978e1048841bb05e467ce89b025a45873c9ca1605815e49effd4b3dcf378f25f

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 965KB
Sample260825-jndpasvtbz
SHA256 978e1048841bb05e467ce89b025a45873c9ca1605815e49effd4b3dcf378f25f
MD5 8e8c718b1b1de0570f0b07c6da54f334
SHA1 c6ffba3fe8c9e8828a7e0f4e99d0c0a6c09c4f86
SHA512 6a91593cdc7ae9d09eb6158ee92b514962c7fd86973dbb856affdb4115b32b807d9d139bfc6116d612629cbfe7090e98e980ded2a8d7f76d8290c0f5deb07d86
SSDEEP 24576:8l7rFE22Hdqj4NkfJ4yL/tNCJPXUQrP/:L229qEyfJ4klKXnH
TLSH
T10E25F120BBE5C136EAB73B3518B4836D553ABCA46B30D6CBA7441B1E5D706C2EC74326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4884	elevation_service.exe
3252	elevation_service.exe
944	maintenanceservice.exe
4976	OSE.EXE
108	PerceptionSimulationService.exe
1616	perfhost.exe
2412	ReFsDedupSvc.exe
4708	SensorDataService.exe
1428	ssh-agent.exe
3212	AgentService.exe
2876	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cd8a31aee62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003df6682f6634dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d1fc1706634dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061ca7f2f6634dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019d29a306634dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089fad5316634dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d45b962f6634dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f4161706634dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4884	elevation_service.exe
4884	elevation_service.exe
4884	elevation_service.exe
4884	elevation_service.exe
4884	elevation_service.exe
4884	elevation_service.exe
4884	elevation_service.exe
3252	elevation_service.exe
3252	elevation_service.exe
3252	elevation_service.exe
3252	elevation_service.exe
3252	elevation_service.exe
3252	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4676	2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	2412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2412	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3212	AgentService.exe
Token: 33	2876	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2876	SearchIndexer.exe
Token: SeDebugPrivilege	4884	elevation_service.exe
Token: SeDebugPrivilege	3252	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2712	2876	SearchIndexer.exe	99
PID 2876 wrote to memory of 4324	2876	SearchIndexer.exe	100
PID 2876 wrote to memory of 2360	2876	SearchIndexer.exe	101
PID 2876 wrote to memory of 4248	2876	SearchIndexer.exe	102
PID 2876 wrote to memory of 5052	2876	SearchIndexer.exe	104
PID 2876 wrote to memory of 2616	2876	SearchIndexer.exe	105
PID 2876 wrote to memory of 4796	2876	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_8e8c718b1b1de0570f0b07c6da54f334_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:944

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4976

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:108

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1616

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2412

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4708

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1428

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2948 2952 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2984 2968 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4248
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5052
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2984 2968 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2616
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2948 2952 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1297d615047f5a538405932c861b4b0632d59eb9855815733d38db685ef2d6ac
MD5 86bd97eed86649dc055e9ed2f7a3a3de
SHA1 9782b04821d91e91bceed69a48778c3e46ad4909
SHA512 bf83500b5df70220728885464f4085acf48c6dbc88658b549e159115090cb78dffcd8eff43ff806e74164c24d08e8c2d83cd7a4df55bc6b234359eda4d0de4d6
SSDEEP 49152:Pb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn6fJ4klKXnM:N3q6mjBRfJ4k
TLSH
T1DAD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 256aff037b8053d6f436ac8fc66d27e023d4e5119b0dfca36db2bfacb539053b
MD5 f31bebc05a4cdfb29162026e136d4dd5
SHA1 dada21729a039cd4487abcd93cb48f25b66496e1
SHA512 549db28576a4faaac7cda33f5fb4c3c5214ac3e102dc9af062031893a34cec608f46ee3f727c57161534c84698babaa9848228bf72e3f311278b54886c28528b
SSDEEP 12288:G1XLsswWkxy2lRq2czA1fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sj:kXYfDtczA1fJ4yL/tNCJPXUQrPU
TLSH
T1F105F12973D008F9ED67827CC9A1C101EB32BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 902a2d04eda4373716d094f10fa5ed575ecc6e3daf769f63f8ff2864f56c8a4d
MD5 aedf4aef3288ef9df38daa8251724b1f
SHA1 53984517374a3ed867bee55fdc345beff2696b05
SHA512 9222ab8ae16ca07bde6300363348476d89ea8078f19c4e806f4721008832fd95fd223750543faaeed040663f179391554ce0e59644e0341c0530a169f3feec41
SSDEEP 24576:70Le5ji0hmxhrMifJ4yL/tNCJPXUQrPm:7Pji0AzjfJ4klKXnu
TLSH
T11D35AE66F5748335D073C0B9C5D2A68AEA71308217308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 645157b4e11216856d51812ac29f309fa689f6cba82811f87314b8149fe9f489
MD5 44c871829fbe006561bfbbc6405db59a
SHA1 f899c64fe8a7aa86f767f0435630195df75c3c2b
SHA512 3e1b421ede2f392449cf578f3a42074b9812d26b5c019b5207baca6ba865197599524749d5103975f93f3c1d0fa6d0066b9e30f0d0fa57a519bfdc909ae2e650
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWj6q8wyuUfJ4yL/tNCJPXUQrP4:P/ezSC6vUzPv+HjynfJ4klKXnA
TLSH
T198756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fe1a4b93580936d70b75df29a4ead10da54807b37a0810d30aa0022fa796e9fe
MD5 169f9bd50908eaa5d445adf42c5d962a
SHA1 48ec9d58733a05f29948aeb3d3e0177c78fd5e3a
SHA512 fecccd65576ccca81c7768e83037831c1d85f46fa91377ed432979842f2ab30be4910d61a15de5a2b5786796fca28f4c648eaca650fdeff8fe6570a56a71dccd
SSDEEP 24576:QVbqPb88hv/l+BhfJ4yL/tNCJPXUQrPR:QVO88hXl+DfJ4klKXnp
TLSH
T136559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 414891279affd3c6ab39e12dbabc4998eff832e76c2c7631af823062bb9fb50b
MD5 6dccc9b9999577cc74c7d9770ad04586
SHA1 e12c728c055f878f1b6bb1d3016773c9f24dc261
SHA512 10b904ff79fa45ca18fd14640cfab38bc858dc5244dc338b8b79a25cb3b8f363d885662d6226577f32a1e8762aefa46121e085e69ffa79ba0c9c7444ca690278
SSDEEP 12288:VGufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S+:VGufJ4yL/tNCJPXUQrP9
TLSH
T1D9C423E751809486DF6687F82A88F001C704BEC5562FA2E7DE42BC857FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 0ea88b9ceea89623d2dfb4e7c0b0f0718a1f67b118602a715e9c514d8930374f
MD5 9351cdc25e1e849fe26808dcbf51e394
SHA1 95136a3195d85f293ae7ad03a73178adf02103dd
SHA512 821739ffb29dc9ad34cc8a2df14fca2233ee560a2020d30c54b57c6ff86516d9e5aba95e946ae44eae1bc9a2087cdb491619cea6cbe80ac10a97a5e516b01965
SSDEEP 12288:GeBNUbTVO86UpfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SW:GJIUpfJ4yL/tNCJPXUQrPN
TLSH
T10405C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3aca04bb02bc851139e9770dbaf51b370b1882c88fec1d2d8e1665584705f6c6
MD5 4c3f9ed4a84fd125e6c37712c689a6b1
SHA1 b5872b6ad95b73b30bfb0106e745e45fd706260c
SHA512 8f4c537848864770014f80df0ee1000ea11ae1c6aadfcb2d71a5af72c4178541e41ef6b8040e75df0472180ef57a41e2fc58d9e74abaca4c5890b9717208ee65
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THx:0QvGAdlCEL8c/WRNw5CkfJ4k
TLSH
T15A266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 ea1d6ae268f6b7fade888e4cb174900b906fd637bb1f942034773612e1798d90
MD5 719f852417b2e6e9ea557422102c7370
SHA1 142cdc51f2c0dda921508261f4c3c71abbbaebc4
SHA512 24706b32fc065e6410829ff28865ea665b5fb5f9295b972c6d0b10d8e59ad4bf64f84770f07b018362e7df11ea2c8d67a698b5c369e3677222edaa3ec6e4ee9e
SSDEEP 12288:HAwSfxL/2Dc3mDLLmt0LDQewsAjzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWE:gfewsAjzfJ4yL/tNCJPXUQrPy
TLSH
T10E15E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0a99bccf4cedc0668e9d531ccbce940375dfd6ddd7cba75a5e89d7511e1d7e89
MD5 43be3a6dd715c034cbcc0b43e3413344
SHA1 29cfa232e44a3e93c6ea33fbd56a2630990efab9
SHA512 10fd8cf8a006c2e1e86928a71ad58ac787e27b59ebb847e1bd7f74ea52f5f55a33e46bed607d7a015f8e7ad1bfddf4f5eae931616b81fb3acc6afca1b19c697b
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHLfJ4:nUEtQevvqc2W1cpV20I32L
TLSH
T118474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2c505bde910598d6666d6eff31453a0c9211b366fa178f0b4327306dc3fca499
MD5 c09af0a374502d9f57f1c2c8b2fb3a1c
SHA1 606655edc151435c8cde209134b72c3c7293652b
SHA512 62ab779c03e133a678ae8d2ff88043f623fb8baf95fab0c0a08173e1ea1147f7c1f3e4bdf6b804bb9066049bccaa72fe3933696c05b6916e0ab43796c079a13c
SSDEEP 49152:7CbRquA/m2yL5zQfFiV+XenmE3/zTfJ4klKXnk:koqtVjnmIfJ4k
TLSH
T1A1D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a19e42d7ad65d389bdfca5d11d6777954887100979ce3b3efbfee2c631620951
MD5 5359f0ac22f584a2c9589ea2b4a83232
SHA1 b47c8ea04c506be0c7a4902fc8decf6ade284639
SHA512 6d1b3f58a1879cec5287bc8877017cf4fa13ba9d3f33b727ba2ca126c2e688eff2dc512c7ce06bc5d79cc09908bbf48f3b0ed0d4248adc4ba48ca9243ba5a078
SSDEEP 24576:mAhGL6IFoiwtA5l7S53ofJ4yL/tNCJPXUQrPA:mAM5Foiq5YfJ4klKXn4
TLSH
T158359D81E7F955D4F5B3AAB899B59170EA76BCAA5E31C20F2250D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 02d8bd4d69db1644bbd9527d192fb132805b6ea3a345cc3be596876cf393e12a
MD5 bffc1b2e8d5cf1b09158fde7b11b3aaf
SHA1 fda3abf8ec02d80fc3331a558c86ddda2188cf24
SHA512 68df63b5ad85335eeb577f2d128f13ae85d89ba5e45926300e8329d3af35ed59fc90bb23212007fd1ffaeb15079ba5eb31ad8f71666773fc3a19a130ae039423
SSDEEP 12288:imw5HEjsChNEBFgl0WDm+C0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTn:7wuROWHfJ4yL/tNCJPXUQrPr
TLSH
T11005014A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 cc2688194f5bdaef9fe6a92612599b3bc7d6605fa2a088d469be2e1904d5ae99
MD5 fa09de7568abd0a690aa7e342655579a
SHA1 46fc3b64d05b9928eeffe9a899e7900f822d55d1
SHA512 17ae1f80005b31897c54acda6ac3790a1a67d908a7bc70f2c70d810f516cec5e4fab467a6f4c43c9a5735d0021c0c7d0d6907bd8d47278f2f5b5f021e0d9def6
SSDEEP 12288:KyZ1IyDfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SH:zZuKfJ4yL/tNCJPXUQrPU
TLSH
T170E4129B32D460F9DAA782BC89D4D101D3317C92233A53CF5A51959A3FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0fe1214fde8c8db59599a7be702c1587af02f5e609c4f986c73f612ead87a2a6
MD5 3dca698e7c33b214356a338052bab9c6
SHA1 37a60f0e51cdf92e56c77cd3203e3857787c0e94
SHA512 a82798bc9c6c0380fb6690884eac5ccb642796657902af59c8009f7fdc8ddf6820f6655ab9c52c2b9431994a294f5f76fff4b3ee3cb286454f48cbedaba8e3ee
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U2:oQRQyi36YOcPDLvw2gAf+PN3dfJ4k
TLSH
T108667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8f026f1424368e85f145bff6b7e9bdb3679ec02ce59f97bd5ad9946fa2f0e7dc
MD5 a8d92c481a2fc8da7a00a76710d43f2e
SHA1 15fa6521fc7cdad7b863e68b2359d7af91c11f10
SHA512 2e69e116c19b14854d7f9c1cb99e6a7108637c02ceecb5aee5d9a6a5bfddce6f819749f6b6a154d1586260e944cb99eea266775c09187cab069bb4ac95655456
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Un:RQRQyi36YOcPDLvw2gAf+PN3dfJ4k
TLSH
T1E1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5b71696be611a7b9f1d0b16662852a26983932cefead91f85133c6cdff122a69
MD5 0a142c0a13eecdb5b3d8e64c42a56e95
SHA1 77d61ef0f65e172cee79f68a2419d803e995764f
SHA512 d0c569c364e86f3b71d55906b14b1cac7bf0f4d18d7c4136f27b4d509b4525f9f4c0b6f326f90211a75daa02aa351bda9140d075e1296f5e80b00527d8343f3d
SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL06fJ4yL/tNCJPXU6:r68Qg55nhkeWu7PNU3/jfJ4klKXnt
TLSH
T104B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7950ab48b0738a1257332cf41ddc4aa9b2d1202cc63d65d0e65c53b5d421a62e
MD5 eb4ade2f1c4f8ccfaa3e90bf821aa4cf
SHA1 54efe3fea13f8ac768864f2b6d551dd3b1634e72
SHA512 eb0374be0a7894d66fd332e439844f2684386c11ffc50014574616e2533e70231652adb9619968fa7b413ebf3a97928a62b4da16113855bb02e5d136603b9de1
SSDEEP 49152:E3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99a:Ry5112gYy5azzVvU69nLKnhZufJ4k
TLSH
T124167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2b56726261bfa41f32bdf005160c8c5d07f73730442f7f975b6a11f7bf132bc7
MD5 3a24fddda7d161e50fb7cff47b24744a
SHA1 c56ed3650408c2cae1ece8ae3f70a76710e4e0da
SHA512 3254a4ad9c2c7c015fa64bf22aed230877990aab3bac6e6f1ed3c03451458b3eb6b0b1f5be0a1a0d7544b9bf1e820c4410c937fc1fd3ae37b2edad9384d45402
SSDEEP 49152:bB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gllfJ4klKXnE:Nu6JmIxd2dlfJ4k
TLSH
T1A4D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2e9561fd7954b9cc665267f3b964456881d380529cb63b0012e0eff5ff4faaa6
MD5 dcf1973ba493c7df20bd5e83cfd3ad9c
SHA1 964d64f96bbd42bd8bd9b17ea3044229029f4939
SHA512 80a5f1ff8ea0113230ac9c85c0ba222027c2ddeb75370f3a745e9615e2672049844bfe950b3a001f77b72d19ce001d017843c693cfd77d6bdc385345026f3cff
SSDEEP 49152:Z1hpsNoJpF1A67U44CwH7R4xJfJ4klKXne:ZmifPqRIfJ4k
TLSH
T180B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ebdd59b0497812087610c5081e1f714fb30cefc1b5527c3afa965722d407dd8e
MD5 19172de84ec434f1da104d58cc7c6132
SHA1 dd5c62769c9678c3a593f92788faa08117b985fa
SHA512 5ab8f1357358dcda8c76c6a68cd9968ad8f8aa869315d346b44b4d055d9c1de7c240594dda33762e02a54ddf9b0a852ae5e1d4bd1b08b4827866b4ae73fde4f8
SSDEEP 49152:NSuZQIY0Be2KkRVtOnks6NMHqKfJ4klKXnz:D5dKqi61KfJ4k
TLSH
T112C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 47621ce830283dfab4941dc2fcbc368d601e5936345d412c95b03a761c758d38
MD5 000635f8c59a466217ceed39b4796768
SHA1 7d64f2c764acb0feabed7a1f18f8ab7c62dc4497
SHA512 3e0a1c70093d23900ad34b1a0a01f38b8f9b5c7eadb578d7d01272ace9ef2fa3f35645f88a01acb9a640c109b76f8e5ed2d33c807672536aa8afa983382c9c72
SSDEEP 49152:ahtSn8EApI0figjgiDn0AP5w1fJ4klKXn7:bX2iWph8fJ4k
TLSH
T1C995BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d9fe3d277accd85089f6aefbb6f96b71458e560b179b559697e705a22b8f33de
MD5 29b4b7974df1881cc7c89408181b074d
SHA1 78c8c130e78ee338082961abc7cdef811514c671
SHA512 59a90403c316aba3cd448ed1a2dad85d29ed65e0dd589c9ae3b0409484795d49386a16f471c4a175c21f58809025a8dc01a4e6e395ae56cc6cd3c445c4694eff
SSDEEP 12288:z2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:z2fJ4yL/tNCJPXUQrP6
TLSH
T180C423AB60D5948ADE5587F81688F001C3047EC6672F62F7EF42B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 ff57ab3ba09d99f7bc8b3af61bca6a9b6c81a75e959c9c042b9a54f2f3c4f79b
MD5 ce18e9342a357e41cf1d724acdfa9c52
SHA1 f6f9e6a895b39fa29163ceb44c62d662370506bc
SHA512 2d4c854710b50143c31e1febaa5c96559c0a54e3447aa784bf31885141bbeef9aff090f059fd14ce53ce0250229234428b059deb9a257efd705e8a5efa2cbc18
SSDEEP 12288:S/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:S/fJ4yL/tNCJPXUQrP6
TLSH
T1F3C423AB60D5948ADE1587F81648F001C7047EC6672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 d4c76aec3db2502c378ea986c537599151ec7c3398a9670bf8b48cd64b2122ac
MD5 509bd5c88f5f11245149c0273aa34eb6
SHA1 0da7e8d491b7dd4b37f3fb80a85f4e491d7c7290
SHA512 154a2dd0a0bd1f87e1ad0d5460e5ca09414b075b533aa5df9cc27f3a09f8c6752b85a46dcb7fd646a89be836b4355b13d6d9d44889dd320316ac46f7c80d098f
SSDEEP 12288:vRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:vRfJ4yL/tNCJPXUQrP6
TLSH
T150C423AB60D5948ADE5587F81648E000C7047EC6672F62F7EF83B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 81f3c216da4f4f099354992991a4b2ed1f41dc0eaed126b2b39b74fa222b4d94
MD5 e36c32872616035306c1ec9ffa27461d
SHA1 d7b683a3383acd872609c4bc5ba76c99dbba9197
SHA512 fd3e132f861e0c4561d3615d6662f390d91afb4cb2e3ce51afef1dcc2a86415346b1bc4f22a62891fb01de90e97cc682d8b746930caeca3f31bfa4b1863693c7
SSDEEP 12288:7VIfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7ST:qfJ4yL/tNCJPXUQrPo
TLSH
T155D42397219480C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 92e9fbe25e261ae8aa9b78e75b7159b9c46163baa73dcdc7699a6a42252656b6
MD5 8bc9f1c0843fbd0be917c40ffc533616
SHA1 27db255f8b14de879b03275f6da7f2915a571ca4
SHA512 2c8f27e57b85ffe5991bcdcd6edebcd69b7c459d83fdf6a9f41c330a348d21b4d08ceb983a306cafba1c3dbf9daff07aa4bbdc0befc6e7d86178327e1f3c8e76
SSDEEP 12288:aAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:aAfJ4yL/tNCJPXUQrPL
TLSH
T14FC423EB60D5948ADE5587F81688E001C7047EC6672F62F7EF82B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 a4c239b097221b3cb3b598fb139e7b1d2e975ed086df387063868fae8f8ff21c
MD5 92bc2523d8835973e52c0a984324d19a
SHA1 dde270a79cd2a13141663f4da25ec7752148678f
SHA512 929febfe11b958cad9ba28a99c6ea3efcd6786259ef10362a5e89eb90b53eb06a7f52728a5b6ac93bf4f8be6ac3b2559e09ed54ae2f02e5a00431ecca249c33c
SSDEEP 12288:DbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:DbfJ4yL/tNCJPXUQrPy
TLSH
T11AC423EB60D5948ADE1587F81688E001C7047EC6672F62F7EF42B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 d3b7edfb15524def4a9f925d04b5caeaaf2f113babf3c710493ebeecf340831a
MD5 8881412d7f1cd837316da5363b3e2d35
SHA1 e3edf5aba070180b61ac23650763c80b55610608
SHA512 9ce205fd808337d068e6086f17eb4b4aa967a787cdc9aeaba829d365556635cd7d52204fe06dcc4b620f92b66c235457745285ae22f9fcd76f7ca69a86bf6f37
SSDEEP 12288:V3fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sl:V3fJ4yL/tNCJPXUQrPq
TLSH
T1A1C423AB60D5948ADE5587F81748E000C7047EC6672F62F7EF42B8827FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 4214a888ec86ecbbf93900f31a18c2b3b287e6252633490c9f79f96c6ff181b2
MD5 2c393279c73e98c85c47df36545cdfed
SHA1 e7abc0241a448a607d2c1150f4700ae3a70f97e3
SHA512 ada3cc076b94def5071f5458c4ea07528dba2aacb8e347ce75fb9f26409020c0cebf8b5f995481bfd3b4621e315e96c2e9cd4211e51bf0a08b5fb8ae32a14be8
SSDEEP 12288:JiZwbDzzFEoS2cPvyffJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:MZM3zFVSOffJ4yL/tNCJPXUQrP9
TLSH
T15A0501A5B39018F8EC67827DC9549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 20dd05a0cf48f7622e6cdd9d180b7d65cbfd513bafb6568112b33973ae366a6a
MD5 d8b735dd6865d9cdd0d1d67bf11e9b51
SHA1 47aea459c234bbed3b7c844115292efc7d45b570
SHA512 7f2b9510648215292fa7f1a96733d1b825b9d68c09ac989fdea4bc27ab7d446c74168c88a002c9407becf9a49efcd0ceed9ba4170882c35c7a23b87217066a0c
SSDEEP 12288:4afJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SE:4afJ4yL/tNCJPXUQrPL
TLSH
T1FCC423EB6095948ADE5587F81748E000C7047EC6772F62E7EF82B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 6cf72b96a97c2c2dfec740cd5717941c80d44d6457bd48af6319daef4470bf9e
MD5 003134dd44571318a2f0d1da6d1bb1b0
SHA1 cb72655c074d4ff2d3bf2e80caf3fde8553fd79e
SHA512 a024d0216d05324a1844959dd0c75c65f37ee97739297e9db963c1d254add7f32bb7c1f067f8c0fda2ed50d194e1b87ceaaab79077b8c2c5282536d41f34fee8
SSDEEP 12288:s+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sr:s+fJ4yL/tNCJPXUQrP4
TLSH
T1BEC423AB60D5948ADE1587F81788E001C7047EC6772F62E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 fc000ec699a3c670f4efd2ff726b333815e56027603215f49adf6b2f98a99c47
MD5 9b482eeb42926b6facce725fff4a27c5
SHA1 6c342e53c47f5158b98fb34377161f2e3a63d786
SHA512 f85613f8adc4502796560bc7cbb73d95cc36ff51c9482339cc8a66a20a261bb79ed6fa6c253d4799d020a21add65b7c6cba92c80e8a2003b33ce5ea84c6b248d
SSDEEP 12288:4yPz5L8DfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S5:ZzyDfJ4yL/tNCJPXUQrPG
TLSH
T1FCF4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 028cb0730259cc04a5fab3e6fa11445c0bf730d1f30c6104c26e9b4f8a73f80d
MD5 4169bbf09fea0d5fe730fe91862be4d5
SHA1 f5a97a26203ad75f687ad6015b135963f1fe18a7
SHA512 3b68386a5e67661c2431f32bdb41a4a18a43cddd0fd067160210386f29e2cac16f5e5a290f8fd53e85d9a16d3c75b4953e199588f51aad8bc55e5654bfbcdab5
SSDEEP 12288:UafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SP:UafJ4yL/tNCJPXUQrPA
TLSH
T16EC423EB60D1948ADE5587F81748E001C7047EC6672F62E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 acacff395b13950534fa6a0aba15bf7866a8f74d2733c64db8ffb35cec480307
MD5 bc14c029eb201433f6a1170c0dbe2743
SHA1 390423b2d87562bc01009ae4f2d7aeff35f81ffa
SHA512 a1d3958ebb3a3fe15367326a53f5f2aa106e339277803c0904e36ec79dc3bb63712d2739cbcd4b6968469db73046be5da445e73510fcaddcfd24a099b9ce1ded
SSDEEP 12288:JafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SP:JafJ4yL/tNCJPXUQrPA
TLSH
T191C423EB60D1948ADE5587F81748E001C7087EC6672F62E7EE43B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 2fde1f56f0383691eb2d004456611c7f84adb82552bfbddfb7ad86eff5cfb5e1
MD5 27c130be06cb9fa246b79385d6a15b52
SHA1 0cd08c1c1d5d5f2e973a8ae6dac01de909f677fa
SHA512 7d3d0e35bf80499f861da21f49650d0cd2ae8c84b77cc879695e71813254492979dce355d741143ebbc20cffa7062107200d4ed8bce0e03a3969ea22346729c9
SSDEEP 12288:tyPz5L8DfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SW:EzyDfJ4yL/tNCJPXUQrPZ
TLSH
T14CF4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 f228f9f12d50a053779f654c2460f07dd8e03d779e0aa0227acee30a62d6e57e
MD5 5e59dc9210334e0c4dfaedc602272a3e
SHA1 7d59732765e360c4a0b66ec6165ccb24cb9bc660
SHA512 87fb7d622cdee1cbb52384b23cf36ae5eb6dcab20a7e269079b2d78ed1565e0ca513de8774374178b93fca6471ae24d54612e283f68bb30b704b782a178635a2
SSDEEP 12288:2Cd91WYoaLHF3z0z04PDvhBfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTz:XT8aLl3z0zDBfJ4yL/tNCJPXUQrP3
TLSH
T15F0501A5B39018F8EC67827EC9549502D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 5ddf84a32fa39c4c7418c65c42881b854ae373e85dad0532dfe984ed1776f66e
MD5 33a2ab54aa725103beeefb252a4d352d
SHA1 1b826a198a38c74f6164ab1d301d90cebe9c2e05
SHA512 c1953246e00688dedf01b1e3fcf12bf504a185b58a35739e6f8b21e61e75687872938fb0117e1a0ae04cc6bd1a8626c6a26a5f03bf899df1c7aa425be177e127
SSDEEP 12288:Si4e7+RdTfgwCHKy7GLbbdIvMfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGm:S3rd9CHKy7GZ9fJ4yL/tNCJPXUQrPZ
TLSH
T1AB25CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 315b9548e958be7e864995e21b5c3356f9fc83dd2802a3bb7f0dd6205172ae49
MD5 d44eab51e745e2fbb6060790397b59f5
SHA1 43064360f7c2946a6f9cf003119280b17ec1bc51
SHA512 13742ac8ae8d5c68c20d29b6954e743d681abc8cbb23a77f2abc01d87f6d97751287c107434584b1d769b895b5ac1a96f09925414a1733f901c15c788709c706
SSDEEP 12288:bxfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:bxfJ4yL/tNCJPXUQrPF
TLSH
T1DCC423AB60D5948ADE5587F81648F001C7047EC6672F62F7EF82B8813FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 ef33aca0920008e11fe345dd1ebe6518c7e737121de608f6c68f26ffc9d0b088
MD5 b29d4c3c9fcc0ef0b1945d65032b2a49
SHA1 9d194e427df3fd4ff26c84ef0782aa3564c9637f
SHA512 4221b43fd82fb86621f4c2e06f2e3c1713f5bf441f048e3a05e08671095f96607d8095928416ae7326301dd848aeb866a8cfeaae5c5a12f672f8eb4dff3e05e7
SSDEEP 12288:8jfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:8jfJ4yL/tNCJPXUQrPR
TLSH
T18BC423EB60D1949ADE5587F81688E001C7047EC6672F62F7EF82B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 43ce8b96fa2c16618f7aa83d7fda886f3432afbd1fb0208c9219115c30d3f9e3
MD5 c82cb0b5e0931661e9c663d9bc3f95aa
SHA1 d77569f4e01b1a1597b202d0de7983d86b7189dc
SHA512 11ca09dc5d0bdafc9af2f3f3f9d0a6f0e991a845c928cc48689c88b0350ac1c396a600bcd23fbdd7562f674626585a79b202413223dd0d6cbe702f874b78dd9d
SSDEEP 12288:xMfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:xMfJ4yL/tNCJPXUQrPo
TLSH
T165C423EB6095948ADE5587F81748E001C7047EC6672F62E7EF83B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 b15acd1c3191382b7dd3904e3e0c7c3449975cbaf4b1c8e4de5da9c7e05a3990
MD5 b17ceca1ecb1f5544058061af537be91
SHA1 b9eeb440aab2da7a414db1778583ee5d02f006b8
SHA512 df1a9e5dd22d871bbcf4ec31697a35e92700741df1f106cdd81bbcb037fccee8210242f40dbe9f5154de41b9bd9bcc80547556f9b457125578ec93e09f21f406
SSDEEP 12288:IafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:IafJ4yL/tNCJPXUQrPo
TLSH
T1ACC423EB6095948ADE5587F81748E001C7047EC6672F62E7EF82B8813FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 ce0f60591cda88ba2f0583e3b4d9c49ac179adae276b71fcef543bb0f48d8bb0
MD5 d7a47b6a6f084d414b440c692a2daed0
SHA1 43fe44fa9accee19beba3623698d790b721c1a24
SHA512 e422a9b4edfed196eaa9f39c0f064348c05604d73b3da422deefa4f99fc06174ebbb38706a8115aa07970e7748f2d0444523aa4710ca7335104db99600cb3385
SSDEEP 12288:cxfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:cxfJ4yL/tNCJPXUQrPT
TLSH
T187C423EB6095948ADE1587F81648E001C7047EC6772F62F7EF82B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 1e4839462c16bd75516dfdb793c83eab37c0e64a8f638894a3646e6e7ad21ab7
MD5 f4bd819944d893bf912025f2b49851f5
SHA1 769a949e58eb2973b42406c837be5eeb5a0e846a
SHA512 90e206e56f5769be54b359d3b593ac7a1f871618b6f17c0d4c93702232835e4c3f70cff3960a114247f996536245cc121f3676d288ce88a4b66414e445d2dd68
SSDEEP 12288:+SfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sw:+SfJ4yL/tNCJPXUQrPX
TLSH
T19FC423AB60D1948ADE5587F81788E001C7087EC6662F62F7EF43B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 294e5b43ea889b74d1a9cfd8cd40d07ae90f426b949240a9f42dd600be74bd5a
MD5 9b62287a6fbe6bb29613072d44a6b9cb
SHA1 b500a18c67abc73b7dcbfb120ce23c59447b62ca
SHA512 4599275202ccf32336dec39cfce623591b53f55d61b825a48c2a2a7185018a274af4cdcc6b627ccfc0dfb241a8fc97c2a127579811e73fa399425a6557ffe3f2
SSDEEP 12288:jAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:jAfJ4yL/tNCJPXUQrPq
TLSH
T130C423EB60D5948ADE5587F81648E001C7047EC6672F62F7EF82B8813FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 51b064121ca2c76c70b2f3c2f5e481b36959c2dfdbda7c9b54d7357ca8e6306c
MD5 d7b7727be9cc0f4cb62a30d8aecbfefe
SHA1 038a127f2d28dc4407c4a62fa2d865f31ab01337
SHA512 47d9d5dc1ba4bba70a66b5c0600ca31dd3b8a18cf2e9b705f52603475fe91088b6d8008e1f9fb023cb2885de648f37fd556e3e2a02acabdbb28bee2132fdfee7
SSDEEP 12288:P5fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S9:P5fJ4yL/tNCJPXUQrPm
TLSH
T174C423AB6091948ADE5587F81788E001C7087EC6662F62F7EF43B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 e27df3e4da36e112d52af21d8c738928e02867fdd0dcf8941d1183d1502d56c0
MD5 20c8253b5638e5b26e6108ab3ad87d4d
SHA1 fe64daf36b3117f0f673335af1016033e8b1ab9b
SHA512 7380b20944d44326a84340521c48882730d74eedbb5eb4a7ba2febf905a7cf3624bb1bd6663c423d845ea0db09e1b97c2094d25ab4272659c57a11e1a603075e
SSDEEP 12288:AAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SE:AAfJ4yL/tNCJPXUQrPX
TLSH
T1B0C423EB60D5948ADE5587F81688E001C7047EC6672F62F7EF82B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 da769efa44610142fc7b7aa303bbbbd904df84134e52635b134219a36ecaea42
MD5 6647e0926cdf5cb0a7778e3a24566a23
SHA1 da3c4e919e9947e9a71ec62a609f4c9b803e43b0
SHA512 42ed5bce2c776d69e4a40b056a98197d44e3e486a7350d19b61ad1b213eb9b96d81fa39709a68e06134a1f3da8b686a8b22ca5199ce87ba5c2c6f97486264fbb
SSDEEP 24576:Rfwvzk9RX6wkyAIOfJ4yL/tNCJPXUQrPJ:QMnYIOfJ4klKXnh
TLSH
T10F35D02AEBDC44E5E177923C89A7860AF3B178591B31C2CF029A53AD1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8629ea1bc0c9b1c421f95957275e34c01a0c7063ec8e9f9e7db81155b3046d07
MD5 d37089ebf454e8e19fde7cec5a6e0c8f
SHA1 67bc8690b9599f39e6b2389ff691d2e13444cb64
SHA512 319d218379c6d38fdcaec5ac044e2419c9b1ad3060f91a15f85a3c97f6cb3ea6ee67fe54081e4b740469e8bf675a932d1ae74db32d8ccc790444780d481d6146
SSDEEP 49152:ZYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VfJ4klKXnV:QySzP9fJ4k
TLSH
T13D066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 082952ee704ecdee146cff5a6dd67bb895410e386474a615763903f4929e93c7
MD5 2f8a5989f5c73921fac85dac3c163000
SHA1 87b2c58bd4db8172b065f8436b4b5fc90ab353cf
SHA512 12fada3cf32c7aad307f49dbfb84ba2dbec0f73209a965e01573a0832f31b6afc5704413c8872616fb70d4ba196434d676a71ffacb8c015c9be99054003ce606
SSDEEP 24576:547Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYvfJ4yL/tNCJPXUQrPr:547JUQjqirIhCnDHUPfF/lfJ4klKXnz
TLSH
T10665AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 7902eab71aa8bd218f093691d21e5aa754ee64ca77c10b777ab7a4454833cfa8
MD5 cc1db71291c33f22a769afb4c216b20a
SHA1 832822b10a0e179ad98e72dc0fb44673f9d31119
SHA512 47e1dc8afb3302d4d4dbe3b1d6a17aa9f50f047645f22d612e24586cad7f4c8e4c323985a437fc00c4060f695cbc595712aacb98258b99370109e1a73bad07dd
SSDEEP 12288:/psfKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:wKfJ4yL/tNCJPXUQrPL
TLSH
T166E4015AD29441D8C46E92B8CB449201F3237CA593E2D3CB97C0F87E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 ea724cf70e86a6f3db2a07ee54efc970eba772057a8eb0db769c8ae20ebd8685
MD5 a24cd983473b5cb2d03ed0f0081d6146
SHA1 8bb200866712b7f48cde916a23e47600c2d16547
SHA512 b9fab8d92d207b7385e3d27aff11496acd277df918eedd9ea736f71d034536d3dff3cd0875884953bdf15bcdfdd3be80b2e282dbb5a8a1b509b2603f31e255df
SSDEEP 12288:XwpdEU3fFQuUdoAPvbUuR8V+CsBEUIbA7fHKZvSL0:XwpyUPqFonVzsBEDbYHcvSw
TLSH
T187552841762AD68FC6A940322E36D6CCA7707D01FE056F0773C9873F9476668BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 f6a119ff9272a220d6b35cdbef6681ae5cffb3d17951bfc8879046532f57e3a4
MD5 2ef20b243be56b2ece8eecce6fca58db
SHA1 2078d2aebb01a051aa5018fad5db1e36997eab7f
SHA512 059100c073d545b70fef252953e31463c2065d865a2232d365fbee859875a5fe1ba03fdfa8df189dab6be5ce1475606417ddc1403b4ef2d0ddb5d5c1b21ee2fd
SSDEEP 12288:tRqXXHWBhqGhzWkbqC9dYVmuxeIdlu1bpPc0oTIQ67dr:tRqn2Dnt1dKxeIdlmbpUrTd6Br
TLSH
T1EF553A01A6B7E35FC9FE5037523286CDAB745C02BB453B0573448E388866A7EB5F2792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 08a6922f21dcc8ec5473e418ff1f9f6f3bdc7b15901e71138937e01bfe6c7f99
MD5 82565292450e1b8b44109550fc890f4b
SHA1 946110cde594a883df4bdf8e4ac847c8abd598a0
SHA512 9d501fc32d6df6eb745332b4f287678346e9867917b755e347c6cd94c2d6c08a64971123479906de86e139fed9ee9c125986ee6ce425d4bc55333177e872f17c
SSDEEP 12288:xM7CfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:qCfJ4yL/tNCJPXUQrPV
TLSH
T17FD423A751C49846ED7687F8164CE000D309BED55B2AA2E7EE42B4853FFC98A1DBC353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 34c591d895e6afb9b9b7bfa6c4ffa6aaa561a68274774c142c3c95d927adaba6
MD5 f8b8909b85ed5371ef16b9e72f660487
SHA1 510bea3e3fdb20af73a0f6b16e23f86815d0b5cb
SHA512 fc3ee7579acd59e7a0d1ef5338c5b5c419ab8cc67876e006586957df6bb65c12f7a92db6616527c4cf1af4f982785050f7251169e8f1abd499e3bc2a35a89f74
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYUfJ4yL/tNCJPXUQrP4:Lgb4mBIBhGFvfJ4klKXng
TLSH
T16965AF1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 e836686f49e1f82b7a8fa074674f7645af504262e05477112eeacef5e2236c49
MD5 48ef697579b17e2e7246157e6225d7f4
SHA1 ad5f7c09d9f9f38232cefbefa3d6bc85762bea23
SHA512 ef7d8986cacf60e0bc44137be38507161ad1826e1cad6d277c4de56539bca067861c9971c02d48d0bd149ce7a2804469929a2b096def969f039a8a110395be5e
SSDEEP 24576:fG88u8FpJqH1vzria7/mffJ4yL/tNCJPXUQrPY:u7ZFPqVya7/sfJ4klKXnA
TLSH
T1CA35026672E101F1D47BD1388A868663F771B8150375FBDF0BA88A512F23AD50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 af1122d48cafb08d5a0096981e661e5c07e1d55c63eb6d8fbe72a38e8dc36bad
MD5 2a1e918a1a8858ab5860fa3983e4c7b7
SHA1 0743bf7f5f863947c0bb7479e3f2e44c219fbeaa
SHA512 5339d6803eb1b354c6507c066848b19e8d7fb008ecfc61a01f4e7ced38e1657ec970f7b92bf807e5be4d51c4f7815177da572270417ccab09d88a13aa0378fb9
SSDEEP 12288:VHvUrBFrEjwaQrfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sx:VPUr+NQrfJ4yL/tNCJPXUQrPu
TLSH
T1E105F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 74d0cec1a32477e808aa9b6d98cceb0460abcb2376d7bacac6da3c8dbb9a5ef1
MD5 8ef4985bb4dc919874382af1346adb4e
SHA1 32a4f8d0392814ae7576e24d1f1e5bddd777bf92
SHA512 9dce7d92bee260f2b389e88053523139c3c2748ed93efa81cb7d047aec380d0dd8dfd2330ba38c4d6567ab24ff4ff44bdd850ae443aa237d9955535181763cdd
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbfJ4klKXnF:QG05lO43bGfJ4k
TLSH
T1C8D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 13c338dda89a4df6c556f476c11b28d17317a19a4ee9dfe56cf102f024fffae1
MD5 8c36bba11b7afbd7e4d3a25de12474b0
SHA1 b808d7d95119b0155a143c879c23ab5efb103100
SHA512 325146567546206e68adee94e98eb48e7da18b27cc0a213d55261b35536be16263638fa0990370c526de3d7391ee48a7a039c1658aec67f72df16b983448d492
SSDEEP 24576:Rfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnVfJ4yL/tNCJPXUQrPq:xa5POZ3lJt2pasx2+mjfJ4klKXny
TLSH
T1E465BF5EA6FC01D5D579D17CC583861AF5B1346253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8e77a3c979f197e43f87fd44a050ad68c45eb6a39ca58c8458a4e1fc2445fa22
MD5 fa7d410b2b3d93437651cbf1e844eb48
SHA1 619520d05fec4bb2431bd1c62fb3e1a11d7cd071
SHA512 6c2fee93b1a0e25eb3c8ddd86be994a23a49ff7326f96078b3ed9f8c0dda23ef651444757a7eb0abce857437d9f2a8eb75ad61c99762697de0234847eba6da8f
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7FknfJ4yL/tNCJPXUQrPa:eNc/zEOVHFMfJ4klKXnC
TLSH
T1DD858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 14a7f5d393743ba61f448d753dac0a1e5f464d3fdfe65ab826078a1fcc09b899
MD5 8f6286e2004f6e7f676a16d5edc9aec6
SHA1 f348ed4528a7332b39dd11590bee49ae677fde67
SHA512 68ad79f4ecb995b9659e5785f9bf77611721d87bbc392808665538f6fc4b6e63918e6384c3896996cf494a866f4163e514448b86f1dde5bdde1a7a8c174eb84f
SSDEEP 24576:bzkNvNnaFeYhJNtmZBm5fJ4yL/tNCJPXUQrP5:bzMwBtOm5fJ4klKXnx
TLSH
T14355AF6EB6F846E4D1FEC6B48D238112E6727861073293CB9290C13F1E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 2929731c1a60a92dea60b3d9f393fc55285feb4df48b487b810911cbecb2327d
MD5 efe51f2c3b50e7d73dbee1d922b68021
SHA1 ef53ab489d85cdb808cef0aa5dc6b389c3d463db
SHA512 b25ecc84c94d5f4b5e2ff1b563c33f1665128c5bad1c68c32cdf98ffe5f344e07269fb0952ca3130e8996de946e14212b6101bcf79b657c27bf8afff8263ec7d
SSDEEP 12288:VQcMxWDXN1Dp/fshBItT1IQgAWfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+G6:ZD3FHshBIYQgAWfJ4yL/tNCJPXUQrPS
TLSH
T11F25E17EE69C04E4D57BC2BC9A538506E77138E9032266DB06D0C1B62F6BEE42D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-295-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/108-67-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/108-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/108-73-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/944-60-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/944-51-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/944-47-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/944-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/944-39-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/1428-112-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1428-121-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1428-369-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1428-117-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1616-84-0x00000000008D0000-0x0000000000937000-memory.dmp

Download

memory/1616-79-0x00000000008D0000-0x0000000000937000-memory.dmp

Download

memory/1616-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1616-364-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2412-89-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2412-368-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2412-381-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2412-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2412-95-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2412-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2876-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2876-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2876-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2876-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3212-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3212-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3212-136-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3212-127-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3212-133-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3252-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3252-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3252-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3252-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3252-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4676-1-0x0000000002400000-0x0000000002467000-memory.dmp

Download

memory/4676-8-0x0000000002400000-0x0000000002467000-memory.dmp

Download

memory/4676-77-0x0000000000400000-0x00000000004F7000-memory.dmp

Download

memory/4676-0-0x0000000000400000-0x00000000004F7000-memory.dmp

Download

memory/4676-312-0x0000000000400000-0x00000000004F7000-memory.dmp

Download

memory/4708-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4708-365-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4708-100-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4708-106-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4708-116-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4884-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4884-20-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4884-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4884-14-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4884-21-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4976-61-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4976-278-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4976-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4976-54-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download