b5017561a9660961a2dba74497c3d60d51b64bcac8edd7c98e9df7cd4438e850

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 06:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
Size 1.5MB
Sample261017-g61knsty2m
SHA256 b5017561a9660961a2dba74497c3d60d51b64bcac8edd7c98e9df7cd4438e850
MD5 cfbfbdb20a5d16bea46cc5193ef6b382
SHA1 ad867c0e509c74eaed17a5e3341956b5011917bb
SHA512 493adb5e33d188f165507652e9d01569e9f5fcfc8fa3f55c89fa7fd3ecadb223e5f50b17553384707052d0fa41140afe3a1c08c9161813792a9ab699a048caa3
SSDEEP 12288:Fn2RlpddRPYXKNcj7wOw5in26VEhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:F2XPYXKNie826VEZGqFE/VcK9y
TLSH
T1DF65D02236D0C175C8E321F996DDB67566AEEDA00B2442C727942BEEDD303D25E3478B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2348	elevation_service.exe
5320	elevation_service.exe
5148	maintenanceservice.exe
5024	OSE.EXE
3836	PerceptionSimulationService.exe
1924	perfhost.exe
796	ReFsDedupSvc.exe
2780	SensorDataService.exe
3232	ssh-agent.exe
4760	AgentService.exe
2816	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2c666b37b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001408b367005edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab020d6b005edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000754690a5005edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f378a967005edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7c6bf67005edd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2348	elevation_service.exe
2348	elevation_service.exe
2348	elevation_service.exe
2348	elevation_service.exe
2348	elevation_service.exe
2348	elevation_service.exe
2348	elevation_service.exe
5320	elevation_service.exe
5320	elevation_service.exe
5320	elevation_service.exe
5320	elevation_service.exe
5320	elevation_service.exe
5320	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	824	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
Token: SeBackupPrivilege	796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	796	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4760	AgentService.exe
Token: 33	2816	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2816	SearchIndexer.exe
Token: SeDebugPrivilege	2348	elevation_service.exe
Token: SeDebugPrivilege	5320	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
824	2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 1836	2816	SearchIndexer.exe	100
PID 2816 wrote to memory of 1792	2816	SearchIndexer.exe	101
PID 2816 wrote to memory of 2604	2816	SearchIndexer.exe	102
PID 2816 wrote to memory of 1120	2816	SearchIndexer.exe	103
PID 2816 wrote to memory of 3508	2816	SearchIndexer.exe	107
PID 2816 wrote to memory of 5076	2816	SearchIndexer.exe	108
PID 2816 wrote to memory of 4380	2816	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_cfbfbdb20a5d16bea46cc5193ef6b382_amadey_elex_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:824

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5320

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5148

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5024

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3836

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1924

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2780

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3232

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4760

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 3024 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1120
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 3024 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9874abc16a7a10aa3797fa85737b77f860f61d4c59487e790985d9705d8ddb1c
MD5 dc8f5e27c39a0ae9479133d2f6b7e404
SHA1 3b76ba23ce2baff5de64a712c718cb4480c07546
SHA512 9ff6b6e6ba93993b3c9f4266d5a35fee0991e7ce1e9faff317ef0b70e7e00ed1ef16c45597c02ae3367d94a90f65548a39f9d4ee3ba4ef26cfcb2b43e9c34474
SSDEEP 49152:wb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnc7EaK9:a3q6sjB9YT9
TLSH
T13FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.3MB
SHA256 e1c845a88d7181989e62c2003e472f8db444594051dae05ad5332ffe7d25614b
MD5 124ad931b9b42bd4858ab31ea9f44025
SHA1 6047a85910b50a973acfe3ea1c28120eb6abbd5c
SHA512 ccd3b56595ba61e4768f8204d23d7653da5f2c754369ade7ad4b8188d3063dcbc5f0f490f5315da2e8334fbbffb9f83fbc4107803f831827e349ee8c8cb23d0c
SSDEEP 12288:q1XLsswWkxy2lRq2czAZhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:gXYfDtczAZZGqFE/VcK9y
TLSH
T18E65F12977E008F9ED67827CC9A28401E773B8854764E7DB03A4996A1F333D85E3DB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 2fe48878db5d8b2da095120cbf242aa9bf58c629e353c788347707bf86f745b2
MD5 4b9b81b343b8934be0d00a3da6a358f5
SHA1 ad4dc6a9993c6bde4bd87e1b72d174633c763791
SHA512 3ad66d2f28c586c570c11c05d4309818b3e1c8a1e5d5ab0c6e73d21632a433a18d2bcf023c89eca4b98f16479c157745d63dc473d36fbf576a9aa67629a8ad5e
SSDEEP 12288:nXZNYVLeyUji0h90ZD0wxpGZIVufrHsEhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7ob:J0Le5ji0hmxArMEZGqFE/VcK9y
TLSH
T1BD859E56F6748335D073C0B9C5D2A68EEA7130861B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 14cd8ec48ec6496d8f8991209c13696cbee8f046f8daebbb8049541c1f0501c2
MD5 2bbd31dffdc6830b32d6fbd50cb64a8b
SHA1 eb93ed74aa9850943c33a47992173d844e36d92f
SHA512 763d6af4f88c00240d369085b7bd5830a72a2f4ab25890e478d28b19478c21d6f6512017c4f924e720d157d7e890b15ee217bf0bceba95d4d26144fb21d17fb3
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWn6q8wyuyZGqFE/VcK9y:0/ezSC6vUzPveHjy37EaK9
TLSH
T14A756D15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0c0799dbc20b87d07b57a3d8ee005bd415e725aad0b189cc55f90072f641fde7
MD5 68e4e6caa5b98983009ec38b1dfdaf49
SHA1 6c4609586b1179517a8243ea837361412fcae931
SHA512 d83ab31cbaa50c81493f0f047d0f3031d7de660a2b4f8d237657868c1c8a65e39dab6d18b8fff9f6c8fa270e0d0a04074438f28d3a2a522b251159a7bf4049e1
SSDEEP 12288:oVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98NhTQQ4xZLRCuix7YdvClO/CSLJ2:oVbqPb88hv/l+YNZGqFE/VcK9y
TLSH
T132559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 3936edbf5c28432cd7d691e17271f3adebc2743fd849a4a7b3b0203d640c0a19
MD5 5e409df95a86cde2fc188f16fea310b9
SHA1 7ceb7f1c839efe84d7a8344eb58058bf79d158df
SHA512 50c7dea4ac0201545be7d0fbf628ca9cb5320cf096c6be83914b07e5ad296f7f7ce54a71cbcbdc7f0bf4c73c728735b94fb68b62dc2ecef9942a88d7646f89be
SSDEEP 12288:NDIhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:NDIZGqFE/VcK9y
TLSH
T1A63523CF9AA4899AF77607F97AF24CDA57499CC8082CEBB444687D8F5830324D90875F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 b849ccc725767745116e3f573dcdbe223ce8f1d49bae5b66a52362feff5c8d88
MD5 12a6b28e44cb723d2ad1295f5c6f5bef
SHA1 f7a8f40cc583dcf806be7d4eb9b5eddfaf3dcd01
SHA512 981edec3788a2869947c3a5ddba942efe5db9d419257133ccd0609b1312ddb3b61a3429f972ed4bf4cdc60b60e38b0033a19158c9f0bad78136863d43e6ab526
SSDEEP 12288:WeBNUbTVO86UVhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:WJIUVZGqFE/VcK9y
TLSH
T1AF65CF7BEE28ECD2C27A4DB85B918640E77278704F61A3CBD174820EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a915e2d42170f6663b3268712fc8e24717113ba584a4a19f5acae77a7175856c
MD5 6150b41ec534dfda0d377e42e8c496df
SHA1 333d41cbc92ed70a3be3a1c895bc4882653ad1ab
SHA512 d1b46f39bc0c79285760db00fa57bc49b8d2d92de135b1cae82610eb9b3841891c1ffb98a9c0543e7742219bad64d6d5b8b70763638ec74f5415d4d4cec6456a
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THg:8QvGAdlCEL8c/DRNw5CCYT9
TLSH
T1A6266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 a0c0fc34d55ff00328c2ba05e631bc3ea25f13102608ab2f83eaf4bff2165ce1
MD5 1b44cb05a33eb5b14f4b84fc075e7f1e
SHA1 dd4f3590c3b46b5399f5c381b897e73d50367934
SHA512 f0b27d10813b90e232a43cb3fa7ee5838e8628e3727093daf079b98c251d1ab28ade3057a378061a5ec9895ee326baa34abc1c1287cd6e851ece03e2c4e8df22
SSDEEP 12288:xAwSfxL/2Dc3eDLLmt0LDQewsAjrhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:SfewsAjrZGqFE/VcK9y
TLSH
T12165E031FE74D436C37B0DB62B36C716146DB9604B611AC3E3A89E8E59302D22776E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f448e58dc0479e3249992105acc94982a1aeea6782f59ef6d5c24d1b13c8359d
MD5 fcde3ebe4ac3df289845f6c80b56aee1
SHA1 04e30e4ff8e2b6970ee3514714bb9fb6b5c943cd
SHA512 74e9863303d40149a1421c0d6cf0ec6053d9157b4418fa4ae3ba8c66720ad5a03b7238fe4dd51d2bbf796226085e9d120854d301badfee05d9e6399a05ee178d
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH0p:sUEtQevvqc2W1cpV2tI320
TLSH
T1B0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a35b05673bca353a72efd543dfbbf0710e253ea728c8a5592fd60d9cfcac1fae
MD5 c079e8c589ee0073c0c8fd3a6e055e3a
SHA1 bfc3de55942719f9c3e09101e73e73c2abed2802
SHA512 5f7451bdae1a7b2c82157b82d9c30a5079e2808931145e39b2b2afeac14503ee3d1015a253682798e90e31073291c18d6538422b46d5cef57fd8430252d42806
SSDEEP 49152:KCbRquA/m2yL5zifFiV+XenmE3/zL7EaK9:/oqHVjnmuYT9
TLSH
T14ED58D0976B8C1E4D1F6C77896A2C647F37178154B34ABEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ec4e121d046a1aca272bdb79750fa4fd384fea1eeba5758d05b498d2c93dd916
MD5 73255ff042f044cea00e88453d208bd3
SHA1 1c98375f8370baae4decab6a45798b263ce1f5a2
SHA512 488db879d1a429ce63320af296bf274f9fda1cce1b139eb6af071fa191a7379218fa76d08984f1785a528bb90301d8a4a958c49833ae5cf8414ce5c62fe91ab6
SSDEEP 12288:lAZ/GL3IFoiwtA5qy97S9uaYFLq3OxhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:lAhGL3IFoiwtA5l7S53OZGqFE/VcK9y
TLSH
T1CF35AE81E7F945D4F5B3ABB8A9B68571EA76BCA55E30C21F2160D10F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 8b64eca44e04702f0e9880c2cca92dd2272a933bb5a7297d7674833e50c8f52a
MD5 d7c052076cfb10bbcd07f1b5f9ba83af
SHA1 bfecf9ff3631753f7943b9fac8229b87c7d44c0a
SHA512 2a9407355dd7b41a901c09752d958dcf27230a437724266a4fa19991309efe9d2a40aae0b50334450e944fa48ac4b9bbacd2378fe23bfed70fbeded82ba29348
SSDEEP 12288:omw5HEjsChNGBFgl0WDm+CShTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:FwujOWXZGqFE/VcK9y
TLSH
T1CF55F14A76E40CF9E96742798597C436F7F2B8412A25DB2F0760C65B6F33321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 a7ce56e06b32ad2b276745ce57eeeb94890eaa06c3b0bbf03984aa0a21d59edc
MD5 0cfdb3a2ce167cc06f6646b11c2836e3
SHA1 6027c377d9ae80f8e7c4fb456f760327aa73742f
SHA512 6acdea846a254978a0dee0872c9c6c1e26985e45b3599b8ba080396841c3809bed3c37c1c13f44a0e7ebb2740cad7dd6631ac325d0c87b3531c014cea315e934
SSDEEP 12288:FGZ1Iy7hTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:oZusZGqFE/VcK9y
TLSH
T15E45128B26E450F9E26343BCA9F24886E7A274C6173993DF0524569F2F336D15E38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1f9c755e7f28ca77804926f3784f225d7e12b6f230b46958b1bd956c2f455df1
MD5 d2cee9f0ac4c955ce35a86bb5c301d10
SHA1 5bc28d73dded89fae6e39df2690e2d759bfc481a
SHA512 cfcc6c5b9822c3d5378e902c74dca9ce78761ded89e98e727b3d49ab02e1132f9277a5c4b34baa232e2dd128d944bf95c57673f21440801896c5020ccfc3a42b
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uk:FQRQyi36YOcPbLvw2gAf+PN3BYT9
TLSH
T175667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 107854421a5ab8aefbde4c3ccb6c5e88cc9b3f6d9c50ed6b2228a3682d602967
MD5 b06f4965345402ddfb0d47fa9e2cd062
SHA1 7c94791e95936c20d8deae701704d908c8dc493c
SHA512 ca9abc132fee2b38b4245aefdb109a89b82ccf4a742fd6cf0b519d64d23a48d842dd572829828723f68083259540939373f6a6e464eae33072bd7c8ae9aa0632
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uk:DQRQyi36YOcPbLvw2gAf+PN3BYT9
TLSH
T1B8667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4fbd67e1811599ef361bddd4cd4a0fa63042a479a1ec593cf6b2ec31c158621d
MD5 67037c628d2b8209c8fea9c5b645f4fd
SHA1 0047de08f15d49a44d264b6d7cba4e022f095911
SHA512 c64c3e2b1aea12afec26c134e8b62367b7c96549f0d0d487105a510bc58ac0b46098847d7d2a30683032ea19bb1810fb2d205b8fd71122678fb008364f198781
SSDEEP 24576:zwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0cZGqFE/VcK9y:L68Qg55nhceWu7PNU3/b7EaK9
TLSH
T1DEB54A33B2F60099C44DE1769F4A872196D27C758FE0E3DB8515720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9ad5b625ff6ba7b795fb7a6f4c963bcd85e8a8244622fddee48f387d08112480
MD5 7df3d9d908cfe570b680f918ef96d07c
SHA1 404c48f3a03628a451f39e8b0eaa4856386e7e8a
SHA512 7d17af8fc5983a22f7767f021ac6692c95d791ebf141f5aff50e6e00c0d8fc1565dfd344c6b908fd75e4ff4fa1a9773a389859ca68f9f4ec44e955e9f3e5ca37
SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk992:ay5112gYy5azzVvt69nLKnhZIYT9
TLSH
T1D1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 722157581d07df02cb4b8317d8b8c7dd37ad7aa3598be3f87f367019873e403f
MD5 d6ee0f479c76a86963b2de912357bb09
SHA1 608687d7ce535d014bc8c7e7fdf776bb1587eb1a
SHA512 65156cdbf80e7cf240cb95bd41e359643a73756ad7001b926f4a079548c99adcb72fff2e9a36c2f4313c1612b75f9c82e5e7fea15dba9e7d3db8997ccf8065e9
SSDEEP 49152:9B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glJ7EaK9:ju6Jmdxd2dJYT9
TLSH
T1F2D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e6a622cbce7fa45e8c48192daff37bb393bbd228f49a913bc48a6ac493b94b4a
MD5 3d47ee4cddf1b6a6e8a66cbf34a4a1e0
SHA1 137a5b6d3aa7de6b55a8e05c702c38241dabfcba
SHA512 0934a7ae874197a5f95c494cd79e599b21562cef85be9e3866fff6063c17f7dfa48636bb4a8ed37634367a13f7fbf9c183e23ae4e7a39e1ff8d125e7f1ff73ef
SSDEEP 24576:xhv8E1hps0+ogd2z615uCMVF1Agz6gUQ1zNOgLLwH7ReaQXx3FZGqFE/VcK9y:D1hpsNoJpF1A63U44CwH7R4x17EaK9
TLSH
T149B5BE13F2D801E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9f5219615ce0e9de4e7f5e3958c551efd696621b4a906a1fc7881aa903653886
MD5 0d1afe08cb7b368679b4beb3d2aa7e05
SHA1 90de2a1350f0c5d2850b697baa8d3f249924cf33
SHA512 2dcf21d9bce8aabef51eca3c025a5219776fc88dc21404b3362c54111faa3e6afcb21b86cfd4a84ede96b169c1a6bb91bf6aed8e534542ae19569e3d6397f92e
SSDEEP 24576:G4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6vR04FxGgVG2Onks6xt4bSMHnqsZGqFE/s:6SuZQIY0Be2KcRVtOnks6NMHqs7EaK9
TLSH
T152C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b1a45b6595c2ce7deab2d11b37f4e670e5453e94055164ca299d6e8ba3a78711
MD5 d587bd611ca91d086e62404b3c46013e
SHA1 0423f57f8ba4b3a605e3ea691edbc782e132cd33
SHA512 2c1adb5718b2d08bb07a893f027aa6548e1bf7fe67e9563702995c7b7e26ee51bf06466517a2c07d08183bffbecfd7b05a789320ce5ac2c3a9a61e3972d023d2
SSDEEP 24576:6hiavrPSLT8EARn+FgyUgd0fJY6B3i3iy9CTn0AP5+2QLFZGqFE/VcK9y:6htSn8EApI0fig3giDn0AP5wZ7EaK9
TLSH
T1D895BE13F2D900E8D05ED178C7568632EA62BC450B38BAEF0A90B7561E7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 449d3010016dfe6e44d38390ab53937f7ab096d4bba74aaa0328f4d54306ea6b
MD5 944532f0f39d9ea1f98a93fa73d31f50
SHA1 834f0dbc92397dd571bec5e696472d4162f4a3a9
SHA512 e63dc8b759549b565d61bbb95176ee9d588cf7e5db52d86971a235fbc5b402f42965aa2fbf05728bfe742cad8f7879ee3290f4ccdef99114e6394588f0f25283
SSDEEP 12288:FwhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:FwZGqFE/VcK9y
TLSH
T1973523CFA9E4898AF72207FD76F348CAA74D98C9182CE7B4152C784F6831324590CB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 9b0a6425c48981c9eb858b278f8b8dd75b97efa4d40c109a08b8480d247ee0da
MD5 79934560bfbd1abfc9f9b7bf6a01406e
SHA1 7980d7a452e58f6e440ed5644ea6bc1ccdca8ada
SHA512 a6d06d70b9903f7ce351eff47aed38190945028aa3194dac4215afce875bfc8aa9c04ed198905abd47c9dd81dfb16d4f0ccec173bdc95607a36441c48f78f272
SSDEEP 12288:WPhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:WPZGqFE/VcK9y
TLSH
T1BC3523CFA9E4498AF72247FD76F248CA974898CA182CE7F5196C784F6831324590CB5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 6ab21c065a171326f41bdf10d0567a6d72ec50f331e67c0c222273c642680a14
MD5 b68e0d2502e504b5253e89957acc4728
SHA1 cab375fb2a575a139740ffe6cdcb6758d4213ec7
SHA512 d1eb0887c6fdf2b673515d3b2edb906669ff0a34b56815403d9b0f55406b5587fbd7ccffc65625cbccdb7a9429fedea36bcfb1e2939722afe4c67ed30df94434
SSDEEP 12288:L9hTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:L9ZGqFE/VcK9y
TLSH
T1693523CFA9E4898AF72207FD76F308CA974994CA182CE7F5596C784F6831324590CB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 d2493a5947f91a3529e962302bd150a3c4759b66781a13fc49be7b20aa2e888d
MD5 33deadc0eda50f4422e5f72d4cd8ba10
SHA1 30bd7b166b58735fe109eb6f352fa09a8d2eb9ed
SHA512 1737fc64e32dc87b95f6694882404e992e34dca803b9eebab60daa242081000573a187657d7791d3cfadee79aea6bbbb63bcf945ea0bcf6a4302ed5e5dd24b8b
SSDEEP 12288:IVuhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:dZGqFE/VcK9y
TLSH
T1C84523CB6AE445CAE53283FCE9B244C6E3A9B8C91538E7FF4914184F1D313606D28B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 a06d4f0aaec1ee45796e8b69a0a9351ab4b42b10861d5e78e6b0036581aab501
MD5 de70a92712e77d935d1e291f339024ed
SHA1 9c62c1e63628983ab0ed9b11efa5c84742502560
SHA512 8ba0cd04ab12114f9b87d150c36190ab871774627d9b7c96923cc2719cd9af46c452c7b14d4744459746e78492076eb0dea2da2aea08dfae6c0866b8848390d1
SSDEEP 12288:GmhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:GmZGqFE/VcK9y
TLSH
T1C03523CFA9E4898AF72207FD76F308CA974994CA182CE7F5596C784F6831324590CB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 68ef915b392c611b7d618dc9919977da6fc842b91c91df439f11c1770fe6d059
MD5 9d81e85334a439fbf540614e5ed6a24e
SHA1 cac83ee2d508b0a5e384a3b6445ac43f1cf5bd34
SHA512 2568e16d45ae9dda1f448c997397b32b57a321363997f4ea6e99b79303d345ca5a45583b3277bfa37d3ec7b4e96d53c1526a47dfaba8b779901392f0580ccd50
SSDEEP 12288:wzhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:wzZGqFE/VcK9y
TLSH
T1593523CFA9E4498AF72607FD76F348CA974898CA182CE7B5192C784F6831324590CB5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 905ec3a37f821417cd63809f757904513da81b766b87115a03df2427ca9fdeb3
MD5 a74fda19bd90ab8c22dc35d97db55eb3
SHA1 9a3805c9e12ece729d4e8e538046161c8e03be26
SHA512 2612440a09d6d7db731b79f55f39805ce61edfd0e0fd59f8fcc491d884ffd925d584be9350800ffb6150684875b6a8541c1c95b2674d28448120a7691ea26fd4
SSDEEP 12288:oHhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:oHZGqFE/VcK9y
TLSH
T15C3523CFADE0494AF73607FD76F248CA974898CA182CE7B5592C684F6931324590CB5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e71a8766957f1960c73874ac5b4ebe5118ba745787f3fa8b76551c39953e3011
MD5 482d498638fc1f95f46450ea41d27b2e
SHA1 27fbc3d77c349725e6adde480ac58310fb3cb7f5
SHA512 3f5abb7a58a7e85a2beb942979ad6ea9092accb149d666652dd0761d5841b6378319189b2dc5e1f6c0e76d0e8b9ffcc42d14d5060175f4e6ad312cd051337b22
SSDEEP 12288:jiZwbezzFEoS2cPvyvhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:OZM+zFVSOvZGqFE/VcK9y
TLSH
T1E3650299B39008F8ED67827EC9618846D6B27C990A70C75F03B4365B5F333A11D2DF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 34515e6450d5683e9166ca483d35797844d59814344d610bbced73d3e9d2d1b0
MD5 51ed1cfe5ff41c7cfb915b2a2ae144d1
SHA1 1ec8213fd3e9b8f07828d00d03141f9dfecfe003
SHA512 786706a5868b3b14b040ad51989ce13e8ea487368551b165095915d31f68a2f29140ad435393a00e300ac7ffdb6692fc343262c80a53e0eeec8054f4dad9f92d
SSDEEP 12288:T8hTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:T8ZGqFE/VcK9y
TLSH
T1AE3523CFA9E4898AF72207FD76F348CA974898CA142CE7F5596C784F6831324590CB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 62e4bb6d3ea98a49aa9fe70e3949d7c490fe65fac60b6567812d21bedcf5126f
MD5 2ee0d5ba8f8930d08491f93d66549124
SHA1 43fead84c20bddd0d613401fe4622e644cc01061
SHA512 fec6155dba3d231c9c7e5edb11f1fef260a8225203f6e4e4a2701f80631d4fb034b96ecc763bef5d6a26e0c3d69d6cbb1064111e835b7db3b2c8599b7edfb585
SSDEEP 12288:7YhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:7YZGqFE/VcK9y
TLSH
T18C3523CFA9E4498AF72207FD76F248CA974C98CA182CE7F5592C684F6931324590CB5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 2648662069786f5546d8e413bccaa79fe9effbc4576caf8a9a6ff0025ce86998
MD5 fe7c6ca25d4c8e241f475b74e6a171cf
SHA1 54cf30c3ba085749044d7b2bf2a6f343ac34ed0c
SHA512 78d0c9a9f33fbf29af570305405f05f882081744a28d6a8f0fe0aa54d4654c940ba30cd085e70232b3f7c1818d84ec5ca4dc3e34401084f3275cbdaca9b597e7
SSDEEP 12288:jyPz5L87hTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:Ozy7ZGqFE/VcK9y
TLSH
T1BC55024B77A110F9E1368278D9A20942F775B8B607249BBF1764067B2E333A05E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 9e8847173a3b97ea7e4dc12a68f59a07e0032a58a2d7712fb8cd1caff50fe8c5
MD5 855bd111d48a76ee35d89aa6ad1c6a56
SHA1 ca0df2caa79cc8ad00adfc25a68fe21e889c0fb7
SHA512 e3336f64dfe1822b646e322b551b67df4c70eba5bfc9202782a62e997cafd5f796429ac7c6362859af2c6b70d11ef19b644d500057435c3485444948bc3dafef
SSDEEP 12288:G8hTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:G8ZGqFE/VcK9y
TLSH
T15B3523CFA9E4498AF72207FD76F248CA974C98CA182CE7F5596C784F6831324590CB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 58efaf023187b53ca61fc5936b5749dfbda0fdb5737637344bbec76687849185
MD5 459715a5fbb6f1162f6655f8a1c8e45e
SHA1 fe2b72537040b133222adccd04203e02a6b6c585
SHA512 7d82516ea2294c39633441999718895b2a1ae3a7cc88a9be73999265ffd8f4ff6524049fba29e4adce6aac6e43331c11083478e066403cbfbdcaecca98a2709e
SSDEEP 12288:z8hTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:z8ZGqFE/VcK9y
TLSH
T1483523CFA9E0898AF72207FD76F248CA974C98CA142CE7F5596C784F6831324590CB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 ca6989702c30c4c8a08a4857f73d1b130ad1e409b4120f984b54438f0b29a2c8
MD5 9c754edb1cf43ce26b24104af5c4d54c
SHA1 3165e794fa11b16036bb9fef69c9fba60250bbb5
SHA512 7bbb4e4a6d1acaa4456fabddce337c544e2d6638f16c00c4c3b47101755fda52eeee7d074cf1f23d4da5d43ba6798ec4a4b4ee6bb10d51c5b3deba8399538330
SSDEEP 12288:HyPz5L87hTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:qzy7ZGqFE/VcK9y
TLSH
T1A955024B77A120F9E1374278D9A20942F775B8B607249BBF1764067B2E333A05E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 cd5c9dd0b6479c9cefd14438c0a1800be94ab5735ce1ec96e9b581b19dcbdd8d
MD5 aeda3af49c287e1ddf1653ee9b3f0a3c
SHA1 96abf3abe7834913fd51a6b24ab67e9f4b055758
SHA512 fe09c10166c3754c2c2b535e8231afc7f2c986ffd39f4e5f8029a395490edf114ef2f75890069e460dbfdcaa3dce74479ad855c1076607a6329f3c82b830e7b0
SSDEEP 12288:oCd9pWYoaLHF3z0z04PDvhthTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:xTYaLl3z0zDtZGqFE/VcK9y
TLSH
T1A6650299B39008F8ED67827ECD624846D2B27C9A0774C76F03A8365B5F333611D2DB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.5MB
SHA256 f4967c815c7466d39cc1e27785a2ecc9b3071a3c4978e575f16330395bcbdac7
MD5 1d5dfc3d70266726565fa6901fefe5a7
SHA1 583f6365e0fee5f7e7f755d8a04a582d349c745a
SHA512 8515278d12003a45087e28ddc3bce80ab0e7c0172c7dbae011e1efab49a0075ca6d0f490de0255201cbc7b421a61199bc23dfe59dcb697ec080f8baba746d39e
SSDEEP 12288:ti4e7CRdTfgwCHKy7GLbbdIvKhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:t33d9CHKy7GZhZGqFE/VcK9y
TLSH
T1F075CF91F3E414E8F1B78A7589724511DAB67C9A1B31DE8F03A8265A1F337D18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 05bb3f542c3d2cb5202ebe9873478343001ddd3e954272cc2d1f5a3002ef02ae
MD5 856f94a3a0cf87467b1e3df27df8af2c
SHA1 be69b21b828ed90ce487401446c435295f99f92e
SHA512 0c627bb1ddfe5b6d40e4599fadf33284bdb135442d249f18957cbd4404b0662f16b6c42a1a52d8099f02c1880349970272459b8c361f49df8cf62c2f3a36e7f0
SSDEEP 12288:rdhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:rdZGqFE/VcK9y
TLSH
T1243523CFA9E4898AF72207FD76F348CA974994CA182CE7F5596C784F2831324590CB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 da0cb88029cc205ff188911c1a32bd417386647ab09422dad92286641b47942c
MD5 8eee84d22a09d889610131d8c6c559a5
SHA1 7a155b773004b5203351a9cbf64ffd225e318cc1
SHA512 5f2a6ccb20824f63450aa5e34b89c69c4c181361d214d0645cea2f700496840319daa1cbb30b5d7e585826ec184af1e7d547fe3ee76ccbd84651211d7c405967
SSDEEP 12288:BbhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:BbZGqFE/VcK9y
TLSH
T1223523CFA9E0899AF72607FD76F348CA974898C9182CE7B5596C784F2931320590CB5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 641350a1af3f597c0498279be8ff57a83c2e5a210ae5104c10507934190426bf
MD5 09e841ac90b659e9e23334a622f6948e
SHA1 8c158f4edebb23c6028b623b921f95c0efe21346
SHA512 51c5ea238d428c985f3ec7e6c6a680bad1f2377f718178c01a84b619275a33bd9a6b191ee6d72ff9b61ce54298e7b5ba2d70cde35fd9c9195c5bff481b71c0a0
SSDEEP 12288:JKhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:JKZGqFE/VcK9y
TLSH
T1EB3523CFA9E4498AF72207FD76F348CA974894CA142CE7F5596C784F6831324590CB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 ed982935b4854877d2da4bb059b87865fb5281ef2aac1174e08326f9d6d1914c
MD5 bc307488c1010fb7bb173b2f1cfa8c9f
SHA1 d0a699d8c3a85d3906d15930266a1bfda232bfac
SHA512 930172986f480e46746abb1c82a8e0f9d702fb79f8f569d1eaa3afe94123f57e0f6dddc4110de72f03324000bfd8428ab855cd660d40235de7dfa5b8ba561e3e
SSDEEP 12288:C8hTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:C8ZGqFE/VcK9y
TLSH
T1963523CFA9E4498AF72207FD76F248CA974C98CA182CE7F5596C784F6831324590CB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 76352eed17e61ff7b2518c0b4a4367e034da5a1147f63d73885b15266f6db1c5
MD5 f1816987e5ad9c6dca987b66dc88f4bd
SHA1 388e88062d96cb9fb6466732e9bb1258cf637b05
SHA512 96d7e8cdc28313e6586b47e57bc20660bab23a8c0bcf7e13a6787e83a134e57a7a11065152f0488859a5c09f5c7f56448a2d0d7fe9eeed703d6440026f8ae09a
SSDEEP 12288:2dhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:2dZGqFE/VcK9y
TLSH
T17E3523CFA9E4898AF72207FD76F308CA974894CA182CE7F5596C784F6831324590CB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 a06862f54c7ad34f02b08ca860e7c776e363d5e11becd1a10c2816d18f5ab7f2
MD5 8ae72bbbba4b8825b43cdad09bf19ae1
SHA1 bbdd9976616ff5a3d258d032c77fb7b3a5f829da
SHA512 7429e404cbb41967d8694207b6ae684e36aee13bd959d5faa9a2444b319168c9ca74075cb02a5c254992fb2a6d6f67f484013c34820397081cae114c4e5b7ad3
SSDEEP 12288:I0hTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:I0ZGqFE/VcK9y
TLSH
T1973523CFADE0498AF72207FD76F248C69B8C98CA142CE7B5592C784F6931324590CB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.1MB
SHA256 769c8a21cefcc408769bb0e8ec0b0f820f88dc8c356cbb65ba676290fb2d33b9
MD5 a60f19dadc648ffef36cdf55a5eaf551
SHA1 ebb0270e5ec762ddd973f2bf84e5d95e787949c6
SHA512 d11660e47ea1c334f384997daadb016ac403449ab8146b217f4ed9f9360af265d633f6160ae53149fb146d8cb35165b8be9e9ed7bceaf929dc29924d5a38d0ad
SSDEEP 12288:/mhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:/mZGqFE/VcK9y
TLSH
T1713523CFA9E4898AF72207FD76F308CA974994CA182CE7F5596C784F6831324590CB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.1MB
SHA256 44b0559779c7da63ff54ca299e986ad4a9f88c89b9698830f980c36cdf412a05
MD5 9dad94970985b9891667130e1aee188c
SHA1 ea0f023b3fce90ba60b590116d624a6afb403f2d
SHA512 aeab91d0441e6619fed126a0f174f46ca7aa9a474743eab65e0f6540e4b6c858c91e5e40eb6bcfcdda61a8d713d34146531224bad12486a8ecee507371c9fddb
SSDEEP 12288:mlhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:mlZGqFE/VcK9y
TLSH
T1B43523CFADE0498AF72207FD76F248C69B8C98CA142CE7B5592C794F6931324590CB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.1MB
SHA256 9cf2e4492f4d0a65d4aa34f9b469b357f4df0579a7141a207f2f29d76250d96d
MD5 12cea38c74994ceeb9c833e3bcf518a8
SHA1 4b06dbfdb3646ca36fa4648479721e104801f7a0
SHA512 f60d4279666072fa539384b7ef36ebffd2528d2d8d2a464af067943f949de6085de7a4967bbafe6383ab47efae5fb69c8d65612f7201a207cf78e22d095e324d
SSDEEP 12288:rmhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:rmZGqFE/VcK9y
TLSH
T1A93523CFA9E4898AF72207FD76F308CA974994CA182CE7F5596C784F6831324590CB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 bcc30bf0e3f1167e15edc987d480bbdddb64b731e6f554980f07bef63490ddda
MD5 492e6b6ac2b1801493936e33c339be2e
SHA1 4517026b475564baf842312b2c428bf935e9442c
SHA512 a0c3e18069c68e602e1735e24f3cbc8f294db439e255194b485b20931ced824a23ec90b2104dc5e99d9152d9fb1afa1e4056367cc0a71b60696e4395c8c01c45
SSDEEP 12288:ofwvD5u264Lk3tRX69qkyAI5ChTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:ofwvVk9RX6wkyAIoZGqFE/VcK9y
TLSH
T15475D02AEBDC44E5E177927C99B3460AF2B178591B31C2CF025A53AE0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b2f4a811194f3e0b0d4621337192ec26968189015eec7e0b5066b6286a8df552
MD5 70cd7c7c9159d1b3eabbb53ef5e9293a
SHA1 b2ca92282142c883c161a6a23090a8e57c965a7f
SHA512 2ecd525440dbb431ae8b0999a94e1b154853b30d26f2c77b112476e585329b9c3ed59a527f843224336a7283393704286fe956f3af631cc62f0761abc6a7d204
SSDEEP 49152:4YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK057EaK9:vySzPhYT9
TLSH
T167066C97A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6075f759615111f9f55268d1251fc97132cc96954ad557574ce0a05f84c6938f
MD5 10cceef9f416863c008a092802dc2de1
SHA1 e3df0f51a03dbb146a41c9eab479562aa02b924d
SHA512 0e55100ccb1c9c69582ea59492c1de32e45c036ee0b4c354f5a22058c32e7e66cc2625e2b20598173cefdceb00c34ab2e09809997449a3f05de88b5e07dfb595
SSDEEP 24576:O47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY/ZGqFE/VcK9y:O47JUQjTirIhCnDHUPfF/J7EaK9
TLSH
T16665AE1EA3EC01E5E1BA927885154A5AEA71742E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 317c2b828690362f1e79218b7a0caed666770f56c00359d87d29ce758b926e83
MD5 06890f8b633fad56186ace7f22f05763
SHA1 b87c5dcafa997d325aa6e0dfdd54856c30d73304
SHA512 9f2540adc5ac93778b0469bf35d66510fad2546bf21ffa856c46a4a39bbf710e434444c66c9e9994ad1dd01a8418ddae99c2c5951f3114c847063de0e2544f4b
SSDEEP 12288:VMsfshTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:BsZGqFE/VcK9y
TLSH
T11855014AD29802D8D06E52B9DBA24981F3277C9547F1E3DB52D0F93E1F322909DE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 0a84314f7d3b89e10d2c01fc073fe75fe155f1898f03dd6ce8f176c4b455f0eb
MD5 93e108babe124dfa7656af213c54662a
SHA1 b47cdfd1c54a30a309ceb5c527faf30a7d9eca86
SHA512 764cc2764e2dae280aaa70debebe1b4fa1021ef1f0271afa98cd4e27a759a15de4bd13be2918574cf55d6ac428446afa2915d2b25d1bb8460bfcafe3b49ec737
SSDEEP 12288:GitUR7WtYEKxEMrCoc8qC3gUWT1Y6+XlsgtbAjC:Gi8KYEyENoc7C3ZWeVXljtbAj
TLSH
T1064528007666CB4FC66940361E37D1CCAB707D15FE04AF0373C98B3E9576A59BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 2a12da466664c218dafd6e0f021fc3522892addf979593d5e3dad45a11894520
MD5 3efcc0966d3bcbbf3d3fae65b5e8f763
SHA1 3dcb15c97b996edd8163ef4e8ac6fc5a19a92046
SHA512 5505b9c2883e175079bd944bd7c349bd7b89484e04654440eabc0294e775d469ba963b6037b85b3df2cd7ebe6c18394d7731fba1e0c148657be9a424c28ef25c
SSDEEP 24576:yNlYKaWeQlJzDEAu/NhOxpqqH9Qy6j7OTuy+zQM:yN3f2cqxjqKaM
TLSH
T1AD750941A437E7CFD1FA5032072A9B8C7B74EC16B7495F22B3894539D82AB55A0F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 a66f9ef45b22463846ad45db9df3dbd27b9223393290da656db9576ee6ca5967
MD5 9d5a3028d5812409a536cb7bb40f4651
SHA1 ea3d42b72ef0beb4b7e07681a34567dfe0574720
SHA512 dddf3241129c81bd3b218b030df683767d6bc77c6328fd899322c3e9aa80b761817f08d09865de6eb4bbe2c2df56df6e202a0899bb86dbc823eb34e988d81a50
SSDEEP 12288:EL7khTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:akZGqFE/VcK9y
TLSH
T18D4523CB9AE8894AF63607F875B78495670DB4C80B18E7F79418698F68313D09D38B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 374d80e6ca98a568ee8aab655a63748d58154f5063a1362fc1490df56199c1dd
MD5 fa601d0b62a0f841d818fb77f17e4bb3
SHA1 0285b910300e8081caf3f7c0feecbfb6bee1d902
SHA512 0596a4645cd5cb2cf80f83fd050f1a73fa9df37b1be0962e23fb955273f0af608498ac397737d0b5cb1e6b71c0aa369a898ee41dad3b4043675a311425ffc3e8
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYyZGqFE/VcK9y:hgb4mBIBhGF/7EaK9
TLSH
T1A765AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 7f641e4b64715ba68d6d67c5acd7ce717e7b22808b0e39eb12ef7afd916c87a5
MD5 d54e75cbf6263d7e7c9d7fc7d9abd5e7
SHA1 eb9adad4d2f7fce0b43c695757a2a8b462b81b94
SHA512 9ef4de1d074064746c794eec33eb271c69c763a7db3cd81596d146b11c700575d56c55eef913d1e34c43a864b732ee8643eeb436ae695f23c1b0ebdfcbc31681
SSDEEP 24576:hG88u8FpJqH1qzria7/mvZGqFE/VcK9y:k7ZFPqV1a7/q7EaK9
TLSH
T19685F16676E001F1D477D1388A9246A3F6B2B4150364EFEF06AC8B561F237E54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b0390a0643f0469280b73ea3525b18be063b7c9cba37c689b375c25cdb9259bc
MD5 f1ef4ae812b5e80a9005f3ae23720ef6
SHA1 593d88ea753e18e91af3293c48bc8c775c8c8afc
SHA512 bd0f8ab36dded77e3a9275499ef9d2fba742e0e0e046fe2e2b08ab5b309922419c1e75e3d35d649773c044e1aebd1a37684535436e39f9d9763c147993dd4d60
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjz7EaK9:1G05lO43bAYT9
TLSH
T130D5CF6E62EC01F9D1BBD17CDAC64A0BEBB23415033556CB02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9d397c3aa373b26fa9e18ee3667effebefa9e1f6a05728d1960237692e6325e0
MD5 12c1ef19d0807a1c8a901cb103b63958
SHA1 8bc9611c1770ed21dbef2e92eae68fc54e96770b
SHA512 f9e35df77a7c9e3b68a35d18f24f86b6a643f1f8866d14026b66401d250791391daa32ae7ec86602de338bcd6170f2559bef4e2b3d07a7312bbe7f7c8cf78fdc
SSDEEP 24576:jfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn5ZGqFE/VcK9y:ba5POZ3BJt2pasx2+mb7EaK9
TLSH
T13865BF5EA6FC01D5E179D17DC5834A1AF5B1346613319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bc073187277cd511662a30525f3d6f9413569cfc5324030d4be6abb494617a7a
MD5 00db6a21609a1d408a4a67cebce09209
SHA1 179851e223567d90277fc73f5b33d13dec46b3b1
SHA512 494d0ac821c3021fefb3a307347c658d0cdf76537c444c7b0f5e7b741cb3ab1f194aa4464348a885cb3280450e7709945bc1f3fa29692b7d748603006b9d09a9
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7Fk3ZGqFE/VcK9y:6Nc/zEOVHFK7EaK9
TLSH
T1E0858B1622E901E4F1BBE1BE89779546FAB1786513348ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 77566a3f27ac2ef5c761b5ef5df492ee3d879ea8882b39a23fad5ba3c1ccebb9
MD5 5e306d7de0e4a2ca54a49191c4dd1545
SHA1 c4d1bfb0f9103dae991d06c09a2e7644818b0c73
SHA512 2ca47372356c73a684ac785b8a5bc2bd12d6a3934dd1b7617fafbdf99bbce06b85d057a01f2ec05175aedc94cb278cd2b481a78cf1775d0849f9f830447a7058
SSDEEP 12288:bQFSBnnoUq8KJfMahDnaFeUnn/rVJNGJymYkDkGNUbTsh/m17zhTQQ4xZLRCuixJ:bTkNvNnaFeYhJNtmZBmlZGqFE/VcK9y
TLSH
T17E55AF6EBAF846E4E1FAC6B5DD238512E6727451073293CB5290C13F0E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 4d31d8b8b6d0ac2818620bd37d268eb4145fe872ae42b92fe55b7e8d24301ddf
MD5 c27eb597c0cbee6672796ad5da2c5006
SHA1 1291062cf3bb9740b69d752dd8012c053e307d03
SHA512 b3f44b0cdf3024ceb64e5f55b36aa702079e47362c7de84ad97ee0e875e599a20ab37f996a480473aecc12cdb72225a99ba44a75864b2c6412cc378a75a43964
SSDEEP 12288:zHvUrBFrEjwaQDhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:zPUr+NQDZGqFE/VcK9y
TLSH
T13B55F15F26E808E5F676A17D89828609F771B4920711E2DF02E0817F5E33AE8BD3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 b17b8543fba94458b33b26f3d4f64d63d77c88c035083a79ff5cb2a3625dcaa3
MD5 ddd29166c207bd0c9906b203efba0524
SHA1 9cda464f7c4df5791dfc2e9c9de7c7daa45a9614
SHA512 8b79532906cd45ea608fb629e123be4eb4160075169161f4de56ab87ab54c7d49e015989d2cfdc20e2c410000e36aa755855e45e037fbc146957fd79d4597e7d
SSDEEP 12288:NQcMxWDXN1Dp/fshBItT1IQgAQhTQQ4xZLRCuix7YdvClO/CSLJ7wyn7oOdU:BD3FHshBIYQgAQZGqFE/VcK9y
TLSH
T18575E17EE69C04E4E57BC2BCDA638906E77138E9032166DB019481BA1F67EE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/796-96-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/796-380-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/796-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/796-350-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/796-90-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/824-77-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/824-1-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/824-6-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/824-7-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/824-299-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/824-0-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/1924-288-0x0000000000400000-0x0000000000521000-memory.dmp

Download

memory/1924-78-0x0000000000400000-0x0000000000521000-memory.dmp

Download

memory/1924-84-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/1924-79-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/2348-13-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2348-21-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2348-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2348-20-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2348-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2780-108-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2780-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2780-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2780-102-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2780-363-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2780-364-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2816-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2816-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2816-369-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2816-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3232-122-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3232-116-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3232-114-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/3232-368-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/3836-272-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3836-65-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3836-67-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/3836-73-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4760-134-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4760-128-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4760-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4760-139-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4760-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5024-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5024-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5024-54-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/5024-220-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/5148-39-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5148-46-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5148-45-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5148-50-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5148-38-0x0000000140000000-0x000000014015F000-memory.dmp

Download

memory/5148-52-0x0000000140000000-0x000000014015F000-memory.dmp

Download

memory/5320-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5320-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5320-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5320-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5320-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download