9ea1f0da4968fcddb29148e532a66ba1fa3499d5f7a9b7bc79d7e098508cc544

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
Size 876KB
Sample260809-rxp3pagn2w
SHA256 9ea1f0da4968fcddb29148e532a66ba1fa3499d5f7a9b7bc79d7e098508cc544
MD5 3d66051909a4aa575c0e47566e9a2c21
SHA1 c8abcf93bee0ae1e1ee86b316b6592392d4cb046
SHA512 188e0f3844fad61526a451e14b6c3e4898e45a71fddaf420fd85322b30a42c719756fb69891cd305ae4aaf66d05098288c6fc66df97525a3e9e30eb2e2e35916
SSDEEP 12288:So5CXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SowsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A7151227B2D480B6D5A3047442E6E75A6973FD316C308C03AB9929DEBEB19D18B39353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1132	elevation_service.exe
3044	elevation_service.exe
4492	maintenanceservice.exe
5796	OSE.EXE
4588	PerceptionSimulationService.exe
1576	perfhost.exe
1188	ReFsDedupSvc.exe
4692	SensorDataService.exe
4256	ssh-agent.exe
3580	AgentService.exe
2932	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4ff49d1f23e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d396c6810c28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000865de9420c28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e611c2420c28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e57bbb430c28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1132	elevation_service.exe
1132	elevation_service.exe
1132	elevation_service.exe
1132	elevation_service.exe
1132	elevation_service.exe
1132	elevation_service.exe
1132	elevation_service.exe
3044	elevation_service.exe
3044	elevation_service.exe
3044	elevation_service.exe
3044	elevation_service.exe
3044	elevation_service.exe
3044	elevation_service.exe
3044	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5880	2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
Token: SeBackupPrivilege	1188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1188	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3580	AgentService.exe
Token: 33	2932	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeDebugPrivilege	1132	elevation_service.exe
Token: SeDebugPrivilege	3044	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1260	2932	SearchIndexer.exe	100
PID 2932 wrote to memory of 2520	2932	SearchIndexer.exe	101
PID 2932 wrote to memory of 4716	2932	SearchIndexer.exe	103
PID 2932 wrote to memory of 3544	2932	SearchIndexer.exe	104
PID 2932 wrote to memory of 2940	2932	SearchIndexer.exe	108
PID 2932 wrote to memory of 6044	2932	SearchIndexer.exe	109
PID 2932 wrote to memory of 1540	2932	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_3d66051909a4aa575c0e47566e9a2c21_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4492

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5796

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4588

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1576

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4692

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4256

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1260
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 716 1640 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4716
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2512 1768 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3544
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2940
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 716 1640 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2512 1768 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0639494ad57fe959ea60945178c3a118c7be338f7feb4bcc332b110e926e602d
MD5 7ceeaac5027fd0dc67d983818f89a1dd
SHA1 b5ed00216e942ebb2af35a3b040e254bd1370d75
SHA512 392c940a31130465d9011c59c5f2d6d7c6d7396f9d34b946f9e67405c3c10936953d9f8faf14b993db473f5abde609a6ba1723872c60ffd91121b051b3095754
SSDEEP 49152:yb+632BuPkFKRrdE6ohvstBhuXjfS4LWxneDmg27RnWGj:U3q6sjB5D527BWG
TLSH
T1D0D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 86c6246d1251c1c78e8f775ef9be3db5ada0adb6743db6c97afa553af5bafe8d
MD5 44fd2087c2f407ef13cf2375f94402f7
SHA1 f3e10a06d29fbdc1c2ee1d3fb9a1f7fae9fa1959
SHA512 01faa8773f93bb01854c0fda286582dd9c1854cff4a67c73e125d69085ec7fff1cc9a1d1f1a2d71db23210796fb20338b2e2767df840d16a891c3a3d7e3d89b6
SSDEEP 24576:5XYfDtczAhsqjnhMgeiCl7G0nehbGZpbD:8tcgDmg27RnWGj
TLSH
T1D5050129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 687c1a9a5226167d6e58cadf2b3e5e093835f5c22597a9fe7e4a2f500360d113
MD5 32f0bbaa80cb45dc1b0a6eb21fde97bd
SHA1 d22cab68ae21ee8f517826a4ff3ee704aa687f71
SHA512 212f1ecd6c13bcb4cd21a907a74ba66879d40d4bf9c73324d5c0cd75a9a139a7e9be91e15779eec51d9aa2ebf43a463051643ed2546a63dfe7079046f2dfd75f
SSDEEP 24576:c0Le5ji0hmxxrMCsqjnhMgeiCl7G0nehbGZpbD:cPji0Aj7Dmg27RnWGj
TLSH
T1C3359E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 00ee6bbdec641f7f5175c56bc77b471b4446345b2b9f3040142c241cebc125bf
MD5 f9e36113f46a5af4f27e6ecd6d0631ea
SHA1 0fdf17f878552e09536e5652d59f9e5fa120252f
SHA512 e7a4e45c971611834df86d20d8480bd4970025d273bf76fa67f193cef73c1d76a068ae9a4bdf1762ae44f2e4496f898a7957c5c5e54156f0ea79494c00b65645
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWn6q8wyu0sqjnhMgeiCl7G0nehbGZpbD:w/ezSC6vUzPveHjy3Dmg27RnWGj
TLSH
T15E755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 660e3543b344b72f4e13d642169ea5f26eff301b581ee06e87bd134ef356cad5
MD5 84eb90c7f3524aae7da14bcf61ff0247
SHA1 0416aab3191904654955a07d514dab909f35f849
SHA512 c66665bcf6a80b1fcaafe6b380d6c6d594ee7b2d6c2cba39cd74ce086c8f3227ee37adcc0da80209948cd199f54843b4c8752659a874cb084147e430252977e4
SSDEEP 24576:RVbqPb88hv/l+Y1sqjnhMgeiCl7G0nehbGZpbD:RVO88hXl+IDmg27RnWGj
TLSH
T1FF559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 26992a3554818fa053b724f5d6eab4fbd4b4cbdd70d14a4457861791aca4eae5
MD5 17ad8e2daba1b56432b109b04e61f398
SHA1 f957d94ee5752c16e5c4b6f04b69778e41629858
SHA512 014d13f81f3b1314f65d5d9984ba643de5035f19594c62fe35dc4521fcb8294010ecf1f9ec13a0e39eaf7a1ea6b5cbcd9d7065147fe303347255fbe5f548ee64
SSDEEP 12288:oLmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oLmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T114C423BF964C50CAEB7608B5C3E9F11EAC137E56982008436AA37DFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 577f0bcced93e2a6f0f7114de2c9f1af6d791fa2009ff3965608604bfc6aca25
MD5 9ebb87f3d10497e9fe0365cd03ae96bd
SHA1 e338fc670038dac8869b38cb59435d0cf452be40
SHA512 6d91b8a6dfe0e1a34c6fdfa2bd7cd4575536fac57e8d4f04962af96edf5e21763765d6b9fad1d48895028b7aafa3bab0b649dcc2626fca7765cf7e946b3c8d67
SSDEEP 12288:WeBNUbTVO86UtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:WJIUtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17D05CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6379d03fc361ca2037f8eb7f432d3ae87b2f0e1ca0a57dceba4876dea359d30f
MD5 2c31ffa7baad687a1746f5ed4154f0ba
SHA1 3720d0a5b02f980ca5fa36b6055b249c46eeb062
SHA512 8a04ded6b69c9946893bc5ccd6e9515579bcb953ea561c9d6372cd3a02593a89a9b5539ee3403dca72e7e39396e7ef9f5cd12df80a8ca07055a50e2a50bedd36
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH0:5QvGAdlCEL8c/DRNw5CAD527BWG
TLSH
T16A266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 b9b24d1897ef1f55cacda42debf9618c62639800f7f34dc15fd2078faa7af0b5
MD5 bc31884c898ac98d5b46c6bc2cdb41d8
SHA1 e1f5a8665d441fce87e324d310e8794b044e7d45
SHA512 dfd8f714265a6cd7aec211463663356f6df5a597486bb680c41505f42959dc47a68509a7c4d5efcfb57d94a16e18a62b780f73013f7b93e40c2c2937478b7171
SSDEEP 12288:AAwSfxL/2Dc3RDLLmt0LDQewsAjXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:V0ewsAjXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E15E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d02c0b234c20758a85e694e2a4954769f0fc6d2e56062fc3fd116df30e3a0b8f
MD5 4490cb3b485ed04fc211400066e9597f
SHA1 1dc981144cee32754357844c48aa5890e9d8b377
SHA512 5e93a968c51cdb7f0d037f6761fef449b45be5fdab7b7075b575c5cfba1625d373cfdc71b753f890580c243a4f89427c4bd07d26bf0363774064c9c1a32f9bff
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHDVQBWG:tUEtQevvqc2W1cpV2tI326B
TLSH
T177474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7f6f2ad155799fab5b2dd5c5f2d364e5a9bbd8785bfb6daa8d4d1859f935d68c
MD5 c75b88753ebeeaf78867a8699637b469
SHA1 6f2f321f6cdbe7d2d2a0e4195a8eece60075ed69
SHA512 c981d823e5c62296c9061b1d6b8b7faa258402112399f389171945b488d25e63c9b8bc87119ea7a5593402a1b00f716d7a87920e56885a64061e568cb57bb045
SSDEEP 49152:qCbRquA/m2yL5zTfFiV+XenmE3/zLDmg27RnWGj:foquVjnmMD527BWG
TLSH
T19CD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 81a97947f3911bca5b8d022d5001918c2012db512b7e2a32a76ac98c72878692
MD5 c2c77f6d64390fe2c35f02f4ad92c541
SHA1 0eb3b849a7df4980d208cb8dd3f3006ddca015c6
SHA512 ab31dd2e8138d965f3afd5bacce288e595356568a16cad8b6d2658e3c85f3e9ff1a5880f28eb73825166ad671e784b8dbfb391e1827093af20fcf1d979b17ecf
SSDEEP 24576:nAhGL3IFoiwtA5l7S53wsqjnhMgeiCl7G0nehbGZpbD:nAMUFoiq58Dmg27RnWGj
TLSH
T186359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 f511884128d32acaae7b7c0677e0951cc672572eac3c5d3e5994e01c3b27d11a
MD5 598e7e58eb0344203a35f3096caef5e7
SHA1 df4a431a9b86f8970cbd9fbcda0c72df77d9ee14
SHA512 b8365943d48052c71c2429331b071843b9c66811910be0cee6f5e93d004e36710a870fa8926873e49ec0583a688db7148e3385c51afb1c75679f69ee5d662962
SSDEEP 12288:Qmw5HEjsChNVBFgl0WDm+CUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Nwu4OWTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F205F15A76A81CF9E9674139C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 51bab79a6805a595468fc34e70b072ede5d9f055a24b3f66b2b743835e5970db
MD5 3621d1e157ac72e0e43bf3d7eca18010
SHA1 8f22449021a12f8509a79649378272d9750495c6
SHA512 c96f3e22768e52d75ba9d2b6bea1a1e850b11be16597f60b51c5a408c6c799c98ab1b8bc41ae32dfce9c09d5a6e10cf5823bbf286995a242b1f2762e2af3acb3
SSDEEP 12288:VeZ1IyHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEk:gZu6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11FE412AA239820FAE163417CC5E5D609E7337C62673043CF166659AA6F73AC44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d0b085bb1ee4c335497325b6a40a6d29d9aaa35c0750ba40c86782132258c83f
MD5 93d84e0d2c194b59c796273ade06908c
SHA1 8dfcf7287126152957359bddbc6b685de6d9bb84
SHA512 7b35b004cb0cdcd7c3a6826c02933be8f36bb60cbdafd97f782c4db2d76f01f726b45c89ff4fbaa386514a7c99ea0bdf905ff1642593f72e1a2cbe34d17b79d7
SSDEEP 98304:JQRQyi36YOcPbLvw2gAf+PN3dD527BWG:gQyiKa/X+PNtVQBWG
TLSH
T1A3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d89de1658852fff9e73a9386dba4e2c72f733db5e2907b0e2260503a529ae1f8
MD5 602cc2ad944cd456d58b5bfc746d1c42
SHA1 667e3048c8e4d95efd8a90f27862e8bb999779c1
SHA512 1a2f45bb0b8ec82111c9eeb1a5f950996e9c17ed17ca169d3bee78d327f9bdef9de465f42443bcb38813feec25091cf2cfd3f61c2e69f7a811e558847c3a5214
SSDEEP 98304:wQRQyi36YOcPbLvw2gAf+PN3dD527BWG:nQyiKa/X+PNtVQBWG
TLSH
T19D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 65310e4b96c9275bd8746e1f7059fe093a77a25e9cfbc8c1cf688e036b1bb153
MD5 61c30abaa00dce945b0578648bd739cd
SHA1 944cf5193899fcb89e7f650a3ad1c8c6e80acdf9
SHA512 a53035efc2bbb23b98d8b3df3f2541d91bda3c5cdb46405d7fdd16d177106be4deee5c1e3c32b408009e11216a161d38c16eace7767a06d86f729c21e727a5a7
SSDEEP 24576:NwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0KsqjnhMgeiCl7Ge:p68Qg55nhceWu7PNU3/7Dmg27RnWGj
TLSH
T1A2B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 19e63cf6e02dffcfda9f210ad705031d644f78981c0387c1a1bca891717128e4
MD5 58398c97db39712f9b13cdc3f858b228
SHA1 6914183e41b22c5099f5317937a1787cbe03efeb
SHA512 ec4a3b02ff50a265dcf287c89229e0f2d2e30b3d97b758fcd1239c50361c363b4a23777795a92abd9c051d81ccdae08ddcbb0589f757acabaf24748c0c2f6d75
SSDEEP 98304:2y5112gYy5azzVvt69nLKnhZqD527BWG:nLIHEWhkVQBWG
TLSH
T1DA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b71ca9778edc011f36b17cd912db1a8a78d078c61c8d9ad49e20e24f5fbf2d73
MD5 95683656c31782bb2791b35d5a13eced
SHA1 af67ce293793c3236dfa00744bcb067f39dd09f0
SHA512 ec1f117e499e323cf03c630dbd38a468f4c3fb40bd921669ca2e2172763815f1623eea382340a670b843a578c4d93495296f3f653d9c72a5411c353a64860c05
SSDEEP 49152:hB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glFDmg27RnWGj:3u6Jmdxd2dFD527BWG
TLSH
T119D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 aa4f6604d0f901d510f5ebe097ff807715c4322b4fa1d8084bc0d3b6eb9b2d6c
MD5 d3b831f3044dadb5b485a791c8440963
SHA1 47da6808b7a03b43d652bfb23f7ec347061c8998
SHA512 215fc0daa53574673713c04a501a22e8b6278ffb4b5cd974e5535491316c35586a1c56cb22b84d791bea560d786790312f0e89f36d7fa488a2d0f61dc9fd994c
SSDEEP 49152:s1hpsNoJpF1A63U44CwH7R4xxDmg27RnWGj:smifPWRMD527BWG
TLSH
T1CDB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5c1d54ef281de5be95c437681f7888342e330a34324a4c86d2192ceee1205446
MD5 39faf86556c6f98944b92dbba45d1c1b
SHA1 03fd14ea4ed7a14211541e6f742e7b6fe37622e0
SHA512 4adac812d995726be1070f1c423951a9a4912ab4b0e1692866137bfb1ffe6536858217d281eb5b2a3a04450e68c6c9e2f80b2e3654d70f268a699280a41d8630
SSDEEP 49152:TSuZQIY0Be2KcRVtOnks6NMHqODmg27RnWGj:R5dKii61OD527BWG
TLSH
T1C4C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ac91d6da4f7b59c133443bedcdc5eda80e8fa716386c197a488026c0852788cb
MD5 8b09483221214dbd2ee9589fcc1ed2b7
SHA1 0ada5d0b82def5061059b393189b07eb04418482
SHA512 5945ac60b42ec93dc579f9855e8f486665e6aba07b67c9790112f23058e7e81ef6da5a1d075c79ff5c1fa243dfdee0c2e5e9198d4bff671901313cf7a0807f00
SSDEEP 49152:2htSn8EApI0fig3giDn0AP5w1Dmg27RnWGj:XX2imph4D527BWG
TLSH
T1DF95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 9c1ce837e784db0df1040783b57ff7d2e7825e9a88cc40bb62fe8344cef794ab
MD5 a5bb4db14d0414656289bb2e9c8124d1
SHA1 c8985d7be55e2afe08874c7f8e122dd12d01bd31
SHA512 5b266d03d38e1c2d1148de84bfdeac917cb11deb1751d753cedc5dc845ee083db09a8c8c17062b84348f7c41ede6e80c89ffb1d31d3e8bc55b9bc66dfcf1a2ef
SSDEEP 12288:ueXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FCC423BE964C51CBE52644B5C3E5F14DAC073E5BE92004837A9B7CBEF7B28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8495eaec776b8f91349c939ab3485235028cedcf09c9766599ba44ff31e192d2
MD5 eb6de808b04e027f658d76d6e6286aab
SHA1 ab73f1d715bf6200ab6507ed85b3b704cb8541f8
SHA512 5043bb99fef435e4ded6853bc21d2503665fe96ea46ffbc05b0cd47085b2d165d7269337d69d9e5e3a342df50f0dfe2922e57c25547ec1fb08c72a6f9343264c
SSDEEP 12288:S7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:S7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11AC423BE964C41CAE52644B5C3E9F14DAC073E5BE92004937A9B7CBEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 10ffa16543bba84c521338e6374d73f51c47e986abb5aca27c24dfad9b0d3a53
MD5 8e05d6adc37eb1b37609671de881451f
SHA1 d63763cc70809d864cf28507992ff7beaa8b5ef1
SHA512 5681859352b37fb6191bc6ed7835c5ff7877eef4bf249a9d5ce8b77b8e5b73137e5f05927ff83f0e947e3987dfcf9976af4e27241a05d10a871433148925e3a3
SSDEEP 12288:lFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17FC423BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 66aa1c595b06b9ac7cbe3ece7f6bfa733e7ac29e81c86ab06eed4dc251c03454
MD5 31c9851fc20c35bf210d58b8cfcbe256
SHA1 4d8419929c1568ed83c65ff33d3bc17488dd053a
SHA512 c4a61f1a33d15ec0b3e9f6fecff211676f2d02539ea413bb2ce65c892efee504f4e02f639ee0f708f3db8edbd5161cadd039a45c4974356119f0d63d3500a87e
SSDEEP 12288:jVQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CsqjnhMgeiCl7G0nehbGZpbD
TLSH
T168D4236F575C00C6D83285B4C2F5E11DE8237D96EB3005DB6B532CAEAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 7db76a0e8fff48d1cfeb571b3be8ef388c532d70610ae973442cdc5ba110cbc5
MD5 3491571a8896302ca6aa5d59c36ea388
SHA1 3b3638cc508e0577d295d3d1091f82f82fa73699
SHA512 a3bd9420a335ea13bf927a023c50a2f91867ec05c6dd541b8d96c03f542b2793de77be6b6ac20b0ee4bbdfa689469493e9b9774cee26a043f708d7416b44585b
SSDEEP 12288:cYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13BC423BE964C41CBE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B28584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 d42f8c0381083d6b87ca25b12e6669b5062b15d7614d6554922899f48022b7cf
MD5 3da44ea71831a4472b0a825bc7916e9b
SHA1 ef29d58446e24d22ecf22bd2d153152f753e51b1
SHA512 5b8479077c79c9757844d20e025c7036e985d391900b726cbe9a8a1dfb7ee4072d66536ff27c729d3a68987461f48bfbb1a57a2b99014b561250db055c5d8739
SSDEEP 12288:EPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E3C423BE964C41CBE52644B5C3E5F14DA8073E5BE92004937A9B7CBEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 29d71b43507a3911f2f339861a3ac4d28c72197620fbd41a4bbfe4ddb96bf37f
MD5 2096e1585450ea9c5faec03ff0790688
SHA1 15777dabb9be8981698f38cac350932572d2fe95
SHA512 323787e45ab0a6b17074cd1ac0f8e81aa421af9878cd5b0a04bdb44ca942f58fab5556aa03d7ecc032cfd807545b449280daceb8435cfac7c4372c5402b4763b
SSDEEP 12288:fjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T123C423BE964C41CAE52644B5C3E5F15DAC073E5BE9200483BA9B7CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 c9ee44234e89f3bf4b435814a11eaaa130d011e39ad790737925aeb7601b508d
MD5 2729c84c37eb7e93719282360124b375
SHA1 67061fdbee3055d1236cd0f02c599cec0250f559
SHA512 d4fe67c91f38e97150f1daf508b72d44a12820443e19f5db149725a6114e5d6ff8215b1ea0568982351a57b5ef20627b3d1727775503eb540d410dc4f2ed2952
SSDEEP 24576:iZMRzFVSObsqjnhMgeiCl7G0nehbGZpbD:iZMRzfjDmg27RnWGj
TLSH
T1070501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 d3e3978d70075b0332ba2df790ce051484698ee792dc6f212de8884a65864a8c
MD5 023cb44d3805e6dfe4eda92c330bb465
SHA1 00c9273510d2cfd1df587a0bcba5e1b31dbcb61c
SHA512 97697edb4f2b9fb889b23a0b3ec31226cbdab8a5544ac27e62818d820abd6a4b062d9fd34c3f75fbcc988191a26ea1ca9d21b3704181a3d8bd2d533c30946074
SSDEEP 12288:tqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14DC423BF965C51CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 99f2e5747708e89d7ae5c341b4f15438e3ba174719759db5dd86fc5c33ca7759
MD5 f99c31f1e0b064a50938dd00de45813c
SHA1 f09b535b337c5dba93f79d68c11b57a046e42129
SHA512 c134ee086ca4ee1a95e0292bfa6ccba5a7f973f34593c5d40be0156081ee33e564d49846fac965aa26e4b5f39b5f2673ba282e14d17b64bf2db58e777ca55651
SSDEEP 12288:jWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T192C423BE964C41CAE52644B5C3E5F14DAC173E5BE9200483BA9B6CBEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 baf529c2817b63566f85ff04bfdedf152a31e3f710f1b6182d8d5eba553f6bae
MD5 17f221b5c022ca19d88514534f12c3ec
SHA1 876dd3eceabd708248658ad0e398d50d453bd6b3
SHA512 787d82ea8d65747969995d119987603c0815888c358843eb994774c2212afa76c016f2eeebe29fd3df23bf63f8e092fb49b2c9d20f9360f41b8c296420652565
SSDEEP 12288:eyPz5L8HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DzyHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F9F4125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 d70a1341960d391a476d145dbaad72409c56b5f07f9995aa32083b04c72c1423
MD5 ec5df8ac56e6c275c73d085e5b8b9d3a
SHA1 b13ee9f8f7889a015b3045c11147dfa6635af3ba
SHA512 d3b11a55b4c883a938202b5150c97e936fda5b4728df0000f6ed2497512abdc0193a1ad72d86efeb9375764c4019ab3de60204c406c4704d986d885803c88e5b
SSDEEP 12288:KqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F8C423BF964C51CAE52604B5C3E9F14DAC173E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 b6438788a66d0e13b59adb879a868007bb931217c42eaeb580e7bb2d746c6da6
MD5 7d6ecf1f61721e23a4da63d0003185b9
SHA1 fae8ef9693559aeec5a59843b49e64ab412acd25
SHA512 df634038418732854d43dba228eb0fc59db0b5bccf80ad6f685bd85ab7a9e26a07f7b4aea34aacc20236a707d6886ee834216cae80bf6848b530169f3f3ed45a
SSDEEP 12288:NqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E9C423BF964C51CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B28584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 c77e0d45076984a360f3feff3aa6c7029f6581466a2af04b89d1c9da7c458826
MD5 bf4a6424d9411cacbac6ab7ea0ff81f8
SHA1 a9aca14fa609046cbbc0ab73c7e3cb1d07e3ad43
SHA512 a74b60d552fde5dc9cd7185ece6a06a3da8fa3c77de575cc1e57534ca7b14c61e922df1c4145d0e9f4e2c28fc1defec3aa082c79e860293597f16fe1cebc7564
SSDEEP 12288:xyPz5L8HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gzyHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T115F4125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 db33faee4c78d5f955d4a167f044f307533c258080f27cd6fa50e22a3567ae30
MD5 3e1d2cb6435ad8bf00333938d4aeecb3
SHA1 036e145f27cb1db9f2ce69e74619e300e01ab1db
SHA512 b839cf68f1672d5226aa646a507290a265e99784c2891692f53b54167e1a489e8851dd339351aa1d523c8c354733b1870c1cfa8662410aa14356071f8ca884ab
SSDEEP 24576:nTDaLl3z0zDVsqjnhMgeiCl7G0nehbGZpbD:nTuLljQDmg27RnWGj
TLSH
T1EC0501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 c6ba28620da7f84047d0420c28c3e71d433bf611c4d1338385452034fbb3cdbd
MD5 7bc0b4764d4e6b969161c68c0c7a1e82
SHA1 705d5f435b00c7f56db9c735772b10af55a10721
SHA512 32a86c2ba770fc2ba49d3492c4f16ea43dbb39cc96595da9eb453eb1e3a084b94878988126b2fb2afb1ca8543724c16877b49b1157de585e474c6feeb8117630
SSDEEP 24576:x3vd9CHKy7GZ5sqjnhMgeiCl7G0nehbGZpbD:hvd9CHKyajDmg27RnWGj
TLSH
T12625CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 c7d96410daf3179130c96de50f5d17a0403c1e119d79c22833e64539f4800ff4
MD5 2a48bb3118e3011c761bc520a917e1e1
SHA1 3531df23745bce222bd027eb8f28589a137420ab
SHA512 6b7baabff78fcebbb76edad16e050fb52ba12e0610339ac2ad998466762113c0206acd1e476cac20501db43dab5ad03f8a0dd68ab3f1f7a80c88fed8af442da9
SSDEEP 12288:ylXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ylsqjnhMgeiCl7G0nehbGZpbD
TLSH
T152C423BE964C41CBE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B28584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 1b6f7249149abb2e82103cc3962c05b840719663613a5ad6a310dd2e396f74f2
MD5 7e6128895fac100b83851fc46d308e1e
SHA1 6520242983d3555d8278c973d7f38d970f573e44
SHA512 bc6aef26b837a7acfd7d134286bdb4f43969cf43eb8a52a9b1d994171ff6a86794fdb4b1b319333959add0aeac1951d1dbb3e1016526f94dacab9401cc1fbac3
SSDEEP 12288:+nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+nsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12BC423BE965C41CAE52644F5C3E9E10DAC073E5BE92004837A9B7CBEF7B58584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 24a86f3c1761a4f1f253d2ab3ee40e0906df7f1fcd5a1b26adb8a444b1f66bf8
MD5 bf6d8cc1d53e8f0fd2c21be44d2b415e
SHA1 88922d4e033e29a73cb14f5103668d90c04d2351
SHA512 b81b8eb52c2707c814042512ddc03ce74e96e7dbba1eb7630ad72c7e82f81a6eec03eac3a7d19c1037867fd65751df42c10babb9e5030fb9b81a13570ca8fd97
SSDEEP 12288:Q8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Q8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T100C423BF964C51CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 48e5f0073a6deccddcab7e64e0980c8a418ef34e0ef1136bb994ca7f5abccf63
MD5 e8009c77b8094f3cba3e3bfcf4e2506b
SHA1 7f2b52c8b479441faff0bf3c69585590ee638458
SHA512 92948e6427ceba103df00d8d8cb663c4f58a062458d021a65d8a268f5ac4a0ee37f93ee2949875062df407f0747308a79c16cd0a7589b0360bb33c09a5ad1855
SSDEEP 12288:qqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12CC423BF964C51CAE52604B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 9cff0222dd2bb8b15b638b9b117faee1d329290f7883781a6d740422a5d28ac6
MD5 3cd395c83c921e9e798c0d67e2307694
SHA1 04b42e7f8abb6a390fb4b17774aa72248a3c15d0
SHA512 3046f8625f6bca779a221c1a92b4096c9981b0b2bb07e27bb22dc18d48700d7bda8d8990088178e328b0011bcc6ca46f9fdeefda2f67191d29b218c11ba44ea6
SSDEEP 12288:2lXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2lsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12BC423BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 9429b70ab5ddbe56ce2581a9607ccb2f6b36572ea392a6db825c6e15ad8c1071
MD5 a9c2cf145d44bce3b1a8358d143b6f22
SHA1 dfc7a57322713319e31fe515f0ccc254aae6b2d5
SHA512 fe5b722167b2e980735d7ce89f95c703f0b9b375164a071fd7ea4e9abc05f640e7bbf1b55bf6b565abaa6eb3136de092df0d9bc8f53bbeb7f4dac0a9e9bc4111
SSDEEP 12288:mSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A3C423BE964C41CAE52644F5C3E5F11DAC073E5BE9200493BA9B7CBEF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 36a96cb5450a095c0feead237b49e604fe678e2e53699f413245445f8d40c28c
MD5 695a86ce47010c2a225a14b11c3749c3
SHA1 8372f81494bdb9d1bbb8ce87bc708b3d92621393
SHA512 e4ddf01036d21e3501d1bb66cd6ceb0318b5d7578647a4acfe10dd5d1ef48b03489cad322c14d3e8273e4d560d9bd64561310263146fddaff11f6b001e64705b
SSDEEP 12288:uYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F5C423BE964C41CBE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B28584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 7787a8388c0a64527f9c554ea57bfb11f9c264e91d9144809b6de3de4e0ddca7
MD5 85ba3b9df02a858f1e477321de53ffb1
SHA1 50eccca7b94f6fe0c1168c510dc1a46778ee5674
SHA512 88af0919f6f64ac8c76205214d26975749932f26a89690c2151dfd045c85feac4190fa4b06ab43c81eb085ddbd089cb62a0aceea5d044f3489ac63de4b5aa130
SSDEEP 12288:tdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T161C423BE964C41CAE52644F5C3E5F15DAC073E5BE9200483BA9B7CBEF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 5a91e8c68f7514376d5db6c5db5a32abd7e5ca8241f6a975be004408e9c90227
MD5 16629db34cd87c41788a870a16a89663
SHA1 67bb7d41a75a5d2261abc2bf0759381b2d2a8263
SHA512 182ec01152ee209270f85e54ff851912c0435f41e8da054f831594e67b39bfc29657d509dd0c9e440c8d269e5b6394ff436e5174b8acc06e7507e18e56fe33c7
SSDEEP 12288:VYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T102C423BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 60b201ecb5ce46ac7a4f3c52b62c3339d6f9ae99e179c32563b06202439a320b
MD5 de59d01eec10ec7dfc6fbd4e331a0c64
SHA1 79d9f9f9991ffe271c8df676fedf1c9eefa1988a
SHA512 d66571844892992e812d5bc1da08c03a7c8d96ceefcfc2b4e31b8d8c5268f92c66770af9a9cac1675b91165c7b6237844240f61e7d40a6530e29bde6a4f7054d
SSDEEP 24576:LfwvUk9RX6wkyAIGsqjnhMgeiCl7G0nehbGZpbD:BMnYIKDmg27RnWGj
TLSH
T1E035D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d378c4beffe260df39be795e4a9d0cd3c5300f8ab208de31e52692adb56f89ea
MD5 54579d3c1ec6a154ba9a2db381bafab2
SHA1 91ef92a0bebbefb53194e6ca7be62bd88f7a9954
SHA512 3082d7f7e62ebde888814ab96e8b34da4ddf5a1175a4fcfc784667fba606c5e5985c4c51bd2abb8863645d567f6bf655c7a374dbffd0e05634e0ef797e7b1b7e
SSDEEP 49152:qYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VDmg27RnWGj:RySzP9D527BWG
TLSH
T17D066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 eb7bbc82b12b6f77ce602fa8aa445768915004a783cdb5634922daefb60bbc3d
MD5 077690708673a0a406befdb721309694
SHA1 f4a05536b75ee1f65fe9d228ff573acf74eeda2b
SHA512 63797654958d1c3052fe734a6efbedf89165d4f8c8c4d25bed5401fa3641fb0cb37b3da64e9dea8eb80967255cad8a0a4a84e6a461ed365bccda6f509433a25a
SSDEEP 24576:F47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYLsqjnhMgeiCl7G0nehbGZpbD:F47JUQjTirIhCnDHUPfF/FDmg27RnWGj
TLSH
T14F65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 8de1935ab8731bfb5cc44e00cd9a0287196b755006ef7dc2160f1c64e2085cd5
MD5 a415929d603f7292162c4020ae17c5db
SHA1 2fc77450a21434913b4e05cc33b52214f494c3c6
SHA512 d8fc58a51c7b38808e0bb5199483c64c9313944718c7eefabaf2ceacd11c94991006fca8abe2ca7a09a7b8ce307c2f979e9e6173bbf962584a4743a8f6f49014
SSDEEP 12288:Pbsf6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T163E4011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b1d12a9e50f9d7fb87138287323028dea64c0749dd3e1b6dc038f5c35f12e9e8
MD5 c4e03e6bdc775cd205fb7e6916a624ba
SHA1 c1ec9d07d8871c483f4bb94b549cfaef9af2d158
SHA512 b402563a2a080f6ee95e75edd90c3207ab4c2ae1784ad477c31acf4dfc213ded6b2fe6a0cb51986f0fe34f0d30a21ee3ceb841aa0310a0c5855a883028224149
SSDEEP 12288:H4LklU3fuO2fOfMb4opNzRQcRu1b9fiRL+orktot8BqqK8fa:H0kUPuVfF4opNNHu1b9fiRqXt2oXK8
TLSH
T1E13517417666C64FC66D50361E32D2CCAB707C01EE44AF0773C99B3F95B6658BAE2382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 2cf9f4df3b84f064f9cbe5fc3e6a4f244fa044f1cfe272b8a52917032d740f02
MD5 0c10e2167aa370ff4bf0f573f40dd9ca
SHA1 4f12b50c0e47040b7c0ab6565f4b7efaac9cabdc
SHA512 beed5839eb8e7f5f8632cff64f7e51bfbe32dc83f9858e23a55664118686d58b63c44a31814adecacb4ec69fee9e39dc7963561ede73d7a1c2eb763403cef366
SSDEEP 6144:3LkZvJ2fzOpYIRtd9J6YkYhzXCuI9NCML58S1wzenjLPosBD9tMx+msS9w4AF4Ds:8V7hzCuI9tL584jDjGpQ9
TLSH
T11565FA416137D28FC1BB6032032A5B4C7BB4EC07B7496F2673C8453AD86AB55A1FA3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 213723e0ae18f3b5084eaee881bb96e1701c7406f85c68f366bdedd5f5fd6170
MD5 353d2c255278b64569fbcbc42d61f280
SHA1 e14793bb84e9ca1cca1f06b0b286af786c0bb1e9
SHA512 2bf0d0358a8806466384d908478896b89717826d57a3ec060bb051688d9a0a057e76bf332d716f4be052f88f2f1004d1d205406a59c73f92ca4c6bc0f254a308
SSDEEP 12288:W07iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:visqjnhMgeiCl7G0nehbGZpbD
TLSH
T10BD4237B934C518AE93605B482EAE12D680B7E669F1044C3BA4778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ee3593ea680d60c1b2600c27bc8941826cab53e4183315bfb6cb51c334d69915
MD5 8059209473f0f51e2b749f1fd221a4f1
SHA1 4e0260e52fdab32bae7da592c605cf7cf0baf313
SHA512 7bcb4f1ec4b69838cf17bb00762058765cd0c3992cb577fe61ec28b3a84676eb33d5b4240bd944be05f7556f644d4c8d45941835a33808d51c690cc3438a8c1d
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bY0sqjnhMgeiCl7G0nehbGZpbD:dgb4mBIBhGF/Dmg27RnWGj
TLSH
T168659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 80932539db1e7a304f87f29253281b5f18c9f04fc91bb51270cab1d7078852c0
MD5 4ea34eac1a09b1222f32a19fec2e4ef9
SHA1 845c01bc65795746ea0d526b136a01bf04139ea2
SHA512 7d91e958004e2332ba320d860031a5a538bca5d90df0be212943904bc1e5aebabb4593316436bbae14687839bc3d6796ac9acfc9566d6c195bb8154f6e30ef29
SSDEEP 24576:4G88u8FpJqH1bzria7/mbsqjnhMgeiCl7G0nehbGZpbD:77ZFPqVea7/IDmg27RnWGj
TLSH
T14935016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 7b2539e3f1e617200b096effd067098ddb3f925fe1aa574dab8c7049c180b18e
MD5 d13a1eb7f201af3930f0567fdbc8bebe
SHA1 f4cc36183070b3eca97cceed282c8693e4cf5eb6
SHA512 c8cccf42e6737934d40b09b71da2bd674605d61f2056422d27905d8af87cd23b64e1485dd17dfc5da9581096ad315b9daf8f604836eac68749250db29a6b3841
SSDEEP 12288:nHvUrBFrEjwaQ/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:nPUr+NQ/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F805F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 43a345be3d11f087b03dfde078a457e72e05afdf0dfc934f8d16709eb803962f
MD5 95fb607867dccd375dab4306e13a85c8
SHA1 0bae596d4992fc7e240fa844774e8544d2e44133
SHA512 62af782f2cb92210be4dd75a94d0bee82c353c49acb681e1369199ff23688dcfddf9097307ad6ae9c10258432b0658d093ccb0facdfa26acaa28b9f7b9a394a9
SSDEEP 49152:cBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzDmg27RnWGj:/G05lO43biD527BWG
TLSH
T19BD5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 de2d6c3d59bd1e150c0ea8dc81af6f3cf318b840a65e398bca74f8431eea28f9
MD5 982688a240b083f21b48c414e44d44d1
SHA1 2de81f56c5cc62db30ea4abd78ba69d0d31acf55
SHA512 74e49e421549432286d0165a8f312e8993ff4277a3024f36a3e56e911eff944b1269a421d6eb64ad363831440438d7b014122522daf996174f71c270ffb55cfb
SSDEEP 24576:wfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnBsqjnhMgeiCl7G0nehbGZpbD:Ia5POZ3BJt2pasx2+m7Dmg27RnWGj
TLSH
T14565BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e94f8e7ae0fe87ca915ba5006d137b8b64177d72259cab3ac384fe3865887807
MD5 444da461dd1399f4f13a40d8ad56718b
SHA1 3dfaa2e2e2432ad98ee0e2fdb2cc2575fcee574b
SHA512 e0f450a9b86fd3e15f9a21c5cc1b056fe3607110237c02e776657df6511465b3086b72788ba9280a5e82f9fd8f7bf96d44cf47abc52fe88c31b6432b9f324c8a
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkzsqjnhMgeiCl7G0nehbGZpbD:SNc/zEOVHFoDmg27RnWGj
TLSH
T1D2857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 65c2caed12dc705b1912b6e02ba59bc9eb523cd1f0b4903a8f379b3266b63eef
MD5 00d136c11df86e2735a80909ee7f509d
SHA1 74f00809fc405b064686c5dd9d610266a9b41091
SHA512 c9739b252ddf48a138c25d7d74ac3fbfc18fd63ad4459cfc255bb27414b659337029360a41f6c36330a0c36a5ac23e1a90d43e3cda0215152c517732560b2caf
SSDEEP 24576:8TkNvNnaFeYhJNtmZBmdsqjnhMgeiCl7G0nehbGZpbD:8TMwBtOmBDmg27RnWGj
TLSH
T1CF55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 e7c9353dffc4296d6b958cc8501e2c03a22a9043866d3a27e8457b4f975b80d1
MD5 3cf1318d12890f25b78663e5cb1b6cf9
SHA1 cada652958190c9c5b8bf2781e5b2b6528848b46
SHA512 a227cd144c863d9779d229c2581bca27d4946662d20727637fb47f42abeb85cbaf86bac6d037ae917ad512606e0be1b566b9914126152a90122b4e19e84ef88b
SSDEEP 24576:uD3FHshBIYQgA+sqjnhMgeiCl7G0nehbGZpbD:uDVHeBIAASDmg27RnWGj
TLSH
T12825E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1132-80-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1132-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1132-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1132-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1188-374-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1188-372-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1188-356-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1188-87-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1188-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1188-81-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1576-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1576-292-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2932-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2932-361-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2932-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2932-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3044-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3044-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3044-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3044-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3580-128-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3580-120-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3580-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3580-126-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3580-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4256-105-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4256-113-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4256-360-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4492-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4492-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4492-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4492-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4492-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4492-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4588-275-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4588-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4588-67-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4588-73-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4692-94-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4692-100-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4692-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4692-359-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4692-358-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5796-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5796-245-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5796-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5796-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5880-7-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/5880-0-0x0000000000400000-0x00000000004DD000-memory.dmp

Download

memory/5880-303-0x0000000000400000-0x00000000004DD000-memory.dmp

Download

memory/5880-6-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/5880-2-0x00000000023C0000-0x0000000002427000-memory.dmp

Download