ce77c73f7167b77f89274d1063680e6c49b6de59f55d3d1754ab46e0b30aa0a8

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
Size 1.3MB
Sample260730-krml2sef28
SHA256 ce77c73f7167b77f89274d1063680e6c49b6de59f55d3d1754ab46e0b30aa0a8
MD5 90d7764743488123713d63c0027a1e29
SHA1 2c66a49698c2487660efd8119728aafa5a67562f
SHA512 2d8f7bf6a6543363ee5d8a940707e34b98ee3ecb1f3eea3d9311ba3c28a9b248672502ae91f66e3a6141afd1577aa73d953648331a74c74a5bf75c71c32827ae
SSDEEP 12288:Ze8CGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:I8CnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T12E5523253812D873E91705B04882C282677F0DB37BF6925BBB742E7DDD792C40AAA35D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5488	elevation_service.exe
5924	elevation_service.exe
4108	maintenanceservice.exe
6828	OSE.EXE
2944	PerceptionSimulationService.exe
5028	perfhost.exe
3752	ReFsDedupSvc.exe
6492	SensorDataService.exe
4208	ssh-agent.exe
4676	AgentService.exe
480	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\923bfb60957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005499447d0020dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000965f197c0020dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c10267d0020dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba60f8bd0020dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d6a22b7d0020dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
5488	elevation_service.exe
5488	elevation_service.exe
5488	elevation_service.exe
5488	elevation_service.exe
5488	elevation_service.exe
5488	elevation_service.exe
5488	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
Token: SeBackupPrivilege	3752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3752	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4676	AgentService.exe
Token: 33	480	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	480	SearchIndexer.exe
Token: SeDebugPrivilege	4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4280	2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	5488	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 480 wrote to memory of 896	480	SearchIndexer.exe	101
PID 480 wrote to memory of 4116	480	SearchIndexer.exe	102
PID 480 wrote to memory of 6268	480	SearchIndexer.exe	104
PID 480 wrote to memory of 4768	480	SearchIndexer.exe	105
PID 480 wrote to memory of 5640	480	SearchIndexer.exe	109
PID 480 wrote to memory of 6960	480	SearchIndexer.exe	110
PID 480 wrote to memory of 1620	480	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_90d7764743488123713d63c0027a1e29_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5924

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4108

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6828

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2944

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5028

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3752

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6492

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4208

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:896
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4768
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3bc639cd07e767fa0f6443b1adf9ed55c5181b2bf916028fbb8a56b011819d97
MD5 9555ff0a9d3185e69ce28559856843ec
SHA1 867c283f71fbc1c993f77c8f0b3b4425361da73f
SHA512 d7907d1d2ecdc53da86f8301630a1f0c33c17c468b3962e8133d6d1d5ef0a547f7c381e3fcddf219a43c85f40548ce2da893bcc88fca1e21e8e6dd1dbb763be7
SSDEEP 49152:bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnSQ/lFTjN4:p3q6HjB+Lm
TLSH
T1D4D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 8552fdfe59af79e3d65ff3bd1b9b61f4c2f5dbe0032d9bc887f743c9b1bb6790
MD5 9d9c8fcf746a01537d5789fe5f05676a
SHA1 9f38078511e6117980aacd5d70942b0763534371
SHA512 9acf05b88353587924e583aaa48d1fdc499019ce3c8e73e50d88d4e6b366dcda3ab71c5051ad61781a185a517d2ff4f56b3fbb5ba20c166f52e5d6762ceb3190
SSDEEP 12288:61XLsswWkxy2lRq2czAFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:QXYfDtczAlnQ/tbw/2Mkjy6Fr7g0on
TLSH
T14E65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 8fd00f8583432bef700aa9c0c04600b542cf56f462924aa0166068b6331975d3
MD5 9f3101e5967b8762dcf89bc63270e4b4
SHA1 fec84b7e08c06a20c1fec672a89d58f30ca42090
SHA512 49afa34290154f0c4296a0446a675b93ef98f29e8384733d5ba313f823fdc8fe0a41e7bee2c4b988bb53f5d2636552ff73254b47a59559f8a760aa6a414238d6
SSDEEP 24576:l0Le5ji0hmxLrM6nQ/tbw/2Mkjy6Fr7g0oN:lPji0AlzQ/lFTjN4
TLSH
T1AC859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6aeae2e48945628ca0fca6ee7eb8f3c7d6c2858adeb393e0835f756093959b5a
MD5 217dd7c2608de76cf105b66bf84dcfc3
SHA1 9e3378d3cacc4bda69ad528f7c127c368e103503
SHA512 f2d6da03cf52b737930ad2ff100beebf02e4120e557940b02f4da5f1929c6825b09e34c1e8e6d9fc0553a156c0d7327410ceae2932b7c94b2ec0051b82de48e6
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWE6q8wyu8nQ/tbw/2Mkjy6Fr7g0oW:e/ezSC6vUzPvxHjyPQ/lFTjN4
TLSH
T1F7755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1fa5ab04f1481958c5f20d6cd9304227ec723d53294155371def5785a1a25a67
MD5 b4f44f6e5e687c99b95bd4aaf9a7fabf
SHA1 ff0b9065236c09888a1a3a6b57aacd8f768ddbc4
SHA512 7943888e3f0f5d2c5bc0757073a77545e04ce113b178e86ac8a1cddeafbec6c5e2a01ba4ba26503de3b9155afa3d53e8c41246dc7119049e70cae642404629fb
SSDEEP 24576:gVbqPb88hv/l+6ZnQ/tbw/2Mkjy6Fr7g0oZ:gVO88hXl+2Q/lFTjN4
TLSH
T1FB559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f8f52fa062a045c416c6d7bdfa2106118c5cf3cb6b799b854b9faf208756a573
MD5 f9eee76d9504ce301239768cc84a21c2
SHA1 fdd5a1752b0b61416d320633a7e08c41e06eb5e5
SHA512 256d7d73f6436de9c44d6a42a8d9fa9bc05b364c4030e9a985a5be26957a3cefc14ff9b0817a8425af66f4b94c43aa92f907c9b5e633d31437e21fe5e279df4c
SSDEEP 12288:uzOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:uzOnQ/tbw/2Mkjy6Fr7g0om
TLSH
T10A5523796A24F897FF2B06B55CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 e2d57a304d0735d6c798affd9803511f3b7f52943e014d78acc65c8bc9c71b1d
MD5 007df1e6f10fa4607394dd3ede31b8f8
SHA1 03fd851f8cf407f63d90da22c654be6c635dae20
SHA512 ed96d851bbf31daaf59cb825b2dfc58b1c3395e3ee4ba2d9ccf2219dc8c6824a8b71747dfad376aad85f7df8011236fa14d1730968c8f506d7f221ef7cfba0bc
SSDEEP 12288:ieBNUbTVO86UxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:iJIUBnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T11975CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 33c0722fed0922b603e983622af7b0db0c72e8b821db994a7ebb5eba9659d432
MD5 072e4839e537647a1b7bee444215a29d
SHA1 7ee3a7753f6a0b486987dbc711b2ab38e9d1287e
SHA512 8068f8a4da0313959b067f7ba5fa9a5ad77c19498d2924fc7057c69c7a5e1508c9e36071fa33a03bba2bb676f285642c921790fc6ce8d1e37a30bbb0f7a16b64
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THZ:0QvGAdlCEL8c/yRNw5CvLm
TLSH
T152267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 020fb67c19154f2595f0617b9e72318c9bdb0fc48620dc888544314b31d4d537
MD5 215173e77fcf07b7f5206108bbcad82d
SHA1 6f1b5968844b7f716b67af99ebae09bea33b5fed
SHA512 7f9ba13d4f73909012b3188d89ebd2bc26e43bc240c2ea60836ce13797aaefe082261b45b8d1c4fd4678f1e98c8cad0f9ba25163578a377c2f3a4855d4645642
SSDEEP 12288:/AwSfxL/2Dc39DLLmt0LDQewsAjTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgU:IQewsAjDnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1E275E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 26ea496d9502d3cff8e84239095e2b45c3b500d1f8190bdc18b856ad100529ea
MD5 e08c7c1c71e45681d16ce360e9fece4d
SHA1 3a6258b797307add8a224828e49669d8e9c81523
SHA512 c5c6491ad85b2d111527ee468040d1709e9fed88ca49c66184d13ba24e7bce568f9760aebaa90decfa76d35d38740500bd57f241a41bb6c4de1c34775e16503f
SSDEEP 196608:+UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHwL:+UEtQevvqc2W1cpV2EI32
TLSH
T183474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dd095526a3d2bae410265a6b73378ff536883e7e45455d3814f2744ab59ebb12
MD5 70391710791eb2ced4684019385da465
SHA1 17537c1a86a1b08ed815a63b57e5066f42cea638
SHA512 4a761742c65e331241f6e25ca91285f9bcd7e47f8bc76c8002015b81630c9e442a34a51395134f72e6e8f78ed155f335b4e9cdef1a817ba4907b9a6a5d449e40
SSDEEP 49152:6CbRquA/m2yL5zQfFiV+XenmE3/zjQ/lFTjN4:PoqtVjnm7Lm
TLSH
T13ED58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 099244fbc587d1315296c83831a7cc16655596e8392be2bb9f701c7976e6cb04
MD5 176b7c56f4baaa4016efe5f96d754a11
SHA1 31458d7d557f000f1e1480e7c8ae6a3dc5fdcde7
SHA512 1192c99406622fe40a4b278eea83d80aa922b00cfcff8f3466cf5f9351ef76caa85ee3ac036a5b76ef664086b50fabf8c31c37e0dea98ab5d41d2cdd517b331c
SSDEEP 24576:1AhGLJIFoiwtA5l7S534nQ/tbw/2Mkjy6Fr7g0ov:1AMyFoiq5oQ/lFTjN4
TLSH
T10935AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 3bfa10455c0c8c37e50452360159fb95b95d124474f6687b1ebdf7c0f4968af2
MD5 81f50fbdbba69189d3635dec71253038
SHA1 8d06f8cfc60161e8f3fe794566fb0abfaf304b22
SHA512 a537ac88ce2ad25b3e274eed5af806aef325edefe71fe4a23e4fae29c9f8aea928a375e56f41d8ca1a40f943924d2d70b1a6d5c4702d1da6968ef7fbc94b2afa
SSDEEP 12288:Pmw5HEjsChN2BFgl0WDm+CcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM5:uwuHOWvnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T14265F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 303b37785d4e80fb87fc1366797823c6353d7ad18f7697eafdca920f9c25b670
MD5 ee054fdaa80b2482f1de8115263fe78b
SHA1 a6ba03d6399186ff16f6053e7381a1c8b59409f4
SHA512 93980e9aef077151b2ed189fce60048337c2507b3cfa3e5ef08e8f31130786e0a0410dd4b74775e26e3cb8846d4061e8363029896d938ea58f52582849043123
SSDEEP 12288:EXZ1IyjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:EZuinQ/tbw/2Mkjy6Fr7g0oC
TLSH
T17055126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5a794c28921302df477d68d66bbe4c98f55a87fa0b3d8dbca6a97ae6d28437ae
MD5 532d0ab39e09383f4c4daba53308ec40
SHA1 06b92f04c9a6b1580b6d82ca56ecea4d156a573a
SHA512 87e6c834c6db9066dae02c70e455e07c870fd4cb258e39d32f16ffae4587e9248ffd2e1adb052d8c25150f9eeb446e9c47e1b7c9bd953ff5295f63b95f37bed2
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U1:DQRQyi36YOcPQLvw2gAf+PN3iLm
TLSH
T17B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e7853ca50fb8c7f2443d1eb17302cdd57aa9aecfbe82833997e0a265e5e566c5
MD5 1ca5231a8ee5f483063ba467ae6ccdde
SHA1 2475ba7aecf03d8b941b4f48e3363992cea1fdcc
SHA512 d5a5422683d68ad26de96b591e0c1f45e0310b9900b9da37cc53fde64cda0a6f7ac05275eae60c8b4af637f57e34bab139f588671107ba30c5e1309f821b2226
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U1:rQRQyi36YOcPQLvw2gAf+PN3iLm
TLSH
T148667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9871fb34a75750de1c9fdfd04952e080dda52a14f6f27cba057392a3ed68815c
MD5 c36c7c52ea4230b1b3b746ff613439b4
SHA1 0278088d941b41af0dd2a6372ded4443ce30e716
SHA512 7c983f1a3fa4baf8a0f8ca4a24916410f96a303212bd0793e78558997db182fcd2359815c6e523dfb3e37d51219a7b0378632936d1b45125e604c2493c136b73
SSDEEP 24576:XwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0SnQ/tbw/2Mkjy6n:f68Qg55nhheWu7PNU3/zQ/lFTjN4
TLSH
T101B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6ff1b2a6901eaa18f52c7e77fa06c58961ab55c0e8e48411566d0f40a5898dc3
MD5 59278f7c412b5bf76af60c65b905e781
SHA1 b9ed1695aab9c40858e4417063e871a9fdd78b1d
SHA512 a2e7683f0c40712cb7ca4f10385b68a1a3d6c5a11668f35e1a4bccb4c9d2a0232cd0982f9c1e7c0678a649ac0935a067f1a0df65d61af967d1440dd54e2971cd
SSDEEP 49152:a3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99b:Ly5112gYy5azzVvL69nLKnhZpLm
TLSH
T1FD167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 861070055a97052ab7aa429b288dd8b94f6d887d34b5c9f4dc387547f8fe60cf
MD5 f09bb0e2574d3e2268c5f6a07d1cc8d5
SHA1 c5c4a4bb3a9f375b1643638fa363b83e014fc799
SHA512 6f5416394e65f3546622e3cdd491df7be1c0803e972d1f586b84edcca6cc536f329f9f57eda9965369b9317a9e24546bdc950f5f6e797ded98a89012de00f91b
SSDEEP 49152:BB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glVQ/lFTjN4:Xu6JmVxd2d6Lm
TLSH
T15DD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 824e62851e81935fee4afa2109a5f5982a84323d4912eb3258e081c4c440a647
MD5 bc07b983964cecc794d0001166784c1a
SHA1 bdb49d7bb1e09d74a08a5dbf9d37f7d259c356b6
SHA512 d624e572f381b4166ec54e5d5bbfcf9d07802ed8f9f43fca229b48fe8d63609ab984da4d9701d913c175240f1c8de26a339c6858f85945bbc613dc42206ae8de
SSDEEP 49152:h1hpsNoJpF1A6UU44CwH7R4xhQ/lFTjN4:hmifPbR7Lm
TLSH
T1BDB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5c0ef2b926d32044e5baed6c5f1555f25f85a87d886a4749245406d46b8a098c
MD5 0347c0f73cd51a538977cbd0717e832b
SHA1 7dbe3553592fae61fe5c609f7cc6fb8cb53a1fed
SHA512 26d9bfcfbf29345668f224af6e27605e966971d852cc5fbd89b75901be8a582a62c36a5125391ea00a326b02d4609c6e87c463687c0a72ed3dbbc68f1b92a181
SSDEEP 49152:rSuZQIY0Be2KRRVtOnks6NMHqiQ/lFTjN4:55dKTi61tLm
TLSH
T10CC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4105058f1eaaebe33e860e7c5cdec6fc4a5efeca062d79d79321a63fbd0d361c
MD5 b7a9700da20ea0d9c5e1e31ebec503e4
SHA1 c2a04d33823392e9482822d01cee4b8d675b8eab
SHA512 291a3089d4a7fddca30be94fe8198839534990cd9970dbad1f5677e95cac79ea89513ccbb38c91f804f0904ca0d0fd96ceb9aaa732e6339c29d3877c050f5262
SSDEEP 49152:chtSn8EApI0figngiDn0AP5wlQ/lFTjN4:dX2iyphXLm
TLSH
T12895BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 dfc28c964e61d47edfe5b3660d385a8d4c0d5ddb441881c99e33a53095313224
MD5 c23d960b443fa4ff987b8c0c86600753
SHA1 31c89ffa96151365fde0c6d79e870825aea5a976
SHA512 3789f8882b35fa1505287a507fe68ecc9b440fd4040d5406b4f10df8caa0394f0e0532ab086da1319f98165e447ffdf4139a9d64e69681fe3de8db4aa1f828e6
SSDEEP 12288:mWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWcP:m2nQ/tbw/2Mkjy6Fr7g0ocP
TLSH
T1B65523697965F98BFB1706F188828182A73F0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8bc0670d6ff5ea4b364c8a7f1231eb0bba33a4ef97a4f6626130bd487eed883e
MD5 3d8f2798b47a202b5f15dd008d2b9448
SHA1 a5d49efee6499c22c8e944b5a33ba06cd647561f
SHA512 667bca8825abf1ee393b21fbb35dbe1c66ed744739c023bcfd24893ad08b7a60db1a6c9933f5d7e2fd606062d448db4b1acf52d2dfc0508bf4bc7d0c370a85f3
SSDEEP 12288:8HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:8nnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T18D5523797965F98BFB1706F148828182973B0EC6BFD1A38F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 86891ae90030e7a2862c57b13ea0352869fa0cecd20215236594030a65d5a9d7
MD5 7d89f5cde5f1258cb6336a96a7dc791d
SHA1 8c43dee4c107bf84ce15247d231bb8fcd05acfb4
SHA512 0f1588ff8c12fc175790c579933df7ab106cd09ea9081cd83a0d98f530f8209d211e7dc762d3c9ec32ee149ce66cec44b16547c7e1bfdba7ca2829c5d1c9ce50
SSDEEP 12288:/5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:/JnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1D45523697965F98BFB1706F148828182977B0EC6BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 73d7daf5400ffbc6a2a651737904ea3430ca0afe376af33e6a15655e6cfba486
MD5 a7c13f311cbfae46b87e2ae20678b89b
SHA1 1b4636669fc0137445022e818e0092f9e6f54550
SHA512 a3af2d4fce6de2a318bfd05322ad1bce48cbd373aa4c03bfbd7fe20904e335f3f61c28ae511e52866c94e25d33e0c82609c97e4a8e72b409d58ca95508949be1
SSDEEP 12288:BVYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:MnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T11B5523693B69F4C7FD2742B4CC928142E77B3DC6BBA1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9964a6753bf5a645933c95aecf89382e16f80e825d272d11d197dbeec5d58d6e
MD5 aa32e6df1f7d1831961b5fd2af50098c
SHA1 b97065b0e543cd44464270bc3f81e7f50a83d880
SHA512 e1897fef0f095b3abc0e2af036f58d73376bedaaf5aad00e900e13c7a7c06f4def39e901e0b3df82844b7fdb8a015ed320c497a30918b219e3c1b4ac2c2e268f
SSDEEP 12288:rwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:rQnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1BC5523697965F98BFA1706F14C828182973B0EC7BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ace22b243bb636af537c84ebf7574611c128163602685340c3ed4e2f77aca8ea
MD5 c2af553d21c32f248b3b082c52a31c70
SHA1 f34ba4c381fad33977d3e916e41b087e441197d6
SHA512 e70d10ee0ab310b2b7b7d174df6d22c4e3634769511d4655110858467681846cda5e2883495758bf498a93a37cb078bcc2481c141ff8e8a01a87ebf301189fa9
SSDEEP 12288:4bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:4LnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1E45523697965F98BFB1706F14C828182973B0EC7BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 201b711e46952576f094403dd7abd4651ff133f2127530e08528d78ac045f7fc
MD5 f551e1d7e80776a7047e00e5546438f9
SHA1 da08c089d300f4c4a1d89ce442ccd9eca1918855
SHA512 bf33b687a28f728b476615f8a60714b3126c250eed7a70a9e45dce0896b4e118b796139fc1c6ad4d627b515223ecde43c097b77a7a0ba4912e7f5c738e464ed1
SSDEEP 12288:b/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:bfnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T14A5523797964F98BFB2706F14C828182973B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 1e5ded2d5b5eee0b280285bfba4f77bb15a4aa8fd20448fecb6b73166b2532d6
MD5 821ad9b2b9e8b7d2e58c0d20076fbd36
SHA1 5b70a48362424d3804b8a3215804eb189e032710
SHA512 134ff7e3b42c7b65f94a18f9c73aef4f62f919322e0d8a3e526e7dd1b0f000ec89ed43a6c4a37b9641193ed3d7acc5e59758867798fb59fdc40d3c5edf0ef51f
SSDEEP 12288:TiZwbDzzFEoS2cPvynGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:+ZM3zFVSOHnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1907501A5B35058F9EC67827ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9649cecddcca6b5e800eb82891cc59042723caef88b6539989e3221966fe7b70
MD5 5ccc02a5907302154539a89a974025c0
SHA1 d7d8d550b2c274987cb283cf5922d4231641c9d7
SHA512 280f22565a7505faacfbcc10f12bca320071369f7788e169db63382185936350118bf9791e18dcaf8071a3262796c35d4634a56a401b1b442d61c0698010c092
SSDEEP 12288:VyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:VynQ/tbw/2Mkjy6Fr7g0og
TLSH
T14B5523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a45451352c1f575add03722d5333a8c9d54e3a9f7397bd742bb31db2e898b827
MD5 c4c749dd2af426647088b775859ac8e7
SHA1 9a5c8f0b37b06f82187d14ed65de5135a5570deb
SHA512 3d9f91387ea0c72a59cbc6a1b856f9bbde1bf621b2778404e9d67766eadfc71dd87e45189b1a934d018c782ea2016b9264711609e1caeed4e3be6934202e55bd
SSDEEP 12288:LeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:LenQ/tbw/2Mkjy6Fr7g0og
TLSH
T1755523697964F98BFB1706F1488281869B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 7138f86494ac14346b955a527a22ec8350263948bf59c9ba8253338add5e853f
MD5 2800767d28e5dd10775dcb56c9e7b703
SHA1 8e801e85ce21e20e36c4f2e5f5a533a49a79704b
SHA512 8bdde2e52920fa7d09901160fd17ab872de60d9caef27f7b090ebbfbf2793e7f58c60e1349b6f4ae0bc08285d250ce5ffc628679d012339389b7a5404009eab4
SSDEEP 12288:kyPz5L8jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:9zyTnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1F965021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 fe988fcb118ca499d9c83b5ae16912f4e50edebaef8cc33dc4bee6a22ad21fd1
MD5 a2f00dfa380ff0dbd6473bc2b83ad459
SHA1 759c74bc3f4f0ded12c93809d6e6fbd49aa0418c
SHA512 2ed5cdef00161df69f4579a2a3b7b684b526107c84bf060bd9f86b9c6a53dc94f1eb53bf65a8847fbbca4023c8bc8e95bc05dfc6e484d94a250cc176c98eafe8
SSDEEP 12288:+yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:+ynQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1745523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1a11a2e15c9dfa2eb8fd6a9ff79af3105e1a877ce65b0df8e58e825500be1b4b
MD5 6d369ef34805e3a241b23519abaceaa9
SHA1 dea48b8b271714b5858ae3e3083d118487d28717
SHA512 82a7a52a1a2a31554f995ac22d691356965f894141bb3c8e7b08adab6574a06c250bf73affd2e8b09255b2ed50e2ca52533932b6e9a89b8ece0416165a5d27b9
SSDEEP 12288:ryGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:rynQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1075523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 6d5e07a7ac26b4b55c4349daef22a7c03f4ef70efa1b53b0883c7e31ecad38e4
MD5 ef17849dfc6d70457f573ab1b4a32cf9
SHA1 c6d23315d31658763bef5e57540af3f61d44b564
SHA512 fd527c0a343ac8a9abea3b430804fa30dd37c39c08d5913f6ef9152c88909a95e40c15bc33366815c218d9d0b9ab6eea936b4459b06c1557bf2407ed5c3b316a
SSDEEP 12288:QyPz5L8jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:hzyTnQ/tbw/2Mkjy6Fr7g0or
TLSH
T16E65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 b507bc779a38e12c2d8ad67d4383fb38995e6506c7f8587140d82a995abf9c62
MD5 4ba3dc3a12537ac7ce88678847224f54
SHA1 0038a6fafee39ddc68db29a93824ff68038da99a
SHA512 a8a96164e541be32b8898ce0033c5b5e6386d5e76c9b7df21b099a2b744f99366f8e03aed0a70fb4fa12a28ed1a61710ee59a3c4ae201517b991bf021d3b2592
SSDEEP 24576:jT0aLl3z0zD5nQ/tbw/2Mkjy6Fr7g0oH:jTDLlj8Q/lFTjN4
TLSH
T14E7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 01110c87bbbd8d82df9fc8e5554b9dd0c9fb923debe116eb91a67c63d58bd7f5
MD5 da01c0cc75b79820a24cdcd077456d55
SHA1 152fd004123690488a52fb2ca70b9611f68ea5f5
SHA512 b6402ed7010af321409aa805c05019b7ca05ef3a8a09bc78063288c68b5ad0e108ffdafcfde6006a17f9c146aec6af281758134886d9e9cdcd8d6614d2172a44
SSDEEP 24576:831d9CHKy7GZNnQ/tbw/2Mkjy6Fr7g0ou:m1d9CHKyabQ/lFTjN4
TLSH
T18085CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d9a9dbbf4d64a9a0f0ad5793e58245a93a974fa101c9b80b953a0a36219d4636
MD5 d459f1dbdd5980f35a88f162940e9677
SHA1 2534ecd01e74f3cee4bbbe1e99a7f5bffabdd90d
SHA512 a81673e2fb856c5b75bb6fe7d5ccc8e7f453bf732505bc7a5b496f93716168bcb8164188d06fa7742e8ceefafed1808f0b4ec457ec36fa37ba0c218be8972149
SSDEEP 12288:KZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:KpnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T11A5523697925F98BFB1706F148828182977B0EC7BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 12f61a59aa1461cab78ef451cbafebbf97882385e1e8df8a3ff24d267edd84a0
MD5 73081a693f4ecd2078613c5b6f1abed4
SHA1 18e0b522f09ad074284d5545aa8632b97b9a166e
SHA512 347f6971a36cc1826f659a4646b98dd287ff0d440c746768f133d536ab8b953e1d71fcb4e68270d93410f88a1be5336e0df058804b96f1f9045176a83156943f
SSDEEP 12288:qDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:qznQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1855523783964F99BFA2B06F158828182973B0EC6BFD1938F7B481129967D39406CB3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7603c561a042786d0391e443b98536d130a4be445aba9d75ab593790a1565760
MD5 838f0cf427908f4d9f33d33a498f7ba6
SHA1 c338379fbcc0b0aaef54592bb93fdbece6783eb3
SHA512 03ee1e1fe659514ca70310dc6d2598db2722ea8abc6cf667a2d9ad252ab14fa549daef7070de767519da15685dcd076ff8c64c6be2199ab202b154fc7dc1e207
SSDEEP 12288:mUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:m0nQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1285523697965F98BFB1706F5488281829B3B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f2bda11e91c98f9f59304f29f247587dc882cc4dc7d6e0fa01796c2cd63a5cb6
MD5 e87c739315e1bc50c9be0e7dc23119eb
SHA1 9974b243594211b6a3a41b0eca08e6dcbbbd1aed
SHA512 0b88744d12c89785d214d2e7dabc9f8347257ceef7ddaf33f0551baec3df87f588ca77c9b61fbd7509dfd66bb3b357eefae3ac1006e634e42b464db7173e14f8
SSDEEP 12288:ayGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:aynQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1135523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 fa45eb1592e229edfee403d5bdbc319d7af9295895444bb3f573031b9d890300
MD5 0fa10b0aba15954d5d9e186a6eaec413
SHA1 bbc8824f29ca06f35a9d41c135bb6a2853ae4b7a
SHA512 b66f229a2372feae10e72c6affc37ba1b4b6740df3d2cb01d45194ad5b988ae6ddc498fe8997b4e0ea62e940b217ed08a89c4daaff36bab12e70aa7378339b9f
SSDEEP 12288:HZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:HpnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1D35523697925F98BFA1706F148828182977B0EC7BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d4fbb5f5104919987a2bd8f124986cca96958bbc166093d33aa3ae2bea14b138
MD5 45af44a39b69c578640b4a18d4ea293a
SHA1 5ef4e1f9ccd9d931acfa2ba22ab4148a97e28b33
SHA512 506074d52ad5fda6d088d229151405a63bbe6ba2c6e119eb2ca6ab4277f39eed26270c8e2b882ab7081edb5c295feefd8cf06cb61f23e6fc9a46f55128823166
SSDEEP 12288:2qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:2qnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1115523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 00504e091407793d1592adf5d90b384ed1ee383651ed9ba2572518caad236c67
MD5 5afe2a6e2100b3a380d7e5705d52b9f9
SHA1 c5d152fe7543733d83f5e10f175522454665662b
SHA512 4e79a5d67883675a4e5b69de42ff8d96d448a4697b376256b8181307c73c2d43efbfbe96c174e28a250791e3cde9be765c73c7a40f86477e89d5d750489ba1ef
SSDEEP 12288:5wGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:5QnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1C45523697965F98BFB1706F1488281829B3B0EC7BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 bf3de685096b864615a9539509fdf1dbb7edb5fe59bb01285e8762e915688ad0
MD5 f822afe0846a8f1de329fd403f9b30f3
SHA1 97249807c9a0c5ec6d420bd1f77bca9f17395372
SHA512 0212e8a46f8af2417d25b487cc4b0bc0df0e69a0867c3b5b56c6a9b7a3b0fa75b17abb636189934f7b23828cf9189ad7e42a986382c78bbb5e6e6aed461d2078
SSDEEP 24576:Gfwv/k9RX6wkyAIunQ/tbw/2Mkjy6Fr7g0oY:dMnYIuQ/lFTjN4
TLSH
T17585DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c18fe0dfbc1858877e5d326351acf859e15720cfca04f41a6bd38a0e3c449a87
MD5 a2e22eda15a6ffa4cf2d5803a3c0904c
SHA1 97da1ad30234357c2a2c39ca5153956ebec1c615
SHA512 4f6bfffa631d737db2dfb3dcacaceaef44d2821e0bdd7f84068331a329a452ecb5423f7e6d6bccede63f87c00c57a22f742642c0d53c256c0700d0cf3ff1646c
SSDEEP 49152:fYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0FQ/lFTjN4:bySzPCLm
TLSH
T1E2066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 134a1236a34cd83a4eaa2673e137a89fb5d805fddb219f23a12c94b470adb61c
MD5 4b1d0c8b748844439f471e57ca1b940d
SHA1 a66d69e64c99a142e68e838048c111650d17ab7f
SHA512 1d5c4200d6218c4159b01b410e639c97a23f08dbbd50575868e29b8156e4b6fae1064420db174829e166cebb702ca2abbcdfc1a07b65db4f995a8b1ae0215ca9
SSDEEP 24576:+47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYXnQ/tbw/2Mkjy6Fr7g0oX:+47JUQj1irIhCnDHUPfF/VQ/lFTjN4
TLSH
T13365AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a9110c385e420428add7fdea9ef6d1d34b71a8cbca617e8078f641b7a768e72f
MD5 835cdcd8216b7059e9f4afc0593c81bf
SHA1 67e6ab7a85d553f68f2eceb6c76167aa6d583ab4
SHA512 3d9bc10e54b1fbd4b64ec772ba0a9a476f9f50eab7382eb5adb0863289754621514d54407d69074166981079ab1f024428fc2fa05c11ac1a5386a40c45af28a4
SSDEEP 12288:kssfiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:KinQ/tbw/2Mkjy6Fr7g0op
TLSH
T13865F119E29852E9D02E5275CB828A41B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b3beea23b39463fae40577284d660b71cd035ae4aeb6f41ff697dd08a716a92b
MD5 d73b9e948480db77aff2a944d22a922a
SHA1 32cd4d546a08dc428fdbd16dab2c4d2ea3cdcb92
SHA512 f5ca973624f4cdc4e10871098b390938e2535defc6f9f52841a16b4f0717aeb3ba27ff8049515d9d9a93d54081c6007fdc3b0435609094fb989297cc67e57bbd
SSDEEP 12288:L/BC8U3fdUS28XNeLc0fxUdzY9qG1KIaDMC2RzzIsFWuKjBUOf:L/s8UPE8XNeLc0fMI5KJMCQz8eW/Nrf
TLSH
T1F3352850766AC74FC6A940321E32D5CCA7707D01EE45AF0773C88B3FD576668BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 5fa58f11f0dd93df0e165a6aa367a71758787967dd1c7f038269578c8f82b293
MD5 5744916aecaca3ec18d428b13390d1a4
SHA1 a41c18831e2ac218eea5323015258a1a8af22663
SHA512 7f5cc52e056d45a82f5169a4fedda77db5f2660a4d4cda64012ffaffb2a6bc90f588df460bbc243e29101175c1b145765690384ba75fc8077a70869d39a428eb
SSDEEP 12288:7bHgf40b5RoQ2OqaKwD33G+KZuNeLc0op8N8ZNeLcxOeeSEnpaD6Y:nHY4evdNeLc0a8N8ZNeLcx1ypbY
TLSH
T173751A816137E38FD1FA5032073A6B4CA764EC06B7496F1673C8487AD82A725B4F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a4dfa393ce05997d21023d3b42c55dc9b94f6a3e4b743ab360a789c2d4952db7
MD5 50a5506b00546bef9b3dc1eaf75f2223
SHA1 50192eef948012638c7604d1ed1bbb4e83ef1f73
SHA512 273083040faab0d3e2e4d6ca756f3ca500812cc04769e03fa378c27e027207e39de3dde4a88e584579bf4fa1d42a2b3291974426af9e8f58b1dddee8a751af98
SSDEEP 12288:t67aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:kanQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1795523696668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d44b380c7064a2e48818d80094f6ac7524fe227518e7849ce6d0c63aabf60f02
MD5 428ea75c1b5fc152d823a9c75c57c290
SHA1 2da634efdf918393fe714afb55f75a07a6ce1c50
SHA512 ce73eb030a274c2fcf5b06826e947118ec0a1e0e010338b56cbe0a6e6af6f7987bd20c262fc0bdb99dcefd79e73b021689ba6eb0b9a515f735ff6e17e8b79167
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bY8nQ/tbw/2Mkjy6Fr7g0oe:Wgb4mBIBhGFXQ/lFTjN4
TLSH
T11965AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 8282170b925b1ca3095664063a2a452b4314e8c5c6ff010cf07ebd48eddcff5f
MD5 7b7d0ce9d60b166aacf0e86db3e4f131
SHA1 47e14fd9e88877e34c7e4dcd57ba6dfefd1a0cd8
SHA512 815cc2152a3230e812882fe5d648cf4f9ab1e589069af3a18b692c5d5eca3ddf7c506f5651849ebba24137b540e6e07016d705ed1bb88c4ba205287aff9869cf
SSDEEP 24576:LG88u8FpJqH1Qzria7/mHnQ/tbw/2Mkjy6Fr7g0oi:K7ZFPqVva7/UQ/lFTjN4
TLSH
T14F85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 576ef57734547bfe16f7a3cb3206bbb8bf382da3cc11311cca5876674d1b4144
MD5 cc23596c54bde34c605e21cf5bf4a316
SHA1 dcd0f140a8e6e579906469c6cb8ca9edbaeaa445
SHA512 9c5abd422f3b987bab934ce8b5a3e7ab46fa1f9d8e2ffe0848766dd853be9be1d9b7582b2b5c609d95a45560cf6c169f89a14ec707914d4c336f9d91e1eeeea3
SSDEEP 12288:hHvUrBFrEjwaQrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:hPUr+NQbnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T14A65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 735f378b38aedaa1618127cf27bf567665070b6b07ee4a349ff7df288c643eb7
MD5 d5ced9ed2fb47830665c9f2641c3e2fa
SHA1 ae03874413da7856b800dac05b9c2e82ae55bdac
SHA512 e73bc3bcbd6c7a9e1b9c7274843408aefedd48bce6bd3bdfd49086477767eec47f897e8c5db2741a533ad84850b7007f2e85c7d96e489a5205c1a66af84b9133
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjLQ/lFTjN4:hG05lO43bRLm
TLSH
T1B0D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5dd71532a8f16cbf9f7dda276618c046eab889831dbd7c7afa8392bc006d4823
MD5 7320bb7ecc4f642f258dd67a5e195831
SHA1 9f0f241dea06a9009ad85e1a2f449c6e599284f6
SHA512 38406dad7b78e08c9a8f5f054c37c54cb52cc1289fbd1f5cf7a6282ea0ac8b588c35b776e9f259b1612c7f5a1226173460738aa9f75f63f0257f1054481d0497
SSDEEP 24576:0fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnFnQ/tbw/2Mkjy6Fr7g0o8:sa5POZ3+Jt2pasx2+mzQ/lFTjN4
TLSH
T1D365AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9c8b758f359bdbe47cbdfb6e78c68922ec4fb95ceadc86312ba53b3c6e8c766e
MD5 5a4f706e1156526fcaf07d35830e844b
SHA1 6bd78176d5da9a256979d222d4640fce3638f440
SHA512 0cfac6e84a833fe5ffba1ddf6f3efb4a3b8beb832644b15150cf762fcd344788acb158f89f6cd55267c4f4d912c25989656e773cc7e023f7274630f2c527b3de
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkPnQ/tbw/2Mkjy6Fr7g0oJ:1Nc/zEOVHF0Q/lFTjN4
TLSH
T101858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 72eb83a168de7549bba486c598f6b503fc03761cdf0828bb6490256cdebb9c77
MD5 e85bc1489c031e18f5508afdb7787c67
SHA1 a8bb52103919f75c531e2c3bfc58047b0e56b5af
SHA512 a3374169f4d664251c93177a5e282d15ce9f9531adca886407f56cfcba91414c93541a933774e945a8a562674738a91671e25ad7a2808d49acfc771c0f432cfc
SSDEEP 24576:48kNvNnaFeYhJNtmZBmRnQ/tbw/2Mkjy6Fr7g0ow:48MwBtOmRQ/lFTjN4
TLSH
T13A55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0ea671a30338def8fb144d228f9a220b991f1c1f6842f9a468760fb32c19afcb
MD5 ba02a0fb5fcd4ae3f5754a56d397cfe0
SHA1 ce5e07c729a437c5fdce1fa89b7197eb0fc69c94
SHA512 23d8f83069c9e2cf4713b89c8c9e101c49e46cd96ea81d788b1d7ef789017c854c3f83b1addac5d82d1786464d0ad29c5a321686c3ee9680f6723e3ea3962616
SSDEEP 24576:xD3FHshBIYQgAWnQ/tbw/2Mkjy6Fr7g0oE:xDVHeBIAAWQ/lFTjN4
TLSH
T14775E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/480-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/480-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/480-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/480-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2944-308-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2944-67-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2944-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2944-73-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3752-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3752-326-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3752-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3752-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3752-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3752-95-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4108-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4108-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4108-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4108-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4108-44-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4108-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4208-123-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4208-114-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4208-121-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4280-0-0x0000000000400000-0x0000000000551000-memory.dmp

Download

memory/4280-77-0x0000000000400000-0x0000000000551000-memory.dmp

Download

memory/4280-7-0x0000000002400000-0x0000000002466000-memory.dmp

Download

memory/4280-6-0x0000000002400000-0x0000000002466000-memory.dmp

Download

memory/4280-1-0x0000000002400000-0x0000000002466000-memory.dmp

Download

memory/4676-135-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4676-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4676-127-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4676-133-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4676-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5028-79-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/5028-309-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5028-84-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/5028-78-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5488-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5488-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5488-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5488-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5924-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5924-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5924-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5924-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6492-312-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/6492-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6492-102-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/6492-108-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/6492-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6492-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6828-55-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6828-304-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/6828-61-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6828-54-0x0000000140000000-0x000000014017A000-memory.dmp

Download