b46b6b32b911c1774dfb981cec5c362621aa8e4c9cd893d5e72b7b8789c9a88d

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
Size 758KB
Sample260802-3fl59atdmb
SHA256 b46b6b32b911c1774dfb981cec5c362621aa8e4c9cd893d5e72b7b8789c9a88d
MD5 ed30a8ae2fe19f9fabdd197c3cf30771
SHA1 a51ee0e52740a7dd8617b138577fbe67ee6376e8
SHA512 a7439984cd57cdb1f78de6519b98f5357348a4ee1905e1addda8fec8ff39d1f32d544ad1ac657898dc8b47f6c8b60ee86e3e35dea60c172030ea4dcdea7c7df1
SSDEEP 12288:VJFMV/esbTD2wnZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAK:VJFd0Tqwnj9FWM170KLX1GbKIaFzErnr
TLSH
T1FAF4023072C1C1B2C02221318571C3F28E7B7D766665A98BABCB5FB94F356D2DB25788
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5012	elevation_service.exe
5504	elevation_service.exe
5684	maintenanceservice.exe
1336	OSE.EXE
1564	PerceptionSimulationService.exe
752	perfhost.exe
1536	ReFsDedupSvc.exe
696	SensorDataService.exe
1828	ssh-agent.exe
2360	AgentService.exe
2800	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8ddff366238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eac2bdc7d622dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013de8289d622dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc569487d622dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a9d17c8d622dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7d08f87d622dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2a6a3c7d622dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f557b388d622dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d871b285d622dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5012	elevation_service.exe
5012	elevation_service.exe
5012	elevation_service.exe
5012	elevation_service.exe
5012	elevation_service.exe
5012	elevation_service.exe
5012	elevation_service.exe
5504	elevation_service.exe
5504	elevation_service.exe
5504	elevation_service.exe
5504	elevation_service.exe
5504	elevation_service.exe
5504	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5048	2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2360	AgentService.exe
Token: 33	2800	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2800	SearchIndexer.exe
Token: SeDebugPrivilege	5012	elevation_service.exe
Token: SeDebugPrivilege	5504	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 5880	2800	SearchIndexer.exe	100
PID 2800 wrote to memory of 4780	2800	SearchIndexer.exe	101
PID 2800 wrote to memory of 5980	2800	SearchIndexer.exe	102
PID 2800 wrote to memory of 2616	2800	SearchIndexer.exe	103
PID 2800 wrote to memory of 3536	2800	SearchIndexer.exe	105
PID 2800 wrote to memory of 5972	2800	SearchIndexer.exe	106
PID 2800 wrote to memory of 5756	2800	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_ed30a8ae2fe19f9fabdd197c3cf30771_elex_rhadamanthys_stop_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5504

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5684

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1336

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1564

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:752

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:696

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1828

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5880
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 73b5372ad613ecf03e385901d450e4c64a19b1532280a933cb0f851a667c7687
MD5 7134f1e05df7d51e2ee20cede99db10f
SHA1 8d075b20e599393f71a2e7341c3616bf2e8055eb
SHA512 6a16007e746781a71952953c31f0f86d9e0544df0df5ad947c66f1538dd4e1fa5ae5adc7c496e89f64a584435dc361e1a1badb9867f4a42c33f7b967042cad7c
SSDEEP 49152:Cb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnEj9Fl19CKIaFzErn4:k3q6sjBv9n19ChaFQ4
TLSH
T165D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 842f8e4b36847d78290863eb07faa5644fba62b51460c444679ca62b409ae23a
MD5 73d18bcfd386841ef13423edd07f56a0
SHA1 42f2fd7e23132abcd1ffad73ceb4a053b824b5ca
SHA512 ed8e3c37f097123dff30fd56b5e9edf60bed854c283603629e7572c2620298af6974cc739d13fbc1a533a00406f19a5a480119880c7373239f4b09b8b5e137bc
SSDEEP 24576:nXYfDtczAXj9FWM170KLX1GbKIaFzErn2Jg:ytcij9Fl19CKIaFzErn4
TLSH
T11305F12477A509F8ED678238CCA28502DA3378564360EBCB03E499651F377D95E3EF91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 2698a932569efbdbc8b85fb6c6927762e3785c5ae286581919e1a925cdc61319
MD5 4a35965a773450c25fd707603d20e17a
SHA1 cea1a516379a76224733f2282e84e20b02c47695
SHA512 3d2229978219e1233f6d89e0678fe16a1829dd0a59ebf6fcabc7a79e156de057dc23ba95edb121a9235a8e5b2df364fa0a7c2cbe1a4d32c264f9050f3ef9a7c1
SSDEEP 24576:60Le5ji0hmxxrMsj9FWM170KLX1GbKIaFzErn2Jg:6Pji0AjZj9Fl19CKIaFzErn4
TLSH
T12035AE26F6748371D073C0B9C5D2A68AED72308657308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 57ddb9d9e9895d61705cb0895072f2888f7add1ab37ca83ad73e78f01008beeb
MD5 27564e169e7cc07997e8bf020a3ea972
SHA1 157771c4aec85129e0c749fd361fcb58072d7415
SHA512 996ee9d54f1727f13e8d401a01125626e668061e5cf289704ae5b8c9a6bce1d3a9dcd0ec6f5877d6411a1ba6f65ccbc082fb4e0874d1b173e8cd0ee618cd03c1
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWn6q8wyuSj9FWM170KLX1GbKIaFzErn2Jg:p/ezSC6vUzPveHjyVj9Fl19CKIaFzEr4
TLSH
T1D2755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 948961d22962b36f0aeed5cbbf403258401062c6227770d600884fe0bd0cd9f9
MD5 e2cd3a44411751bf9f5c7d6ccfdc9b96
SHA1 65ce9e49d6ec3345a470ea4fb929a5aefbb026c0
SHA512 ce3269123bb03d4d1e61adf402159227237f92c32b19134143ad7584c6a5ad785ded991892fe8b16cd6997be76aed0c2993dcf2e22284ed3ebca148914bddd78
SSDEEP 24576:RVbqPb88hv/l+Yrj9FWM170KLX1GbKIaFzErn2Jg:RVO88hXl+Kj9Fl19CKIaFzErn4
TLSH
T181559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 059aa143c6fb26912e3f50c7bd8c759e71109b3125b9c05e3d42615015bc7b5b
MD5 6ec18ef234c32d687e6159eae85a8057
SHA1 3397b727f1d2809bdd7333d6fa548bc93ac8bee0
SHA512 32f6cdedbe99c1bc890f363732fc707bac43f78f70f2e090908c982d7648337fa0785c7cfffe59dfd1b9686af7bc00e05aac6dcc7cbba0e2e3199e8ba9f3198c
SSDEEP 12288:/LqPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:/Lgj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T153C42371472A81E4FF3A6331997174838E2A7EBBF3641D4D019B7885587C91BCE91EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 35ac9e88c8f246f6e4b7ad72cf6ec5669e571c68bef6675a2fc5fbfb0506fa63
MD5 09ab930b50beace8569a8464fe3dbe3d
SHA1 b853ee5173941088238bd642f4447eaf5948a982
SHA512 5eda0e583ac1618541fa78f7faa34747959c1523496c35b09219e828ccbf7056cf047559ef469b3f34f85404843e20725c23ff366accaeaa178b825cfded9f6f
SSDEEP 12288:ueBNUbTVO86U7PZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAK:uJIUTj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1EC05DF3BEE28FCE1C27E9D785B918200D77278718B62A3CBD165820EDE235E54E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6b8690173d3bbc29eb2faf798d9909cdf9e09e3928438432649b6d61e0a0be70
MD5 a5e1713931640a684ae187f211a85814
SHA1 a3b9c1bce2fb67cf26d7d5e7fbe0a6ffc42e50dd
SHA512 32ba48f9473aa0ae6626b650d83c8ecbcb7192003581ea1d6129d8a5f3e08a5ea41e2bd2c3cb3539cf7032a16068718cc30f5e92ae7c7f36053d8b9db97cd132
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THP:3QvGAdlCEL8c/DRNw5Cs9n19ChaFQ4
TLSH
T1BD266C656BF880F5E0B7E138897A85B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 4ed0ca482bbdbfb9b473e57a7e4c9725daf6ffe4f3e72c01ba59430dab0096be
MD5 f4ff89c0ae95505a230b4fa9849ec060
SHA1 bc0ecd90cd9ba6599d0b359dc68fd53725b4a3a3
SHA512 84db4b862ee4d7a52ee936c0e0c0eba57a08a82f8dbd51d7b662fd62734286596ccf9d48f9941ab9dba5d4e50a46a3247b7b6daae086a8ef13480ca5e4c6d370
SSDEEP 24576:T0ewsAjJj9FWM170KLX1GbKIaFzErn2Jg:AljJj9Fl19CKIaFzErn4
TLSH
T17C15E031FA75E036C77F0DB21B36D706582D7A204B611AC3E3A88D8E59342D26776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6b0d1acb41a354cedbdacdc743cbded20c9bcd8812f2c6d8409abb41b56dd79b
MD5 fa25099588137e7ff908e255d8b63e61
SHA1 9b60c1b53f201463302270973cd30a933484789d
SHA512 0651bcd632c268cc70b3be2d090c44970f611a985ec64d648b63288fa19d2f066e00e57a66aa5ffe27718393c06fcd5d686b7d4a50ab15f2a71d0ee477fbd478
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHuEq:tUEtQevvqc2W1cpV2tI32W
TLSH
T1BE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 48bd8c8fccd9ea04960c57502df74af1514d95eff1cb7d99f663408669ed3ee5
MD5 6a6d8e6ca1f5ce6067506844489371b3
SHA1 7f975007eb326f1cf9b30993d65b0caa89304cbe
SHA512 981af36a6f40c389822ae7b04c9310a1640cefedce29da0a459d7043110adcc16d5d236eac36c3aba52c6bdf73c5fdbca1541c6344684a18d6ba150970f8cda4
SSDEEP 49152:bCbRquA/m2yL5zLfFiV+XenmE3/zpj9Fl19CKIaFzErn4:Eoq2VjnmQ9n19ChaFQ4
TLSH
T1ACD58D1976B8C1E4D1F6C37886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3ff742dc9f612c9bdb441654c13f3d18b32bbbe3f79b55b77da904933f528361
MD5 015b0436e2d4dc80eb7a144b1c81654b
SHA1 3023a7ae7569629bc4d6162d6a649c2e7cda3886
SHA512 11f831b803538d769e6dd1aed8ff1a6198ff4662131c0de8f3b58b2b12fce53d8f59e61ae28d851d6d3419eb334147f6857b7673e556dcc55bb7933516ade977
SSDEEP 24576:WAhGL3IFoiwtA5l7S53ej9FWM170KLX1GbKIaFzErn2Jg:WAMUFoiq5uj9Fl19CKIaFzErn4
TLSH
T17535AD81E7F945D4F5B3AA7899B69171EA76BCAA5E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 2beb7142245ebfafd75c4bd494899371ef8f1d0b786834ed07a9aee5383c31d5
MD5 fd45b08ef93baa8db109c7c436fa2da4
SHA1 0144655699eb6b66de4d8b14430c4bb6b675f962
SHA512 0f44f964fdb1c6cfb1a7e88b94b192b552db1ae8767c74a66de93333b667c7cde0b6b607dbcfb04b7a4e95f3f5e9385b4b9a62a53ba56ab467a6573c6053c53e
SSDEEP 24576:1wu4OW1j9FWM170KLX1GbKIaFzErn2Jg:1wvOaj9Fl19CKIaFzErn4
TLSH
T1EB05F15677A90CF8E9679238C557D132EBB2BC123621DB1F0360C65B5F37321AE29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 51ab1fded4178abf5aad3d847cf074f9053ec730fe9958d114b066cf375b7def
MD5 fcd58c8e8d5e2fa459d40832a8284684
SHA1 0a4bfdaa3eb7b3a20ca901ec76d854b87633d0b0
SHA512 84f6cddd56cbff14b324177d6ea820ba72886dfc718df0e025e830bb867759002c064d224fcde00be18c8c53805163d41db91f853ae9039efba8b7843a1351d8
SSDEEP 12288:aeZ1IyxPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:3Zu0j9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1FDE412A623A860F8E6775238CDF15642CB727867733107CF1266469A1F37AC68E35B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d4922511ab0eab4511ac3afb7aa80a98bdfc9dbf738560a785aca8647f57e912
MD5 0bad8361feb051257ee7afe7b3d90383
SHA1 faa0cc6977d92c7276bd56a17f8a0311623a9338
SHA512 30d837b7cb95dddebcfbbf020a7be3728e7ecaefa996680535fa7a2be827a04860dd6ad89e7c69595fa6f4723620a28820e7a5eb8b05ea825810ef461be9a884
SSDEEP 98304:1QRQyi36YOcPbLvw2gAf+PN3L9n19ChaFQ4:MQyiKa/X+PNQEq
TLSH
T11F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f39f9544e480005aa3e2fc0ecada03b261f6cad392a882d851347535965d7c57
MD5 2c348d158b33c520e66adc6c75471fdd
SHA1 e103fb17674276967f8a368ee9002c829e3a100f
SHA512 0513ada5cd93e5183baa22df4d98aaf7d839fe44076e274500fae0aad972ec19b32af3dfb887091cd9437a9a077ed0185328e17627e021c9017aad9c337aecfa
SSDEEP 98304:yQRQyi36YOcPbLvw2gAf+PN3L9n19ChaFQ4:pQyiKa/X+PNQEq
TLSH
T17E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d3143c17927e9ae2d50d7f93ad532db54105de3176c6487abdef107a7c290c14
MD5 c81ce2b0d60db556a43db4beec72c2e1
SHA1 0cb2c80765fad2b269a004f9e198d003a02f2e5f
SHA512 806211dd9b5066e1f7a72b86b17ac877eda9a03a437c8d86b98e425aae9ae38018f4b1481c94712f1517996125ec14af49ba8a412167306ef387396597859cf4
SSDEEP 49152:068Qg55nhceWu7PNU3/Zj9Fl19CKIaFzErn4:ethLRc/59n19ChaFQ4
TLSH
T1DBB55933B2F600A9C44DE1769F4A972196D27C75CFE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 77d9ff97c05d1a86aff18dda3fd3a18a2aed5a21928dc34e0638664df304597f
MD5 621a0ef90c979d50c78f9256643402a1
SHA1 e92e7eeba56014cc6424db8f20889539d7a7d7f9
SHA512 6cf683d34c819e1c5cf7e322d67fda4752604660fcaef95c765c0d7038dba3c2b3cd585de8a4afbf2b8b61c2e81bd31cdab420a08ef31bbd735354553ba67d86
SSDEEP 98304:Uy5112gYy5azzVvt69nLKnhZ+9n19ChaFQ4:VLIHEWhTEq
TLSH
T1EC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b4c9dca3854c87dda22e86822219254e8aee0602eef422575de8a7a086ebdb41
MD5 69f1109fc425fb559e1aa2bc1bbfd994
SHA1 3375e25c3dbc35426da9bf8f9f34be43e0c9a489
SHA512 2523b58aabd9420002f612900a1221a212557d6e2cb71515ebbca216a790327b71011fb9964f89cdbba809a8d6ae0e36adb3262733820c3dee50df7f6f3f753d
SSDEEP 49152:LB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glnj9Fl19CKIaFzErn4:du6Jmdxd2dj9n19ChaFQ4
TLSH
T1A3D5AE13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d97ef0d31ed10bfdb1ce81b5b2f057e1876032311bf17e63a9cf0d2547c91f55
MD5 cc8d7ccdeaa07321af96546d02b19707
SHA1 bb4c27f82bbda0118d1aed979b6a93924ca2c57b
SHA512 393b924e6937d4e68d8650f1bb70583b0821dcd2d8e3a57ff75cf3946f948c724438b7b84700e870c9e6e9718aa84f1caf37a5840384ca8a087ed661824bdb24
SSDEEP 49152:J1hpsNoJpF1A63U44CwH7R4xzj9Fl19CKIaFzErn4:JmifPWRQ9n19ChaFQ4
TLSH
T117B5AE13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2682bf7b2004a111352733ab23738d00c70c961ba2ab361dbb035b055b3ba9ed
MD5 6d8655928ac01b0dcd792d7c2fda49ca
SHA1 dca292f1b7a908e04c4cb2faea3522f25c395d71
SHA512 6abbc34679655045d2a1f1b1b5cab9c12c8a3d1b855830355708f04bcf40a0adb38fae410b47f3631b6fcbfccb9ed1f2e38921e8dc106516c2588a1d016d2541
SSDEEP 49152:QSuZQIY0Be2KcRVtOnks6NMHq0j9Fl19CKIaFzErn4:K5dKii61q9n19ChaFQ4
TLSH
T1AAC5BF13F2E940E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 489fb5acc0e36330196207d8d6d3eed6896a910e653fb7a516cd9d1b0739fe3a
MD5 6d18216455c83b8b596a6c06deb6e952
SHA1 c7f6675cb8c6e2cff54b18dc7dd2eddd6e2b06b6
SHA512 4e34ce92361665565196d1eafa13f884ab467cfbb66f479ca8fbc5d8f0b32860669e7bee7b67d34b6634860266b8f9c9a043f661a2b5b7caff2f121eb44160ea
SSDEEP 49152:fhtSn8EApI0fig3giDn0AP5wXj9Fl19CKIaFzErn4:OX2imphU9n19ChaFQ4
TLSH
T13795BE13F2D900E8D06ED174C7568632EA62BC160B34BADF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 fcafdaa5355c0dc53cf0ba23b7bfcadbeef03746d7b8ffdee2a0dceddb0d7702
MD5 65676fa36ead5960679d04b89ec15708
SHA1 a52b551969485056de1c127b77f899705137c788
SHA512 21665d1189d4861c76330e2b406dacd769a78b09cbf26c6622f06ea27e09925067b781fc989bdd8e9e447fc305e3f29b55305e08f6dcac80dfa4cda28c1aa89f
SSDEEP 12288:biPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:boj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T125C42371562B82E8FA39A330C9613183CE2E3EBBF3211D4D219F6445597DA1F8A51EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8421522fc3d2b6b8e72cba282eb0dc7f0bf889fb1db56699a27c8db25f70a69f
MD5 1d406c5673ae788426e0602f84c03b6f
SHA1 7d36dc43f8890ac6da7adef5aaafbf7a13725dc4
SHA512 20353ec030a2aa5b8f15a7f9b98b22164baf5a9634bf128b31d70080290631a540dccd69d480a3c642af7fdbaa0320feb9b22a9487f9690175254be5c56374d1
SSDEEP 12288:g1PZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:gtj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T192C42371562B42E4EA39A330CA617183CE2D3EBBF3211D4E219F644559BDA1F8E51EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 5797896ac216cb552529ba703990ea39da629c352374ef59852b466abf794d1d
MD5 69758efc216e1fb94393ef2c648580c4
SHA1 0c71f49142e9294cbb5654ecdbc62fd6d57116fe
SHA512 a2c85f128d2e683205a0f6cef7049e49707d1e933faf35a90a6750794acea53867c2c4975a9e71eca3929dda16fa694add84e18a66623f0bab94aa0b37cb0596
SSDEEP 12288:VTPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:V7j9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1DDC42371562B81E8EA39A331C9213183CE2D3EBBF3211D4E219F6445597DA1F8A91EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 b89fc848fd9e3cf0078155e27c0c8eb4341c4ee0fd1cf536e2642025661d6155
MD5 6d4fd5891cb4a518e1aaffa6044d2b0a
SHA1 c9aed4ef5a90879daff2b0d66a577969dc395692
SHA512 3dd394ced103c2e0b2884ec03dee511054ef3e76b7d991adcfd5a1c01d2df863894ae32a015e2727f75e405248acd62527df12b9012e7f2438c40dae69934370
SSDEEP 12288:3VgPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:oj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1BED42361672A41E4E93AE330C9726143CB7A7DBBF3311A8F125618491D79B5A8E70FB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 560d175407add756daebe56e926423b7656aeaaa45cfff99bd3a660728eb96a5
MD5 0608de58a0a614f90bd8338bfdd24c73
SHA1 121444fdb34c60c797515be52b8dede8a67a4982
SHA512 30d3dd929c09bf17dc2c5f6276289e64f3b16c3bc41a0c52e9dce6795ddd56c3945412b24b1944cd6fa9626178f704a3a8c698ba244ee8fd3b46d7f49e1cbba0
SSDEEP 12288:jIPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:jWj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T141C42371562B81E8EA39A330C9613183CE2E3EBBF3211D4E219F6445597DA1F8E51EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ffc170b4aff151e10f6671475c6f8089a60d4a1e67dd59c0287eae2add51041e
MD5 3c8348126135e8547723e5b80354301a
SHA1 cd0d8b358c95d95dda2f74f4f835c0c7dc02f833
SHA512 39332dcbf3c607f7aaed4f40f20845422926849cabfafaf604ea8993916126c540e66ab0425765735fac00344f9b84905c3b40f9bc67f5fdc1424e49e02b2323
SSDEEP 12288:m5PZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:mxj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1AAC42371572B82E4EA39A330C9613183CE2D3EBBF3211D4E219F6445597DA1B8E51EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 978d41946b25b617a0d541a8af68ea7f4f6aa2987afc8c932e6de2405caab133
MD5 f8005ded80eb6b180270d1b6b80f564b
SHA1 37fb9897e1b98f726179f778d73716cc4550e37f
SHA512 d39dc1a9da52c8f874eecdecae2a76d44bc6e9b6f53342ea6aabad7443ef355d7d559f068ba82f3b30869f4ebdc71e5739fbb34377c8853266b025f1f081a429
SSDEEP 12288:TdPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:TFj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T143C42371562B42E4FA39A330CA217183CE2D3EBBF3251E4E219F6445597DA1F8A51EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 d43ac075361c7e22de0ca19971a545e9a1f63bcb11c62e083695e63898d3476a
MD5 8936781bdf5de12c4af23ba0714c1a22
SHA1 e80295c397033959a10e98be735d35067cd6aace
SHA512 08266fd799537c6a026f94e727e9e6e733db41c028f3d511a3f268475fc96557927ea8eaee1e70380c4fd73953175692c7e57d15570dc4bd10260ddd77b0f258
SSDEEP 24576:4ZMRzFVSONj9FWM170KLX1GbKIaFzErn2Jg:4ZMRzfhj9Fl19CKIaFzErn4
TLSH
T1DF0501A5B35018F8ED77823ECD219906C6B27C6A5770CA0F03A836665F373614D3AFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 38bc09b4514ac4ecdba1644d686d1617664f4d364cc9cd657523c7fa833a3da1
MD5 6f503faf0c36c82e4ce4731add5dde49
SHA1 fdb015b12f01c5c180242c955a2dc9cdc88f1df4
SHA512 a8e42f06841245a4bbd1dbfd236480ddb121793a7d63b33cd03931bff3e1fe76993aa6b8a5f95e43a5d91fbe6c74d2e41bfeb29ef62fdf51501814f639763637
SSDEEP 12288:wePZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:wkj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T114C42371562B81E8FA396330CA217183CE2D3EBBF3211D4E119F6845597DA1F8A51EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 8c20a79941e1e51995e8416625f38101ca4f70501ee0ff8dcb48dae367b51767
MD5 fbf1065544248fd1432cc3c340d4d85d
SHA1 c37fa5c69e153b367d51131f3e962c5802bf0282
SHA512 1dbec2d0f1a1883a8581cca3386a0645c30192928ff63fdfcdc142997d014eb94a99c6cdd2a27882c23ebfdfbf27f7b2701c688f524505f462a77c0f0f504dbb
SSDEEP 12288:faPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:fQj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1B5C42371562B42E4EA39A330CA617183CE2D3EBBF3211E4E119F6845597DA1F8E51EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 48413ab1b767e39011c4d8f56ca8e403b075081981aac0570c0a98e7d5b90b92
MD5 e6309e51ed6c29e1f4c12c8f848e4640
SHA1 6edf621aef7c41d19686791d225a3612859e2831
SHA512 8875efca035833428dd1c29fe402f7f5fe639abae81ee428553a910ef8925a1d4b785c55f5032fd26398f01406802381e985ea62533eb3b5d91f887ee65d636b
SSDEEP 12288:JyPz5L8xPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:ozy5j9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1C0F41253736630F8E5369234CD621A02E776787757208E9F13A406762E3B6968E3AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 6aec80da30fafb4da891116a1d5a31191edaaa376078eae7e652f78e44496fa9
MD5 b93f12797586e3f3379af9dfe6d4be40
SHA1 f8d6addec4b93eb14bfd7b3ef74f539b89547e35
SHA512 177fae7786217c6d665a31ae53ab100283d35a7a76af52b711b8cda781f4c0216791067ad1db649a5353582ce2db629bf682a07bada3268c42271bfd9bcbb38f
SSDEEP 12288:ZePZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:Zkj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T19DC42371562B81E8FA396330CA213183CE2D3EBBF3611D8E119F6445597DA1F8A51EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 7308ead25db50b2248dacf7588c61a761a4faa364a97077722bbfb9c16d84f37
MD5 d85b97545f11d3146ebb395e60fa99e7
SHA1 30df31df494de35514ad37463f017b68abe40fd5
SHA512 9352608ccb367679bb9d25bd08e8f5b18efe1270e0b82edeb79517238f09c7b4e812361e430666017e9a1a160380eeeb3522c3d2084882a142ecc12bcb37df44
SSDEEP 12288:VePZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:Vkj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T140C42371562B81E8FA396330CA213183CE2D3EBBF3611E8E119F6445597DA1F8A51EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 d94ba70c4beb759a30c0e708e607d5ba871eb51f71c54885e92b981e8f53aa8c
MD5 ae36e19e83bbb704d5a20249901e327c
SHA1 71f2508731b2c62300243bc56be690c2954cba53
SHA512 37640154549443f6e47999a35d88270a280ff14e369678a7767d808f1c80a47adcc5138992db17d56755f7916bfc546f1c98b2423d2e41ff6c99f0ac29c70ce1
SSDEEP 12288:dyPz5L8xPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:Uzy5j9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1BFF41253736630F8E5369234CD621A02E776787757308E9F13A406762E3B6968E3AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 5431305d43ff882311bf033cb018f873de8adaeeb9fb00775e9184ff496a49c0
MD5 ffb217f0c1295c21a47aed20f9e4b3bb
SHA1 e7c7310f419c8b64ffec42c7b15261157b5c05b4
SHA512 07d3bc9d1c34b8e127dfa655b0038acfa5ad2bae25447bb728f4549666bd7466181fb22c1e4c4badd752aaf6b70b288c00e45fb46e748e1177ac6a6680c4d12c
SSDEEP 24576:KTDaLl3z0zDLj9FWM170KLX1GbKIaFzErn2Jg:KTuLljSj9Fl19CKIaFzErn4
TLSH
T1700501A4B35018F8ED77823ECD219906C6B27C6A5770CA1F03A836665F373614D3AFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 bac5771d3d72aedf2ce81ff57ab194ed20973473371e4d0f03b32bfd76f29218
MD5 3a8151744ae69dfcc932d63ee2b7bfb9
SHA1 99d30319b591eef937d417012e55177b094ff853
SHA512 7a8c5dcc26cfc889d3a69587eb242a7b705405c9440f827071d22526192e4e44221d831bde40c86ddd8eefd4461a4be177723a1fa67f68fc1d1572adbf60d828
SSDEEP 24576:c3vd9CHKy7GZ/j9FWM170KLX1GbKIaFzErn2Jg:Gvd9CHKyahj9Fl19CKIaFzErn4
TLSH
T13425CF90F3E410E8F1779A35C9725512CA767CAA5B31DE8F03A8255A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 768734d087009c9851042bbe6b76b5ab1fa6548b3ca35ae46fe8549c8c143a67
MD5 2e092955450fb1c8d2b619ca7e5d676c
SHA1 67a77d7184a8d026eee18801c8d0ae665826f82e
SHA512 8e320a9bc71c7edf216c05475bc07a61b0e5c4c9a35b7b50867c2668704f99d0df46d0e8f428eda3c484f4ae3cf0a88daab09367eaf3b1680c70b4082a8461f6
SSDEEP 12288:YzPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:Ybj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T12DC42371562B81E8EA39A330C9217183CE2E3EBBF3611D4E219F6445597DA1F8E51EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 36c778c06ed26f151e773847561bc09093785bd12614b86d8ee2a98429bf5c09
MD5 d386f2878f4d98a765557bf266c7830c
SHA1 26f1e8d85669ccd38752dda921c8816300a08f90
SHA512 c8b23938e722590a32b098a1ac0ef5c8e229c2597c6bbb55f2ebdea2903b6d16d6c537f3050de97e00d4a93ace682c3861e048e7527807781d082cec8ab908fb
SSDEEP 12288:FRPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:FZj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1A9C42371572B41F8FA39A33089616183CE2D3EBBF3211E4D219F684559BDA1B8E50EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 4ad8ba9b15d305498772badff497bf8fcf3a7df860fb5121652d2f63a4863001
MD5 26e180289877e1c67a44d9029690b9ca
SHA1 eed61df245c8d603921271fc3490ed63e368576a
SHA512 85451766129ed8cf272dd4d01d6c717bad14793238b9200e0c01a1fcdbb4c7493eef604db4f87d668e8f777be080346f1178450c190d0ed8ee59817b3a1fdc20
SSDEEP 12288:qcPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:qqj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T130C42371562B41E8FA39A330CA213183CE2D3EBBF3611D4E219F6845597DA1F8A51EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 53cd32cba13205cd6235bca9908c7e44aaf3aa066abf7270cd110afc174a1db5
MD5 6a78d0f568cbad651fe11bd0ddbf2d5d
SHA1 d5e2d1f0e1ed7e4591ab4095d0684f991e5734bf
SHA512 173b8e5d118fb462b035cda7c1ed725395d70a9f0cbaa8d90df30f9439226309ec1ec5d6fb1c5dd394e0e3a35c1404969a9832ef784a7ea31bca5a4864ac5179
SSDEEP 12288:nePZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:nkj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T19EC42371562B41E8FA39A331CA213183CE2D3EBBF3611E4E119F6445597DA1F8A51EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 2ee5a11ab5182560ecd5215f04cf4e3ce7b99002f99bf953030f48e95ad1374e
MD5 3a3357852fe7a411e4a53a80925985da
SHA1 285e3c22f7490b60a6ac34008468fcf9c976e721
SHA512 24eb065dbad3cd7a928d5901c1595665b2d00c93369e6750603c1aca976825a6155c494ebdb506409bac661921ce4721aa65155fb1865df9e9b10025aa896a40
SSDEEP 12288:SzPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:Sbj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T110C42371562B81E8EA39A330C9213183CE2E3EBBF3211D4E219F6445597DA1F8E51EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 bda0b1a924c6dd57960f1627fd3b7f8f2411f1c2cf6073e7bae5d7ff81b64ccd
MD5 9139c1695d4092419e7d57cd0ada172d
SHA1 9e89c9b24f4f717781cf64a409ee3845afa097a0
SHA512 5411f0e2d77b1c367412a554108048a17e162d3729ec71a18d2019e9b9ffa70825b8752291a6e41ee525fe3dc01bfcd7534f2967b8121ba845d12008af395f83
SSDEEP 12288:zmPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:z8j9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1D6C42371572B41E8EA39A330CA613183CE2D3EBBF3221E4E119F6445597DA1F8A51EB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 81f705d5e8b61f83d8d76fb75be7a1d21ffe476e74af16fff3362c25f6561638
MD5 ab7456172f42fbd0ae8e0c205e67d034
SHA1 428408ebda59f46674685a681d934fcdc2bce19f
SHA512 c4208f980be5808e256456643c4427cc7cb3b5e34d93937cbc2aad1300ab6bbc4a313be84924fa5a007b97aeb62e914a18ab4e4d8fdf03ed6f709c671a9f38fa
SSDEEP 12288:cIPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:cWj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T19BC42371562B81E4EA39A330C9613183CE2E3EBBF3211D4E219F6445597DA1F8A91EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 ec45ff768d757a63194362f5ed9c21232e5f608db97a99b5bc0d564f9b8b93b5
MD5 221a64d224076c6f8c00d20d56eb5949
SHA1 91cba700b586870794849ac36c2fc4087c8ab024
SHA512 847c76afeca933c27068e53af35439ceee2f8d749ef05400d007f570c5ccb101ac21d70db8954579122e07c5a1a880de239e5c1a83aa1e410d19dcf2e06b5bdc
SSDEEP 12288:orPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:oDj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T16AC42371572B41E8EB39A330CA613183CE2D3EBBF3221E4E119F6445597DA1F8A51EB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 698f78f76cd2507c39316df2291db5f2e1e795e85e86de8aee10f945641073e8
MD5 77545cc29b0410dec1eda2f8d360c319
SHA1 edbf6796dc46f38f4a86276dbe15cfc9ed80032d
SHA512 932c04345171bcef0f69c11c7965171074d253b4d73295b825060c152cf9a3e305f366f441b3c006bcbb39c6e0041cc07540525638bafb37d384167672e152b6
SSDEEP 12288:BIPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:BWj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T127C42371562B81E4EA39A330C9613183CE2E3EBBF3211D4E219F6445597DA1F8E51EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 e2bb8d4b4c884a72bd12bd091a3f6099760e5b7cba56ee72420d367fc236acd1
MD5 2bf00f40ec538c13e2383a33bf6d3335
SHA1 d6377d05be09690a99de75eb5bfa143a4ae973d7
SHA512 266a59ead40f6798a4c09aba18f9a01b49706e0d7c6b61cef044be5ca5bbf7d2765247d9b2fc8b96794dec56e742b3230158689b702dff042de4db40903ede67
SSDEEP 24576:8fwvUk9RX6wkyAIAj9FWM170KLX1GbKIaFzErn2Jg:4MnYIAj9Fl19CKIaFzErn4
TLSH
T13735D029EBDC44E5E177923C89B3460AF6B178691B31C6CF029A53AD0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 161ed6a81986c922ce6841b8cf652906d1360d1f1ca3a160383bf27e962245bc
MD5 92e12e865069295f6861820657cd4b4d
SHA1 79cab47c8aa03d99cc3f6aecad71c09d288fe6e7
SHA512 ca254167f58b1bd20f495a3c630525c612d94e7f7a7ce03d109be4c8779496d49dca973658de5e0524e9b471621e874b54780865c83c6d4ef759fa12fe3b4a4a
SSDEEP 49152:EYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03j9Fl19CKIaFr:zySzPr9n19ChaFQ4
TLSH
T120066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e8a11b751b36b7a4ee239a0bae6e4751d5e25157524506d1f65c2af9405618d4
MD5 757e0af7f894047260b2dcecb8dc0215
SHA1 ff2f4a3b98914745b4c1f10dcfd0086b73947937
SHA512 aca9f068fdbb44e75afb64117c9564d505d970023b280d56539cc9617a499909ce4b0df62071d40f13a8c7bbf94ce56f92a7179bda30c839623b0c3d19f8aafc
SSDEEP 24576:X47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY9j9FWM170KLX1GbKIaFzErn2Jg:X47JUQjTirIhCnDHUPfF/nj9Fl19CKIW
TLSH
T1A665AE1DA3EC01E5E17A927885154A5AEA71782E5B31CACF1270837D6F23ED48F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 3bbba6c8da0119e7fcffe301f2dffc62c6f37a32ff84684ffa43f81d03c12427
MD5 ed01deba98b6a89135c2aebf95e58a88
SHA1 4b900ba6762a6c233e2b97095a6af793a2aa0fe9
SHA512 fb65bd858a794b60d124054b9982e98d0be736ec168ae52d82ffa733217993d5131079a43dff36507b8f2866e758f656a8a562bee6308c29d9cefa228f2403ab
SSDEEP 12288:1bsfuPZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:Q0j9FWM170KLX1GbKIaFzErn2Jg
TLSH
T118E40126D25802E8D02E6235CB525642F7373C66A3E197CF12C0F43E1F7A6958EE6B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 bcf87a50ff19fd7d66f922e45f5adeb76704a4ca042cbd8f19e8129ecc45ecf1
MD5 4c7efbd3d05fcd8a8eb6baf936c80a1a
SHA1 992edb23a7a2a77a5be10488cf264896e373508b
SHA512 c46943b38060f4b7fae9b1300abcc98bbd25e5fa061ad484513f38f13ee735350c6267c49a4e11eaf4021dddc1b977ac6129077c8d508afab04ff7e8b8b9e5cd
SSDEEP 6144:2sBC2na2W2BXrERtfKDexHx4Dy5wh0pW9x6/k5U5bIDv5MLJt9XjRu+fbe:zjCFsy5fW9Y/l5sv5OXjRu+fb
TLSH
T1BA352851762AC75FC6AD40325E32D5CCAB707D01EE05AB0372C8873FC576668BAF2286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 7540d595f178d1850038590585bf90186010e73d422b01aaa5b7ff894a7994e7
MD5 6d2bff33166194a8df915115bc9d1a5a
SHA1 3d180a5459edce949141b9f0f4727d805b630854
SHA512 0172660322b36e5237811bd1fc62fcebd1e97fc7b1a6a974dd4f713e1faedf9f966d4b3f5e76bb813f3045eccbafb1cb89a9540acf45c3d16c6a632cca885c69
SSDEEP 12288:831VLtdw0btdLn2OGU1YWxE3S7i4pp3X67saIsG:8311nuU1Yq7i4pp3K7fG
TLSH
T12665F7419137E38FD1F76032432AAB4DAB74EC02B7095F2763C8453AD86A765B4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 15d0b741eda5e97a560d59ddd3b976c29788654a29a858b79e338892142ffd20
MD5 fe3a19e94c63ee416a878381ded17550
SHA1 cdac9472a5e7e7e25e30ef68d9c77873d74e1976
SHA512 107cadbc8935dcf83200f57dddbd31302f1709a7d58fc72b95f8be5bf42a5d24ec01af578167327c839cd601d09bebc5118f92c5f0484452c8ed6bc91051b7fb
SSDEEP 12288:8F72PZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:QMj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T199D42371572E85E4FA396330896161038A2E7EBBF7105DCF614A6485587CE8BCE70FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7f89f3447f85a0125672be0880256991a8839d9bb3030931776fc33e2593712f
MD5 32ee9f15b90fa6959c7a371fefcfa6e9
SHA1 06842143d34dde758c6fb4951649a56dd7edc44a
SHA512 f55a750d4017920fb091d076d05055284cbb38748a78c8b65eefa5f35e54050c0664099368c5bafa814b5b3835ab467cfe477a08703d37fc07b6f23aa35e4456
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bYSj9FWM170KLX1GbKIaFzErn2Jg:igb4mBIBhGF9j9Fl19CKIaFzErn4
TLSH
T1E665AE1E22EC02F5E0FAE2B8CDA64417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 75388e15e66389a37f3a04f8de4c9912d947e1f2cf1cff6e80a8c3f8c13c2819
MD5 4a7000ec4a7c329fcda1b4f9b4b32972
SHA1 37168fcf81e09d66444bb88dff9c015fb7c3de4d
SHA512 dcac6792a0f699bbc03512727a305fb1c5fe6954e3b2739e8f1371c717cc5c898feb4c6f3e2cd58349dc7f3b5fb81904cadeea2bb7f8457ec0c38db45c78242a
SSDEEP 24576:gG88u8FpJqH1bzria7/mNj9FWM170KLX1GbKIaFzErn2Jg:z7ZFPqVea7/Kj9Fl19CKIaFzErn4
TLSH
T16A35F16167E101F0D47BD13889824663F6B2B8261364EFDF06AC8A551F33AE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 1d80044b123ed521b6bc62fde890d73e05460dc7e824f94baa6e7248c303c944
MD5 3003169b123f9a17a93a3ce2977d674f
SHA1 0ebfd62ec9ecf033d58255fc9f9cccf3f0cf78f6
SHA512 dd4d30b3dc4ba664a7d7ed3213b3ae8d38ffb8a908ff5b1ec72635a36ff261cc7c43b85316859a2a45cba7f23ac4b2e96d6f0618a7677727550a347d65ee05a5
SSDEEP 24576:yPUr+NQhj9FWM170KLX1GbKIaFzErn2Jg:yJQhj9Fl19CKIaFzErn4
TLSH
T1E405E22F22AD18E4F67AE13D89824709E7717862531196CF02D1817E5F77EE8AD39F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 556a9eae9a6ad27b4c80c79b9bd5eae388b23a1385e2469f059a033495726ad0
MD5 3a72d763edff687c43c17bc5759c44e8
SHA1 3d86c1896226fb2533f8008e8670b8dba15a0cb2
SHA512 8022094e2831623e0f895c4ad158e865a30efd6c082602bfaca04ba8e2c237ef9e15a3578b3e1bc93aa13d5f579cd50665378dc5fb9c7ce8c887cc49eff0514e
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxj9Fl19CKIaFzErn4:jG05lO43bG9n19ChaFQ4
TLSH
T1F0D5C06A62EC11F8D1BBD17CD9C6460BEBB23825033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 437c88f70ba72c45a9ae69a4ecc767b1539a1fa7a137938290b52cfba063d36d
MD5 3d8156bba2ec12b84a399ce1b03c4583
SHA1 53ce10363e987329ea39a506e934d267dbdf0586
SHA512 898bdc8b1d0c2f1cf323abdfe181b5325b524946fdb7280a943e4924a252b3cf875c10249321d0c69ac75e8634f141740e2ed9675cadb5aefec24a48b2bfcf5a
SSDEEP 24576:jfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn3j9FWM170KLX1GbKIaFzErn2Jg:ba5POZ3BJt2pasx2+mZj9Fl19CKIaFzH
TLSH
T1DA65AF5EA6FC01D4E579D17DC583461AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5a0a7bd87cd6aeb5bb151d01bd496cfe888f7057972612c5784eb5679bf6c8ea
MD5 e274d676e22f50aaf1301cb28b67eec1
SHA1 f2adaf13a163a80e5ebad3420af68691577479d1
SHA512 db9de039b5adcd693686af9ce8521eb153006ba4a8d3a63260ed41efaf8d8029299d64e2d694e64666a19aacfc59d4ea9092417ac2443e4d833555498e8b46b9
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkVj9FWM170KLX1GbKIaFzErn2Jg:tNc/zEOVHFqj9Fl19CKIaFzErn4
TLSH
T1D9858B2623E901E4F5BBE1BE89779546FA71786953308ACF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2701eb46dd71e98446905ccbbde98575d865aa5d25184ec0ff37c702b817052b
MD5 d3c027e7a2b1086ef10423111b418ef6
SHA1 be7394840b4cc02fccb4989512eb8c1d33d8bd38
SHA512 e8d7ccc0d655651cc336552db501031742e4df5d9ad1d3fad804167c528d9ac6ec9b828647ed725bd614f440eefaf4643152373b48ed1f5114e47f13e9f43429
SSDEEP 24576:gTkNvNnaFeYhJNtmZBmDj9FWM170KLX1GbKIaFzErn2Jg:gTMwBtOmDj9Fl19CKIaFzErn4
TLSH
T16A55AF2EBAB846E4D1FEC674CD238512EA727461173293CB5290C13F0E679D89E76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 2faec44c57723b452c27d9da86db621730e27a56b23377a222e1e4acfbc53677
MD5 9ae78178b3decdff86465060c9d0ee6f
SHA1 21bee31b0bb635f4438d9bf4a737523ac6a11977
SHA512 5a68cf81247355efdfea322aa50df3aeae03b84100f85b027c99a3708b9ed3ad825746d343834abe5ba29dcdff851cf48661e6835764e405d849885c7af8224a
SSDEEP 24576:FD3FHshBIYQgAIj9FWM170KLX1GbKIaFzErn2Jg:FDVHeBIAAIj9Fl19CKIaFzErn4
TLSH
T15F25E17DE75D00E4E57BD27CCA638606E77138A903226ACB02D481B61F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/696-368-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/696-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/696-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/696-370-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/696-108-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/696-101-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/752-85-0x00000000008B0000-0x0000000000916000-memory.dmp

Download

memory/752-80-0x00000000008B0000-0x0000000000916000-memory.dmp

Download

memory/752-79-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/752-311-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1336-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1336-281-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1336-63-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1336-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1536-386-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1536-96-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1536-384-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1536-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1536-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1536-90-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1564-68-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1564-66-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1564-309-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1564-74-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1828-116-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1828-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1828-371-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1828-122-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2360-138-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2360-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2360-132-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2360-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2360-126-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2800-372-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2800-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2800-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2800-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5012-22-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5012-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5012-14-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5012-107-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5048-316-0x0000000000400000-0x00000000004C4000-memory.dmp

Download

memory/5048-8-0x0000000000BB0000-0x0000000000C16000-memory.dmp

Download

memory/5048-2-0x0000000000BB0000-0x0000000000C16000-memory.dmp

Download

memory/5048-0-0x0000000000400000-0x00000000004C4000-memory.dmp

Download

memory/5048-78-0x0000000000400000-0x00000000004C4000-memory.dmp

Download

memory/5504-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5504-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5504-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5504-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5684-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5684-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5684-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5684-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5684-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5980-381-0x00000203F27F0000-0x00000203F29BA000-memory.dmp

Download