94279908975a75559a46ed20d025e34a01ca1725584fd0e02e86d9eb9ff1c083

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
Size 2.0MB
Sample261011-3cacaabb39
SHA256 94279908975a75559a46ed20d025e34a01ca1725584fd0e02e86d9eb9ff1c083
MD5 9c6ab90b2cdd56bd6618f9f0f2af2c99
SHA1 f20ec970467e725659410d94a90b5c2b7bfc37f7
SHA512 9208ce0cc71e71f0f241702886e01a4e514dd08f07841ddccd1b58e2705246505c939d797a6d8e7dcb89e732b80e29b3427f6d361d2135a8b1ad05af0faa0e6a
SSDEEP 24576:dQ6V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dQ6VLNiXicJFFRGNzj3
TLSH
T15AA5FA5036F8D925F2F32B343AB9E26559BA7D40A934C64D2601625D1BF3F00E968F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3432	elevation_service.exe
2600	elevation_service.exe
2696	maintenanceservice.exe
1352	OSE.EXE
4628	PerceptionSimulationService.exe
3048	perfhost.exe
2876	ReFsDedupSvc.exe
2476	SensorDataService.exe
6108	ssh-agent.exe
1156	AgentService.exe
2884	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2c95a8ee4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\Logs\DXError.log	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b7fbb58d759dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000024b97b59d759dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000827ad159d759dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073606059d759dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb332b9dd759dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3432	elevation_service.exe
3432	elevation_service.exe
3432	elevation_service.exe
3432	elevation_service.exe
3432	elevation_service.exe
3432	elevation_service.exe
3432	elevation_service.exe
2600	elevation_service.exe
2600	elevation_service.exe
2600	elevation_service.exe
2600	elevation_service.exe
2600	elevation_service.exe
2600	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4860	2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
Token: SeBackupPrivilege	2876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2876	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1156	AgentService.exe
Token: 33	2884	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2884	SearchIndexer.exe
Token: SeDebugPrivilege	3432	elevation_service.exe
Token: SeDebugPrivilege	2600	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 4704	2884	SearchIndexer.exe	101
PID 2884 wrote to memory of 3364	2884	SearchIndexer.exe	102
PID 2884 wrote to memory of 4948	2884	SearchIndexer.exe	103
PID 2884 wrote to memory of 3540	2884	SearchIndexer.exe	104
PID 2884 wrote to memory of 4980	2884	SearchIndexer.exe	106
PID 2884 wrote to memory of 5468	2884	SearchIndexer.exe	107
PID 2884 wrote to memory of 4500	2884	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-09_9c6ab90b2cdd56bd6618f9f0f2af2c99_amadey_elex_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2696

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1352

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4628

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3048

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2476

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6108

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3540
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a20cc67638061ae68b85e82a3ff7916039609cb822e23bbf65a27362ca4339a1
MD5 6b4632b5904ae12ce4a1fd08f27f71ad
SHA1 19c597dd2e4075b2cd545069fee3264a315d9269
SHA512 a01ba1e29f1845f014b250040ce1ae3891a006b5b235f94dbdf162753228d63a13ab91dc56679835b2b258d559f2900725c0a67cf61cf575563bf350b18501cb
SSDEEP 49152:Fb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnZLNiXicJFFRGNzj3:b3q6mjBq7wRGpj3
TLSH
T181D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 581cd77665547a907378610c283f2d552baea93e08c8aa49b75db3f23269331d
MD5 9c4e8c62512ecda1cbed42f1c09890d0
SHA1 bae44a61eb7355d2ab930740258ba3c77e976a37
SHA512 26f65fdaa5d8a8dab5a0625dcf78be8ece88a3a9255b070f20c98ca3ed199d440b6dec122dddd6759352a0c113d8f4ba645ccef318464d21f07b510323c47964
SSDEEP 24576:JXYfDtczAO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:stcLLNiXicJFFRGNzj3
TLSH
T10585012963D408F9ED7B813CC9B28411E6727C554760E7DB03A4A92A1F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 66f24e478268969035f6b0687075d461247b7976b682aafe424b96536ed506f0
MD5 e6f6bebf9db45b3803c0aecfc075b1f2
SHA1 9ef3b352749595195330af2d41e74bcfce2eacc4
SHA512 2c372cda5cd69a7e0949193607d72cc1ed1b3dceff0e60069312fcde298ea58bcec9d0e5bf8ccf867816b452cdf4bc8e4adb1bf1653eafce3c18f4c4c08c8283
SSDEEP 24576:p0Le5ji0hmxkrMh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pPji0Am0LNiXicJFFRGNzj3
TLSH
T102A5AE16F6748331D073C0B9C5D2A69EE971308657308ACB4286D77C7E67BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ec74227c940d732cca8522465f9ba96aba8b8c30d78f72e07cb70700f394e42e
MD5 e05d44ce4e74653f7505f38bf5f6ff25
SHA1 fb746e5a60da973d3696d2b48dfb1b0ba0041ea3
SHA512 de4582204f9916657aac58348ff0c4d7c4af223c9232be4eb2f5a4ecdcbb64847d9e1c121a843cb538187f5c9f44343a25b4a09186d570c5d0d6ba8c5e3f68cf
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWj6q8wyub/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:r/ezSC6vUzPv+Hjy4LNiXicJFFRGNzj3
TLSH
T1AF756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 55b2104ddf6d119b091d9defa0638bd0d28f0b2893df28a77bde332525eb5768
MD5 b4cec9d0bb05a97372dea0b6c22ddbec
SHA1 52a06fdfd31310945f7883cf46ffc0502ae187ab
SHA512 908c99570aef05b2588318972b91f79e788889a7badfa93aff7d6443bb90c2bd61ee1a386286cea888795f70ea6446a0727efa62a0d05849eab8f4acfb3ff4ea
SSDEEP 24576:UVbqPb88hv/l+B6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UVO88hXl+ULNiXicJFFRGNzj3
TLSH
T1A6559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 e422861f5fae69f92e1cf62c71ae210c3ea0904836122e53f19571b5b23326c2
MD5 32e0b8b38d52bee143e32e1362f64a0b
SHA1 3bac7bb590f9517d09512e476158d71bb813ee29
SHA512 c6bf1c045b893d181c6c79c1accbd7c8ae62123353074fb733a825efb2751efd73b8d50e84f3850108679e9c33e9ab62698a9be2cc68214d2f14b3c0975dec64
SSDEEP 24576:WkN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BLNiXicJFFRGNzj3
TLSH
T16A7523E3468864B1FBFD003986795428A6845E2CDB5A5CE2D2543E5EA17CFEBCF34027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 fa2b61dff1428d698bb085c4e276a9d0afe66e76b6f2af425d6f40218d640fc9
MD5 b0521483390ec08a2daaa6a7829d0488
SHA1 4f052e02d5173eeac85c2d68c14d0e641fb074e7
SHA512 0c761b25841a71c9226f06bb7e5df350325d496aa89a8c3d620b99d0cf9458bbf4995fd241e19500d9c3cc4b209047c6b75548904124ae474f6b4309623fb3fc
SSDEEP 24576:dJIUC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dJIUCLNiXicJFFRGNzj3
TLSH
T13885CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f0a5065b8243b7124a672d89c9bf53524f0208184d97015c6004377b2018a657
MD5 f8fae758f35b941046f9a4ab450d0cfa
SHA1 b863ce4e156c2623e9cf696715c4727c3c479d61
SHA512 bf4d60122646d9ba4568d29fb5969f9d3bd5fa3f6a43ef60c8401d0fac8062be31e329f88c68ec4bc8e92d23aced0075434bdeb8a50fc6df80f6372b9720fffc
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THM:+QvGAdlCEL8c/WRNw5Cr7wRGpj3
TLSH
T175266C656BF880F5E1B7E138897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 7617ba21e8a8dcc65248aa5258cf252deeec579793dcd3a1f1187e0b5ff6a0a9
MD5 61b127dd54100b07da9adb419f91d74c
SHA1 6977b16e80fbf79f73f0e5f95424b7e1f7464a34
SHA512 d070f4a8bc67af6bb2c6be378b175b95e0a9e8a2dabacd8e556c488b574a62e7aea365f9a9f16c49a5f5178824382d70e12515ef03dca4f484b88b75d331a272
SSDEEP 24576:NAewsAjE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GljELNiXicJFFRGNzj3
TLSH
T10795E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 341f9a8828b773a23e637a16d0c7815d93e79652c42d35abd4829b9c5aa66847
MD5 2596576010174c18f21201be5fa6ae80
SHA1 2d2f49ca84918b9194ddc50331cddfe9376bcfd3
SHA512 c2dae233389e258c08f48c210e938835e19fa4e99a7d07d52c953a8e2974636e487aa6cfd1ea9012cf58586b3c15032669f8e6acef5eb44e723764b160ac51a8
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHYF9:7UEtQevvqc2W1cpV20I32s9
TLSH
T1DE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 59ba0aa9c3e8333c619dede45742a7a2dba4c8d287fbf660a190075cf001056b
MD5 c37d798387f545eafa1845979efbce03
SHA1 b33ee4ebd38003a08502cbe8b4d0d0b296504fdf
SHA512 91690d830d5bae304f83fa34a965f86120ff24d67ddda3f6ddf5ef7dacc41387cc3b5d1ff2c3be19f3e31dd4ffbecc9c0b00b8a9b43afa71ecd286f5aefeb194
SSDEEP 49152:BCbRquA/m2yL5zifFiV+XenmE3/zkLNiXicJFFRGNzj3:uoqHVjnm/7wRGpj3
TLSH
T12BD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 eef39094265b21f4c837f0bcc3210fccf30ae4ab8cf50eb15fb83c13fdfd766d
MD5 d7a93a53a6144ff420c78cdf5304aa47
SHA1 a40af2b82d72aa00bf10c881259c68c4e285bed6
SHA512 9a4f72e558ee1a8b7c8b91fc5964e54aee2db23342e2cc626e5c2cf701d57181ecb6a4fba2520075b7ee2caf5ddc3fd83f3f70faa4263fe9e73e475d7c03fc0b
SSDEEP 24576:CAhGL6IFoiwtA5l7S53f/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CAM5Foiq5PLNiXicJFFRGNzj3
TLSH
T139359D81E7F955D4F5B3AA7899B68170EA76BCAA5E31C20F2150D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 75b9ec0341e158e5c6970d8c93584815ce6b7a97e4d33c70f296645bc557fc84
MD5 b1dcd5261bd92420f223481854ab9fdf
SHA1 f995f0d249f42d1a6db49fd6e432218e16a06996
SHA512 207593ac0980c0f5625620e320f46e3832a49f0676540f64316eee80f51f2146f8a279dd6778297de86f52e8ca71d2ec803e6584a5be201bcca71fd1613af98d
SSDEEP 24576:xwu4OWY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xwLOjLNiXicJFFRGNzj3
TLSH
T14385F18672980CF9EABB41398657C035F7F2BC152A21DB1F5360C65B6F37361AE29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 5611d56581a8f5e7f58e44e095b6c4a2ee2472f2eff528e01a2b11295e9e8b17
MD5 f17174ab702c864544eb7fd38c1a99a6
SHA1 d64a9d442e2d92644cf6c9ba9d8259b04c8d69a4
SHA512 cc00f3eab3f3bc99d6081a140a53295540e295297396429ac4e17e56e57e4398a5be3703389fccfef6ba61e59b2247df3d079cb550017d53b1128165b74870ec
SSDEEP 24576:cZup/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3LNiXicJFFRGNzj3
TLSH
T17D75129622C820F5E6BB413DC9B54504E7A17C2A573643CF52242A6E6F36FD68F39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d1dce8797f106b16459bba153597879077129bac23e4e3166b683ac7c4b0326d
MD5 ff215b67550276b204bfd9e6f0272a9f
SHA1 29d63a61b2c3ae5879e7fdebc69bf744e764908d
SHA512 821546946c0ec7b0cca12a88736cff4cdc6b2be37ca8a5396264a26af3faf3c16d51bee66f9323daec0c7ca930b3b6953317cd83ba894b7793596839bb81afca
SSDEEP 98304:MQRQyi36YOcPDLvw2gAf+PN327wRGpj3:TQyiKanX+PNKF9
TLSH
T183667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b2b67f984fc5a9761cf5d808c4c233cb1607dfdbb2f97a8104d761c6fa9640ec
MD5 d0764efc7ce74515b2a1e9fa6390bbc4
SHA1 bef3309d89aada01f63090da1de2685453de6b54
SHA512 16ee742d37298667a7ab07a0dbe21d62bb158c01729ca3aef18bf049456dfbc82468415a6cbf32f68d5397019a08fbf679681748a7cbb9df332d34a1ee4b8ebb
SSDEEP 98304:rQRQyi36YOcPDLvw2gAf+PN327wRGpj3:aQyiKanX+PNKF9
TLSH
T1A8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f6660654a7cb70705463985c63ad264c239e24b74eb406fb16156870999d054c
MD5 8ccb8018f6ad6be0055c8479120921af
SHA1 3b00ca877b4d3e0fc0c21ff53e330859cff3960f
SHA512 a21066c173894577323e046329f909d602952287eb83b04aae14148d6d124ccc4e25b2f22e0461dca65339a425a1dde4175eb630a6a12d35a19816959cd945af
SSDEEP 49152:R68Qg55nhkeWu7PNU3/0LNiXicJFFRGNzj3:PthTRc/07wRGpj3
TLSH
T19FB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4505565416706a58a33f96451b90735f8b8b79ee3014ac128c7f8f1974649dfb
MD5 a2e35a58a06616c26a1c2a08ca5a8d70
SHA1 2ae83dafcddf9485129a2890f61ade2ac40e3ae8
SHA512 4d0e6f1a45756b266658ceab68ea0d36c9342cacf9b7d59a9704001f08c93499ac113d3f1ef9949874d4c356e1ff2e0e3f3d248ac1cb700df7b3f1773d626e58
SSDEEP 98304:Ny5112gYy5azzVvU69nLKnhZN7wRGpj3:wLIHRWhrF9
TLSH
T1F4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a646019669f8da01a2a489625e0180af5528759a171333293e8d8eab22711878
MD5 5ffbab68ca48bdc1f4fca0cda209cfcc
SHA1 e253ac0301874cb390046d01e103b5e4e0b27a19
SHA512 7ffbbd11b52ac242cd6054010eddb6ef777ea7cb05a54e853c59d6155062703db958d3ffe91815f658261de437c27a61fb5116aae2a5db5d8e5e7fd1d2dbd875
SSDEEP 49152:4B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl+LNiXicJFFRGNzj3:Su6JmIxd2d+7wRGpj3
TLSH
T17DD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 86baec1be23cde2fa00799d4f0701dfc58343a4624e4eb7fe7040df6b962759a
MD5 f106d10afcf8c57cb78bb702ce4e418a
SHA1 e399e84d14d17f1c339e8268abd304ac6d713b14
SHA512 9816371bec0e8a4bae5f0cab2ca14748b1debb2bdb908117f0495de82c331ea8658fe50b256e47da9d59e080777b1720ef625e55ffa91a7891515281396776de
SSDEEP 49152:h1hpsNoJpF1A67U44CwH7R4xiLNiXicJFFRGNzj3:hmifPqR/7wRGpj3
TLSH
T135B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 508667924fe43ed82d9ed9810eb000a11fb761e981a4da556a9cc011ca066e85
MD5 c0c6c9b8f0798a1df4e958d4ac42a78d
SHA1 7c2ab78da3fc8603939e7c7ab2aa000181b2b2b5
SHA512 d3e5f331fbbce4a2b918abd461885e992b1f09a394958e9718baabe2d78dbeae2960f5d114c7b0bc6c2ab923de918b53dfc493b683f718b6e1e8e4b6d178275e
SSDEEP 49152:oSuZQIY0Be2KkRVtOnks6NMHqpLNiXicJFFRGNzj3:y5dKqi61p7wRGpj3
TLSH
T103C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 65af1f6889b70404ce74bd0d59c98e8e538c853714669b2955fbe2fc9f6f0209
MD5 64b261d0e04c51118e277f49e445f81a
SHA1 d9b0562a44923a1e1249534b8d3011252f721343
SHA512 e2cf525c564d2781145e9d72b2e4c565e07e68361e6cf063c3a0fae53288057c1cd05d4460c759b934190968eb590925fd892e0d57ac38229fc411ef7bb5a6d7
SSDEEP 49152:ChtSn8EApI0figjgiDn0AP5wOLNiXicJFFRGNzj3:jX2iWphD7wRGpj3
TLSH
T12F95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 357169d9154d8e8893b5b5c94c9603082c56327d971587cfa0c924cc1fd9982f
MD5 e38a883514a56d910ac59216ba41797f
SHA1 b7c138967a4adfb6ab0f68fe3b3dfe32296a62c2
SHA512 6609fcff0d250bd3c4a4824886d8e376a351a506873e274165cb7d77fffacbf72b6ee51d4726566625cbec2ec5623f5ae0cec3e5979ca4651e25e3ae369f2590
SSDEEP 12288:EpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:E1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E87523D355C955B2FBBC003A86755428F5881E2DEB5608E3E2483D1EA279FEB8F34076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 3faaad893a5c2c61756c55988d21691fdca6c226ec528a3e12ec23a8bf97276e
MD5 729c4031023813829fc7321522d969ab
SHA1 237dce7a797bda4fa6483be06cbd2946b380b400
SHA512 b2366b80b3fa7fd6b323407090ca42d5669cd1d361841dea482690928633ea533d673e0efdec326d89011278b6d175ae192c38a8bbd8926aef98bd5b2cb2f0ac
SSDEEP 12288:KmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DB7523E355C955B2FBBC003986755428E5885E2DEB5608E3E2483D1FA278FEB8F34076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 adc9c4b8b04194223490351753e5deea164a574fff9a57cefb043814b1ffc5b2
MD5 2162d21ba8f622aea6f33e148ad19cab
SHA1 912cb3af7088a11b6315ed5416ef5a1667d03edf
SHA512 e30d379d5101bbff5cdb1e1970f734555998151aaf1cb882aee3c518b4855b4f4e2580adcdc281e4d8e3d3a4d39162b5d5546a13f1ab674522707893a98e9a44
SSDEEP 12288:cYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19D7523D255C955B2FBFC003A86754428F5881E2DEB5618E3E2493D1EA278FEB8F34076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 98eed988fcb77431ac08861c2dd2eb1027771bdb2c5f1b91a298d273c775ac73
MD5 f5a545153c5d4bd6c2c7c74da47af5c0
SHA1 3ff2cd180d39fb9ef47afed205ee0836ae0367d0
SHA512 b2826ce92b026e9c317613c522ceeefd1c4d7a5271fdd3a461e82ced3da8101fb25f03fcdb514d092ed4dd2f6a52ef834b65ab627b5b5b233312789ef4bd73d3
SSDEEP 12288:LVriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T111752392168900F1EABD803DCA764024F2A47D6CD7365AEBD3003D1E5A75FEA9F34662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 2d3dde700299097ef887928949c91d413157a46407e9220dc418696a103845cc
MD5 e3a47d3061912b5d456f00101656bc37
SHA1 fbfc7bf79926b5a904aa352c4e7f5b572d9c66f1
SHA512 0382895729da9ea096ddda6057a47d1d11398fef8bc7dc1c576acb148cb8d81c559051e7d12911480d35e1b3bedda027a71d671b14d96879991389bb34ad7d04
SSDEEP 12288:FjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:FX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16F7523D355C955B1FBBC003A86754428F5881E2DEB5618E3E2493D1EA278FEB8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 ae2bd8e7a875d431213c6f26e3d5264d2b5736c8fe02c3f2699e73ad6ba03541
MD5 2014d862e447a6eb2ee7603998cf4bed
SHA1 eb0410ec5de714fa0d2d0e282fdaa9909c0c3543
SHA512 f43da312f62ef28daf27130cffeee0633de308f49939f5d76f61e99b954c5305b919158c6eeec8b88a448c28a6f72d9b003230041c3ff5f0c52acc5251834a67
SSDEEP 12288:1KiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1027523D355C955B2FBBC003986754428E5885E2DEB5608E3E2483D1FA278FEB8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 c41397deef25cba35b86142331f91e3edcfd0dda31e7d35484dffcbf549cb04b
MD5 727892bfe8e669cc13dfee947525633e
SHA1 ec4e4caa2b4bac0f3e9617f356bff58820ed4b4c
SHA512 aaf03bb6a950e8a15000c3e02814acac39463d6e83b8f84f5be588b40bd44301955296df2a6f7dc3d57229abf6834390591cee1a8474bbb0d831096b8d98e2fc
SSDEEP 12288:P+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:PI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13B7523E355C955B2FBBC003986754428E5885E2DEB5648E3E2483D1FA278FEB8F34076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 5a3fcf02c7e580242521aed54fcd3148b75db20e4cfa16fbd0cc250aa7122ce2
MD5 41e9734874daed17b32e18f1f07f22d6
SHA1 18f485c4236033ce3a1d699ef17c28f5431fa173
SHA512 85dce5c1c15ff85bb882d476cfa67630487ac5e8a056af992bc63fe9fec78126b821f70b26864357bcdc00c05f9d030a0802de3e5bc5bf1221d0138b1000cc04
SSDEEP 24576:jZM0zFVSOw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jZM0zfcLNiXicJFFRGNzj3
TLSH
T1FA8502A5B39018F4EDB7813EC9258815E2B27C194B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 df16b24acabbff8617e3c3c5dd870c507bc3e3fa1d158bd28a2bf3173306f787
MD5 5cfb24bd208a01ebb9aab075be665758
SHA1 c23e9bd05f9f4a9865ea522c0d6a13f7e766fa3f
SHA512 26f7b8f8b32cd1356770bc78f54901d4e17dfb1fb7844483eb783b2062c73e7546edffd75556c6607098c2f8a6b5507f4e7bf52a3ad5646aa35c24d514e63a6a
SSDEEP 12288:AViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:A5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E47523D3518955B1FBBC003A86754428E5885E2DEB5618E3E2493D1EA278FEB8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 60ce5aa2bbe36d000058d283048b52156ab126cb83960e1abefcf8abad612b45
MD5 ad04fd46cd2d8f187628cde9609758b0
SHA1 644cb4d04bc84aff3b4e6797619e6d95b3ab7a06
SHA512 b43d7b67bee3538a86a4c18a91f21a86987b6e5338ce0d89c4fca9b317d13ba51f7b4f19f9f7bf56c2766ce70d71b7ef9d0e7ac5f0da5e2a548ba74dcb4d5cc5
SSDEEP 12288:CRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17D7523E355C955B1FBBC003986754428E5885E2DEB5618E3E2483D1EA27CFEB8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 eebb70f0294f5196a6248705c7543717d51f123f7ed604728f404147c80d8e8d
MD5 d4b61c2a94641f31fe10b7bde4c83214
SHA1 d2f51cef91b9a0fb53cf2ba1e73f555764babccc
SHA512 983c7d163c3b1c70eddd5342647e414a6e58e1def33f694bc8077ca76fa6c3e26b510ea1c5ab68a8f00cf1de12285bd603e9ceb5c590009863717d6c9a83b0b7
SSDEEP 24576:hzyU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hDLNiXicJFFRGNzj3
TLSH
T1C1750257639530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 d0586ebc0485749ec86bc1129ae9e7f7d4c5a8ed828be824b559916e1f85fe5e
MD5 7bfbbdbde3c3c588e07bbd8b8733b308
SHA1 a563df1680dbef6275d295d9490f430128dd47d8
SHA512 1e82f350581038f571010938f1dbdb7dd84ac2bc9a1b57b0577b9de385695cd9ff8aacb7199d87c5083b9940152e40975b220d5410417bf26cec3cda256fa924
SSDEEP 12288:XViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:X5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1567523D355C955B1FBBC003D86354428E5885E2DEB5618E3E2483D1EA278FEB8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 f51c54bbe7030411c1a6fe5f9779555c060df2f76c8d11caf5cfb81f540a30c9
MD5 8f0f74970b01befe97ea5f17580202a5
SHA1 8674e1e8e47cc3c9499ca30f5884d74e0f32312b
SHA512 885084165980d45693daca83077ada053b7e8a5673f974246e40d2d2063844b58d3fa2f873d22f8dd842eed4eeb6d066d3d385b75dfb4515f9590356931599b7
SSDEEP 24576:T5/TwSfVcYG3K/cJHlnFR+IGNe8j3IzM:VLNiXicJFFRGNzj3
TLSH
T1447523D355C955B1FBBC003D86354428E5885E2DEB5618E3E2493D1EA278FEB8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 19f5c26703c19d6cd00966536d9538be0b8d812cb9efe1fb3765ecf3caf82ac5
MD5 c3dd365350b3ad42ca5e9e0b883d26a7
SHA1 c0a73331c0c5032a788c3d05edf58eef9a9603af
SHA512 3d0c2363582bb9d4ac013bc630b678dd721bd4426b21b5c81c6555dfba9c1efd3e40c4ea053403b8e52df823597bb9c8cea43a3b7ed68351f5fb16c91e527949
SSDEEP 24576:/zyU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/DLNiXicJFFRGNzj3
TLSH
T15E750257639530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 7b0630654f9d999c0d523463672d56eb9fc3ef7a579e8470716d6652abd0a7be
MD5 f4cac81c78638bcc240f523c63386288
SHA1 d332719bf097b087963c8115621f5911cde0be16
SHA512 dc4274cafc2b2d74244a0fab54c4c9dfccd8a827e287cb410ba7198dd4c70d71c358293bb8d314c186a06340d5003e5f1c7c9ca4d380450aecf4e092190c3848
SSDEEP 24576:UTBaLl3z0zDa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UTcLljbLNiXicJFFRGNzj3
TLSH
T1548502A5B39018F8EDBB813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 956a1b7dcaef1bc697bff2132134715a3469a19ce972bddb2aa105f17b3b7240
MD5 24b36ef616659fd5b8bee7cf5d34310e
SHA1 144548ee2040415d180609f587d7c9013aa9f7d7
SHA512 b073f37b1eb2fbcfde3a01500d74c47a71b973a8982d8c05ccb1b94b7c1505719d23904bc6949ae4348fd585b74e4407dd6562df33f5860ee56b12c54049bec1
SSDEEP 24576:Q3Rd9CHKy7GZW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aRd9CHKyacLNiXicJFFRGNzj3
TLSH
T18395CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 681b69ad5d67294ad904861bca24625214c592c05e9ff257cf2c16b8b72220af
MD5 40253b05bbf41b89ff527234dc29c5e9
SHA1 c3c25f83e03357a60a9bdc4cbb7c3922a7916616
SHA512 39cb502b49df212ed75f3a66d1d143d9135dd8dc05b39cb34a0c0899a62401ce9d9bdfe301d4934b228006303cf9e3391827420e588316a0bd543724e865fa91
SSDEEP 12288:t4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1027523D355C955B1FBBC003A86354428F5881E2DEB5618E3E2493D1EA278FEB8F34076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 e6be5bd01e68c657f3ad39c61cb09f544429ecdc7e8989353804513518b79953
MD5 3e78ace41f896b02d97dfd4efb726a88
SHA1 f5fd380ca54b3fff09a54c77c4eb37742b39eb92
SHA512 5891a838e3b64b625a8dcdca374ed09767c0165e7598ea32299ef8fcb5f252dc53100f15445048242ff6a851e4adfaccc54ef2a683d89c549506a0844a66aec0
SSDEEP 12288:0SiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:00/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E97523E2558955B1FBBC003A86794428E5885E2DE75608E3E2493D1FA27CFEBCF34076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 2e1a9567bf49d967a7485372a41a82651e4f2fb43ea86e38cc9ad8e046d18d11
MD5 f4c91c8f17056f6ed0dd763783fdb5d1
SHA1 b508a0a2a078a1434883399b4b41b82cd9319228
SHA512 25360db31f156e8bcafd60e954bf0fb08a5d87eaceff969029fba4c050da72c7eaf9f7ec3e9b3714c85c6ba1289f5555bcd32aa5fee37bfcd71b12e3f75a2886
SSDEEP 12288:YniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1767523D3518955B1FBBC003986754428E5885E2DEB5608E3E2493D1EA27CFEF8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 04a353a5d8cb3a79418d01d39865fa001a47e44f811403a4e7c98a104f2a5c67
MD5 380d49b9cd3e1d21895abea8a33c2a1b
SHA1 04f273b6fed461a4257e52ef8f9f3fb39b398542
SHA512 4429583e84b28ab30c5f636b7c556a4b17498a0829c06d3b29ccd43a3aa51a9bff26ad8f28fa8b7db555c2900f8fc029bb98b9e612400fcb7e008ae205491002
SSDEEP 12288:iViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:i5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1597523D3518955B1FBBC003E86754428E5885E2DEB5618E3E2493D1EA278FEF8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 98774d1e2e65193d3210b09fcddccb9fd9475a35f4643c5faf60befc78a80964
MD5 511e9236db93c9e3a6375ec3513773fe
SHA1 49528def2bb1d09ea05ed59964e14ab3ce90e9ac
SHA512 27096abbc7323a209de589598745b5911c9884b697a52a81644b259db5d20aa937fd9c7e6822c8f54bfb22d8dec3a7032157eb47977e908bf4da28c279a6cde9
SSDEEP 12288:u4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DB7523D355C955B2FBBC003A86754428F5881E2DEB5618E3E2493D1EA278FEB8F34076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 cfaa6a0270e4cf565e704199a75b3148141077e68634f542a2e8902545e3b4b9
MD5 61080a760fa40fd6035f8219d37226be
SHA1 e9e5459085a6d9bdf216c0057e119042278a33c9
SHA512 5092599bb387cabbf1a2578a07d1b587a941ebb06ce3c2f9f0f98799138ea6351edc998a9549e31586cc93971315678e27db23585f38342d7d4f2b7b9f7c4958
SSDEEP 12288:kNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1547523E255C955B1FBBC003A86754428E5885E2DE75718E3E2493D1EA278FEF8F38036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 103fc9bd0f8e57ff191df899481509dc221b1c17a30281bbc069f4a42c60710f
MD5 6826317b1a30f3e85ec4013e40b108c3
SHA1 5d66043092e2d6577013cf8cfd598b462af87403
SHA512 dd671a2494475597ae6790114b02a68a4e2b25d242e13857181522c40fea376f0f209da3991178acc07b5858f9c55d95f28acbea3a67a15bc2d715819b7f7b25
SSDEEP 12288:OjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE7523D3558955B1FBBC003986794428F5881E2DEB5618E3E2493D1EA27CFEB8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 71837e9ce947f6dac811ba5eca7cfa8765dfd649c6b58b87ec06a890da8cddb5
MD5 7e5fd52f28b7d9873f74f0e64302c384
SHA1 dcb3bb084083ec0aa052389ded6914c2e0d86c44
SHA512 f3fa29402969052736aee74caa07d0478b275ca9e828ae92a87413ce425fdce2dc964d20a78626e543e5dd5a6169a42683006b000705d5f7fbab91f7853c5729
SSDEEP 12288:jAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1417523E2558955B1FBBC003A86754428E5885E2DE75718E3E2493D1FA278FEF8F38036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.5MB
SHA256 b76c9405bde2a039d11cefd89efbfcc443e80a3019fe9b6eb6f0e3b81307a9c7
MD5 75d90599f68d7b880b8fc562ae36fe96
SHA1 42dd529903467ed7a77ff4703654341e3077f3fc
SHA512 f15793c213872527dbcc5417a6bd7e7e8dcc0413010442cec82eb19b6ac9d6a67397736d987121f4d5ccc88f189feac0720873bbe0670653e0eabeb519580208
SSDEEP 12288:rjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E77523D355C955B2FBBC003A86754428E5881E2DEB5618E3E2493D1EA27CFEB8F34076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 d7efde4deb8514488f9cd495a26c82c6ba5c2b6fe9508823ee3a3e0f097ab05f
MD5 079330ab18b7909f387166603449a0e1
SHA1 23e05d699468e9c0d008751206d2c7295caee0d8
SHA512 b503041da8118a74c35d0eba9f378132867c5126ba8056e60ca65a398ef0a38d7a78a8c3f293fb04a990139e252338cee3316de3b497347ad303fc038fae2e27
SSDEEP 24576:Vfwvak9RX6wkyAIt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JMnYItLNiXicJFFRGNzj3
TLSH
T1EC95D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0d455adbbd01da3c98a154ff3947e855b2f9c2d922c341df98ca84392d66eb41
MD5 ade7920ea021fe77b8b6a481d254664e
SHA1 19bb84efdc98d7336bd1945ee3de0b0543e06516
SHA512 cdf121aa72d574ee8541177dfe41807b15a85cdab4b42f48c7a1960f43f1dbba1a2147c3bce4ee55f8e8c18a31bf7563d7e2c232f1081eb2d8054616fd8715ce
SSDEEP 49152:IYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0uLNiXicJFFRGN:HySzPW7wRGpj3
TLSH
T1FE066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 089b5801bbce8413e0e33a617080b96fe3170878d15d3f579482cdb3400e9672
MD5 5cad9e3471e19e4007fcda310a28beec
SHA1 cb9666b9db016fdbf7adfb970ee533d9ba7db59a
SHA512 5ae95372629714da8eb8d1cc7a33ddc1d2dcb5e469ed8d615da319ee46b0b54df6ba4e2af370233415f04e09ff52a61b123655918c7d5acb70eb312dd7e4d890
SSDEEP 24576:u47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:u47JUQjqirIhCnDHUPfF/+LNiXicJFFS
TLSH
T17265AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 5a08e8a6a943c2b57a438b6fe8d9b25aa5cf982aae34654759f64837ca0e3065
MD5 e52467098592ffa807b4fd14ee943e1f
SHA1 fdd19be5734403256d6f6c8b4ca18aec2f6dcf68
SHA512 b7b3f9cab63353bacbf926ca85b2612a162614f0bf8b5d048a72885a2860ea78743330cfa9608471fc1afcbc66416a9268e5d13b0e30188699020cb3e8091ce4
SSDEEP 12288:YisfliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:op/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17375F15AD28802E8D1AE5139C7664500F3637C2987E1D3CB92C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 d20c974369ffa538b16e6e532905cdc281c303fb22b9b1ab74e2392062d8da9f
MD5 5533a423c80f2e37547e879c7f0227be
SHA1 ba6968b92429c0eab0bee6cc902559099deedc82
SHA512 944f550d842b666dd9e2af6db468ea728c2f4e1d132165a1795e48cc3376f53dca7139e62123ae0caeda3b92ae4cb0f433d2280b4ae14be8a4af68ee7afc2661
SSDEEP 12288:KpN5zqU3fxw3Pt4+Ph/7iX3uIzoRYHOKW8YeYxTUiY0YbCAz:KpN5OUPy3RJq3uIzok/Wj4iYXC
TLSH
T1404517417626CB8BC6A940321E76D6CCAB70BD05FE495F0373C9873FD476658BAB1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 226e413ee51d63c40d71695a379a54b68b02607dcf7172f28a595ce781c1b017
MD5 ed20b9e0171fb1bb3da27795260e27ef
SHA1 7de3ea5acbf08abed4806a7a10283cbc54deb04f
SHA512 3ca768b23357b6a48659bbe29a6798cb4815120ccc4783ada7460682dd574450380f7eb8a1dd02c8a996d755c8eeddcb569592dc9fc9bfef1ca807181415a5a1
SSDEEP 3:OlH/lf/L4/lol/UOJ3WPJlBl3y9Gxtg3mCllltGlslslslslslsl6PWhl//:KR4lotUOlQQK0mCtEEEEEEEJ
TLSH
T18E811261979C0E32EB73DCB6049D4B981333E46C39E09BDB450831E36C4C2944C23B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 c3da55c6bae20e41cd7cd3368a0001be3836111195170063fbaa9078520030ee
MD5 0606636ec0be560197f0cffcabbcc9a8
SHA1 9da46ff1be4c5450fd63f26a466291d3b3c549ac
SHA512 c1d66eb369ae814842b9a462433d503b024ee9355fbd271ce492a679f8e8e9cad27f2cac6313571f3fc3a1e7b7e8f8a925c54ac5df3d56b8b4ba85335667cf54
SSDEEP 12288:ej2KIMPyXy4l+cFZxJvVzLaOjpM1fwYawF3M6QIKmqihCTnIegD4:eXyy4lPZRVyoRW3jeIegD4
TLSH
T148552A01A5A7EB4FC97E4037037286CDABB49C07B7852F057345893894B796EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXError.log

Path C:\Windows\Logs\DXError.log
Size 384B
SHA256 12f8a9424c41aa118b45ab4d7cbd2881e76d4d3f1e5f1ed55d1cbead8b8a6d88
MD5 5b13b59f95716f6725b7ddacdffc7a0b
SHA1 126f8ec22f3d511913928736437e7d5a8b02ef90
SHA512 4d5e594ed634b70bdbd907f2c781429de76a85a046791d6327032d16b04aceb25eb57c819c1323730bfb92be12af438ee6d2839287cb5f9c6f9bbc4f2d54d42e
TLSH
T13FE068241CE7F06E3257D458BEAB13ACCE5013AB6C6463F0700511895E6001B29CF07B
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 2a617cb1c4b023d7b43c4f86fbd1dfaa15958f5efaca7dd8d1801efb015894cf
MD5 c2cf4f28a5ee44854dfae9fa34309c68
SHA1 a039265b5570eb5a407db51b0a00db22c2930d18
SHA512 fb50930e5d09cb2cf040f0181b9214740836165de0f7673e930322c26c22462bf68edc5e235a855d098a5080a49be238fc7f61aeecc9d13dfcdf2a56b0f82c97
SSDEEP 12288:Rd7diJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F47523A3428D59B1FAFD1039467A8034B64D7E2C9B1598E3E2043A5EA178FDBCF34527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 42041f4f7fc595fe993bfbe25fed9bcc6dc618ece9fc37659aa1c945d7d76056
MD5 3102dff5955a4de2ec38cc20a92759da
SHA1 7b0ea9b6b058d45b1468745782de3b1592024fd8
SHA512 d5a801175f065cd587461ad34d22e88bb2b3b8fbf0553a0be3eccaf667fdb313f3c4a25e717968393cbc4c61e1a3d4986e2349311dd8d955972157ca9598592c
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bYb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dgb4mBIBhGFALNiXicJFFRGNzj3
TLSH
T11865AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 99b4fa33e760b38e522e0a9a10b20c8bb860ab1298d6eae8c820f14b433f99fe
MD5 7db4022e7d750e15d9e6f003c8a33f4e
SHA1 becc345ca262f42b5429be2d952c949ef4e0546f
SHA512 a1e8416cba31f461b5e7de9c50e80b1eff51855d788a98a22c4c572ec66f210d118194c88589f7d940e4f50a89010ebe4ea18d441db5371a695b2e672a6843c0
SSDEEP 24576:HG88u8FpJqH1Kzria7/mw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:m7ZFPqVVa7/zLNiXicJFFRGNzj3
TLSH
T147A5F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bef601a8f5e2300c6970d59df493bd039b791c874232c4d741a01330e329eef0
MD5 30c6e2307f7abd7822964c6f8758c4b9
SHA1 16b9f3260dc09f63f984eb3c6a5d7b159e34b4ee
SHA512 9b0cb89ba99e01a1b56734c1a7fe4713f54858ca47480d0b257ee479859b9d7575b74b43baf76dd27d18f71a136b8746264438fbc3398ca6863ef6b841cbf999
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjMLNiXicJFFRGNzj3:PG05lO43bF7wRGpj3
TLSH
T13FD5C06A62EC11F9D1BBD07CD9C6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0af83ac6192bb83ce894b3e8be610594eb55b14e4a912845802f944273d9901a
MD5 e419601348e29d2d033da4ee68bcca99
SHA1 2fefed2c0d8e2dbcb187ef6e7ac79179964bb27b
SHA512 75d1fa88b56bba2fecab6e15ba03b4b407747a144e272b9d74a2dc73628fbe186a75805ffeecd0299fb0324dc53e52eb906b00886345031b014c1c228cf4b398
SSDEEP 24576:efa5POZ3dpyWVM50JicR2hG0lasx2+47eidnu/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ga5POZ3lJt2pasx2+m0LNiXicJFFRGNf
TLSH
T15D65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 050aca874d1561c7efe93aa96e43659dafeea8283b83c7d4f47757c28ec0a635
MD5 cac8b3dd19367072e12a9fd662885d87
SHA1 d7d3821372d04e4eb477207301c2b7287006a717
SHA512 dab71d023158d0fa28e7d2dcf06323343f63df2bcb736b182b81cd6437ec0ab201d8c2a963d68788f1eec606138d3d010c9b23c1ce8272c78f2747bf5f16e684
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7Fk4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PNc/zEOVHFTLNiXicJFFRGNzj3
TLSH
T153858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 23bc753bd91ac4849da13b131c29333e8045023ec2f3139aeab76e0e38df4a03
MD5 15152874d89c54fc62f42441b38a0d77
SHA1 be9aee7df0fabf7b8f8b88a8e1474395d81e003e
SHA512 e3c4022f234a98b7c5def7843cf2622b95613ff4948c84e27822c3d2bf846aec0bc7e232fbdd4534c670de82036a6b26a0e74962f1d25010ea8941be674090b6
SSDEEP 24576:SzkNvNnaFeYhJNtmZBmS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SzMwBtOmSLNiXicJFFRGNzj3
TLSH
T1B655AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 144c2aaf0dbb90bd1b3d58e0243bb6f996beecbb96fd4ec7b015c0df05a23ea1
MD5 dc48b00c240f04dd482e4e8098c4aec9
SHA1 6f377d2b4a2887ea1deb26a82ddfbea617782a46
SHA512 21904d19b7d756c9bf4493d507dd24e22ab2785c51638d325fde6271dfd2d605b801098eefc879985c4d9f38122cedc42b9a58679b0f790ff498775e50222b26
SSDEEP 24576:FPUr+NQc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FJQcLNiXicJFFRGNzj3
TLSH
T16C85F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 199d2897f1ba4f21907f4d7fa786056d17ed7f7eec17fb4672aa32d079bf8e81
MD5 34d2f580d5e2f7a7dd974179f2d6cc46
SHA1 fa36d1ef4a884c626ab4938909d06949b814a5be
SHA512 178173c48f9cdef23dae0d4e202bcb135093a6221c3e5ee5f8b7fd83b3a782bf82c5462f40f52c19d7f436b18c6dfdaba720f70e938088b8ecd23cb735371f2a
SSDEEP 24576:5D3FHshBIYQgAV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5DVHeBIAAVLNiXicJFFRGNzj3
TLSH
T1BB95E17EE69C04E4E57AC17CCA638906E77138AD032265DB02D491BA1F6BFE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1156-158-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1156-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1156-151-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1156-156-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1156-145-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1352-72-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1352-73-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1352-79-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1352-298-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2476-387-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2476-351-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2476-120-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2476-385-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2476-126-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2476-119-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2600-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2600-52-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2600-51-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2600-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2600-132-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2696-56-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2696-70-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2696-68-0x00000000023B0000-0x0000000002410000-memory.dmp

Download

memory/2696-64-0x00000000023B0000-0x0000000002410000-memory.dmp

Download

memory/2696-57-0x00000000023B0000-0x0000000002410000-memory.dmp

Download

memory/2696-63-0x00000000023B0000-0x0000000002410000-memory.dmp

Download

memory/2876-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2876-106-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2876-400-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2876-402-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2876-114-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2876-113-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2884-160-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2884-161-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2884-389-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2884-167-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3048-97-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/3048-102-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/3048-328-0x0000000000400000-0x0000000000582000-memory.dmp

Download

memory/3048-96-0x0000000000400000-0x0000000000582000-memory.dmp

Download

memory/3432-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3432-40-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3432-31-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3432-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4628-91-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4628-315-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/4628-85-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4628-83-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/4860-0-0x0000000001000000-0x00000000011FF000-memory.dmp

Download

memory/4860-334-0x0000000001000000-0x00000000011FF000-memory.dmp

Download

memory/4860-95-0x0000000001000000-0x00000000011FF000-memory.dmp

Download

memory/4860-9-0x00000000007B0000-0x0000000000816000-memory.dmp

Download

memory/4860-1-0x00000000007B0000-0x0000000000816000-memory.dmp

Download

memory/6108-133-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6108-139-0x0000000140000000-0x0000000140229000-memory.dmp

Download

memory/6108-388-0x0000000140000000-0x0000000140229000-memory.dmp

Download

memory/6108-140-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download