6bf1b78cfdf8cb57e4a8c9af4d9384b334988abe488c6b4bd26e1f1891efa511

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 3.0MB
Sample260928-slxttsxarc
SHA256 6bf1b78cfdf8cb57e4a8c9af4d9384b334988abe488c6b4bd26e1f1891efa511
MD5 66f394518787d0486fb112c21f4dec63
SHA1 84be56cb799ca4434747f76596801db74d6b09f9
SHA512 ee76cae0d9f8f358e0caf4c3e8625eaf363333b492b15e9fda0ae4c9b2066b85322ba5e0819e6ac7f4a227eeef291ee5dd77701883167c1b2d3ffb33996e0945
SSDEEP 49152:hdF7BYljA9n/TDbXNKd7JIsVihMadGxf+CA9n/TDbXNKd:hdF7/fb9s77WW6fb9s
TLSH
T102E523003BE0C836D6A325368DB9DB18996ABD215F2193CB67C4362E9F316D3D93524F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4624	elevation_service.exe
2356	elevation_service.exe
4184	maintenanceservice.exe
4904	OSE.EXE
3908	PerceptionSimulationService.exe
4116	perfhost.exe
3200	ReFsDedupSvc.exe
2548	SensorDataService.exe
3700	ssh-agent.exe
4260	AgentService.exe
1088	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
	\??\F:\	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7f5b836b25f2ba71.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105218\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000066817f65b4fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0111f345c4fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a84466f65b4fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043ff89f85b4fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039c09df65b4fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e634cbf55b4fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd09f8335c4fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d5f1ff65b4fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4512	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4512	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4512	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4512	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4512	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4512	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4512	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4512	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4512	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4512	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
2356	elevation_service.exe
2356	elevation_service.exe
2356	elevation_service.exe
2356	elevation_service.exe
2356	elevation_service.exe
2356	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4512	2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	4260	AgentService.exe
Token: 33	1088	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1088	SearchIndexer.exe
Token: SeBackupPrivilege	3200	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3200	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3200	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3200	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3200	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3200	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3200	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3200	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3200	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3200	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4624	elevation_service.exe
Token: SeDebugPrivilege	2356	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 5152	1088	SearchIndexer.exe	100
PID 1088 wrote to memory of 832	1088	SearchIndexer.exe	101
PID 1088 wrote to memory of 4888	1088	SearchIndexer.exe	102
PID 1088 wrote to memory of 1952	1088	SearchIndexer.exe	103
PID 1088 wrote to memory of 5332	1088	SearchIndexer.exe	105
PID 1088 wrote to memory of 2692	1088	SearchIndexer.exe	106
PID 1088 wrote to memory of 3744	1088	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2356

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4184

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3908

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4116

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3200

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2548

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3700

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2532 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4888
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5332
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2532 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f06d15f5bb5b6659266131eae5617ce3949f78e14d98bce4db5c57a7ed9b201b
MD5 734d8a14dc2bc1bb9599ea6f4b521978
SHA1 9c60f9f79eccbc81b409123005f766a8ae6db419
SHA512 0b134b602793fdae2130306c93586ef100798ceb4a88cf4d496b91873b8febfa54c79a47c9a83e5825ef13cc69561e23bd2b1e7d54c977c4f583b3f550556340
SSDEEP 49152:Lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnXA9n/TDbXNKd:Z3q6HjBhfb9s
TLSH
T178D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 83425306d7502b74b06ced669eff37a99d9856f83a0fdbfc9976c08bd9e24608
MD5 2c5dfc131896171910c70d4c0287015b
SHA1 25203f6d1fafb85ab26255b62a550ae6da821058
SHA512 0a54980d306d5f48e1be47db583136de7568fa80cc36b3ab07c90beec8964b06169e4793fc0f68da48e7613ec1afe48daa2a76a04916c628b12f5284c339a765
SSDEEP 24576:kXYfDtczA+UeA9n/TM4NZYeNm+9MhUwd:DtcpA9n/TDbXNKd
TLSH
T15A85012867E408F9DD67827CC8A28505EA73BC454760E7DF03A499261F333D85E3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 23892cb1b7cb93e4cf6749a33d55171e2bfe81f1b2c44784d12ad5a9f763ca13
MD5 a0a26cd054209e69d0904c07e4fffd3b
SHA1 b5e99d248c20cc2397d470c23af1865c89a2ff62
SHA512 82f39901099c438dfda0bc07f463b790fe6638f09c98aa82495315c6071948d1146673b8e4a90bfed66cb97299e68170f6f18dd096540b0f483310c48951c6c8
SSDEEP 24576:60Le5ji0hmxYrMLUeA9n/TM4NZYeNm+9MhUwd:6Pji0A2GA9n/TDbXNKd
TLSH
T1DE959E16F6748731D073C0B9C5D2A68EED72348657308ACB4286D77C7E27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 37ee6ae396377da88b3cc7f9c678278253232a8ed316b8c3545722a91a8b1c54
MD5 f4413791b8fdd5cd725a68f83df3f95f
SHA1 0db7de79890e810b3f0daa9e573ca189a793021f
SHA512 9261570c67490c90304a01aba500ef815fb9c8827219812bdb499f96c63f436922e0765e3d86db67c8f8ec70849e73943d030b54796bc7215f4c81f66c279700
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWE6q8wyu9UeA9n/TM4NZYeNm+9MhUwd:f/ezSC6vUzPvxHjyKA9n/TDbXNKd
TLSH
T135755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e4452d4364de4b166f60ba3d090d5d9fbcc03eee07f215a1d2d0e59ad73a4bbd
MD5 2c58a37f660ddb7296a5c5460fedc36d
SHA1 bce7b8d443b389794d2a4b3ed1d084ea12e1ae16
SHA512 e8fab14d434d7710adb910c9b78cb417da62209b202b20240a8b2831e96e10620b28b9a1fb05278eff16f61802c72ece2e812b731727f208f7d15d1423fef4d9
SSDEEP 24576:QVbqPb88hv/l+6aUeA9n/TM4NZYeNm+9MhUwd:QVO88hXl+DA9n/TDbXNKd
TLSH
T10F559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 16507faabef73b7cf66870019820ed48fbd5a43ab257e86355d1b270d524fcfd
MD5 7113427e8567bc58f3c017e46a21333b
SHA1 790b2530f48550665528a8b92ac08cc28b85b563
SHA512 f57e97b4b85e4563f31cbfb03f37299404ffca45b73874e11b44ee7174962544921686ed60a3ef7257b9735ff0053560d3168af78f18365fd93b6f6eeb8e8034
SSDEEP 12288:MH3BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d+:MH3UeA9n/TM4NZYeNm+9MhUwd
TLSH
T11F6523824FFC0CF1C78E0A7544AABF0CCEA2BD4DE684879D4719762A5E385C6C95648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 1b5217fff88500ac2b926be4e5322440eecc558a9a56e546d66f5cbf07a29458
MD5 802671879596953ea5be18d8b5dac581
SHA1 7c263cf5368b64aaaef2a46a562ca4c36147ffa8
SHA512 8763c344f1655f9084331b4b8fe02f6e3ee42ddae6433dd6585623506fd0ddf52cb90e0892358379b5d015524f8135a93940abddaea2c6fba9358b4b204efa0d
SSDEEP 12288:geBNUbTVO86USBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dt:gJIUSUeA9n/TM4NZYeNm+9MhUwd
TLSH
T17585CF7BAE38ECE2C27E4DB956918700D77278304B52A3CBD165830EDE235E15E7AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f2b2d89e4dd1a1656fed2fc3bdb133b08367df3639357bd328f340e6d46724fb
MD5 7c1f80ef29feecec3f847e6a786cb338
SHA1 72bca523447bfe8c1a6e67351a74eed51b23d0e5
SHA512 51d9c4c6c1f9c4a428dea733732f86b27625ced4a95d24b93524d2512e6a90463604d1b3717aa94fda32f59aa8ce5be10e0fca9b519789901452c01f6678f3bc
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH4:hQvGAdlCEL8c/yRNw5Cifb9s
TLSH
T1D8267D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 b63c006d1e16788da2c01339e0ea52327852d0a85febd96fcd846ec6b627bcfb
MD5 e6923095006391cfb788dacf37c62536
SHA1 c3f168f607b22983f256b624589ecb9d9c5dd922
SHA512 52bab48e81940a48edba177af37fcf2bced3c6ccda0e800119cbc1a81dce48c85b93a179988e4d044335055f892fb9a3fae98ca1b9c618a8ec093b6d4c9ed91f
SSDEEP 12288:6AwSfxL/2Dc3SDLLmt0LDQewsAj0BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9+:P7ewsAj0UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1FD85E031FE74D432C3BF0DB21B36D706586DBD204B511AC3E3A89A9E59302D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fb8dba2b76aaa7059062854ef60cbeae91c1b65e478387f56934f298aba21c7d
MD5 cce0982640c0d1ac9c478b433a711ea7
SHA1 74c46dda5c38112a8bd6d4f4157fc9915263238c
SHA512 4740f37851d4a369b7b7138bd9f69dfea01cdda582573cf48d9addbc77b4cae9febe3bd64c90d405deaf02b7d2858b771deadd4c2612305d2822090035d4673e
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHz9:fUEtQevvqc2W1cpV2EI32
TLSH
T129474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2becfe4028b93ef409da27dcc33c18c167843996e4ca373eafd66f586319c30b
MD5 f6403172bd8e7eb8760177e3e6f15346
SHA1 4d188b8a6f264b1eb448216cfdbcfde0b2a57ccf
SHA512 1203d98853b7edc2c7ad429baa372a0b63af39e4b5fd4df7f772d76faa27acf67542cd394435e7ff843f496517d06779421f507f31f81c5ec485084740782c9f
SSDEEP 49152:CCbRquA/m2yL5zTfFiV+XenmE3/z2A9n/TDbXNKd:HoquVjnmOfb9s
TLSH
T190D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3da14f7f5ac1e97be3d86a988a15b407d9517c060395eb6f19d58b6eb6448c77
MD5 38dcf93ba2b62960de7fe040f9085efb
SHA1 607602f86fbd98153e388ec91f55aab96d44f1e8
SHA512 34a898c22a05633b7dd0472a7b0569df97ad09fef3285135521a0fe8043bdf83fa458a68b10613534a4c69ee63b83be1b2a4896912642be9e0738d177027c096
SSDEEP 24576:JAhGLJIFoiwtA5l7S53RUeA9n/TM4NZYeNm+9MhUwd:JAMyFoiq5NA9n/TDbXNKd
TLSH
T10F359D81EBF945D4F5B3AAB899B69570EA76BCAA5E31C20F1150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 4b0689d748414948c14fcafcf74dac3bc950a59da67934d48e48007bf37484dc
MD5 c8ec24f65895ccdaf6ae0331366b308a
SHA1 627a8fbd93e816b32ea5967dbeaaad1fddc2caa2
SHA512 3c551d5528e5bfeb1abf15b988bdd269a7b99c7b10237d51ca693ed46c3c849a1fd02af0be07fe782f1218e4cbe9aa4f9980533f497f8df949151bee712be7c2
SSDEEP 12288:Amw5HEjsChNzBFgl0WDm+CdBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d5:dwuSOWIUeA9n/TM4NZYeNm+9MhUwd
TLSH
T10985F14637E80CF9DAA742398597D535EBF2BC062A21C71F0760C65B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 9742e83f02d4126c9db4cf24a36dc01f9eff17b5ae34d8ce93e344bc105684ea
MD5 188e89ff80c3d8cdce9913bc02255ea9
SHA1 eecb1762d65f2c664a8bd28d0cacacf6ca0ebf4b
SHA512 b52bcbd132f544d5f26095753f342c88b045d4346288e04ec6cbb40f6b7a210ceaa7b452748e3a801eb80f44257b8be0b4d40c883660371bf447c47735f4b10d
SSDEEP 12288:GjZ1IyEBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2do:SZujUeA9n/TM4NZYeNm+9MhUwd
TLSH
T15275128627F814F5C397527DC8E56B08DBB27C5A637543CF0225526A1F32AC28E3A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c4324acbf9297453ee47f3025d2315cfec45c1ee2c4abbbcf495ea217ee89b56
MD5 02d1ec4146b9b8d839f41cc3baa639a7
SHA1 d49560a0d3b9a78054ca2a51f2569364a3954792
SHA512 360a04b25126fb5a0d72fb84f2935f951c892f329cf53f545994421e19d0d7f0f5f533d8a22276d3756666cc549715324f84105c5d809c7adbbc734056bf90f6
SSDEEP 49152:vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:eQRQyi36YOcPQLvw2gAf+PN3lfb9s
TLSH
T15C666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ee3b3d34b1e02d04dcd25e7371f27bce753147893577bbf0812137fc62f71f74
MD5 a7d5888aceb96928420e14e6fc9b11df
SHA1 6b8cc42a5f812c116aa0b40f02e0acc6f43e3bb7
SHA512 337d50bb791f99ca08e021e9a7b3c3efa336a818bad75a6e8338c0b79bb363774f1a45558bda2925c32aed7b4b8a9f94e1d8132933be956776d7ffe3935a1720
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:uQRQyi36YOcPQLvw2gAf+PN3lfb9s
TLSH
T160667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0c219e48e1b4e536af7c0ec503344ae1f2e9ea78f79f7cf057f73a9e69ac3bf4
MD5 44672187d238ca797238866f6b712026
SHA1 ed12809b12eb1ffe305dcf9d562c79696b07e4d9
SHA512 04ebfe6ca5ae3f15f1cb62b3a142ff6080e480cbe1417ba69a7b116920a8b820b9fb828c08f629afbb92d3991aaf934c2ff485fd89865eb24344ae33be3941f6
SSDEEP 24576:zwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0TUeA9n/TM4NZYeq:L68Qg55nhheWu7PNU3/GA9n/TDbXNKd
TLSH
T164B55A33B2F600A9C44DE1769F4A972196D27C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a37ae552cd4ad4e59edb44e258fe9a045df26a2775ae96b929fe2dc3c8f71405
MD5 85719b8e948b835bed658255114426ca
SHA1 b8b4ec5f85bfae286acc7eb50deb4f826bd17ed9
SHA512 0e56f6287056c9904fa7602cf814587d583d038f8b8b98752d18b17e9b219d3880268f476ca48e1d61944a5fcb3a890e8dccc7ebc66eeaeba8fbd17a993766c3
SSDEEP 49152:k3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99m:xy5112gYy5azzVvL69nLKnhZAfb9s
TLSH
T17A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fa8371ed2820f1394c45a1fbf542b66035230fee04b89a809701aa55e73d861b
MD5 f274411e19f098e677355d6006105d57
SHA1 e2fd9e71bc730bf0f0706092ebf198edc8557f27
SHA512 1cdbdde3b271830bc73222727d882a44e1b64afc462c45b743ff0f2a07817a68516ee003b833106c0bbddea3fe76a69b8a3ec7c188601e30afb99bde13ba96a1
SSDEEP 49152:HB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glYA9n/TDbXNKd:Ju6JmVxd2dtfb9s
TLSH
T157D59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 897bbebff66a736b3ca62896115d3f58437c8094b43511c7ba20daf4998d8e03
MD5 b1975de036b40db23e0592b554692b06
SHA1 a13fa6da81bee08605dc6c357b28a0071e08a871
SHA512 f4109655d991e1303be659e4197729f9daeededdce153dcf4a896bc23572dbeae53ba64b3127e59ec5bf77828f527da1e4998b9c1030a6930d3c14033a91f5ab
SSDEEP 49152:L1hpsNoJpF1A6UU44CwH7R4xsA9n/TDbXNKd:LmifPbROfb9s
TLSH
T150B5BE13F2D800E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c251267330f1893ba6bbf0df4915cc440a5cf5cca1ff499b00348d42c9ac9b29
MD5 36d5e3f7704d993f539591f35eff8fa4
SHA1 d529c04de40ac6f61be5b7f9efe4fa997f0f1245
SHA512 92d34d7e5823ca3a60e134612e666cc02475d93ce782dcb276ab3321dcebc5cc5c7b298ca3faa96999c7acc3b51b294ff17c1079ccf938baf1122458bccc9deb
SSDEEP 49152:USuZQIY0Be2KRRVtOnks6NMHqnA9n/TDbXNKd:G5dKTi61Ufb9s
TLSH
T17CC5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 236172c439c5692855803eb02c04eb801b3568fe85273d2e0d1258a5d4af5a18
MD5 a6cdb16bd7190cd784a51393c3483d47
SHA1 6dc955cfbc792630324302e05b7d4fdaae35b40f
SHA512 ec687b7b9c77a17bd4af0a4831aeac46e5a6feda2c8f8e139c21d8ab356492e2b1f191bc458d112a24e3b8eb20ad110c431aa5830a6132c933e65ab2291efaae
SSDEEP 49152:uhtSn8EApI0figngiDn0AP5woA9n/TDbXNKd:vX2iyph6fb9s
TLSH
T1D895BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 c8103456b52b7e53aa9f9a4fbcfc99cf0c69921e0a17353292d04b4a64726d6e
MD5 93ae635f09e18fbbd20334d2e3a713b5
SHA1 eac4117d55f32a9656729f8445a4252f62c7d91a
SHA512 00a42e9d21d1c4f841748375e5fe9a313d6e3507512754ff39d20beda46e2ab34cd5096b10789d420212e2df02f1ab75a92bce3d059c66438e7fe8f67e693ba9
SSDEEP 12288:YPBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d/:YPUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1276523824FFC09F5C74A0AB580A67B0CCD91BE4EF685439E471E722A5F385C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 3801107994bc876ed9918dc71e0e99b562be7f86bfdd52439f976196d25ddb1c
MD5 d4dff4d606dc43f6ab553775471ed3e4
SHA1 099f033b186492655af4686fd6b16c1371bfc7f1
SHA512 1287dbe951bb4a1a8622b0e67288bc728994fd231179028ed3be366403460ab6c83e5c35e1e34fd68697302cc3614772c950459e22c1d2759fcadb3dcefe89da
SSDEEP 12288:gwBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d7:gwUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1086523824FFC09F5C74A0AB580A6BB0CCD91BE4FF68543AE471D712A5B385C6C9568CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 6664764e666a9ec1514a93246d43dcebb967b472d8bb7e5be7809a6f57a1c299
MD5 7f283ef0f1af63f39e06502ff6e24a95
SHA1 ecb7e92c8ea62d57bd4d7c95c5b1a8006eacf7dd
SHA512 b779c21c5cb8a5f70debf8b37aa165de5d7b5bb31f793366a7c75aa51e6cba477726567a41be333603c12d99ad07e0282565b1a93caa6a9e20a4421e0ec1e603
SSDEEP 12288:0KBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dZ:0KUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1146523824FFC09F5C7490AB581A67B0CCDA1BE4FF68543AE470E712A5B385C6CA564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 edc420affc5ead3a5b85992b37d235f32e27e9542befa0f59541f91df5df019c
MD5 fb8a03ef12566331d56659a9b3845969
SHA1 06e9648dfe3f2e28201c042ea0c85048520b6d8e
SHA512 e3ebc54782cf56d2a01d68300d392788ded50b0da061e46e5949485ee15a929ff2b1a6cc0a23d204a59f38783b4ca5c6229caee5169df91a57376e43df0cbfdc
SSDEEP 12288:zVxBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dh:bUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1886522821BBC04F1CB4A9679C4A6A708DAB2BD4EE76183DF4705361A1F302D5DD35A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 bd4a6f705041c0a9b6b24717225ced5ecacfa83bba5a09a292104dbcf108d013
MD5 836aa6c914891a57ec753d58861ef135
SHA1 59f28dc0a9cde63942cbd4d64963330d408f2933
SHA512 e7aebd9778b56fd31195f828d235e219a532b43e86f69dd08a2e3d931337a077f9013b630ff0a73c03ecafc39d835e6b528b22c7040b9afff0974137214b2adc
SSDEEP 12288:L5BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dt:L5UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1356523824BFC09F5C74A0AB580A67B0CCD91BE4FF685439E470E712A5F385D6CA568CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 46e792eda4ebb6fce95bba9420e2247329b8ddad1e7d1b7a7eb7e011d9767198
MD5 171b4d6ee525d93720f31f8b293472f2
SHA1 1dda605f4a418b8ca50cd6b585321a7221f6d7ce
SHA512 160813d78983213e0567d060bb02dcaa4d76d0c49dd38342e2cb68aab6c0b28ed498729cb7ce8548c792919a9676b17b7d66b07827b99902c8813bd2d8dbf5d9
SSDEEP 12288:hsBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2de:hsUeA9n/TM4NZYeNm+9MhUwd
TLSH
T17E6523824FFC09F5C74A0AB580A6BB0CCD91BE4FF68543AE470D712A5B385D6C9568CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 5018cbb4ad0c0f1d44ae7ee3b42f5e52d3a9a7db5bdb0269db81a3d528e210fc
MD5 d846b6b66a7511d31afcc66f940e44c8
SHA1 bae35de54cf5edda4da9241e8fa88f7b45ca4d35
SHA512 11b4b5d5c24bec10730b3ecb5a6427ff342d39cb1956825719785d9d9297b05d9671c2c8030e08c8a7b8676787b41c9f5b984bf530598a70d292599845515f50
SSDEEP 12288:S4BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dG:S4UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1AA6523824FFC09F5C74A06B581A5BB0CCD92BE4FF685439E470E712A6B385D6C9168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 b9522dfbc29210cf36f9481fca1cbbef2205e88664e13ee454f24bf21f26bf26
MD5 134f4a6339aca77db178ed3be3233ca8
SHA1 2b157b008bcc43e7ce3d42c6eac26b090c95efae
SHA512 b595ee235e10bfdeec083b5267c8e2a4f79f9401b5a5271cfa23e9abc5b1a98e1b89de85b2b4873b6596a25a43e33bdc4161d8555935b8c4a305fbee3da0c1f7
SSDEEP 24576:kZMEzFVSOQUeA9n/TM4NZYeNm+9MhUwd:kZMEzf+A9n/TDbXNKd
TLSH
T129850295B3A00CF4DD67823EC8659A05D6B27C1A5760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 a66033ddbb2ff46d8c7bb519fce390cab2aa1a63d0259ce258e45f5ff72b9f09
MD5 9c030444b37e3a61ad3e95a383899f5c
SHA1 8b9a3eed2ddaa8e570a910c50d3f88e495169edb
SHA512 230f980a4813f217b56f88e9f34363eda9857960e1b018a11b5005bf3e2421dd143bdaee1bcb47b7556a91e9c5f079181f3ae00560ebf1289c4395464a62d73f
SSDEEP 12288:SzBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d1:SzUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1986523824BFC08F5C74A0AB581A6BB0CCD91BE4FF685439E471E722A5F385C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 f28ad775a1c8e0d4b17651f6fde642052bf6d3ab605488ee83550dda7e03f9b1
MD5 9534222315cc9d944b9422f354e21de6
SHA1 04a39b74729b8a998c171c6b5a172d382154f229
SHA512 e64030e9a69fc840a01804196fe4992432007f335c1b97ccdc50bf3a24ec585a959ebede670db7ed73c3e5cf5a2dc6dff203054a09467c4a2f2666b66e6afe3f
SSDEEP 24576:mHUeA9n/TM4NZYeNm+9MhUwdIUeA9n/TM4NZYeNm+9MhUwd:OA9n/TDbXNKdqA9n/TDbXNKd
TLSH
T1164523824BFC0DF5C74A0AB581A5BB0CCD91BE4EF68543ED470E722A9B385C6CD5648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 c8c8e7acf496d7069ec87171cab86ff3d370a85383b999441a54d8c583726d5b
MD5 a14c0a94e8d296b136e6343897aba08d
SHA1 49e6a9e9e5bafe882421d530a38fe86325ba8ba2
SHA512 df1ecfb240002a9c28349d66910939b317450fad78e29d7577b91bf91f97ef9abe658264a16c5f20b4e378933c50873d5e54a810ad893982b12a95c57d96547d
SSDEEP 12288:FyPz5L8qBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d7:MzyqUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1E575024767B520F9C2674238C8A21B05F772BC3A57208BAF036417762F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 df293cbf4ea01c35d2ff685f7451417fc545e10149f247fd3d23b75bcacbaca7
MD5 4dc26b4173a83167d09a571fba7fb149
SHA1 625a8ec3892b3135c5e24f44712461e88d5b6f6f
SHA512 5a2106eb2b426c4520f5b548dad0bdb897ad0934ee4140dbbc807a07571d16e12a155f56beca6bb72854e39729ff17613f810795558933e610d58bd80e3c626a
SSDEEP 12288:glBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dY:glUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1AC6523824BFC09F5C74A0AB581A6BB0CCD91BE4FF685439E470E722A5F385C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 0900115144df5899f75679ec1d00006e9fd6007d200de24ab67835a4e6de3754
MD5 278c3835363bc3a281b6fb3dd329dd57
SHA1 1509edf73ef05260404073472b102c2703181872
SHA512 c8be471382e8af3fcdf918b05c6db2b63cbf33e3660bd66ca083cdad31bfaff16ce64b89b0bb1f1e3779a9c8aef37343eadb32a983b3d2631fb173c02c8b3699
SSDEEP 12288:9lBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dh:9lUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1546523824BFC09F5C74A0AB585A6BB0CCD91BE4FF685439E470E722A5F385C6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 46d1da290e6ceafd663bc0c13fb5bab481c6506055ac55c4e064c948a19ea998
MD5 fd59b3f78e9a913344c43e5bc22342c1
SHA1 5e7c7ce909d10638d8cbc4d54fb5e47151ee4bb3
SHA512 b71d91dc602caf6ecd6fee121b3f874f98b8971812bf862f6cf29b507fc58b548a245a309031a22ad88840bdf594ed4906d73a210daaddf78df7ee55548e588b
SSDEEP 12288:gyPz5L8qBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d/:RzyqUeA9n/TM4NZYeNm+9MhUwd
TLSH
T16B75024767B520F9C2674238C8A21B05F772BC3A57208BAF036417762F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 40cce8d9a9e5f7bd5eb5f5f302dd4ea8f28637dd37009f043ec9b86763a865af
MD5 4c06f6f79ebfc279fbae14671ec4ceff
SHA1 fde01d98400b24f1e219786c9461ac147fec905f
SHA512 56dffbe2d9dddfe7199235a0af2927b7d5043621f4a9b671642419bf9581b4bec7bc3d0f1041f74bf00295073d7b07f742566b7537e6c26bf78d1856ed13dafc
SSDEEP 24576:jTdaLl3z0zD0UeA9n/TM4NZYeNm+9MhUwd:jTwLljnA9n/TDbXNKd
TLSH
T1BC850295B3A00CF8DD67423EC8659A05D6B27C5A4760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 a6ce9a1c8b22ceeee9b1a246bd6f2d73b23e1c18f7f41034f7c926fc88569aad
MD5 1134f6b6d896d88aa85182afceb8fe89
SHA1 2ee25d7db07547d770f63af9e66cb4606e5242b2
SHA512 3dbf186318efa8f2e634b8b170a8634b079f781576f5c6f283e355073cc358998f28a45f26575e710e49c9dc139bc5733300786bde1e4ea0cc4aab00fe1fa4bc
SSDEEP 24576:s35d9CHKy7GZ4UeA9n/TM4NZYeNm+9MhUwd:W5d9CHKyasA9n/TDbXNKd
TLSH
T13E95CF90F3E814E8F1B79A35C9765501DAB67C5A5B31CA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 43db9d8442677e395e06b8d776af942a7fd13054a1f822cae8a8b985bd5cb863
MD5 16aacbd7d171622bd1e0fd94d573f07b
SHA1 c31e1c215653b071ecd169b9630232d04efbaf63
SHA512 b315ff914568e3c0fdf62800a3221662449c3db15da5b2c913c6e09091987a34b6f39af6403ddf8875c441ab312214d9442828382e391df3c826cfb528107ef9
SSDEEP 12288:vEBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dV:vEUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1806523824FFC09F5C7490AB584A6BB0CCD91BE4FF68543AE470E712A5B385C6C9568CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 c5a4bc96b48cfed4cad6e2fdade58666bbbdbea11663ff4eae6671f3599aa78f
MD5 be14bae269515b7bf61c7d0aa533cb1e
SHA1 45f195127737d0766de77b72cace032b40b0e94c
SHA512 81479dd7faf73aa95958013743f0e2ec078eeea97b35602ebc0968ec49c3c66645cfb414ce2c42ce2eb4e431bc55d981d2dd4811ad0403a4532f04a473a66454
SSDEEP 12288:HKBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dE:HKUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1546523824FFC09F5C74E06B580A6BB0CCE91BE4EF68543AE470E712A5F385C6C95648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 80c8d91390170b6d1633477a2ae1d3e23db0b55002a00e1cb39b56288fa60a6c
MD5 0c4f986213cd7b9bcbfae7265fe79e37
SHA1 82203abf80c285e8a80d17a1f9f3b4c88cf5ef31
SHA512 ca5cb81535b7ce121ee7b7375964b36fccba39486564e0b32bef188dca57e75d71a2b114eccf3690f1237b2144be467452f4a56aa087358d9805376166ac9b22
SSDEEP 12288:JbBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dl:JbUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1386523824BFC09F5C7490AB581A6BB0CCDA1BE4FF685439E470E722A5F385C6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 ed5f7674a610a738a6e781790a95907d37b56006e57c619c9154fce0cdae8423
MD5 775ab355d3ad76bdf70769d80e8ba143
SHA1 b8488a42650c4bb82d84a49fa468d629ad1dda95
SHA512 375ca8a3bb848c3934a80143937c4e88a126c9fd77753d7cc894ccdc791b2c3bbde094d4135d77a7b0dbb6107b0fcf0313ad132f8af7a5651a79e9fe9b18a903
SSDEEP 12288:vlBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dl:vlUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1AB6523824BFC09F5C7490AB581A6BB0CCDA1BE4FF685439E470E722A5F385C6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 0052bf2ab94c62050f0de5207ebcbf945a06d591b1330ac477be6009844819c4
MD5 aa616896f5ba93a6a75050d3fb7a4bfc
SHA1 3bd9703606b6439f548bdb1295713936ea211203
SHA512 d428165bad5cd4fd9b9cfd6a78ab6be87db83dfd3bbea486b4716689c1b1ae878b7a9dc12de0c843963d652858646c022ce820298e5c9591537ea362dfc82317
SSDEEP 12288:pEBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dM:pEUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1F66523824BFC08F5C7490AB584A6BB0CCDA1BE4FF685439E470E712A5F385D6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 70021e7e8b1e6127565dffec532a02809ddd90c3619d47afc1c117865d385788
MD5 3ff85c314b84e2ab088a5ca0f40c8635
SHA1 f7b8b4ba7cdc22ae8f3e99972dfed19dd7ecbd89
SHA512 878272011c1ead2cc31e8efe12444535a05e3c0fb3a383502e81bffb66318a6146f8e11a0412d961dd23fdca3b1d5db0e7892109c0ee5f7ecaacc8d623fbe64a
SSDEEP 12288:p9BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dv:p9UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1126523824FFC09F5C7490AB585A6BB0CCD91BE4FF686439E470E722A5F385C6C91648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 9e5a6fb9ce133e2b5915ed0257cea54607cc018846bb32636d3d22de2ab37f0f
MD5 950a1b52ad5df2f5015409f28fdfaee3
SHA1 dd9e40fc16aee3681eee0df0117b16b94df82f52
SHA512 28b1428877235358bbdca310b545d41f78aedb0ef5d49612003567c0a750074f3a40a21a78cb63c07d8fcb7a6bb28e43c2d3d1187cc1575d9328cb6252b1b98b
SSDEEP 24576:3fwv+k9RX6wkyAIXUeA9n/TM4NZYeNm+9MhUwd:nMnYILA9n/TDbXNKd
TLSH
T14F95CF29EBDC08E5E1B7923C89B7460AF6B178591B31C2CF025A536D0E37ED49E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8914e078a2ae71acfc211eaec72bd05d5392dca13984d4901a8a5d321e59451e
MD5 eab6eaf452881a6176bfe51638af076f
SHA1 24111f2c232fb7fde13771b654822aa411fb060c
SHA512 6afa3307797af111e56a70aa21beb25352d8f07d84fd21cf738f67cacc84ae3f6318f80abfeec80d8a0645a1bc43d6cc57f85e8fed8a339fa0545f341638c4e0
SSDEEP 49152:JYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0IA9n/TDbXNKd:xySzPFfb9s
TLSH
T1D7066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4ad5113be071a97075495a59eb9e413d20b0887be35c4e7bb1456ebe5696cc35
MD5 76a3aa023639fbad19430f1707e1ffd3
SHA1 28cce62c3bf67eb239dd602b5b96f235bfcaa9e9
SHA512 40248e35fff8b8c930cb76e5207aae9478d15a0da83a3b0980a26362771511a0f37cca165ac55940bc0a004465ac105ddefd320496cd7ebe0e0a3af55622c127
SSDEEP 24576:q47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYgUeA9n/TM4NZYeNm+9MhUwd:q47JUQj1irIhCnDHUPfF/YA9n/TDbXNs
TLSH
T1BC65AE1EA3EC01E5D1BA927885154A1AEA71782E5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 a201341d898fb543f6279613ec223f5d037d320b091b3c9391ec230bd203b4dd
MD5 51c6329c928d2f7005d4af13e3afa6c9
SHA1 c8bd4acdf452e0012fc8858a6046e0ca12722281
SHA512 58ba5d3d2fcc0846ea87b19c8250423cdb1ca016720b70b5fb682b77c8c19ee8390f53c14df7110e5c632db5be7b6511a3e1b7ae7402bc72f4173ee77acd911f
SSDEEP 12288:bzsfjBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dL:2jUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1A275F04AD2A802E8C16E6279C7565A04F7637C2993E1D3CB43C0F53E1F366D09DEAA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 984KB
SHA256 af61a77498ef586ce7e1bebb1a1633dacf859d6c954d277b1d1af86da6416e76
MD5 013adf04e2fb0bd5cf10129cf4c1f742
SHA1 fe3c3b48ba4707577f510b05de20ecfa59b104ef
SHA512 2dc069cf0fb2f63b56e1190757b88cd5ad7ba58a1e03a97b5b13b5bb206629d5b57d42b13ea2a3611d7c87316d998799f29881ae3cffac47d85811ca07c9ca99
SSDEEP 12288:rciGfU3fLeFoeeZmPX/m8VDk1plthJkARMQoX62p:oi4UPLOoec8VY/kARMQI6
TLSH
T1BF251810766ACB4FC6A944321E32D2CCA7707D11FE44AE0773C9873F9576658BAF2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 2fdafff2517a5ff39a401b271137cb99e23bb66b66f6159efba3418d9367ea4a
MD5 2967704652111d3bb994472f24e6e582
SHA1 a9f7af26875751b9cc554bb50693448c46133bde
SHA512 1074c0c1af7a6e947b59216463a3c0d7e32c2bd716f10e4f12b203e9159423a75f0261160c695b7800516d0d4aac4d21f2c59b5dfe8b41f3b636ee66d1494442
SSDEEP 6144:8OT2uTVFTuEg+4VUxhVDAjNmB8GRW9fyNtMxJLVLSD5i+8S01z3jcVK6A29ttNyx:TFCt3OxhVdB8hxJeNYS1A29ttZnyxd
TLSH
T15C650A416137A78FD1BA6031072A5F8CBBA4EC17B3456F16B3C9453AD82BB51B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 e4bdbd5c194353f35a03fb9e97ba04fead0faa1b359e71127911ca10a938dd56
MD5 9064ae9ab08354d8df1484b62df77665
SHA1 8e2c84157efa15e297b92c5d0d27bb63d8870399
SHA512 b41a8880cd7a5972eb97879a599f61a7444bb88c93603d13b4ebfe779cfa62e5841303a292801b199831212aa9df92a6ea4219f2f120fd7db53038806a15ca9a
SSDEEP 12288:AO7rBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dU:rrUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1176523824BFC0CF5C75E1A7440AAB7089E56BE4DEB4083DF8609722A5E345C6CD7698F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dad629b1f2b25cabbf06da22cef7c7216253b69117321e2327f190a86c2a57ee
MD5 b678697eb7f59dad7b5f7fb83253a8fe
SHA1 8869fb65fb962966eb3dbfbf6d84019754f5d042
SHA512 614531f95f2667bec49eac85c9a208b3dd6f04941bc863c308f260ee6e6fc09831143cb0d31bac0254ba1ff9d587a24b0ef3716da1b45d61464427f07c11c3d7
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bY9UeA9n/TM4NZYeNm+9MhUwd:7gb4mBIBhGFiA9n/TDbXNKd
TLSH
T1D765AE1E22EC02F5E1F9D2B8CDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 897ac99d109814b144ee74ddf7009b13b3729ba825d1962ace5fbaab6eab43b3
MD5 110780512138d848f72e7d2f962edeeb
SHA1 c1e7e7dc0b6c01d91959717bf3e21315f78d0366
SHA512 2fdfacda36b70ebc946e86a76fb56dbbc7407c9e2240679eb38fe03593f5160c13bf1122f29866848428683c2f6fc6fffa1a0efd22c624f871abd3a4c4a8e883
SSDEEP 24576:oG88u8FpJqH1hzria7/mQUeA9n/TM4NZYeNm+9MhUwd:L7ZFPqVoa7/BA9n/TDbXNKd
TLSH
T1C995016567E401F0C47BD13889824667F6B2B8251364EBDF07AC8B561F23AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 475a6420493bc969f785da8a6b738127ff4106e4aec3a5fc0a1e7dd9e957272b
MD5 d9cb0211472e7270320f7632d13adc0c
SHA1 a58ef39c0a2c2866de447353cebc823ac636c676
SHA512 07e059b008b5e24a7a56a7bf46b9bfd45f9363ce02aba30071cabe2f354764042e7f8c1e17b02416edc9b4b49d8090829318a45d0c4a1d91e24ec37c57980794
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjuA9n/TDbXNKd:tG05lO43bYfb9s
TLSH
T185D5C06A62EC01F9D1BBD17CD9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 103ca7762f212fd258594a3a90ad12f9f61459ecac4e1f83d92c9ce6e1ae2f5a
MD5 01a44c124839499f2bfcd1f0ada78354
SHA1 494095c0645ba389966e4c334b6dd4c7f5dc3ebb
SHA512 c4263e5354ebcb3e49ca47c4c7ec72888a7158c9557836b3e4baa56a4584093e667a00bcad846a050d9deeb8f8c72ea0a6de42ad78513dd9c7121c0dde973924
SSDEEP 24576:afa5POZ3dpFWVM50JicR2hG0lasx2+47eidneUeA9n/TM4NZYeNm+9MhUwd:ya5POZ3+Jt2pasx2+mGA9n/TDbXNKd
TLSH
T18A65AF5EA7FC01D5D5B9D17DC583860AE5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7a949ba0418979d13f2645440197347982c9e8d29f886f5f6010ef02f7049d77
MD5 45cf379825ee3bdda5022af613e1b72b
SHA1 12c203c3db793fae1f178cd23d44366f76c0213f
SHA512 e04e7cc5377a7b10c6956721a0f62bb34a890ad623dd5937b242da23cd5d951a2f28adaa5ce802f57abff2f4d9bdcefc338f86c91a3f4056ba3361ccea1287eb
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkoUeA9n/TM4NZYeNm+9MhUwd:fNc/zEOVHFhA9n/TDbXNKd
TLSH
T17B858C1623E901E4E5BBE1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fd65fc30ba4dd5edc697357d84d30f0356961b6da34ad194623c9f34eae4d6d8
MD5 4d77cef72e9d3829f1f3f0fe98bfd36a
SHA1 04b90f1be2219ed138244408e16a5ac671dfbd3c
SHA512 20e22e05a7b58475798c87fcb8fc3b6a88f71823532649588cff3486ebf1b6fa6a51c8a0bd785fd3d216e80f9ec90564cf206a71395766ecb3ad66ecf4e7a39a
SSDEEP 24576:58kNvNnaFeYhJNtmZBmiUeA9n/TM4NZYeNm+9MhUwd:58MwBtOmcA9n/TDbXNKd
TLSH
T16E55AF6EAAF805E4D1FEC6B58D238516EA727851173293CB4390C13F0E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 70ada6f3870639067fbd1407a384d20237c3e5b7704b6ae0f2eaecc4e9551309
MD5 bedf7c007488b180b215259a74bc7526
SHA1 69b6281806b34c19088f2cf0d57bc59889da42a7
SHA512 b4805d38e78e99b802454c301e2775eb156126cc69e3f11b2cc335dbe0f7cb4ac4011713cc53df66f50cc81c736c81731a418c7b01a584e6d83d3745b18d8b39
SSDEEP 12288:iHvUrBFrEjwaQ8BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dZ:iPUr+NQ8UeA9n/TM4NZYeNm+9MhUwd
TLSH
T19885E15F26EC0CE5E67AA17D8582870DE772B856131292CF0290817E4F37ED8AD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 a80f557220caf89c504b691f8da912a1596918c1f8fb4784c6c631518836561e
MD5 74bfc36c04dd39d53e8a0d54d54e8fc7
SHA1 4b2f1cc8ae563abb152308cd5f6fb7aa227418bb
SHA512 78f86c549d86333b0f630aa5bb9d5de9a62baf24d2da6df57e2cb1d2e80d4e503c25653deaea7cbc8cefafa536ac4ec216d81b0f4c5781c8767a84f3c150072c
SSDEEP 24576:fD3FHshBIYQgAvUeA9n/TM4NZYeNm+9MhUwd:fDVHeBIAAjA9n/TDbXNKd
TLSH
T15F95E17EE7AC04E4D57BD1BCC6638A06E77138AD032156DB029491BA1F2BEE46D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1088-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1088-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1088-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1088-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1952-381-0x000001222D8F0000-0x000001222DABA000-memory.dmp

Download

memory/2356-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2356-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2356-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2356-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2548-352-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2548-350-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2548-104-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2548-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2548-98-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3200-382-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3200-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3200-368-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3200-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3200-92-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3200-86-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3700-369-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3700-112-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3700-119-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3700-111-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3908-72-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3908-78-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3908-70-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3908-353-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4116-82-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4116-367-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4184-48-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4184-54-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4184-121-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4184-124-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4184-47-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4260-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4260-134-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4260-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4260-128-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4260-136-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4512-193-0x00000000040F0000-0x0000000004157000-memory.dmp

Download

memory/4512-209-0x0000000000400000-0x0000000000711000-memory.dmp

Download

memory/4512-69-0x0000000000400000-0x0000000000711000-memory.dmp

Download

memory/4512-1-0x0000000002610000-0x0000000002677000-memory.dmp

Download

memory/4512-0-0x0000000000400000-0x0000000000711000-memory.dmp

Download

memory/4512-9-0x0000000002FF0000-0x0000000003075000-memory.dmp

Download

memory/4512-11-0x0000000002D20000-0x0000000002E69000-memory.dmp

Download

memory/4512-7-0x0000000002610000-0x0000000002677000-memory.dmp

Download

memory/4512-17-0x0000000002FF0000-0x0000000003075000-memory.dmp

Download

memory/4512-188-0x00000000040F0000-0x0000000004157000-memory.dmp

Download

memory/4512-6-0x0000000002610000-0x0000000002677000-memory.dmp

Download

memory/4624-23-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4624-30-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4624-29-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4624-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4624-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4904-346-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4904-58-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4904-65-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4904-59-0x00000000008C0000-0x0000000000920000-memory.dmp

Download