d63d969cf79d4c259354a5a104c5142dbc18c5541cadaac0517c484b0803a0fb

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 08:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Size 7.5MB
Sample260824-knwesaej21
SHA256 d63d969cf79d4c259354a5a104c5142dbc18c5541cadaac0517c484b0803a0fb
MD5 7437351742f772583d2e0fc06a79c156
SHA1 c8e9cc4c2b0e265d9a1cc3f35c25d604729f6bb7
SHA512 e34475b06506400f015d36c47fecbdf895f44c0527dee555c9a17d1d55a466d5018e3c7799af7300aabd660677382e9415a17bccb405b027c7e3d0a020497176
SSDEEP 196608:6SGXeD1sb291kfEe1/mzi18barGioBSMH6aQcGiRfVQBWG:67XW1f7AFczimb7nRe3wWB
TLSH
T1B9863313F294C061D63F12360C6DA6581767799ACDB8688F5F8B86486FFD0883E71BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
4116	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
4384	elevation_service.exe
4440	elevation_service.exe
1884	maintenanceservice.exe
4904	OSE.EXE
4400	PerceptionSimulationService.exe
2020	perfhost.exe
5768	ReFsDedupSvc.exe
4580	SensorDataService.exe
4676	ssh-agent.exe
572	AgentService.exe
2968	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b596caade62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067c5e940a533dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a5a04fba433dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df143ef9a433dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a198baf9a433dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001748b240a533dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000178351f8a433dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc855ef8a433dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4384	elevation_service.exe
4384	elevation_service.exe
4384	elevation_service.exe
4384	elevation_service.exe
4384	elevation_service.exe
4384	elevation_service.exe
4384	elevation_service.exe
4440	elevation_service.exe
4440	elevation_service.exe
4440	elevation_service.exe
4440	elevation_service.exe
4440	elevation_service.exe
4440	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1300	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	5768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5768	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5768	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5768	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5768	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5768	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5768	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	572	AgentService.exe
Token: 33	2968	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2968	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2968	SearchIndexer.exe
Token: SeDebugPrivilege	4384	elevation_service.exe
Token: SeDebugPrivilege	4440	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 4116	1300	2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe	89
PID 2968 wrote to memory of 5532	2968	SearchIndexer.exe	101
PID 2968 wrote to memory of 932	2968	SearchIndexer.exe	102
PID 2968 wrote to memory of 4272	2968	SearchIndexer.exe	103
PID 2968 wrote to memory of 3392	2968	SearchIndexer.exe	104
PID 2968 wrote to memory of 4116	2968	SearchIndexer.exe	106
PID 2968 wrote to memory of 1492	2968	SearchIndexer.exe	107
PID 2968 wrote to memory of 1752	2968	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Users\Admin\AppData\Local\Temp\e58e74e\2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
  run=1 shortcut="C:\Users\Admin\AppData\Local\Temp\2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4440

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1884

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4400

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2020

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5768

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4580

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4676

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:572

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5532
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3392
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6a536b527d242499dec6ac5bf4863dd3639742c7816ed7b2807987d5395b6be4
MD5 8bc69b41734504ba85f300f3d522bb5f
SHA1 412eccf6d313cca8988cb93ff80417949731dd99
SHA512 3b224834ce55259af86434b55104a07f8744bb35d5297c97ed3aef3d458ed957557245d4888a066ef53774ff2cbb2d2882f664d531d5b33fb3eb0c8e77910827
SSDEEP 49152:5b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnXDmg27RnWGj:P3q6sjBQD527BWG
TLSH
T15DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 0207d9c6c73ab471387ab995edee6d4ee4e88b9a42803cf9468178c83f29452e
MD5 0d652b6001289082ea71d7e122647f55
SHA1 ec8275c1af7e5698236e0d23ab53124b8d050da5
SHA512 87a76a94e16ce0c15ea51992df298727ce94e175cc2159b5969fb3fde196d56ab0c06925c7fae8685ceb26d579c2264597585dedfef74ab917ea9a98ddf5e0be
SSDEEP 24576:IXYfDtczAIsqjnhMgeiCl7G0nehbGZpbD:ftchDmg27RnWGj
TLSH
T1B175F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 ce7d8dea755a0aaafc0c4c0564d2893e40a6a662a6964d4b683e5b4e340024d3
MD5 78c3167ebd221ffd4531a1421e4ba3cc
SHA1 892301be06a89fc9958b4dcb5e4255a751a43d78
SHA512 7957247694ae0dc6c6a9464b961ae06e6d22b950a68f7b92fcd8e92785e11df95e7a480e80090d5a1650e73853bf8cf6c7445601593ceefaa1b61a5b1279ad84
SSDEEP 24576:S0Le5ji0hmxVrMLsqjnhMgeiCl7G0nehbGZpbD:SPji0AnKDmg27RnWGj
TLSH
T143959E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 79ccaf382593e5ab8ffd6f18fef21404fe264eecdcf848b285f0ad591d8958fb
MD5 ec5a52c3053a4e471dbf468bc8dde426
SHA1 50d816df7d4e2c0c5aa6888695d046f757c92c8b
SHA512 ac694f51fa7bbcf0e2b5c3285854524455d0639e0c96f8e64c3f37aef9762f9cfdc0051997693d1ae5a28783e615a32352623fa715099f5371b5c37f0d353c17
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWn6q8wyutsqjnhMgeiCl7G0nehbGZpbD:Q/ezSC6vUzPveHjyeDmg27RnWGj
TLSH
T1E1755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ccd2dc52edaacac3d4ab3ab2364a07309ea212169d71fd6980f8f7fd23fdd419
MD5 51bdf5902ff0bfdc5113b60f7abf9abd
SHA1 4a247472249a415120bce02ecc3231d48621d81e
SHA512 0e1780c683b9a671ea5798f0fa87f7a74a9527f6a5a06ba3d8b3f868d9a9b8688a534d258a10edc9972c4ebc6d197b890ff37afdb589bbfd9301c1d4e0e9fc84
SSDEEP 24576:bVbqPb88hv/l+YksqjnhMgeiCl7G0nehbGZpbD:bVO88hXl+pDmg27RnWGj
TLSH
T1B3559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 3f04da7bb381b4a75bd140918472886d71ea3e6ce4fab8676e1b519ccaab5c33
MD5 c1055b8ef904a83bfcec2f2ea8d586f0
SHA1 3ee39bb30e78ea2a25939689c3bc2f5a59bb62a5
SHA512 315d24dd6dcf07c82ef0742ead0303554d70285ed08b57c883ef3b2e6787d6a6118954395d61051e8cd79c3ffcad3214c797ac854ed70b3b4e6495ae4addbfd7
SSDEEP 12288:q03Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:q03sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C5523BF865C50DAEB7608B5C3E9F11EAC137E56982008536AA37CFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 993cb189876929db600922970bfaa56822903690e0551a52d8db261276162c7f
MD5 182bb8cdfb6e368b121898a7c4159502
SHA1 10cd8d8255482875c93713d0d365cee3bf45ef92
SHA512 49a2d14848a7590f03a5462690bc206872b752770d512679511bc31e5858a0bb5e6a9673d4344b7ae4a78168470bcf3621541ab110928e0526a177692338514a
SSDEEP 12288:AeBNUbTVO86UcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:AJIUcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17F75CF7BEE28FCD2C27A8DB95791C600E76278314F2193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 149777b7deb72d444014b5d6c4dadff3dee015defe3832d5f5060662528e8bb1
MD5 14b9d1745c922c032734e63f1118c2c9
SHA1 3339cc8ac2d0fbf357ebf963a30b50b7a2131924
SHA512 549f68752752620538688adb93131baaa1a46b00c5207f029b82617b3159e867c1b63d49517f95443e0c445eaa649987f27b39c7e9d4abb72a5bee9f5aeac02f
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THj:qQvGAdlCEL8c/DRNw5CBD527BWG
TLSH
T1AB266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 26c3d84d6a831943ea8e39174e2b89731feba7216d95b11fdedf426b46f269e1
MD5 4a7a563a8b757f14d7fc67e79c1e56ae
SHA1 1332193b5c3ecb28300cef056ec4f46e942b232e
SHA512 6bf1bdb5ef87a81891d6284b8735da5035fa825d60d6d5d355181917c308fbf017691007b3c62f090c3b445f8cc168373043030715736fe3b1b702368e2225c2
SSDEEP 12288:CAwSfxL/2Dc3lDLLmt0LDQewsAj2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:HQewsAj2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1e9df1687d7f8808dcb186054a259d31818eb08fe4e21de7df61ce2b870929ab
MD5 e5871d68f9f825a8722f22f36188822f
SHA1 37c99858089687d69810c84f4b11a434689dbd1d
SHA512 48fb26c131e9e30769c2c18b9a3dba1b09fb09c68aebe097c2b6973a9a253f28398f1a591492ab06170ddbf0a38c6b02b4ef422e97ecd146b2dc06cfa6266c64
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHSVQBWG:wUEtQevvqc2W1cpV2tI32FB
TLSH
T1BC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 841617457986f001678e1bf8357171a4d76565e99f917fd91a44e960602d248d
MD5 ff1fcfed59862fa75cd69f3e8290b4a0
SHA1 f25d201f537a9461d11b7f74fc4ee4b2a1f9e2d8
SHA512 e834b4758d7118022af944be66e871f06635dd08a13b420a0028feef3079299027348f3d0b65c29834e7ea47253feb1ce085ee1e0105da57e7ea1f14fc6d529a
SSDEEP 49152:3CbRquA/m2yL5zTfFiV+XenmE3/zaDmg27RnWGj:goquVjnmlD527BWG
TLSH
T193D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0a701197152f6f3d5a77c6e600beb7812e6791ec266b027175bf233c62f10859
MD5 73526f30348c3bed700a90fc02eee642
SHA1 3564da874aeae0cafb13a835d607f4688466a058
SHA512 5a6a33f86c14f9393bcb617f0c880a51aadca604775cb346066019435f666b82747c915f93d66df401530f0503fc71bcc715bc7d976c2a7f79b453c32a9b0183
SSDEEP 24576:6AhGL3IFoiwtA5l7S53xsqjnhMgeiCl7G0nehbGZpbD:6AMUFoiq5VDmg27RnWGj
TLSH
T18E359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b510fe4852deffcdb5dcaaba116d7a47a8974e6f2f0acf611ef2add907adb5d5
MD5 36a2afd6c138722d5f314cead7f73949
SHA1 ac0d536bbe1d99a289c13efedc9c4c12fee45de6
SHA512 2c79c0a4ddc6ce68be1c6144e734f0df0754c5ea181a4f734e638a03f1c01320807a386386b852d28428d950d33583bd45b2e07eed095220861d79dac9e2ed42
SSDEEP 12288:ymw5HEjsChN8BFgl0WDm+CNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:rwudOWqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D75F14A76A81CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9b0895657c63a6b923674223e256067b66f7b4cd91dc62a9753fe3a5f90cbcce
MD5 09be3b55051d0068d0735900a01fb4db
SHA1 f4b4cb1428ae76e377c86498ba23ef7e26b2b959
SHA512 00bc6cf9666937f47758e83e9d308390b233d50aba7dcc02e0f4457a1c600ea629e919b0b420d3e436b62f852da175d2161b340b925952fd1aa74ee9e5e10eb9
SSDEEP 12288:XtZ1IymXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9ZuDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1406512AE239820FAE163417CC6E5D609E7337C62673003CF166659AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3e3702e5d40557dde1489f3c5777e2b869193cf1aa6f0482e01e699d15048cf1
MD5 1ade70865ea0b480e4cbe4586969b47a
SHA1 f1d4b4ee5aa1930655732b83550034b461dc0cef
SHA512 67e3b032f40697912e1f98ae081ee741bf8ca8d67ad04e489fea9e3f9dba59b30b47e3c7fdb6277d64e60dd926ca98beda3a9391ec8a2594eb9d39865ba7f982
SSDEEP 98304:AQRQyi36YOcPbLvw2gAf+PN3cD527BWG:XQyiKa/X+PNsVQBWG
TLSH
T18A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1270ac806fde32edcd5ac0f168237e850af7fd4cf1e9e3b304e6e0c6e16e69b4
MD5 7026a2b8a0acce23448110d34101041f
SHA1 dc837239bd1c2f2abfe039c298e47e6ed212854e
SHA512 ba0f3acf3eea834ffc63b0b2a2eeaf3cd0565d29685c0dee5d262b7494193410826fcd2c271f331b4e760e6a8d2da56a0dd89d499979da544ed1ae2c475495c7
SSDEEP 98304:sQRQyi36YOcPbLvw2gAf+PN3cD527BWG:zQyiKa/X+PNsVQBWG
TLSH
T10B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ac8472416b29c9011f8d3c7fb2d7d8921d24eeef813ad209dfdaa942c07f47c9
MD5 0237a4eba41861498652a79d241738aa
SHA1 5ed483775e651ba80795fc7d8deb669f54b0798f
SHA512 00910dbde36164b216e39784d266409261c5e899286ece4990ed6a622a846ad2c9b43b95b3f8eb0511309da850ca3c6f7d815f839cbf4e483f713da6d022bc89
SSDEEP 24576:zwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0TsqjnhMgeiCl7Ge:L68Qg55nhceWu7PNU3/KDmg27RnWGj
TLSH
T129B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 02cb77d835923d4ef550a08bca38efd486ea3a87dc00b0127fd7c89c8147a022
MD5 b5c5fa136bc4c038dc9cbd62fb1e2066
SHA1 7e2823f8966200dd1b835ea9c3def7b8c6f842f0
SHA512 4364d009ec919c986718c132210a29b55e271380ac267a938511d934bc97b6b5b23869af27fd2aeb7ed9bd858b5293f86d7c5c1f59203560a5204a1067cc0df5
SSDEEP 98304:My5112gYy5azzVvt69nLKnhZLD527BWG:NLIHEWh9VQBWG
TLSH
T182167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 45ad5ff8ffebecf15389b6101f5ffea69e49bb5ae58aa73e4cadb5676d4e4364
MD5 6b3e0e0fdf5924cc901d2260e79aeb2d
SHA1 4171ea222a8eddc9a18750a3bcd4c1024573f9f8
SHA512 560ae5046e6959d877aa36755fe52bfa00de41f611c713ebe48b3ded8fec8e8f50a5d7ca54b61822d976180cf671fe09fe2347f50042b46718c3060c4726adbc
SSDEEP 49152:tB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glEDmg27RnWGj:zu6Jmdxd2dED527BWG
TLSH
T1CAD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 761817bbdd30e8bf2b007d81d4af11ca91a46fd7a1d40369014c941626abd08b
MD5 6b1d58727c3056db16f198ade17a8981
SHA1 dfe7d2192c160aabb5cbe1808fa96a77c8a01b52
SHA512 4789409eb4cadc93356b1ce908035b489f12b7ef699e4a72ebcd5929913e41f073ab16a7d243ffe45e5c6988014c6f66dd061ddb5b72f2255e6aea6726f9e82a
SSDEEP 49152:11hpsNoJpF1A63U44CwH7R4xoDmg27RnWGj:1mifPWRlD527BWG
TLSH
T151B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7f63a6f150b895372e43e5d6a744a52ea60325f14c36fa67c8854bbc075f8050
MD5 46fb093fd24958a46944b5d042187ab1
SHA1 b10d71c3e8843bfc96efd41e58a2a8a7ee113d6b
SHA512 f61a786a95c6ffa4167bba40eab43e59101819f03ecd62946a653641f38c7208a9b7e4fbab0bb34938115086e57f33b60566f8e9b75d967e237a654c4628277d
SSDEEP 49152:1SuZQIY0Be2KcRVtOnks6NMHqHDmg27RnWGj:b5dKii61HD527BWG
TLSH
T139C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7184147a931474075160b7ba570852926daea8eb3f9a922a46f9523fcb330a84
MD5 66e9f7104df087e59fcc09cd72ac72c7
SHA1 6f737eea89346deb1fdaedeb3c0c292046ae1eab
SHA512 61fc4314fa22a9a6675b7387c162904b2b36aca8536e6db98c446974e2f7ddf991ba9f09927e62cc2e21f795664146b4100252917ee63a73f2fb3f7e24787bab
SSDEEP 49152:7htSn8EApI0fig3giDn0AP5w0Dmg27RnWGj:aX2imphZD527BWG
TLSH
T1C495BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 02e1fd62ccfd5b1fad6067c5caeb34cef883df8e4f174a62e8b9d79ade4b9a3e
MD5 6c7acd4c60f618831a4885b2775872a5
SHA1 a893a46d7c98a6359870734697b6844eb55e283c
SHA512 eb0aea15e50787145826c3e70de34883cba806bb6dc3cc29519c6cc74209e90b1dea800c6cc7b99713e48b24dbba831b99361a39d736a5a312e070812c51f13c
SSDEEP 12288:7PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1145523BE965C41CBE52648B5C3E9F14EAC073E67E92004837A9B7CB9F7F14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 b0bbe5251b0c04bb3070749f6d036782dcc5530c68c5bc657dfb488e1444d062
MD5 8c26016b642419beeaee9983365f1bd7
SHA1 e4a75978ec1902a904e3e4494a73c92a40a4d329
SHA512 e04e234ca5e2c7f1f3a42f87e25f9dd71f3cf29f829b1d40c1dc84c059bb7b85b7556ceb1acf8aab03a8cef9cbb45a0216e41a934efff1929d4d3fa77f35c045
SSDEEP 12288:LSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E45523BE955C41CBE52648B5C3E5F14DAC073E6BE92004837A9B7CBAF7F18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 0fd3470473c428f80e26296de52c3ebe43bb55a2e80e3443ec52b4cf2ed0a1e2
MD5 4efa4b04589bdc11a53e12edc7393a1d
SHA1 c8cb85dd1ffba2e73c0e5b90aca32b2aef2438d2
SHA512 e0569a69dd316dfe663395aa45d2a63f5698bc7f47af6b75c691238a86e105920ef11ba1a60b5f689bf5c88e656e1081cf41a1c0dbdc078c36a1b63078e4060b
SSDEEP 12288:90Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:90sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F5523BE955C41CBE52648B5C3E9F14DAC073E5BE9200483BA977CBDF6F18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 2d08e936198277f60dd7faf4f2901d1979a75293fc58aa440eb5748f2d8c3896
MD5 8b8571a677f4d2327e52c343818b1aca
SHA1 7cc6f7c682421b1ff00a725fd325a75771f4efac
SHA512 3c03a2fb54c77cf42b46891583c0d4820f838126c5060acb78864a2e556e4a18a0fc920d8f5fd1606f883b927cff0fa360198efd93ee664d7aff93d99852d949
SSDEEP 12288:9VRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:psqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC55236F675C00CAD83285B5C2F5E11DE8237D96EB3005DB6B532CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 24283b1e41eb421eeb116c9730dc0d4eb72da799a7a6cffd9654f8badadf1080
MD5 04ce6d22c71e7bbb8f7745f40e2a2d65
SHA1 e180c79f372d5b53bb2d28a4a3c4291a6d42c54e
SHA512 7fad5e8a76345b9c7cdfcd16a2a60cc7779f93503bc170e5b87bc7a7477560917635a4c6aa563d4a956ad7a6366dd78f1253f2121f0bc1673942d8a6a508f598
SSDEEP 12288:AZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1135523BE955C41CBE52648B5C3E5F14EAC073E6BE92004837A9B7CB9F7F14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 809e33edeb40dd2fa8cdba559b16b0043676f43d772c6d72166efdbf6244b437
MD5 8cd2b135201cc144db18a9c855f2189a
SHA1 b7421e13d07581c3f10748d92d088a2294e50004
SHA512 845b5d59741730728d317acffa8165c1c852fc7402b3d14af8bb2dffa081e6abaab65a4dcd04d5b39d1f3992e322e1b6f66a6898b64d2c2f817de2a67402d9aa
SSDEEP 12288:KuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1425523BE965C41CBE52648B5C3E5F14EAC073E6BE92004837A977CBAF7F14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 6f77f2eff329bbc07113327d4444e1d7c28e89cdf4c846ac370bb36d250dca2d
MD5 c47703a720b6133d14431a94e3547d18
SHA1 3199b8668d72a32860e45cb74ec9475c42d169e2
SHA512 856efb3b0f720f64c041a4ed758b593571fda2bfc8b45d6162f8ce09c9ec7eb4662e34f9108e9a5b2206342adcbdc6d4ec891f3909fff88adfd54a0a473bc51d
SSDEEP 12288:Q6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Q6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C05523BE964C41CBE52644B5C3E9F15DAC073E6BE92004837A9B7CBAF7F14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e1b0dbb4ec313869649eefda33171e0ca70408a934ffe77b8b2e0ee4ed6edad0
MD5 58e8cbc8c9628379847805c9b8fcb11b
SHA1 3ab2a5a3a0b1b4546248e0cdb311edecf5757e8d
SHA512 1d8da170ff10861065c6d6658275fdb7304c95465590e8354ca32981fce47f933b04f8ae416d0bc2f513619886aaca737e25c5a296f21fc4fc0e0f170670441a
SSDEEP 24576:LZM9zFVSOysqjnhMgeiCl7G0nehbGZpbD:LZM9zfyDmg27RnWGj
TLSH
T1717501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 383cbbe55a7a39bd97ad86c6211acc398c19b8261e8ad7d5985db59baff579fc
MD5 0bca65096afc633271e4388c11e05ab1
SHA1 338e8f0a12140e98e46e3f1a6ae1d0c7a666f8e5
SHA512 624a7c5f016c9dcc747d4f6166a0816aa254ba316426665b4af38c9f8b8a435f84dfddd6c7e22dd50d593f8a9fa9cb5c9bfd5ef281f9042ce33abb73c009ec98
SSDEEP 12288:1zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E5523BF955C51CAE52608B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 b283cb7c91161f195e0a4485d9c4b6302767b605141fe90509dea3008381689a
MD5 2655596de721539bb9bafbd419e29db3
SHA1 f97e24bf54786f0a5bc251adf9f3a47d6613127f
SHA512 5e9f0755ad44774aad30534ca2cfe6ffcad70c1b405a38baddebb87106ed290c5b16bbf4e4126e288f136145003303d280e2131e829a5f9dae6966002a646175
SSDEEP 12288:WnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1425523BF965C41CAE52644B5C3E9F14DAC073E6BE92004837A9B7CBAF7F14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 bf47f38c79d9efec6b98661123d5fa58094f481f61671a06ccda9e87ae2d3ce0
MD5 d1093b76dc8878c6b0568c4a20f5a70c
SHA1 9f72cd572b8925a3204f7771c5a0924e98644515
SHA512 3374e93c0d4666a075043f31a53d89612d41c4dce9508d9280255ef914d9d1687923ac508a5e1b29fd8cd95b322759273488352ee6929d1bb37a5c31f00f378f
SSDEEP 12288:AyPz5L8mXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xzymsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E065125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 2f57a000d91e6629d6d8b46a968a170338ddfe9c86f64a1449e7934565c85129
MD5 5e83c1c6b275f655f207dc749d3da4a3
SHA1 3d56404226ab9def3ac8098f3235f9d8f98f8697
SHA512 82d6a29ee709926bf7e4c3a98304fb79d61a7ca35551b661db14947d26f3ec57b3216ce074c24dee684723461fe8a10ed22d0f4cac4d3adcdf0963f8f1e712d7
SSDEEP 12288:5zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A5523BF955C51CAE52604B5C3E9F14DAC073E6BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 9e71f9be871a30819a5004557b2ae2f590465792189e78582d9744888dddb343
MD5 86cf5f5c5ce3416c617445c7e8cc161e
SHA1 a80499e243869f98f65bb3df57ea18dcff5b1a94
SHA512 f61fd1fae87db7bb97d76462436f9a5bc130d3a97a8e0ca430271b17cd2c0cf7ec353b37db7da23edb4cb16a105c966a30fefb66f310b439a1a54a14da3bcf9d
SSDEEP 12288:HzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1835523BF955C51CAE52608B5C3E9F14DAC073E6BE9200483BA9B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 234e75bce034affe754d48282deb6a2b92afe3a1907e97aa94a57e709c376db7
MD5 227d8bca75f093e9c997ca444d1a4d08
SHA1 502ee1135348865e52fc2d076d209c3ad442da0f
SHA512 08ed09c6f412c74adb1e3e4ddc2251034a817338f32ee4e68a66cb38cea1b0de96d19f5b8216cd6ba769ef491bf7e55d5b224f0c8b545835c0b4384bad612d1e
SSDEEP 12288:xyPz5L8mXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gzymsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE65025B73A430F9D1368178C5A29A06F7337C3657204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 d9c51bd1c2ebb92fcb914f75ccdde9436f64d562a3fe3343b7fb9787eb09409b
MD5 62d0ea09ada47f55e8f25772bfb0cd0b
SHA1 3a264015b52d7fcfc382d6d68c14cd2d7e001195
SHA512 bdaee5dc3ebaa356ef56b365d6cea5c189bddbcb86d11af76c1a4cc0051b9c8a291bbb195eb12dafbc46959f84e7dd7e99e6ab28e409243ede1e0709ecd3d55c
SSDEEP 24576:KT/aLl3z0zDEsqjnhMgeiCl7G0nehbGZpbD:KTiLljRDmg27RnWGj
TLSH
T1287501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 37c37619fb7b1fee585dfb162ceb9c0155ce7a9820b39da6e22c7c56d9f54ee4
MD5 b5d5b2c280e3d1fe8555d7318ec8fd3c
SHA1 8fc02f33d4c84eedba6da5b524462158ecc6e766
SHA512 c7b73d53509ab83bf5b35777c905ba01622d9780607aea6842ce4f7f2f000e95bad48843a6ea860beca67e92b61403e26376ce8dac876253f0329bad1d3e5734
SSDEEP 24576:V3Kd9CHKy7GZAsqjnhMgeiCl7G0nehbGZpbD:1Kd9CHKyayDmg27RnWGj
TLSH
T11385CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 6b0526f6883fdb95c66b0acba980fc19363e78ca07719b37757a3a951cbaf9d5
MD5 f1b51289dbd57e5826ab7029eebc3c58
SHA1 f33421b36dfde953d06ed63ac08aeb7fc78febba
SHA512 704afb525fa7e4be483d4ca00af653badcb98ec8469eab75a0073e11f4069a743ae33aa97a81431e8c425af9e0028ab1f62b00c447c9a58e965bd875215de3e6
SSDEEP 12288:AUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1235523BE955C41CBE52608B5C3E9F14EAC073E6BE92004837A9B7CB9F7F14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 dc4c983c09fcd0953e41a9d682cda463db5f96e09f5ab3433a820d9555d5887c
MD5 21dd3d6fb9701291869f6f93f6160df8
SHA1 8bf14b7c63a1897f79a6e4b21bdffc15c14e9b7d
SHA512 2531deb40ae184ac321670b505eb69c2408809fa37e9c9469766bcc178cab3b5dec950f77579867549470fa6adaab22a51073b5cc8dd327f89dcdbd7fb27c8b2
SSDEEP 12288:dGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13F5523BE965C41CBE52644F5C3E9E10DAC073E6BE92004837A977CBAE7F18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 0087063e62c42f26e2007be91052bda7cf23bce350b9ec0a7abdd9815fe15714
MD5 c018c028303e12935fa242c72c6a0362
SHA1 84486d0b1b02e3ebe889bd1e3e7ba95f725a3454
SHA512 33ac5d8efe2b9d0298f2b9cc2ef97289e1db856e7d21f157afa9d028b1df0e5ca0e148c9f5fcc629fead23723c034822383251bbc2c79b60d7eb77c25d422867
SSDEEP 12288:tVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B5523BF955C41CAE52648B5C3E9F14DAC073E5BE9200483BA9B7CBDF6F18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 3ca12f62e01d64eb74f74d3a323187f820928e5c48fc22803d9d79ebb42c8d14
MD5 a62e9ed9ee553214c6b175ad45f6cf45
SHA1 9f4346879db9e95e6f8f7eb953aba5de8ada5964
SHA512 6178cf54a96af574aa369c1c9b043835034ab6f629ac51e90786f1a74e35f3c23d75be626d748a6c83b358102a02538178217ea00781aab791a000b5a5b287ec
SSDEEP 12288:szXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:szsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1045523BF955C41CAE52648B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 0f149b99d73307464a0eff2e7bf37d88fbc23c2de80a853fc83c526890dd0596
MD5 43ab53a37b017f951f0ea1e8ebaa907e
SHA1 6b2a8d8b793e65bb78b9226cfa5158d4cfa82c7b
SHA512 b3f8d967541c61287165dc0e397fb95f626628b3eb0a1b197b88a6ccaf9a79fe9851773c3d60da25102f220af9bfa74f26f989e40e927ea9d9c852936a185239
SSDEEP 12288:FUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F55523BE955C41CBE52648B5C3E9F14EAC073E6BE92004837A9B7CBDF6B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 ff36122d7fbef3f2b3b1029754f87daa744eba744800ab316aedfb984c067fcd
MD5 3c98a414c4cb62cbc8ea5190917adfa9
SHA1 ae8d2239cca123fa4fc01f7151a3176df5054aa7
SHA512 640d9e0ca615f40de36cae48217bfd6c4bb3aada22dc0408c6d65f21b3b1ed7cd5c9c15bf1350d1b7d1b4ef4fa7b2748776eacc4429329ba7f7b219bd328c604
SSDEEP 12288:RbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF5523BE955C41CAE52648F5C3E9F11EAC073E6BE9200483BA977CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 3c9af0a6a122aa0058dfab4426ac5e08b97892142e4acb51e96aed35d36907d5
MD5 f303b7fbf05c56e201cd7bfe87ba54e7
SHA1 6c698a547e018f134bac6ddf704fc3d87a8d1e06
SHA512 e38f7c8f655be6922516878927e99bd49e2a3689c7a258e57f4aaf94a91e7fd7438074c091e11c29855aeddc0dff4434349f68432e85e30bbef2ef421a42e3d0
SSDEEP 12288:qZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC5523BE955C41CBE52648B5C3E9F14EAC073E6BE92004837A9B7CBDF6F14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 c33e25d06218368db0dc21553fa7e5dcfb0316b7cf79969b77db87807e228783
MD5 119b54cb696cf5ba95dad7eafe18eee5
SHA1 3acd14815617d19ffeb5087af0be4e999ba6bdf7
SHA512 21c2aebc7e6c07c3fad13d296e0215633315073f873dedc81e5a7e8e54afe3bc8f45dc1d0b559c6dd5d8d068fa248cbb12aeb0d0f5b85216d67f56d5093e8062
SSDEEP 12288:cMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1775523BE955C41CAE52648F5C3E9E11EEC073E6BE9200483BA977CBDE7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 c88079cb671f4c0b4afae82f6dd6af4debd53ed8aec43c6b2b5377c4498f93d1
MD5 f47b653850d339d640cb2fd908e9a15c
SHA1 9e074bd5defa41589096d4c4720738696289b9c1
SHA512 1d1c1d37195b9337009c5002e58869c04ab40b46eaf81a764e789ee5cb29349b7a8e41c0802c6f0ed44fee8d7e939258d7f550a16e254f96040111b551ddc40c
SSDEEP 24576:ifwv4k9RX6wkyAIXsqjnhMgeiCl7G0nehbGZpbD:+MnYIrDmg27RnWGj
TLSH
T19A85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0b2e5cfc6599a868ebf7862a984e3cacf181f0aa178da6fb3833119a14ac499e
MD5 8075fe8b31a886cbb0c539d5b77c55e0
SHA1 3f5511c22f507ef8fb389e49317fbcc7118d9ffe
SHA512 60374f78c048478bfe9940e58994948c30d5af46241549d9952237a8eda46c9bc09ece7debaf731633f013dff39d644ba6b88aab955b4923cf561aeaaf203945
SSDEEP 49152:6YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0UDmg27RnWGj:BySzP8D527BWG
TLSH
T11A066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8eb89ddbc87c5d059473ced00e6951d6d4d968568e78fedd96bf0780fabaa214
MD5 96e8c7311de86c8a8d00f8375eb9c5e5
SHA1 779ba349deeaccf885c9ecb4f28f65f8e6e85a41
SHA512 e8013706a8ddf243ebbc19f6c1120ace21fdad1b48c26f3617def927011e36e48e917736109426ed4569922c626c5c75259f2e40a04510be60b7c687280fb4cf
SSDEEP 24576:q47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYisqjnhMgeiCl7G0nehbGZpbD:q47JUQjTirIhCnDHUPfF/EDmg27RnWGj
TLSH
T18E65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 61f4d2e22f2f7328831a967631f752fe9891d8e72e0831bc5fdd6f883f096184
MD5 95d16ecf44c08dc5e2b115bcbcda461e
SHA1 c8518c73694950cd22e9afb66697bbed97e208d9
SHA512 9ddf24a0387e873c15d0505179121dbfb844e75cc6c14d3cf55604767d1bf55ea154558582dbe66bff2c6a545e647eaaae488faf50e9925c9c47df1859c6dbd7
SSDEEP 12288:oKsfDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C365015AD29802D8C06E6179C3969605F7333C2697E083CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 a03879619c962c642b5fbb117dcbb55b6d52584b9de9354d635cf86d797efef7
MD5 8d129a1d07007873f2c98c7eb6f8f383
SHA1 ec269f5971df0a67b5bd51c5360f40ccd890fc7e
SHA512 699fd49138f5da76beafa2afe497a4b1a3c5f7ef4427fe608a588dd112ecf8d0e715c6bf5d734eff511ea4529f964da78a8f37a18179dba1cc0237db59a314f8
SSDEEP 24576:Cp3CUPomoZt4pCB4o9khtjOtgv3PwgLA7L:yCUQmXcB4o9kTjOtw3ogUH
TLSH
T1B55538417626D78BC6A940325E36D6CCAB707D01FE45AF0773C8873F9476668BAB2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 6fa7a764af964235d316716209830d1800f5c4a4c67e2eb51bb668321e358646
MD5 7530f37eb97577c405d57c144b9708eb
SHA1 cabfe54081c15f2eb4a316086147c0ac9580517f
SHA512 c093629692ae4851312120ea4c62c38df404afe96f06900571e2108afddc9b79edeab5e40907d9895700c773717252fb5f7ec7418ebfb6e65479475aada6d66e
SSDEEP 12288:PJswp+fsiFk8xB3F5MnWkuy4AkYsxW5ot3jri3zvn816ykg4u:PJswpEB3vQR/ZBTnK6Bju
TLSH
T1CC551901A5A7E71FC9FE50370732C6CDAB749C06BB46270573448E2C9877A7EB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\e58e74e\2026-08-23_7437351742f772583d2e0fc06a79c156_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Size 7.5MB
SHA256 d63d969cf79d4c259354a5a104c5142dbc18c5541cadaac0517c484b0803a0fb
MD5 7437351742f772583d2e0fc06a79c156
SHA1 c8e9cc4c2b0e265d9a1cc3f35c25d604729f6bb7
SHA512 e34475b06506400f015d36c47fecbdf895f44c0527dee555c9a17d1d55a466d5018e3c7799af7300aabd660677382e9415a17bccb405b027c7e3d0a020497176
SSDEEP 196608:6SGXeD1sb291kfEe1/mzi18barGioBSMH6aQcGiRfVQBWG:67XW1f7AFczimb7nRe3wWB
TLSH
T1B9863313F294C061D63F12360C6DA6581767799ACDB8688F5F8B86486FFD0883E71BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 60927dcaf6d6bf777c7f2eb62c41dbdf6cf43105a12ebdac12aade668d093796
MD5 ae78b4c6c85044ca670f7101efa9e435
SHA1 413807a96b3b276d4abe2b51be8ad589b5e71320
SHA512 1b688198563a81d9bb44bdbb37c0ecb0885ccdc3dde47fb205cd050a1f9bccc3fa5e03f6278fa130fe51e9c4bdf454309a1f25538754534d2fe34e47abd81b29
SSDEEP 12288:+F7rXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D555237B934C518AF93609B482EAE12D680B7E669F1044C3BA4778FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 78d85e2d540cf1f8bdee1ab504130bd643b931252f74815b23339d54ced06493
MD5 a80312cc30ed923f5b7f1fd7fa07867f
SHA1 a3cd4f72604301e2024a6dfb249353838cd4bea9
SHA512 ab80399f51321d41ba1b39a49c9a89880bb8bfb6c6051d651937c95c90405722ad1523a5fb7c0a2a2dc052ef637ebdd0c5b5b4ff40f76876132cdb3935ff369e
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYtsqjnhMgeiCl7G0nehbGZpbD:Cgb4mBIBhGFmDmg27RnWGj
TLSH
T17D659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 37d68a6373c9adc93dd61019505c7e27b0fb06e23737543447745cf6312246e6
MD5 53169be0ed8a6d4d716d82d95e852b2e
SHA1 d88aec7a2f72eb325501cf6ffe278e799bd4883c
SHA512 963542fb0eca0e05681066972f0569277c9992b9215c0f622e2caba49b73aa6b4e9c908eeab4490d2a4b29660f20be8d9bd9df2a9311b322aa341f488a97a6e5
SSDEEP 24576:jG88u8FpJqH1wzria7/mysqjnhMgeiCl7G0nehbGZpbD:S7ZFPqVPa7/pDmg27RnWGj
TLSH
T13C95016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 32ae533c39fd45de5d310a7f122ba595e1d4feba857e041ca63cfd3036b08854
MD5 b552eb914c3d61a7d905cfddbe11f588
SHA1 9ffb43ddb90b945dcd5f2c0711f52ecde18a1fba
SHA512 24719f4ad57c929fa9895658befdad05cdc899888d8cc22044c38476ed28640fc15057303015b419325ab7cc6dcbfdb4599ed201ba3496456ba0a5ed769e300b
SSDEEP 12288:EHvUrBFrEjwaQeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:EPUr+NQesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC75F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 59bf835e482164a43d6604d8db7bba711871d184797b28390299bb8aebcf9364
MD5 777dbb43b5084a43fa4bc62f2320686c
SHA1 67fe04099e1be55339d0e248f73377fc94138ce6
SHA512 a0256acf34de0294de8f109d17087e00409f45b13cfbca691f101a30519574e341e71c5998ef1459a40b566973f4b660f82207c2573e8c23ce654e60b4a84619
SSDEEP 49152:UBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjCDmg27RnWGj:3G05lO43bjD527BWG
TLSH
T167D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3fafda1c44258e3624bf5b291ca07feb7829f34957a3b0adb37aac47fa84f70d
MD5 a235b10cf81ad1198ae6368b4ada574d
SHA1 b456234e7c443935cfc6455f7ac9726b37f1bb49
SHA512 a4da5af1c8a0c69b9509d41ec61f9c6d91b3203c26e956c7c71197087667fd932dba7f3c6182d414273c345d0b9987b8c78b4574c8c9e6fa372238c6fa4818e9
SSDEEP 24576:Ffa5POZ3dpuWVM50JicR2hG0lasx2+47eidnosqjnhMgeiCl7G0nehbGZpbD:Fa5POZ3BJt2pasx2+mKDmg27RnWGj
TLSH
T1EB65BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9b5fbd82ca873213d397855bf8221db7335af26a8b686fb8b8fb774e691d2a43
MD5 80399cc3b846a9590019d344dd1124df
SHA1 3c18fb33233bc866e5445e0476bbf54b47a5d6f2
SHA512 d8b378b6ebc809a3dda0eb0e503d341e2378fe28c86083d98ac570da58e88c1c7f9835667b313e8c6249e861fe7fb632710a02e73fe9e0468fea27ab0a13faea
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkKsqjnhMgeiCl7G0nehbGZpbD:RNc/zEOVHFJDmg27RnWGj
TLSH
T177857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 25ec23bc2a00fc949b4057134515dbd071563e6ce500283477e46ab8bb604dfe
MD5 99fb7df5234bd9b7313d6b5a2d015bef
SHA1 090e0bd0e5e34e03f430a872926d3c48dc8bc2e4
SHA512 2b40178680cc5762d2e85e01f86bed530ac6bb3d56339621d8c696a9a1fb04cc7e6c6fdb11499ded3c0d03a0081a235dc10c71c292308ae385b389a4177029c0
SSDEEP 24576:TTkNvNnaFeYhJNtmZBmMsqjnhMgeiCl7G0nehbGZpbD:TTMwBtOm4Dmg27RnWGj
TLSH
T13555AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 33a274e7789585b3b494b2594eb21cf6c9b28cc489ff527579a08fe8a20ae414
MD5 af00634e655287dab21d85b424b3d7e5
SHA1 e1867d76cb35b9bafe73ea7901a3f707ef0e4507
SHA512 bfe0ca73566aff6c8afcdeb41d33409faa76e8f7a0dc70d91a588326dc475081f180323244ec8891fc3d5f7b0245b5914d7366ab88bb1179266e9692882a23f7
SSDEEP 24576:SD3FHshBIYQgAvsqjnhMgeiCl7G0nehbGZpbD:SDVHeBIAATDmg27RnWGj
TLSH
T12A85E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/572-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/572-131-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/572-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/572-140-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/572-137-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1300-0-0x0000000000400000-0x0000000000B96000-memory.dmp

Download

memory/1300-8-0x0000000002830000-0x0000000002897000-memory.dmp

Download

memory/1300-48-0x0000000000400000-0x0000000000B96000-memory.dmp

Download

memory/1300-338-0x0000000000400000-0x0000000000B96000-memory.dmp

Download

memory/1300-1-0x0000000002830000-0x0000000002897000-memory.dmp

Download

memory/1300-6-0x0000000002830000-0x0000000002897000-memory.dmp

Download

memory/1884-56-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1884-49-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1884-55-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/1884-60-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1884-62-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/2020-88-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/2020-354-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/2968-374-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2968-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2968-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2968-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4116-75-0x0000000000400000-0x0000000000B96000-memory.dmp

Download

memory/4116-21-0x0000000002730000-0x0000000002797000-memory.dmp

Download

memory/4116-19-0x0000000002730000-0x0000000002797000-memory.dmp

Download

memory/4116-224-0x0000000000400000-0x0000000000B96000-memory.dmp

Download

memory/4116-18-0x0000000000400000-0x0000000000B96000-memory.dmp

Download

memory/4116-13-0x0000000002730000-0x0000000002797000-memory.dmp

Download

memory/4384-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4384-24-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4384-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4384-32-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4400-337-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4400-78-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4400-84-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4400-76-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4440-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4440-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4440-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4440-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4440-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4580-105-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4580-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4580-372-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4580-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4580-370-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4580-111-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4676-373-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/4676-119-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/4676-120-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4676-126-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4904-71-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4904-64-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/4904-65-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4904-201-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/5768-368-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5768-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5768-98-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5768-377-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5768-379-0x0000000140000000-0x00000001402C9000-memory.dmp

Download