e8fc13aff981567265ba579793831f222d941472ba8bc37f315362767b2b1b3c

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Size 7.7MB
Sample260816-wf2glstxex
SHA256 e8fc13aff981567265ba579793831f222d941472ba8bc37f315362767b2b1b3c
MD5 647cb78ae8edcbd342b304cde323fc17
SHA1 021098500d6ac26dfa411551d37958cd6b9f478b
SHA512 0f0f06cbf4deda4a2dd484659efafe16589ac7ffa91a4df7b8a308184a3a367bc48af2caac457a2e44ca69ddc2c95ec5102e812e4c06c1b1158d96c79e9e38ac
SSDEEP 196608:VYnJNM0kRMIQ4B0N6EvjG0CUw53kxs2XRHlc4u2lcIW6YplTP0RQk:VYjWMIizvqkwBEsQlc4uSfW6ETP0d
TLSH
T1BC863302BEDB9431F5FA1FB088608BDA9B3ABE305835806F7F9D015A7C655C49A79343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
4036	elevation_service.exe
5216	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
1408	elevation_service.exe
2544	maintenanceservice.exe
4832	OSE.EXE
3492	PerceptionSimulationService.exe
1064	perfhost.exe
6000	ReFsDedupSvc.exe
4024	SensorDataService.exe
3924	ssh-agent.exe
4364	AgentService.exe
1132	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\618424cde62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f10671aa82ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4036	elevation_service.exe
4036	elevation_service.exe
4036	elevation_service.exe
4036	elevation_service.exe
4036	elevation_service.exe
4036	elevation_service.exe
4036	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4512	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	6000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6000	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6000	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6000	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4364	AgentService.exe
Token: 33	1132	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1132	SearchIndexer.exe
Token: SeDebugPrivilege	4036	elevation_service.exe
Token: SeDebugPrivilege	1408	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 5216	4512	2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe	89
PID 1132 wrote to memory of 5176	1132	SearchIndexer.exe	100
PID 1132 wrote to memory of 3932	1132	SearchIndexer.exe	101
PID 1132 wrote to memory of 5072	1132	SearchIndexer.exe	102
PID 1132 wrote to memory of 4028	1132	SearchIndexer.exe	103
PID 1132 wrote to memory of 4260	1132	SearchIndexer.exe	105
PID 1132 wrote to memory of 2120	1132	SearchIndexer.exe	106
PID 1132 wrote to memory of 5336	1132	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Local\Temp\e59df3b\2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
  run=1 shortcut="C:\Users\Admin\AppData\Local\Temp\2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5216

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2544

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4832

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3492

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1064

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6000

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4024

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3924

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4364

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5176
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5072
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4028
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2120
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 398fe3d462ac3041579e9813ee0495c89d76cf5e2a1e254f5047fc4df1f21dfb
MD5 1d142959f91a8aed5076e0ce2ade3699
SHA1 d5ae895cbaa9d6dafe148c1a7ec89afcd9c86454
SHA512 1f7788120615575217a77eb87d51c6924b1437202da51a1fd6af7d86162a588a7faaa1f652fcfa98807b3bab446e29017ee5ff6c6a6c540cbd55650179e16097
SSDEEP 49152:Db+632BuPkFKRrdE6ohmstBhuXjfS4LWxnI95MdTAcQQfjP+:h3q6HjBt0xTQWj
TLSH
T1BDD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 67078da360072e8ceb5eb937503d83b9fc59940a6a6a4029dd7a7785937e81c9
MD5 c60b51e59cf28c8e870bf3119b41896c
SHA1 64b1b778f4fbe0501030247b7cd9bb06b3ac5363
SHA512 f4853dd7dff12fd4f7282f74f072f6de60e69bc75e633cf5ec3c5d511614de7614d9f4bfc01444aae9be6f757d1fa945e9aa11d88f36478a3a5f4f16880fb392
SSDEEP 24576:aXYfDtczADN94AMdTEvcQFuOjOP95Xdt5c:BtcS95MdTAcQQfjP+
TLSH
T12365F12877D908F9ED678278CCA18511EA33BC514760E78F03E48A6A1F336D49E7EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e37eb46ed88bc1cacdb420369fc0de20ebf91ab0d03309534208a5a05bee79e2
MD5 376b3be026c3735c13ac5e59d9eb5266
SHA1 3ac04dc088250eec93ff137f8dd3f93d707fe309
SHA512 900b9c0de387a7fe5dbad332880711de2bb76f0a590b81190bbfd1f44a1ec5894cb44b4d83f233046185ffd0463df3378f128f62fe03ad8661ab293892143fb2
SSDEEP 24576:l0Le5ji0hmxirMQN94AMdTEvcQFuOjOP95Xdt5c:lPji0Ac395MdTAcQQfjP+
TLSH
T1C2859E15F6788335D073C0B9C5D2A69EED7230865B308ACB4286C77C6E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6ea3bf731de931d36f234522a3f06af8e796527f4571ecf8dda85ac8ad9e3dd2
MD5 c7550eb82b7c3b51dac416ae9b6e0b45
SHA1 1fbb6073403dd6a1a1cd924cf58da51d933e8b67
SHA512 5b8bc44c98cbce517994abf1684cd26cdc03ad4eee7182e27962ea9495b93ab706240fc1620c7b063806253cd70beb00e94c572cd8cb98aed6b41deec5ee9d10
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWE6q8wyuSN94AMdTEvcQFuOjOP95Xdt5c:H/ezSC6vUzPvxHjyb95MdTAcQQfjP+
TLSH
T1EE755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b641cbc7b89dea5ec70b37af2a24c58f7c6e5435b5db6841677d716d50e91dfd
MD5 fa3f116622e8c17fcb1a89b7767eb30f
SHA1 dce88a6e1762c706bfbe545e6bfb3a0b57bb20d9
SHA512 906789bcb8f675dd8a0fb3192aac53fd82e57ea8d55b452d2d258e5939d9cd593a39d93462115139c8f0f065cf57ec9fc2f60db3232cf8a7c20970a6c4ae0ead
SSDEEP 24576:IVbqPb88hv/l+63N94AMdTEvcQFuOjOP95Xdt5c:IVO88hXl+k95MdTAcQQfjP+
TLSH
T1D8559E66F6748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e7fcfb54c7fd9e7625e5b2cf1f1daf1470e708c99814fe37d0d99d72d083180b
MD5 55ab06d1e728d15a7d75be06a354c192
SHA1 2b12138bcc4429cb573c491b507cc10bbf912f6c
SHA512 7e9d9836710bb65daf1e92698fdcc72ee8d75e2022879f24ec2709e6175a9c44b9dcc43abf7fa1c1120a90b250714d6a95eedc9c6847a60c9e914cb85d6cfc6c
SSDEEP 12288:vR0qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:vR0N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1134523643F8D90BBF3DB1A7058F880796C0A9F518E41964F57D35FAE89389C2D6E102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 daefc2351517bcac6044d2b3a357bc23fa6ab9496fab42751ff3fa52cf984f50
MD5 2394fa99394810c63cd9ae81dc4e2ef6
SHA1 2d63baf3cb57ee9a7735cdd64bc5af655dd6fbc3
SHA512 71e0a6a83e49c100832ea24f81a2f5807dc35fd41dbb1ec751d6e7b9798f1a831e67415147314849116d93bc779e977f66f1bbb4715133d8ed39cb1ac806d02b
SSDEEP 12288:jeBNUbTVO86UfqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:jJIUfN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T11165CF3BAE28FCE2C27A4DB85A91C240E77278714F52A3CBD165830EDE235D15EB5C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 20a12fc31e56bfdd5607181d8cfbba6c42e403d89a4d07732de8719555e72880
MD5 71674ae04acac9bddb2c9145cdff54c7
SHA1 4c4650ec3e3cdc33b442cfca183113e0a0188716
SHA512 7e5830c995c73c7f91a5da2759a1a7351559e776c25b52c731844260e5e0f5b47cb5f1d44736738aa81256218659eb3a2a5dd11378e788ce42e983225cae11d5
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH/:zQvGAdlCEL8c/yRNw5Cy0xTQWj
TLSH
T1E2266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 621c219e198365fcea1677a2b42ee91cdb2fa5e44f24b1b7d8188c048dcdc556
MD5 318cd5e359f452738aa772e3282a15c3
SHA1 a00dc7a29023c8e341ba4af5332e8a13e1128328
SHA512 be9d7c3a1f7afa27de9f628bee8c3a582d09c476ab15a49b496654ddc07d36f69a4330edd0535b8aab3cc7d039143c49d1d86a15473f2e8b291549e010a04ff0
SSDEEP 24576:IdewsAjBN94AMdTEvcQFuOjOP95Xdt5c:IljH95MdTAcQQfjP+
TLSH
T1CB75E031FE74E036C2BB0DB21B75C716582D7A204F511AC3E3E88E9E59342D267B6A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d184db7b9a5669b1dd909b1bed636d3d95cf5bea6e687f52bef1dabec7fc63cc
MD5 8b51dc4388545b861623d2d031a1443b
SHA1 768cd0a0f571ee10a442b8c8b49fab72f581862f
SHA512 d9bddc0d6d3b093e08b3d3a0e6af1b3df8b4e4b075580513389ead01d0d42e6db09859e72075d521e5612d2102e3147a1f3d0acff02a22e33a66f873be813324
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHv0RQk:TUEtQevvqc2W1cpV2EI32v0d
TLSH
T105474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c420653f15a17dd6817448c2dac0cf72cf897bd0b77c5220049a2f2ea7ba828c
MD5 4c06722a0a756235f500eb6beb429c80
SHA1 6d646001f95239cdca6e9685ecd428374eea607b
SHA512 b953e92760920192a532623460fd5f3cca79a770bf4623fb7b6dc246cfddec2977f1d3254e8ffc27e4ddade7f7e54d301bb5abf01024221123c66a3f668982d4
SSDEEP 49152:fCbRquA/m2yL5zTfFiV+XenmE3/zn95MdTAcQQfjP+:4oquVjnm20xTQWj
TLSH
T13BD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9ddfd46cba487304ea2054a106f7b613b0b3363ae93ebd1515c4ccfd4df360cd
MD5 f493820327cc19d15f09c29ca5b16d92
SHA1 5bac1145785fcf05d2d3036c797c9443e0f9a7c8
SHA512 57691c41fa9ecb5b6296a1f2bf5da2dfd88ae048c5cb21931d422e1d80fa54d818cb1f851cce5b19079f016cdd690c5f62a86bdeb3db7df7c41a7fcbdcbe0cba
SSDEEP 24576:/AhGLJIFoiwtA5l7S53+N94AMdTEvcQFuOjOP95Xdt5c:/AMyFoiq5G95MdTAcQQfjP+
TLSH
T1CA359D81EBF955D4F5B3AAB899B68171EA76BCA65E31C20F2150D11F0E33E809D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 4a82945e10b3b395138ebfdf596722045584e18659e28361de1b697ae329cb4d
MD5 f566b8054aba7d702c0f279b2b3d06e0
SHA1 8383737863d501ac496ca9597d89fa5786f7f991
SHA512 83f3a16c138cc228250756826af1cc93dc074f81e9e29381c0236ce912bac04d5a3a51128d4b0cf6fad3858d09eda38729858f2586526a7e958d53a9bb084388
SSDEEP 12288:qmw5HEjsChNVBFgl0WDm+CyqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJs:jwuoOWtN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1A665F14937990CF9E9A786388597C136FBB2BC022A21D71F17A0C65F5F37261AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 36b3bf7bbb61713c385bb2a291b017105325c5eafbf1f8ec11703b3a58535648
MD5 9db107c9da5a407e266cc9160ac2d357
SHA1 232941ad34d12e261106ac06b06fc5d3e9bede84
SHA512 af970194b3bde1404b1797eddab7fe7edca34d4c8b98e5a37500fd836c8485f57d09166cbce2ee1af93679e476587cce9e0a880de8a9d6d3987c6380122c9f65
SSDEEP 12288:OBZ1IyxqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:IZuYN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T15F5512593BCC60FAE1A75274CCE48215EB7279525B3283CF136146AE5F32AC29E75332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 06aac67090e790db808c61d0067e6daf1181748f38dd9dc638f7a52534fea081
MD5 68740889a2e02afd57d80489161e3a32
SHA1 81c911d5ef3e19c39a5765719a28f6550572fb3c
SHA512 e0fe3544d4bae8c0bf71589173e822e27c759f5a8e66c1ca640b04b0bd87ee48a32ce86a908a58755e041894b495bf685fdffb5979ad07a3f70c52b6a09415a7
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uj:ZQRQyi36YOcPQLvw2gAf+PN3Z0xTQWj
TLSH
T10B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c0490d52f96494acc073f9f89cc6225ec14f441fd67e79dc8be8c7baf817941a
MD5 20c328265242e515f7b49ea02f4b66dc
SHA1 3fac74cd92f0fb671b596a77226f43015f26de9e
SHA512 ddc2db06c2827acd467411add3e22d13a623e26fabd0c323c72039e7211c06e9f62c519054b13af4e0b603165bc42be62c9823ee3efa3d309c622356aa1d1a64
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uj:hQRQyi36YOcPQLvw2gAf+PN3Z0xTQWj
TLSH
T1CB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 df4e2fa48957024728e40f8772315d5337c48954e47b943100895435c3f1351a
MD5 ad25d6a037a47a15b9167137a28f2ece
SHA1 58a7b643d99dab3bfb8b15d7f4c55fdab30c18ba
SHA512 5378c11da67db02346fa395bf8ed44aa869e2217dd7e6f2ce0ec49480bf0f9bcd95376c3831d574d9c13993003940d384bac6da3a5923b44d042996d70ad41b5
SSDEEP 49152:C68Qg55nhheWu7PNU3/395MdTAcQQfjP+:AthWRc/30xTQWj
TLSH
T14DB55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e223c45b5c45fbc5a11dd10104f4f2596864782abdc0a168e0f78850c1fe044b
MD5 b60bacc7f7f46fdfe2025484fdee1b3b
SHA1 e0976fce341cd58deeecbd8c755f7e0328383f7a
SHA512 f692a69f4bca45b69b203182b8ae5cb8ecb1ddfdc36f4d2813d2cf83bce0b5058c65e52d998aa542a5b4ae688176b8c97cf0d72d638ddd218f15cad708148bce
SSDEEP 49152:T3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk995:Gy5112gYy5azzVvL69nLKnhZM0xTQWj
TLSH
T1F7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 df78f516671cbdc9ab2290d0a8602a286514f1577f4142d84bff614b2514a6f5
MD5 6784e54290fbeb30f64763996961d6d2
SHA1 240e8a46aefc5a8d4fc1750fcbde9b6052644fb9
SHA512 4a208ee721186b6356f88ed85cf51daca7b6308cfabdd7554ebba88a6c2ee097595049885b37fad3a2c712805a52c23a632404315a07e1207d11801dcef67770
SSDEEP 49152:zB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glx95MdTAcQQfjP+:Fu6JmVxd2dx0xTQWj
TLSH
T1FBD59D13F1DA01E8D06ED478974A9233E962BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 149509418644ed5627742c9e169442a9d1f8e83bf3394f00201718504cf53195
MD5 0fb793d6ee832e6a65bd52d2b2f02437
SHA1 8fc5de3b48bd3672c5621d50df80e21a7a60e8b5
SHA512 4d67010edb5862494e3149a497eaf5cb0eed21ba3703b29bb2e37d4e34ee3640f0d36c25ada0a4fcb73612d2bc7786e9f67e5ae89084ec68b3ee13d23c7974a7
SSDEEP 49152:O1hpsNoJpF1A6UU44CwH7R4x195MdTAcQQfjP+:OmifPbR20xTQWj
TLSH
T1CAB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 37b9243ef7cc70b3689440e0ff01ba7d58c51a08b4867e5450fca1bbe1051540
MD5 e7b78302627ec707266ad791e91b14ac
SHA1 db09167900606d4af65f2bbd15d5fcff322ce9c6
SHA512 d6dc64a21f8ffad02888f28f1d32c530422dfe54e3958f36ba07f4cd2052aeca1e5654ef14003a7d7e79fc5d5b7dff0e2c0aa95784da0108016b93b9ea8d0c6f
SSDEEP 49152:4SuZQIY0Be2KRRVtOnks6NMHqY95MdTAcQQfjP+:i5dKTi61Y0xTQWj
TLSH
T119C5BE13F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bd665d01464a4b8054416d4ccbdae89ccaf39899a6c86c29c9025931eb000e7e
MD5 0719e59eea64fdfb84fc3a865eb895e9
SHA1 3d0be7526c65ff4d14141eaa13b6159e40fd7ca8
SHA512 afee11b158452764252b3d5e4313d1f79e3b839e0747c26dd3f986e6f90df2d318b5d98b607897d5fb2876d7040258ceeb7673dcfb051bf6dabecfa659ce4d6a
SSDEEP 49152:hhtSn8EApI0figngiDn0AP5wB95MdTAcQQfjP+:wX2iyph60xTQWj
TLSH
T1E395BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ef0ca28c54774155dc8915943c6fd0abbe170bfab5d07315db79e7a021bdf9e3
MD5 0c5af5ead12bd62563d2ff72f3b789f5
SHA1 a2a666424347cb84b5c95df1c58b5a3730d4d279
SHA512 d4613d7395b88d974eb9f21f913bdaa9032d126094923915d794cf4f0d9d2ac3c6869a31306a5f3c67ab72a3b8fdaea279a73984cf490f6df3e813df0f2036eb
SSDEEP 12288:TcqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:TcN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1934523543FCE81BFF1875AB088E48168AC0E5F47DF02528F63D74A6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6cede2d5ef984d9707e602836eccc9eeac3e2aef86f6b6153e92595feb0d793e
MD5 8751e95167745ab222d7e0bd99432c78
SHA1 cc7431cae48493183d5ac562707e9826dd1afc73
SHA512 0db4fd9fb27a7d433fc3e84a11a3581d7652bfde9802e79489284fea177cbee895de7225db935ba5322251bb98574e2f1a62abdaf07d35c38f72dc212ce5848d
SSDEEP 12288:IlqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:IlN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1AE4523643F8E41BFF18759B088E48178AC0E5F57DF02528F67D74A6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0cd372704c3cb4444080375de26acd442de125840b11a03dbe5c42f762d66a83
MD5 bb431907844b8319ff33d82ccf2748d4
SHA1 8dc51b58cb1fdb38686f4c5b0180314df8158954
SHA512 94fb943666f4fb5b0497b64b9a5dd633634482ae451825407f58036bed6fdd54c2bece759a00f3d0dc58598ee89629644acbe82132a73c1b31b7779edfe802eb
SSDEEP 12288:YHqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:YHN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1484523543F8F81BFF18659B088E48178AC0E5F57DF02528F67D74A6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 651aa1a512a14b25989c74b2add0caffbdabf92a31d62c7450d297e620bd7ebb
MD5 e0c8c2ebf717d3065f854491eee08ad3
SHA1 d9929ba18460da44f899e4fbacd43f7fc827ef09
SHA512 16f6185751c2520636395937e5e2bba01df02c8efdd476c0224db85711886ed9c0472ccf5186ca67244be419d4b7d1f608bb3e0cfd540da54b4cc599c6e66a33
SSDEEP 12288:vVeqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:kN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1B34523543F8E41EAF59796B0C8F48064ED6ABF969F12938F57820A6E0E317C1D9F0069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 04e0af26d2f25d0f7b2f82723340ff8c37123907729a17263a5d2ecb37730456
MD5 430c78f2ca513c0c36887c7e0dca94f5
SHA1 8a712699d8ac07eb337adb39c966e5b57de27a9f
SHA512 5addc250df692b63fd56c60537af9873ccea76c1763dbd165a8c5a3be4db57e458805dbe7c6910549ec090d6192d77ed379486c8a376c487f1e2640471887dad
SSDEEP 12288:oWqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:oWN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1394523543F8F81BFF18659B088E48178AC0E5F57DF02528F67D74A6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e1fd7dc08568a3ff8cf110e8bc4bb14699a63930ac5961185ee7f48b6da2f14f
MD5 c00e7c4f8ffe1feb001687c10ce3922a
SHA1 90c83d5fedcbb5f3f0ef60fa3040a4c3d7ec1717
SHA512 26136cfef491ccaa1864690541dcbf59d6ed78125ef5dce1310b62e1e30fade14fe552d0677f0988c6d782fb2216f7c1152756b1fd9b18e51fbaf5311502955f
SSDEEP 12288:KJqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:KJN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1114523543F8E81BFF1875AB088E48168AC0E5F57DF02528F67D74A6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0b6a48065b43456a9af2584cccd06286a7875a47bfb8eb8f0d8ff356c0a4ee8c
MD5 5a9f82c942e65da2e29c5d4a18bb30e8
SHA1 b5ba3b3773ff095ad58be5eace3739e65042d25b
SHA512 701ee279844e529dd45968fa327160dd3f94328d99b30f7d4546e7585a7752053afe5f4dce6d63d07ecef6f64d26dcdf00a72a6d6ff462634d535445c1d65968
SSDEEP 12288:09qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:09N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1694523643F8E41BFF29745B088E48178AC0E5F57DF02928F67D74A6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e34646f5217167641856418f03170d56d0f1883194804e0874232cb5139cbf58
MD5 64dc3d644761994465bd12e55198a4e4
SHA1 2c9af07f35af4f6e28f86cf1851840d64753d851
SHA512 d788144e5a7ba5c8132470febd41068ab09d90b55a8b3fb2e6761003062a4286d321ff251169e731699304d962531624d198cf0f8a3d9de107b3b5365c8aea74
SSDEEP 24576:vZMSzFVSOFN94AMdTEvcQFuOjOP95Xdt5c:vZMSzfP95MdTAcQQfjP+
TLSH
T146650294739418F8ECA7813ACC658915D6B27C5A0B60C60F03E4366B5F333E15D7EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0eebfe0d395cfdf97e3e38d18b5d90b68de5d2cc7b8299cbc7727e12847cfff0
MD5 f5652bd6c64a10fd596ced51289fca94
SHA1 db6edd489f16d128788eef42d658158eccd04de5
SHA512 3064ab77bc6735cfb73eaea5d02791275ee5d11541807891fcda622e17c059787cf1a63fea6a9d4d061136343bbab3af365cce628512b57e1f56d39a2af85869
SSDEEP 12288:xIqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:xIN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1254523543F8E41BFF28619B088E48178AC0E5F57DF02528F67D74A6E8A399C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 66b8fd4d1b6136860f4e14374de654049a318e786cd70578af86bd0b30137ad7
MD5 644a318cc287a5d08430be4dac2856c5
SHA1 186ef119a3a115153f1459369453af621775ec09
SHA512 fe73b4605165f336f4651836ab743fac2639b12cc3dfb030748322f3e9dd62be8640c4a301f78c53054b2b45d8b74bbc39410d96b7b0becbf8b836be857f983e
SSDEEP 12288:mkqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:mkN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1A64523643F8E41BFF28755B088E48178AC0E5F57DF02528F67974E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 7c5c2b8ba67a30b0b5aa38913fb92d631bab169c9e1a518a5e99fc1c8b24a108
MD5 7155a6c14c63e3e0952c7241e925275f
SHA1 1bcaf6c71906ff28162cb1aa567acb1790149f49
SHA512 b7d8cb32f642f9272bc2759f31ce87c41403b7783388c829d695c851085cf7dd20654c7893dc1bd42bc3df4f4e29388f3d85dc837b424a2c147468424e698913
SSDEEP 12288:wyPz5L8xqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:BzyxN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1295502173B9930FDE1679234C8A14615FB76BD324B208A9F13A0077A1F376D19EBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1de0d00b5ffd63c87200d8f37490adbbb961da226e3246f0254b8d295d138ebd
MD5 ea142b9761c158ca1dec7dfc373a9d4d
SHA1 5b9e00cd550a7b9a6bd3f605797801ae3d8a5957
SHA512 add716878af9134219415166b8a5422ffc2ec1345cdc22e31c11012466d93d1c6f838ba31a34fa8f469dff17532d0aea6b380d0af1ae28a3e2d69bf6b28f570e
SSDEEP 12288:cIqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:cIN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1354523543F8E41BFF28609B088E48178AC0E5F57DF02528F67D74E6E8A399C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 96fd30a9600fce3e248c19eb9153e12fbfc620af1ef53b3fc12f578a498a21f0
MD5 d95b115ce5b2a1ee4324e804256db5d7
SHA1 7f899d5bd8c5c57f23d13aba9a4ef26631ab9e2e
SHA512 39e83433ad7b48b58868fd5f3605da92efe1f038bb7db4949f7063a7d4da10d25e132b412d7d230f0adcfa7ba27e572686242681c9ef2067215999fbcc7bf18e
SSDEEP 12288:CIqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:CIN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1994523543F8E41BFF28619B088E48178AC0E5F57DF02528F67D74E6E8A399C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 dc53f562900fbe2acec9c436041b5a316fdc5d0ab48306002b05e9fea1d7b23d
MD5 9fa302eee9ffde907cbb2d10495c12b1
SHA1 d5797659974ad4faf35dba16ae7e253739391096
SHA512 a0ae85b0dd290e9558bbce6331763984375444651dd093f611195ee36b30d192df097c40261070bbc83af0c95c373718b86acf8743286d7cd3fdefda2f4de200
SSDEEP 12288:ByPz5L8xqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:QzyxN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1815502173B9930FDE1679234C8A14615FB76BD324B208A9F13A0077A1F376D19EBA760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 6d64a9f301198a477bb5f4afc3a523579899cf3d6bc7bba9f93c30d9250c86c2
MD5 048c1b684e526db93165765af5766b1b
SHA1 296d3edfafe9ea909a09db2e21da977e36729fca
SHA512 99a1a8e866e4691bd1d57071c0d010f7a9d3288bb6d4d5234efe0d53e1266542ab2c514e305b9e5ce0f107195a5ceb8eb563c12e0c80d120eb9e3857a904a4ab
SSDEEP 24576:KTHaLl3z0zDXN94AMdTEvcQFuOjOP95Xdt5c:KT6Llji95MdTAcQQfjP+
TLSH
T1E16502A4739418F8EC67813ACC658916D6B27C5A0B60C60F03F4366B5F333A15D7DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 41061b7a10a1dde56f5afa7e0ebbb7d228899305239eb70a061177c39c9feb23
MD5 ddc02d7ce94c9ac45ac29cf5e721b6e3
SHA1 80ee062cafee75376a7ecb853fefdb210ba07dd0
SHA512 a624c2b3312ea4ff8b78536a4604603751d32bca8125804145f1b20c1b7a7e456d6ea136b6947f2aabaaffdbd4b8c78ffdf3a77331f6a02e31a63cfd371d342b
SSDEEP 24576:X37d9CHKy7GZrN94AMdTEvcQFuOjOP95Xdt5c:n7d9CHKyaP95MdTAcQQfjP+
TLSH
T1A475CF90F7E810E8F0B79A35CD768511DA767C5A5B21DA8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 86dbd685873e25ad9cdaec3aff564c7bd1eb08289c4b036de57621a907667991
MD5 e9b9b3f42a0f2231e4af42dd3c404fb3
SHA1 eb789c7fbff3ef3ce05a0aeb55154a3fa8120582
SHA512 584e58e73d97a920d9dd8410d552b65e1e56af3548cb469cff37e406d78fb4b055b5bb6889a6857d52acc836f9f2554373d6cc80cdb1ddd4173c37aa36a20e94
SSDEEP 12288:KnqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:KnN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1EA4523543F8F81BFF28619B088E48178AC0E5F57DF02528F67D74A6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 20ea69e23ab440dd24312e75c56d056863491f3925e391e8d12aaf3cc0523abb
MD5 36ad651d03e7cdad1ae38ecdc9dd9627
SHA1 198e1b347d15dd4d78e3c5605834a5a03af6ac4d
SHA512 3dc46b6005253254dc54999544972b0fc8d1bc6cad7b44edbfa487473499031c3de1d6481e57b23c9085167f4199d909374bc7d1e5b1f42283cf473902a7c8fe
SSDEEP 12288:ORqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:ORN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1394523643F8E81BFF18B45B088F48164AC0E5F56DF02528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6a2a979704d04ccb686644b30918834013d6942ea386e8190af9943a8e83fa1d
MD5 a9f05b46f68a2bae3659db89e28f25af
SHA1 bd24155b66b504d92a8c494153923eea18803650
SHA512 071972ae610ca598e998ca0904a887a41cbcdbca8badd9db4d9a01975ffe6eaee61f18c6cec72a960ba11dce21eea81c73323a5dae8687b67d19c4b573f8694a
SSDEEP 12288:pqqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:pqN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T17A4523543F8E41BFF18659B088E48178AC0E5F57DF02528F67D74A6E8E389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 fb10c34018a93072748e5443c03bb9e32ed8ccf107064680c03c5272a467048d
MD5 5bf03db572d8fd3f1844c8826fce9d29
SHA1 3eae25e05f4efd09bd638a3eb688fddb2c8118fb
SHA512 e7a356617ba6551c43869c7fc08d4c7ef9bf28e8f9dd25f3a8ac2962a482d2a3e444dd8d4aaca7515c5d1c38ae646b5b96a1dcb704bd4c6e0ee6cca5f50b9d06
SSDEEP 12288:eIqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:eIN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1B74523543F8E41BFF28649B088E48178AC0E5F57DF02528F67D74A6E8E399C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 892482b03abc09ce3b5d09d29748cd5d2673a5dd2c49aece5b9b72f13f471dd8
MD5 636587424498f1ef29011a1df74bd205
SHA1 b6446442f62e45d9820d68e9e15ff6de03ca2bd2
SHA512 5be7097db40b318e52c663f524a3907c048d783cecf6dd00a00a07a6b5c1a297ed506b8550385367828987a10649573791fb5bbb35f8ad1f2124acf570fb8845
SSDEEP 12288:4nqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:4nN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1604523643F8E81BFF18659B088E48178AC0E5F57DF02528F67D74A6E8E349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d88a6f53cc42b7f41d7211f17d0d64443a11fdac4c7722f7f80754c4e3b94679
MD5 b3baa5a55ae5b01f8af1e424d1347ead
SHA1 47cb9e845182756fe8dc2f820715076e72ecc94b
SHA512 9c0af3d35b8888e4fc8759e217846ef959740f6e24427e0e447c28673cf944417f56b3736c6244135bd225aee860ba3ed4c7f9d5bcd0290d84098aa2904bf53e
SSDEEP 12288:SgqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:SgN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T17D4523643F8E41BFF28649F088E48174AC0E5F57DF42528F67D74A6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 35b52a0f54af2ec8eb4d0a4eca9edd377a2a7acfc4f1387419a7b3c07b1045e4
MD5 d0f41658b78c97d28fef6d65b38f0459
SHA1 fd30c3e7c842d23c8299b655c75f51d45a343722
SHA512 19820f7e842af01b3a9f63439834a32ccda60f98e1fa6e59d182412b6b34bc18bdc8e202976f4c7c0ee439f67213bfbf6d56d3c3caf7b7bc2902d287eb861ae0
SSDEEP 12288:7WqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:7WN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T14B4523543F8E81BFF18659B088E48178AC0E5F57DF02528F67D74A6E8E389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 8fda616a91c864d28bf74c8465d4ad9170a8e91721844130bb39513a7df40bb3
MD5 262963dc168833feabb83281c99be406
SHA1 1cb1d3698866de5b8bed2837c1fd271daaf6214c
SHA512 f7ca6309c3c0b920c8840f2c4362965a83ec20e79b3ad3a936de7e8e073355fcbe924bbfb9f6d9a345e9e472e4eb8436c8ff573ee06215061fa11c9276d46ac8
SSDEEP 12288:ePqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:ePN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1A94523643F8E41BFF28649B08CE48174AC0E5F57DF42528F67974E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 57cd3904e4320c7f72f515715271c9fd8874ce429d1bb786330126f4ff09841a
MD5 75ac8f2a6fe2bce2046155541f55408a
SHA1 01d9bc8720a699405ecc394879a0859ae84aeea2
SHA512 b345f3bdb6a30b8d0107b413f8da94f30f5c1242bfa16ee118f782d1aa85829c532116871c0c03d04554877862e225b198bac86472b4f13facd7c0a0c67d5bf3
SSDEEP 24576:3fwvok9RX6wkyAIUN94AMdTEvcQFuOjOP95Xdt5c:xMnYIs95MdTAcQQfjP+
TLSH
T1D385CF29EBDC44E5E1B7923C89B7460AF6B178591B31C2CF129A53AD0E37ED09D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9fdf4be60ca0faf1b9260dd23e3f8848d7202f7a2d8aa9c3f9ce39558bce9a81
MD5 e771ee57adf411dfb48c78513d62fab7
SHA1 88f9e0cf898e889bb36d9ce5d6a9cbba6818810f
SHA512 30f69c23410604349f1926ddbddb31b01e8019968c368fa9e2fa8f81db1a26f15633807d5777109ad564eeafd67a0f5e548e7f4d26e57cffe694c31cfbfeadc4
SSDEEP 49152:8YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0h95MdTAcQQfjG:iySzP50xTQWj
TLSH
T1F0067C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8fbbb1a965e4f35135830b1947d36ce940284e86775fd34f153f26b9497ba644
MD5 51ad7ce5b6952b756fcbff302ae9ac1f
SHA1 2fb735278c7d23d89b373f3ae6ae4da003b0b5cd
SHA512 37ddeeebaf3b9fc59542bcae09326803af9ae6865c65d4378b87db8586457cf3ae110eb1476c68bea4d7313934ea760c63fe63fee57b60417e1018495f3917b8
SSDEEP 24576:k47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY1N94AMdTEvcQFuOjOP95Xdt5c:k47JUQj1irIhCnDHUPfF/x95MdTAcQQq
TLSH
T15665AE1DA3EC01E5E1BA927885554A1AEA71782E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e1155bb82ddb6ff3fdc74041e01b7d5ff0dd7664cf82bcae40db45da47e57e2a
MD5 2076e18541e492668e239447c343956a
SHA1 9c063c8ec81f475e007fd94f958411691b405176
SHA512 4ba3161d22995dcbb5f68b6da352dd50158e260618f660b9f4664d302fdcf448239665c716918c81c562ed5ae00de25da55ab59e3f2f2c3874d047cf22a6cd6f
SSDEEP 12288:vNsfYqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:MYN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T18E55F119E68802E9D0AE6271CB958640B7277D258BE1D3CF53D1F93E0F366C09EE6613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 4ca892ff4a8560afca556c1c73ad0db886cf8b484dcca180a26260ccf751ffdf
MD5 46a575f020397f751689ad05b2896801
SHA1 6d1ffd8eeb3658083e83bb5f5200a8ade502256b
SHA512 6cb519f797523bf4f4eebf5854cd5ddd7aea05588c32280a52ea351c278338a1694e974585cf24c9a5d36aa519b51d829b031d8099766b3ccaee524f7199d435
SSDEEP 12288:GBHdtU3fzkAb/QXfl5kJ/m9a+AsOunBQNG1/FQDku:GBHbUPhMX/aZsOuBQU/eDk
TLSH
T1BA552741762AC68FC6A940321E76D6CCA7707D41FE056F0773C8873F9476668BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 d3e4a747e4391bcff76288a6455a825c5dfed1b36e567cd77267d93093d64201
MD5 5c7bea3e08b729d0deaf227808557904
SHA1 79f34385d5c28f174055f0d6b9c2ac99642aa207
SHA512 823b4799563436106598d8cd8f1f0e9a38835a7e89641c7ab0c8c39b6e111fe7d09a2e2c07106558e99a7522a3e78d8302b88ae756812a86f7004ee38348383e
SSDEEP 12288:SwiwumrHBiCaPg7Ol4C5LmcIkCJNj/+8F6N+8256lSvBPD0AOJQW0bl:Swi9ihP29CE482560vB73OqWul
TLSH
T1BC653B00A5ABE35FC9FE50374272C6CDAB746C12BB463B0573448E3C946767EB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\e59df3b\2026-08-16_647cb78ae8edcbd342b304cde323fc17_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Size 7.7MB
SHA256 e8fc13aff981567265ba579793831f222d941472ba8bc37f315362767b2b1b3c
MD5 647cb78ae8edcbd342b304cde323fc17
SHA1 021098500d6ac26dfa411551d37958cd6b9f478b
SHA512 0f0f06cbf4deda4a2dd484659efafe16589ac7ffa91a4df7b8a308184a3a367bc48af2caac457a2e44ca69ddc2c95ec5102e812e4c06c1b1158d96c79e9e38ac
SSDEEP 196608:VYnJNM0kRMIQ4B0N6EvjG0CUw53kxs2XRHlc4u2lcIW6YplTP0RQk:VYjWMIizvqkwBEsQlc4uSfW6ETP0d
TLSH
T1BC863302BEDB9431F5FA1FB088608BDA9B3ABE305835806F7F9D015A7C655C49A79343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 af35e9009bfaa86d48a53b948624f5ad74359d4c8546234df719bca24b7c13e5
MD5 27acae123711edb45148b4e68b5d1099
SHA1 3180efdc09a37ceef033ca4515844ac1139baa08
SHA512 533bb2f1feedf690fdd669fbbf39f141f63dd2cd0c7051e00e9d8654ea407827baa06e0ffae4fef5a964ec784e2cf9a75233ce970eb84c5c032a413ae76370d7
SSDEEP 12288:B07wqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:iwN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1B54523253F8D956BF5BA5AB048E8C1346C0EBF658F0191CFA7424BAE99349C1DEF101E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5f8e0debb6a079cba231adc6d9fe846c7cb2d09e9810cea811d81ccc6172b83e
MD5 ba36b1b5cfe824e32e0ddc8045c411e9
SHA1 bb3f5285bc7533c26b6e4e4555ba1be35686392e
SHA512 d4712afb05b028b164e9a67f4ad36b14fd0a1c3c86336278c594275383cd37d80cda249ca522900e9d658f545c411ae71f0b9c043ddf20a50e9572e924c7e6fd
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYSN94AMdTEvcQFuOjOP95Xdt5c:Mgb4mBIBhGFz95MdTAcQQfjP+
TLSH
T1FD659E1E22EC02F5E0FAD2B89DAA4417D6B278160731D2DF1251427D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 fc532955a02f039e5f4918f338f9609b0fa507146089540817df242604d52029
MD5 da4e73b8c7df46494b3b12fce1589f42
SHA1 df3ce5ca99d2797b38feb316e2ae5d5ff0909ae3
SHA512 9a13a475dc9e02a9b6ba1a908264722c1f9baa170dd7ba435384ee1c0e5f24456c7c8529897c4531629ddcc5f6f2f29e6a338b4254bd081ee291d8e4e468aefa
SSDEEP 24576:nG88u8FpJqH1bzria7/mFN94AMdTEvcQFuOjOP95Xdt5c:G7ZFPqVea7/q95MdTAcQQfjP+
TLSH
T1C185016577E501F1E47BD13889864663FAB2B8210360EFDF07A88B551F23AD14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 c7583493cda8d5c5e17f550d9624773a2b282613af378e94804136afcf39fcf4
MD5 019b2ac6451011e261b2c16572588ab5
SHA1 95083c3b4f1d9bc8d3c35d1ee3e0add815119831
SHA512 5b2511a4158caef6d8c3ff87b5f0ea4d239deb807189f6c851bb39138abe35b3ccfc6ed9f3024890010326b10ca91ca99bb0232dbecb7a7b381fc2ef43e94c2d
SSDEEP 24576:4PUr+NQ5N94AMdTEvcQFuOjOP95Xdt5c:4JQP95MdTAcQQfjP+
TLSH
T18765E12E36DD18E5F676A17C89858219F772B8620712D2CF02E1817E4F37ED4BD39624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e53e547968a41132c018d4be0abc468d9806085f3ca3e3a7247985ccf7820e7a
MD5 c49f0dd0b33126c727acf8867fb59859
SHA1 0300687f55d61730ce629fc0fb735f5a89917515
SHA512 ec84f8e77b8c8f1bb2819191dccb06d2b5f2bc594eb2530c5c54d84b11a303ea3d79813a9c432dd933789de6d30a6d460eb304a039efcd4a3dda2a2d004a7f9f
SSDEEP 49152:cBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/95MdTAcQQfjP+:/G05lO43b00xTQWj
TLSH
T169D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 87f0898c0d20e34e357e0ffa159b49f4f76cf491a948e0f525400705acf611a9
MD5 b72dab31f25d3a27c08f5b1b7a33ed2e
SHA1 cf229463b68c5952473cd75cf44c74dd999f6c89
SHA512 ece68a45eff46a191fd532759661d7083e57ef7d33afc6d00c643975f6ff807b4d51524feea66f777aa7051c7fe61784f089561b09dfb862f597a4a7dfbc352e
SSDEEP 24576:dfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnjN94AMdTEvcQFuOjOP95Xdt5c:ta5POZ3+Jt2pasx2+m395MdTAcQQfjP+
TLSH
T10F65AF5DA6EC01D5D5B9D17DC583861AF5B1342253329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 110dba2d7c42bec24261c90240dd9c1143ae2c02ed2ef1b238f1fdac4e0e93f7
MD5 f13fd036ce6bad11f04e79de4a4e5af9
SHA1 4e1db5aae10a8d1c943e00a3fca14c0a168f2d0b
SHA512 5ce525b34a56a410287fd1729e282b2008e95dc22ee30d3578b9da593983bec71edfc67767d5b241be25cb67a1f7072886134bee278b5b151b3b690c404b1b71
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7FkNN94AMdTEvcQFuOjOP95Xdt5c:LNc/zEOVHFK95MdTAcQQfjP+
TLSH
T113857B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e7fd7bd9f369bcfde5f00b49220226d32f5466bdbd3374915dce891b6e33e827
MD5 001362071d7d51637953645724cc84a3
SHA1 8ae43316532437d1017363f727f8c26f600c841c
SHA512 5df5ef2fb9cdb7c723ef2ab8b989200c6e492e75c886648de580e7728543b8c52ee6aa3afe8eb5e07a58f599643d1df14ed85e0344fab151e6825c4a3b94a935
SSDEEP 24576:s8kNvNnaFeYhJNtmZBmPN94AMdTEvcQFuOjOP95Xdt5c:s8MwBtOml95MdTAcQQfjP+
TLSH
T17F55AF6E7AA846E4E1FEC6B4CD238512EA727861073293CB5390C13F4E279D89D75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e27d0cece8af577226f2ef9d76b1c58b9b51bbda793c3037830cb24a11fa69e7
MD5 1c9dd9d61c559499c1e0b5607f64cc89
SHA1 d7dcb259ce222f05d0af437dc601ded266b9ee14
SHA512 fb2dfcdc33643430f3e36bbcf0ebd1cb7d70aedd8105ec1b7cddb5e8906daa40a8c2ebf87b00f81024a4a77dc2451149c29b6fd95497737e344cd17e7ba94109
SSDEEP 24576:TD3FHshBIYQgA8N94AMdTEvcQFuOjOP95Xdt5c:TDVHeBIAAE95MdTAcQQfjP+
TLSH
T1D975E17DEB9C00E4E57BD1BCCA638506E77138A9072256CB02D481BA5F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1064-86-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1064-338-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1132-372-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1132-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1132-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1132-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1408-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1408-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1408-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1408-127-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1408-42-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2544-47-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2544-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2544-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2544-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2544-60-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3492-75-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3492-81-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3492-266-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3492-73-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3924-117-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/3924-371-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3924-123-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/3924-115-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4024-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4024-370-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4024-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4024-368-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4024-104-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4024-110-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4028-378-0x000001D2A98F0000-0x000001D2A9ABA000-memory.dmp

Download

memory/4036-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4036-15-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4036-27-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4036-28-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4036-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4364-135-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4364-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4364-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4364-137-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4364-129-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4512-6-0x0000000002730000-0x0000000002797000-memory.dmp

Download

memory/4512-1-0x0000000002730000-0x0000000002797000-memory.dmp

Download

memory/4512-85-0x0000000000400000-0x0000000000BC0000-memory.dmp

Download

memory/4512-7-0x0000000002730000-0x0000000002797000-memory.dmp

Download

memory/4512-0-0x0000000000400000-0x0000000000BC0000-memory.dmp

Download

memory/4512-270-0x0000000000400000-0x0000000000BC0000-memory.dmp

Download

memory/4832-229-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4832-62-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4832-64-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/4832-69-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5216-265-0x0000000000400000-0x0000000000BC0000-memory.dmp

Download

memory/5216-26-0x0000000002760000-0x00000000027C7000-memory.dmp

Download

memory/5216-30-0x0000000002760000-0x00000000027C7000-memory.dmp

Download

memory/5216-21-0x0000000002760000-0x00000000027C7000-memory.dmp

Download

memory/5216-89-0x0000000000400000-0x0000000000BC0000-memory.dmp

Download

memory/6000-353-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6000-376-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6000-377-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6000-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6000-91-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6000-97-0x00000000007B0000-0x0000000000810000-memory.dmp

Download