohdstBhuXjfS4LWxnJLNiXicJFFRGNzj3:Q3q6mjB27wRGpj3
TLSH
T13FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 e3ffcace83b84633f7cff8aaab21073bc9aeaa38d6f13b9c03f2d3fa408fb215
MD5 1ff32aad0188fe194e7718c163ad6af5
SHA1 0ce9d45b6bb540b2896aa14e0b42b09409a57902
SHA512 c0dcb2ff5f4a31d7c161b2ca9f98cbfa3e8c4cb50ba5651f49f943563c75150c68a431e680919212a8c928c0def5b88b754b45f959d92d115106e3c588db5417
SSDEEP 24576:3XYfDtczAy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:itcrLNiXicJFFRGNzj3
TLSH
T1AC75012963D408F9EDBB813CC8A28411E6737C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 fa86c795a7b5544252d6dfe688c549fbaec38296ed142288509dd7f99a28afc3
MD5 f4284d938f5d22b06f39f16229ea2630
SHA1 044a0e9444343201faabd667e91ce2fde24ecf81
SHA512 2914375223be7eecd4e5bb40be642e5ade57c45d0c482e8d74a6ff5c9320e009a9f90056195cc628b2b6874ec4cfabc8083e9b83e86972b9fdea386fe2143c13
SSDEEP 24576:b0Le5ji0hmxhrMR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bPji0Az4LNiXicJFFRGNzj3
TLSH
T11E85AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 96aad613e75c02d83c107b030566be0877db2d8fa988c35cd62e9b9ee13ce053
MD5 5304c631df0990de1036ad4f21bcf68e
SHA1 08e21a9c8531afff8630deeb73661f994b396449
SHA512 3972ebfb9613174a6514cced6bfd945b2384294e96ce76146227b0f9734b6e7be861472f0790aab31e79700de85924bf722d0134e20ebd394cf1c37babd0e0f8
SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWj6q8wyu7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:X/ezSC6vUzPv+HjyULNiXicJFFRGNzj3
TLSH
T17A756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d671f045956e9b622bb425adb5792db09565e6e95a7458ec79de98ad523a8920
MD5 70371e32e00364e142266f76ee969825
SHA1 5b5db4516866dece610cfa595e25652d416071e7
SHA512 5bd25cad77a2707943ee7b3380161aab251b49eb2a6d597c6d3eefec8e8d5e2a1200fbf038b9e521fe2e980975528120d562e216010c64b01e35ee44faed135b
SSDEEP 24576:cVbqPb88hv/l+BG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cVO88hXl+YLNiXicJFFRGNzj3
TLSH
T17F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 70411324870fa875ebe2a4083f3f2c4f88e85c2c6c0b26e5e3acc5eb07442d8a
MD5 8b42ef7bc229c724dbb34fd4d7958b8c
SHA1 23f0afeabfc8677f698aae232502aa9fef25fc9c
SHA512 e87e11e330daf05a59836275ca01428172ee06285937185a2f7fce51cdb7dc60b66a20bca0ee9547d7a8dfc070bf5ca83f7278f7cfdb2357a64e914caa9f05da
SSDEEP 24576:0G1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9LNiXicJFFRGNzj3
TLSH
T1875523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0b447b8ce10aafafb11b0d25271137f23e5d7ddf2092be2c67bf4dc7622e89f1
MD5 14a88ef48ea134e42bb7e540d78d99e2
SHA1 5615c7e4388a252d96a8a242254ca4c837414572
SHA512 280df9cf9d804bdb5244e1344b4b259790e5720c0adcf51ef83e9d723fa1b6172b28646f1807c3f47bc4441fb4e6b3f1e6097599c14b0736a237cd7d7b964b21
SSDEEP 24576:EJIUu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EJIUuLNiXicJFFRGNzj3
TLSH
T10D75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3523545431bc9aa220a1c1bbd4e215d59abe02dcc48d3858155492af9155720f
MD5 d560d7f34069b91805c4b2a8d3293b6b
SHA1 83ed83db928cf6065f917463c5ea04321081b721
SHA512 36aaae44e6489709c7870cc6622b1a83eaa171af39dd36e4d3706d7398b6ff9043f9e2ba5a61f856afbb0e7b0492e1bb89d0c6e71494e9440ef72bda965c43e9
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THw:tQvGAdlCEL8c/WRNw5CL7wRGpj3
TLSH
T10E266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 147b52013341f6246ee606ed51fc653c0dc435ab3b4533904be3525816576178
MD5 391abf4e88ce0babcccd0d4a43dbe4b5
SHA1 a5ff3e16eb0d0c39247253f96276aa999173ae3c
SHA512 8ad881bd7d095ee686c1ee853bdec0b4276f3518d20263b3b73e5d249a7bd43646ac21efd37b7cd4c833660c1a0526d21c0b8e25d5a8301c53c11cc6dc3b2f2e
SSDEEP 24576:vfewsAjI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3ljILNiXicJFFRGNzj3
TLSH
T15A75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2e83b2aa292dd7d04f6552764b683c8c014390991951ae88637b08b8c22a2cb1
MD5 d79f0e154ee55c3570d46867e6a1b4cf
SHA1 49db7502627d954aefc4f7d28be5ddcc55413acc
SHA512 ce793bdfb3d325e9f62c70e7e48411e6875c9f4e4318ff2263d6f0f525a0062ca8b09dea98da2ab0a2f13be176ddffb161a974ab510801a194b604341dd24fc1
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHcF9:QUEtQevvqc2W1cpV20I32g9
TLSH
T17D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 728647f6bfd24231e614ccc33299bac4cf9962d2c2c79736d3dcefb6dea88f10
MD5 be322161985d668c660ca8b4a73bd5de
SHA1 a73640181aceb9011f3aea2be4c41064faac142c
SHA512 a23cb46134d64f67798a32b666376c3ea56f3cdc2e0dba68d29e02664c7e5424578cbccd75ef5ce267d7d00c6d3b720e2025d34811cfeb6b836ae01b2f1663ef
SSDEEP 49152:XCbRquA/m2yL5zLfFiV+XenmE3/zoLNiXicJFFRGNzj3:Aoq2VjnmX7wRGpj3
TLSH
T1FBD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6cf47a1d32e0352123463d46e96b4a7d4119b300e85393acab9e14f7e62582e8
MD5 6d4dd85550661dd957c253210e0839ba
SHA1 fb7f7ac98037c3fb6b7e8fb9002e8af0de042b67
SHA512 7406764748d1959836fae7afdfe603016d181ebfccdf1d6a02e230a48a4b29066f0cdb3ab75777dd7314eccf9a2a71b9f2979f09d58178677a57e6cb32381638
SSDEEP 24576:1AhGL6IFoiwtA5l7S533/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1AM5Foiq5nLNiXicJFFRGNzj3
TLSH
T13E359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 231a5bc6dc6b823339fec8f516f88cc2711a6dac4b976d7f993853353a902478
MD5 4885733b66977b38c9efe98b41d553a8
SHA1 61b3552a2d8c7b1e608f80b0c0bbc0399800b1e2
SHA512 fcb5d5cf2d8e3dd9ae45aa42d4a2c16dc34575b5e95c11693200e8c4e38d127b3d8f80f1bfd894ede29cc91ecbaf66cd6ae82557b230d93924418a4bc5c596e0
SSDEEP 24576:cwuROW0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cwSODLNiXicJFFRGNzj3
TLSH
T19765F18632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b0783bebe083440ff9db83ced712c6038ff976362968b404a5a535507b57a22b
MD5 df50b0cc53d635e13f34fc805b003582
SHA1 08c062efa9b39781d78d8a71145dfa1cf4188bd0
SHA512 fa679a902a098f986624cd9ad0452f258f03e2986377fe76f796147a1d8fe0202a1248465865735a8a2877cb93bd0107405e43a405009f3e59fe3811ec6e24ac
SSDEEP 24576:iZuZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pLNiXicJFFRGNzj3
TLSH
T16C55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bb1c6c9c94ed99178b10fb0f0938a6efb529afbd1dadc6f6f9b7fab8d138dc0f
MD5 bd81e1a9772123b6a39fd7b257f8c302
SHA1 4e456eda384db3dbd1075fc0d5c4afceb15ee865
SHA512 c798c88b2e9392511e89b9403f1409296946c7ae5142df370cdf8bbff10c9ddf3d5aa8dc1681eb27ed90148c6471211711496454543e8fb623a552b96766ae10
SSDEEP 98304:nQRQyi36YOcPDLvw2gAf+PN367wRGpj3:2QyiKanX+PN+F9
TLSH
T11B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ea8bd409e5220046082ad5014f8510e7082651edf564268edb949236641f2a56
MD5 235ff295d871cf8a2a311fb712ea7f52
SHA1 effde3501617f0afa9d1ec637865c14f4b86b1b9
SHA512 870590e45e7aea6b3e4dee883d2ca126cfc5484236fa13edd27840ec3c3645c0ff73abe6506ab056deb08ddfd65974e0eaa022bf8afff4eb128b87225f8fde67
SSDEEP 98304:NQRQyi36YOcPDLvw2gAf+PN367wRGpj3:kQyiKanX+PN+F9
TLSH
T180667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8a1714c69fca41f1babb3b8bdd7576f4132603954fc6be85e65592d706d1913f
MD5 bc675b7dfd96485327458351f8cfde27
SHA1 5da5685d47a6ca85e3611aa7bc76586a7d3c5c28
SHA512 53a0fb02ee41dd37f2d79bd92b2973ca3075c973764759200210bcebfcd65a038feb5386d5292d0ed1c6b2f7868b8fde509712460823e3facbd6b405d533b220
SSDEEP 49152:F68Qg55nhkeWu7PNU3/4LNiXicJFFRGNzj3:TthTRc/47wRGpj3
TLSH
T1C4B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c737a999a0a8e5ac42e290d4f038061404bcbc5ce7febd564f7cfcad752e14ea
MD5 5b9ac0e211fdfae1140ffe959e810ced
SHA1 b01ce74e11c5cf2d2ba503b3bfc6d3f16a020617
SHA512 78a61369fd2a12279861daa15c33bfc847c06c2ad06479e33c0063e1d0732f0088f3d933a415e4960d4246c8bd293fc969b45fa95bb0523ee64c0f6dce332c0a
SSDEEP 98304:Ay5112gYy5azzVvU69nLKnhZ17wRGpj3:ZLIHRWhzF9
TLSH
T12D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6d47b166fd937378766e8d6fdddb35bb30dac7bc6f7be5255ec18e93d32b21c5
MD5 47019448c381e7bbd1a39d78d4c5913b
SHA1 64119ae77bb0f6f9b62de81b014e6c10b0db970a
SHA512 50933cdc656ddc2965eac4bb571f08319f13f0264b86fbb8ed48f5cf6774ab487fbbe0292b15ff6f3b74c84696e7084b460a8d53551e4ba445aae17ebfd59229
SSDEEP 49152:LB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gliLNiXicJFFRGNzj3:du6JmIxd2di7wRGpj3
TLSH
T1E8D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b17cf743bb57e1e1e8ce222d411799d1669dc066a2f6b2f7b1bbce3fda0895a0
MD5 019efc4d6cf36bbf2041aec771e48364
SHA1 a5846042a2fb42f3adc0850f73ed3ff74f307e31
SHA512 c309dd5d55c721de1a8a82d087efa018f0e7d6dbaa1ffeb21b0c31a804d7ec0893e6a8bb0254afac3a8094d6e7d9e10da44932b31f86fe0e2c7089d942a28ae6
SSDEEP 49152:y1hpsNoJpF1A67U44CwH7R4xOLNiXicJFFRGNzj3:ymifPqRX7wRGpj3
TLSH
T19DB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bd0d33624b1d4284fd5b9e391353c47110286664a7e011d7500619e1b3474b5b
MD5 659e1d5c024a9b166722b2f6c0230a81
SHA1 6f19d67c76c9878fc0791ea98bb82adc5a2f2fe3
SHA512 1800b40c67506dcd5283b9e178332a0ff528fe83bc1613eb803545218887e4adc55d0b515ce75275226590f5354e3673e3e5434bc2b8623da5fbe3e805b065b0
SSDEEP 49152:qSuZQIY0Be2KkRVtOnks6NMHqZLNiXicJFFRGNzj3:05dKqi61Z7wRGpj3
TLSH
T18BC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d325474aea6c696b7ec10bd9c15f336ea31a4b0f13eb601ad5dfd17766b80626
MD5 130c7425cc4713564c08d5fa2ee3d69b
SHA1 f8051721f8219e68139a8cd12ffe633101aac287
SHA512 8d7b70c621dfa4b44a0dd29b664f48a90b0eb357f55f80f28590f6716ecb106d7f7ac41c54d23b5c27ce51c1d8986fbc006c592db787201e27dc7f7d8173c4cf
SSDEEP 49152:rhtSn8EApI0figjgiDn0AP5wyLNiXicJFFRGNzj3:qX2iWphj7wRGpj3
TLSH
T12295BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f3b6664b18b0cd3751c559759a43fd07f04d041220747ce421f8bc0fe9a7965e
MD5 655cdd3813fef2c6dfd00b30b4398d3e
SHA1 862a7dae817ec191f453186881c504b62f0aa269
SHA512 6897de0d87e3699901e3f3b1155ba0aea4b2731d67ca80ee88b0a695f9044278ba49d2f8009e54e2c28a1f8059b2508dda369ae6e6b6688c8dfabc97dbf4e396
SSDEEP 12288:0xiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:09/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13E5523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a600ddc365e8aafe09f61ea7ce053d2cabd39c3f8ddcba56163d103e7e509ee7
MD5 1815dde1845eb44bbae4e86fbd2ea8dd
SHA1 271c7e2eb196ee992e33effdcb9741fd9bb16493
SHA512 623313b07d6287088802d67891a9138ecff0563868942b0f6711e650152749f620aebf4a1bd7c1d96d580bc1bf35fe71664e8647fd3b708bea5aa0e593636bb3
SSDEEP 12288:/qiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12A5523D3548955B1FABC0039C6754428F5882E2DEB5618E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 947d7190ab1b9372e922c75fe7223884cda77f148e162b823b7b5f68afccc27b
MD5 66dfadc5c237323e19661656f6f133e3
SHA1 27fdace7127596686ecbf105e420c27db2e8d6fd
SHA512 c40e427b4ceb962877c9ad2aa3cc227a9337036352673368d259e5ec2e882bc2adbbe349f97026bed57332bb37c23d56c50188b17f1bd0b55f652596a6e192f8
SSDEEP 12288:XMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:X2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E25523D3558955B1F6FC0039C6764428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 3a42cc2e3ed3321f619df861fff220eb90b142057c4f5da4981defbf7daa3f0b
MD5 7dd8b870de5823aaa797640abdf145eb
SHA1 e628e72e0cfdedd21f6f926ec5b00be5dafd7511
SHA512 631f0365f72526cc2d54fd7ba7e75a7ab88c578ac0763d32246f95aaab7efebb73946923cec92604a16c2b348336d1f8f2aeb4727c11c75960eb2eb0eada74af
SSDEEP 12288:3VjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T196552392168900F1E9F98039CA764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 56b7780c48a6cc609a1633e44e5507fe2b3719e7fb7bd8f41ea8d3226bd51374
MD5 e3760ac0d7abcb82fcb8a6b2247de54d
SHA1 51e1776137b196a075adda6fc88046ce826023b3
SHA512 edd9b737135221c7c66ebff9483c836016e23cdb8c12c1df3d2b0d8f0eca34f00e7c4b76cf27a194a6317cce579fe13acba624ae03e261f87bbb64cbbd6052d3
SSDEEP 12288:bbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DC5523D3558955B1F6FC0039C6764428F5882E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ca1eddb60efe0bfb02da19a1196b929c906329f66e86b9306c22e48b97789a99
MD5 29ebd28a3637ef9d31b6be4dd737d9bf
SHA1 44bf4792c3bf44c22237dbbd7e7cfb93697fc711
SHA512 15af9f1b2af643c004bbed878c4f68a6e4cb65b6154bd1bbb1e509d7bfe1214c151b845c2cac564dfc877c399d3edf7f4951773d146afa88b98f04209640a549
SSDEEP 12288:bmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1595523D3558955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3ba0a043bd7e494e4f45ea3b0bf8cac65e3f2d2965278a568ecb33ed6395089c
MD5 d15ab5dac697ee9a88c512d1641a06d2
SHA1 40cb64684cea427927fbb2e754eb76f79f4ec85b
SHA512 246266e59f2ba94a89de59bae31d3ff3238cdea828ebb85eda02812af403fe06ac914536efcd6a07f9a1a6d6639eb6ef2325a5f4851fe6461103bae7bb6aeff0
SSDEEP 12288:miiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1645523D3558955B1FAFC003986354428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 8fe955261c37d87798b688cb6417157f9061ae822371d6ee00d67e085ba68690
MD5 23e5811804f20fb9b39dfe97c4f82b80
SHA1 d29a28c6e6332dd2f4df84234b0ba54185fcb7b9
SHA512 ef599dfd32d65d14c6015c3818ff16e07c9920d8f644c90fe17af994ccaf50a9100ffa32ad21a6eaa7aa59a461883809800af432d74d60f5b1f29efb7b4c22a6
SSDEEP 24576:zZM3zFVSOM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zZM3zfgLNiXicJFFRGNzj3
TLSH
T1DD750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1dadf5d5e9bd7e99fbf795bff8637d82650f438d3234867f649a9e6c9ff0ed08
MD5 61ae92f080c749891298e67fcecab53b
SHA1 5c17a9811ec0883488aafca3e96c9193e4c36e79
SHA512 364f3a6e08d598f371aefd5fb04b0c5e5040ff82b5c982f70268957a80380d8abbf0fccbdb5f9dba010c89130ae6d45e8b954b8eceb0582d8260ea3b504afd78
SSDEEP 12288:eliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ep/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1525523D3558955B1FAFC003DC6754428F5882E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6b38fae4a73d48616761df16027edb7d75a24c836ff1805becf9b1615f4e8111
MD5 b2814e805f4268e64a273b5506c52355
SHA1 167738ea549370739097c036d322185aac486bd6
SHA512 c2833491174c096528049bba253a4a350379e3f35946f24d17cebbf3c8f4719c93cfa512db25dabccca76f495a06e3e9a65f3980b7ebe8164e53f56a638fdaa1
SSDEEP 12288:YZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E15523D3558955B1FABC003986754428F5882E2DEB5619E3E3083D1EA27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 dff0be63394e4f11f60e58a7cb385c971feddd053d392f9e6ae360c05277c7ef
MD5 487aeebc650d7548f55477c9bcae88c0
SHA1 9695e7239766a6e344d54a7fa4048b57f99b1351
SHA512 fef93b8f680e79bfa60e2d383ae31774f27300579058600513ea20a45146c9e40e5e93c7f881f3dc668cdc0e95bf3293a03b611751962f5e2facd7c5bc4cf3d1
SSDEEP 24576:jzyY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jjLNiXicJFFRGNzj3
TLSH
T11D650147629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3ee1f6fae2a53d160139bc07b2ebdf98c0f129284983e90eb0bc5dcbb30ea952
MD5 ef3d390a1435a44a0273a84bde065cee
SHA1 4574290e08032e9f0c96099a819bba2cec0f7ae9
SHA512 51cc0256772e12028d169602215f6dc2ef6d9bfb89c69be1cf3655fc0c5f381e78d865a1038b12e97a4c3c8e20a9d32b97a03f62ca103db30f9a6c4980908589
SSDEEP 12288:8liJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EB5523D3558955B1FAFC0039C6354428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 87bab67a0e78a41bab5c000703e23548f4681addd7109420f5e9b5fa11a9923c
MD5 5308e2d217390bcbbd4bc36373221d81
SHA1 c6527c95fe7e86d74fb4dc2b58d0d4c12ed3b4d7
SHA512 e680504bf178b1a22d93e71f831b208db9c8e45ce3bfb96fa496f5e589e949f023bef369af34139d56dcbc363fcc51704df51431e5d64d951fc26461323c38a2
SSDEEP 12288:JliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1755523D3548955B1FAFC003DC6354428F5882E2DEB5659E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 c3d182fbb964b3bcca37945eb6a31ec116e5e697e2ee9f83756216944fa68142
MD5 bfad7f461fc45d58791921e2960e24f1
SHA1 4b7ad14b6691d20cacab610792a56e5f7a507800
SHA512 37cc2836a9c01cba65539b51e3e41214c807644466978db84eb961da967faa1797f9313ec3a377a4806eedd41d9549b1dcf3b29e3b5ac168932d201dcdb64df8
SSDEEP 24576:QzyY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QjLNiXicJFFRGNzj3
TLSH
T120650247729530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 c486cf1be31ef5c591aa207a1c76496994d4795d8095105618df0232374fbd85
MD5 c3095dbacb12fd4742a8cbb6bd89f7ad
SHA1 7084bc2cf1e335ae12f2be720340cacbea11dc48
SHA512 2214eca92df0be30b71ae5b76eb0b094148d069c794b0e3d18986e3b3ab7fdccbfb99f9046aa9a5c9857119f08c5a379d6d1f5631e6f6cd4622042833f20a1c8
SSDEEP 24576:nT8aLl3z0zDm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nT7Llj7LNiXicJFFRGNzj3
TLSH
T15E7502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 d9091e874592810878ca2b8c784d070b54518173cdd9d869eeaf83357fa39b5b
MD5 44f7e02e952e1172b4d4414a1e0ed7f3
SHA1 7041d426f801ccabd25f3f48addc9f26c57224bb
SHA512 b712a78d8bffd76d361f364f57b318f97012b75c6218162302a69f6979a99d03779c94126fa8bd4d03398279301f126881bdea0718672bd210f75e032bdd4b2c
SSDEEP 24576:43rd9CHKy7GZa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Crd9CHKyagLNiXicJFFRGNzj3
TLSH
T1A385CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 bdfcbd0a1d0c270941ded93a248e488e4383ce9a04ac5986250ae31ef70b9c82
MD5 22c02d18e47091a92c1c07c15a59262e
SHA1 8a586049b01b63a1b009103ef71291e0ce259f03
SHA512 5a10401b21c18dfa273c1399826ac7fc97a5b07aed388e8eb4579ddc6caa6879767f393964237b629a5357c590769cb31c1cf34e3a7471523736a16ae2f38b75
SSDEEP 12288:ksiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18B5523D3558955B1FAFC0039C6364428F5881E2DEB5658E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c994adbef2de036e40e0e97ca544a73bd39dabf2b1dfd3f6920ffbce6e05f0c4
MD5 e84b2ea07c94a2d5d040312146aaec8a
SHA1 c38dcaa7b78b962f625b6a299c7c6542e2cecbee
SHA512 dadb95ecdc8315dd7ca7f7c72d81dbd598810e5e4b6b02bd666a5f1a771cfb8932427b4188151ca0d9b17dceb94b7d0de69f1e477abd6320ec85258632f94e5b
SSDEEP 12288:UOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:U4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1575523D2558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a8967f1aae81229a89fa136ba4190f52995f3f5bda3703d2564bdedbbe039ea8
MD5 f7719aea8d74db425400153b2a9ee586
SHA1 14d33820cbe94ec898007c471098f531ddcb18bf
SHA512 1389dd1b6c26f4898973cf43bc5b4383fde685e9915def8a21487ef0ab2136c38765436546d8af80edefb53bf926ba0ffbae2be717825e40dfbf14c3e33ae488
SSDEEP 12288:rHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1995523D3548955B1FAFC0039C6354428F5882E2DEB5659E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a05d664cf2e459c83d7e28456b1a88f6a9e7f2dd6bd505604d848343824be363
MD5 14faf78fe4dd3439dc18181b82d2b0b8
SHA1 689762c7af94a53b2591f1bdef1c462dbebce94f
SHA512 a65f64aab8c37d9d96ddb64190dabe397592c5c4f4a8417c58469cea53980a90d7ac098bbfc48e675804152d92fd1b2543ef3d84e268e08f45db90938f9b1afa
SSDEEP 12288:FliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1805523D3548955B1FAFC003DC6354428F5882E2DEB5619E3E2083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 d64576d147dcf3080692c4a941f225fcbe4d0bf8ae90d73a00762faac8aa13ad
MD5 dcd11bfa612d4ec60dcba7732dfc8492
SHA1 7ea9deb76ba2f7dc1701056a1e017b0bb077f962
SHA512 134396976e3f4b7f834bd832ea6ab3fa87cf79b76dc3ac01eb4fd2bf612cb6670b7b40e04111c6aa75c2756b7598ad336e8fe0ce38d136153371de4fd8ab635c
SSDEEP 12288:HsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C95523D3558955B1F6FC0039C6764428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 1b219c95ef83cf1f1816cd3e5bd6b388665623ffd4b715ccf1c58e87b03b3b3d
MD5 6e392642291c9189cd96de79100d35a0
SHA1 b1b289ec48da81cdae7c0bb1a508836c642c921a
SHA512 66ba163d0e11f52ea994f1b9c98193b4eaf0817f4fd73695a12a1f3f54263613a01d0c07034867234685c9b2f06c72cdc025b80bed26eb73d22fda008248f016
SSDEEP 12288:kdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12E5523D3558955B1EAFC0039C6754428F5882E2DEB5659E3E3083D1EE278FEB8F38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 2e0e1973ccf8a59a3d8a3ddadb6db310b0ecbeac123def418b3ffee98aef2850
MD5 51c97fdce708508d42e750240bedc459
SHA1 756597983ae70f4b1018e5d3460b6a619f34ae9e
SHA512 45c4e6d9e94804a88ae35216063ce6d3235049a8890c0dad811216f838437e8aea54afa5a225073ca69d1424a5f48774237673147b208c805fc03bf6ae582cb5
SSDEEP 12288:9biJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F75523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 ce7f52962f26af0082b2a39889d4cc3f50c82992ca72e743cfa38c78b2397e0d
MD5 2734ac812031935dc17deab8fe00d88d
SHA1 8307f77b5665016da1e2ed146fc326d9d8d80643
SHA512 3eded8c10db64d190e2cfafcbc89d1da3f26d6c398fce5f22fcd8c3cc6ee2749c327544933ef6ab8a8a917c3842bbf3c6e086e085dfd45d24824272c2b06f594
SSDEEP 12288:9UiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C75523D3558955B1EABC003AC6754428F5882E2DEB5659E3E3043D1EA278FEB8F38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 5aafc44cb2766bc7ed8813ed466dfea7738b5215dcf80cd4c9b59dd9a8cdd987
MD5 f8050cf22e09ae32f6ef633924c3e1e5
SHA1 e3654a028fc1e96567cccef658354f5f6b40cc4f
SHA512 80798ca738c63a45a436eeea25695d1fa5668a1faa0200ad2f8c9897238275408f2be956a1663469b2c8da9b9b692ac7ed5dcf3fa5bd8d619139b55c05b7f20c
SSDEEP 12288:SbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1655523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 2234967e80a4e13e1beb50f9ff30ce1af8c4e62144861f3bd31f4e1e4dc600c1
MD5 7746744786cef2f9ab36ca7318a3fda3
SHA1 be09815b52f03c90a041427d3d3ee3bad37c98ee
SHA512 0bdab9a2de6570d75a9554c31dab2372f3ae1ad9b10f055f8100b49892a252ada1fdc44ebd3c55e111342f6d6583bdee04014829fa5e1cb6203868e8a829a2bb
SSDEEP 24576:kfwvzk9RX6wkyAIV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vMnYIVLNiXicJFFRGNzj3
TLSH
T1C385DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1323bcad9645ff62b0eb64c7125ee1b78b86729985394d7d062a3d31e749dd4b
MD5 b125baa987d32596621691b6eb0a827c
SHA1 bca54f9d92a0025c99a672f87a567ee46f5733f6
SHA512 e7717ab4d3213eb774e5f0e80118b3d0d604b2cc0863764257c53ae134dd56e785dbf467cff8e235917be2ba24e44f3a110b6b509cd5f08904136bac53a38717
SSDEEP 49152:qYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0SLNiXicJFFRGN:VySzPa7wRGpj3
TLSH
T143066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8de32521a90d25c5bbcc84ca50610720457a34b8829d781563380104e02215eb
MD5 ff233b924d8aedb7e189ff7298e20952
SHA1 e43064b26286e9b7b80c66a65dfae8b99c6a76bf
SHA512 f70c7f98c6effd2916e63d7e49127742fe4a6b5d7189cd32636883ff571bd15df19b3a76293adf20342a66dc3b262a04a6a02879939edda76d9980144cb36850
SSDEEP 24576:Z47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Z47JUQjqirIhCnDHUPfF/iLNiXicJFFS
TLSH
T1B065AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 844a7256995167aec1d3acbed78d1532ab7559c84395979b1efe75d8c44f7071
MD5 0d1cec7fe00f32d6b34548db430a24c8
SHA1 3c2c9dd45256dda2be10970f224b39871e539d73
SHA512 53c0e7c803f360430acc454eae0592abadbcbf8a4963f83c3215546aa821f49d88b5dc6bec8f96263e66982dfb9d8c937b358dd04bb048cc6a7a0a1158dc67e0
SSDEEP 12288:apsf1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13C65F15AD28802E8D1AE5139C7664900F3673C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 988KB
SHA256 342f001bf8d006d2670b3e36aedbeb9671ce98f12072f7dfb544c8b734a38ef2
MD5 9a41aeab3215978c2fccd466d64faf64
SHA1 ad442058698be972046dc3f87aac1bccbc664a26
SHA512 f479db9b32791a19235a648a2a6e4a04f8c6dd2c92611bca0986fe507cea4441db1617d604f6e35705342e40d59b6098471f3ec98c0341dfd881613cdd5447d7
SSDEEP 12288:Lo0eU3f7t0Y7/g91W/QT2jiVWvTXwhxIJsd1Onwl+Jj:LozUPzY1VWvTAhxIGd8n4+
TLSH
T1F72508007666C74FC6AD90321E36D5CCA7B07D11EE446F0773C88B3F9576A58BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 594390983088037e0f29ba9093a735108a535f6110aac2a527b8dfd8de19b7a1
MD5 693896e2839c45de9aae51544790f9aa
SHA1 0511b26c66244ffe95aea7146003bfea55e9c789
SHA512 751df0ab033e7b613f2471e7a3610c53c2d2a8db8aace4c38c1ffefdca6267d85ebbb07e256327610941e2ecb40dea9f09cea52fe4c2b7b5a085765ca2264a0e
SSDEEP 6144:YAL1/QT2ja+G7GWQ+1CnWy1BfHf/U5+p+eElB3D3JySqtMxfSqtMxwn281Ztt9fm:1/QT2jhj3WyPHf/U5+pwB3Dlzk
TLSH
T15165E8809537A38FD1BA6032072A5B4CB764DC16B7096F23B7C8453AD86BB15A0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0b38e9d37749e8748ec1285058d7b873731f8cf5691fd7a79da1235252ba5ed6
MD5 d88d6458efe1e85103c37bd0ee970338
SHA1 05799f61877ddde12022d19e050974237e957558
SHA512 afb573a7b0654793ce4aeb7d9adba4797e4cd3785f560e0da3e1971af7e4cb756f9fa378a6fa74a8b989a5e7021a2fefc66818daef1a8bd55cf9861df80b72d9
SSDEEP 12288:JF7tiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10F5523A3468D59B1FAFD0039857A8434B54D7E2C9F1594E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0a89810a839f97e4c3580cfc37f61b35be173d5aec27cfb087f1269ebd90070f
MD5 ab97ed30893b2116dd7f6e34d7e798cd
SHA1 fd784272f0c15e21922778d5d5c8b2aaac3228b6
SHA512 8d4d1996a6b4ab5e3d62248886208a5b1d3ae3d23c7fa2f2012fd15d2d13506083e82d2df32d90bb6ce24b65c99ba67b5f52fc8ce5ace0829be002e4b8dcb07e
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bY7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Lgb4mBIBhGFcLNiXicJFFRGNzj3
TLSH
T15265AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 85a95f5110a4c91bb65c6aa46f5a11b432d6913f9975419021a2e6bd56aec857
MD5 1cfafc26234e6fbc96d6f39ab94f3a7e
SHA1 d64512efe88b74bbe0c8f51bde2b984e810fb37f
SHA512 cca0456a255bed061dad4d89ef34697c8791da483ba0a652da3e0579fa9a9618a70a993ae09232eb7160487e7880fb5f93d0fa79e0faa367baa4eeb74c84b711
SSDEEP 24576:zG88u8FpJqH1vzria7/mM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:C7ZFPqVya7/TLNiXicJFFRGNzj3
TLSH
T1CF85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3f72f51853f6f1f6001919cb7318590269a39f364969030e8a28d49f45809d1f
MD5 0b183463b6fda5ae9fe07e26dfb3d286
SHA1 d21768ab3524b3e56319db3ae3bdaf4b5df9bb25
SHA512 15d961309a47c979e585f67e1152a504ca8017838984fcd78bb3681b6acbe892659e5236f7ebab69b70f55e13b641ce3065d9e2e57a89e6eea5c1015afeca03c
SSDEEP 24576:SPUr+NQg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SJQgLNiXicJFFRGNzj3
TLSH
T16065F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 907e2161f1980e5ca1fb59ba46d5bb9ca5c23cb934305a158574a725b3b17627
MD5 c775dc8b9e7cc0115e99f4318ef733bb
SHA1 aa8480e2497da961bc0af3c3cf61679b6da7ca47
SHA512 d7f5297a27b37a5545fa24bc2a175a7da8e7c1192f7083393707a6c305618866874894d71bb4216bb1892b85107037011431e2614443cc5b319b39bbcae1227d
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjQLNiXicJFFRGNzj3:CG05lO43bN7wRGpj3
TLSH
T1CFD5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c4cb6742de5aa40b2ff9fedc5bad22a828e3bc1b098296181718db65e9671f1d
MD5 a6e0c1e602f9e4ed639dcd94e10f7da0
SHA1 a259a27f53849e56482eeb420f7e5b993ba4057e
SHA512 a0fef1f8776ea33e0299d817cef23a188dc48d0635aa7bad9bbb84b1e19a5e1234d106b85c27d0a8d63bcee689ce309e7bb5e147a412a8c2a5930f30ef7b8aed
SSDEEP 24576:1fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnS/TwSfVcYG3K/cJHlnFR+IGNe8jg:Va5POZ3lJt2pasx2+m4LNiXicJFFRGNf
TLSH
T18D65BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ce4de68f5389b2f941925bec1f8dd3f978ae42d5bf0dde64bf4c260df24fc959
MD5 dcde89a08896dda7c320ec6133ab3135
SHA1 2e9a7c4a7de0025de256162b7e3b0d0476f8d143
SHA512 eca02c36b7f3064f08b28d0e5ea26693a0d436c8877a0863236ca6174c057002ddebb474a8a24dea04d579ff85736d92973d408339eb4319d1277611cb6cc6d4
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7FkU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0Nc/zEOVHFzLNiXicJFFRGNzj3
TLSH
T1D8858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8e9658c4d48d451679e2f5b264f56afe37d1dfee57c389149fc3f5a2446024d0
MD5 26a9ed4089624e9d6bd822061c70d346
SHA1 decb8d0814bc4537ac0ecdda423310af8941c390
SHA512 c7dd95914cd1b05f2e20bbc6d37cecc0b6d1f499c1a41dc5b22a010d84ac273d9e602ef95cf56357512ff2dd9734b20a633dda4a98fd299869e75bc3f4ac0fad
SSDEEP 24576:MzkNvNnaFeYhJNtmZBm+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MzMwBtOm+LNiXicJFFRGNzj3
TLSH
T17855AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 cc850daf606b9a097f814821ca32dc34016adc8e1e246f8579baf210e032b08b
MD5 cc8be207c15538ee307fcb5372b2fbae
SHA1 fece31d1ff1b93cfa19cd4c371722692bdb44323
SHA512 b8202c74c6b4228bd5e7f54cb5f92bb663033951fcf8d2d1864307b40e685cf6bd2fbb9e36d8a4bd72cdf79f31316d751d1146bde635fffc77f89cba1f3b9bd8
SSDEEP 24576:JD3FHshBIYQgAd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JDVHeBIAAdLNiXicJFFRGNzj3
TLSH
T1BE75E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2436-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2436-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2436-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2436-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2436-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2616-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2616-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2616-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2616-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2616-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3176-8-0x0000000000D40000-0x0000000000DA6000-memory.dmp

Download

memory/3176-258-0x0000000000400000-0x0000000000624000-memory.dmp

Download

memory/3176-0-0x0000000000400000-0x0000000000624000-memory.dmp

Download

memory/3176-1-0x0000000000D40000-0x0000000000DA6000-memory.dmp

Download

memory/3176-76-0x0000000000400000-0x0000000000624000-memory.dmp

Download

memory/3360-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3360-14-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3360-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3360-20-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3360-87-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3520-101-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3520-340-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3520-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3520-107-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3520-342-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3748-387-0x000001E134BF0000-0x000001E134DBA000-memory.dmp

Download

memory/4796-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4796-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4796-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4796-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4796-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5004-127-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5004-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5004-133-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5004-150-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5004-140-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5056-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5056-53-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5056-59-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5056-176-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5604-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5604-383-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5604-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5604-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5604-89-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5604-95-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5608-122-0x0000000001090000-0x00000000010F0000-memory.dmp

Download

memory/5608-386-0x00000000008F0000-0x0000000000AC2000-memory.dmp

Download

memory/5608-338-0x00000000008F0000-0x0000000000AC2000-memory.dmp

Download

memory/5608-421-0x00000000008F0000-0x0000000000AC2000-memory.dmp

Download

memory/5608-116-0x0000000001090000-0x00000000010F0000-memory.dmp

Download

memory/5608-389-0x00000000008F0000-0x0000000000AC2000-memory.dmp

Download

memory/5608-370-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5608-114-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5720-72-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5720-64-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5720-250-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5720-66-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5916-79-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/5916-83-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/5916-77-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5916-267-0x0000000000400000-0x00000000005EE000-memory.dmp

Download