fea6f0ed43c21522ec1836290ce63f55d2c86db344cd1b23fef177c33d9ff16d

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 1.3MB
Sample261027-p7wbcads2x
SHA256 fea6f0ed43c21522ec1836290ce63f55d2c86db344cd1b23fef177c33d9ff16d
MD5 84f57e76d32a98728f2c098c4191856d
SHA1 c520eabdeb652f948531ad97091856d4d51d1afd
SHA512 4152da6d6ba15301eb889b8be5cc2f7a97df285ae4c3fbfc30072693c42c4172bf4d3d91430fe3389800efa4bd8a1cfd715c3baa1a69e580b4aab186b5ec7c65
SSDEEP 12288:l7BJHMcEet2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:lUNw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T1285523093946F833CC354B358A4E52AC635CBC729EE6D65A514A39DB3EB02D099F72C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Detects Reflective DLL injection artifacts 3 IoCs

resource	yara_rule
behavioral2/memory/3404-11-0x0000000002C30000-0x0000000002C46000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/3404-189-0x0000000002C30000-0x0000000002C46000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/3108-336-0x0000000002B20000-0x0000000002B36000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Executes dropped EXE 12 IoCs

pid	Process
3600	elevation_service.exe
4412	elevation_service.exe
2712	maintenanceservice.exe
4752	OSE.EXE
5440	PerceptionSimulationService.exe
1900	perfhost.exe
2728	ReFsDedupSvc.exe
3732	SensorDataService.exe
1832	ssh-agent.exe
3868	AgentService.exe
3856	SearchIndexer.exe
3108	CacheMgr.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\StubPath = "\"C:\\ProgramData\\CacheMgr.exe\" -as"	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7f559a8c3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
792	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CacheMgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CacheMgr.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CacheMgr.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000720ea4321366dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c769af11266dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ded37d321366dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
4412	elevation_service.exe
4412	elevation_service.exe
4412	elevation_service.exe
4412	elevation_service.exe
4412	elevation_service.exe
4412	elevation_service.exe
4412	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3404	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeAssignPrimaryTokenPrivilege	3868	AgentService.exe
Token: 33	3856	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3856	SearchIndexer.exe
Token: SeBackupPrivilege	2728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2728	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2728	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2728	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2728	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2728	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2728	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3600	elevation_service.exe
Token: SeDebugPrivilege	4412	elevation_service.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 792	3404	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3856 wrote to memory of 1012	3856	SearchIndexer.exe	102
PID 3404 wrote to memory of 3108	3404	2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe	104
PID 3856 wrote to memory of 2000	3856	SearchIndexer.exe	105
PID 3856 wrote to memory of 4188	3856	SearchIndexer.exe	106
PID 3856 wrote to memory of 4684	3856	SearchIndexer.exe	107
PID 3856 wrote to memory of 692	3856	SearchIndexer.exe	111
PID 3856 wrote to memory of 2396	3856	SearchIndexer.exe	112
PID 3856 wrote to memory of 6008	3856	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\2026-10-26_84f57e76d32a98728f2c098c4191856d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe" "C:\ProgramData\CacheMgr.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:792
- C:\ProgramData\CacheMgr.exe
  "C:\ProgramData\CacheMgr.exe" -as
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2712

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4752

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5440

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1900

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3732

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1832

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1012
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4188
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4684
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2396
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fa68f2f0e8aa37e8d78103cdd5c15653cfaca111f55870a1224316d0224628a3
MD5 6363f996dcc181a3d046d46ddf890159
SHA1 39d38f60fda449398bd7ec47854d537ea1a39858
SHA512 4ef28466d95e316b364965207057ab71c2a6291564f593d637a4f03d32a049531c7b51f31e5ea6d02c98e0e0284046b236139ae847bb907e8bfefc65a0580b52
SSDEEP 49152:Rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnQwIQmth4XPhaxg:X3q6HjBkIQmthEZ
TLSH
T116D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 c4ae8cc6a08661922bdb2f0acc565628e0e82fb510464aabf6e6a8ddc82c9191
MD5 35343c1b59b172cd619636ac81df20d5
SHA1 be10c359f9c22cf4df8cbc85acb777e626a12a38
SHA512 1a21fac94b0b8a38631d707fc3707bfa9ec50a633d72be3b3a68f32b1135ae83104a7ec3489384bd8b5fc60c328be613d5f178041d62ec8968cd0b7e1a49f2ae
SSDEEP 24576:BXYfDtczAvw9N3MA1JjFnFbGth4XtXh3haxs1:EtcqwIQmth4XPhaxg
TLSH
T1CE65F12C73D548F9ED6B823CC9A28115E632786147A0E79F03E499660F333D85E7E792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 831959126ecd8fb3e5683f19276e00781e54e605466736a60c2c6e0aec34c6b0
MD5 2024de497e547332f567cc6b161351c3
SHA1 6ccebde0f63998a6a8dd3e8d4b7405d7acb94d03
SHA512 7204dc2cd1b475978a325547efe4896b6f9b3a7d8f31aa6557d3fcc6a82132636beefffe245443c33992b070465371fac620dbbddab566616f132d3f4e291713
SSDEEP 24576:Q0Le5ji0hmx7rMow9N3MA1JjFnFbGth4XtXh3haxs1:QPji0A1twIQmth4XPhaxg
TLSH
T1EA859E16F6748731D073C0B9C5D2A69EE97130825B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e5502503f1be2a37b7ad554b45c9e82aa90715c2348d757b184774990e3c6809
MD5 fc168e281b06839d8b9962aa0d896965
SHA1 e8a6165f52e0071436b849ede8e378b74b0a40c0
SHA512 fb42b2214a57e7231f0acc81d1fb87bb3e558fcac1a866ea10e758b6bbab0059f8835eb6f683fe01172c0c8066c16052d7165dbc71796decd86bef2469410e48
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWE6q8wyu6w9N3MA1JjFnFbGth4XtXh3haxs1:m/ezSC6vUzPvxHjyZwIQmth4XPhaxg
TLSH
T1F4755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1db01dde231062443d9a63c568894b6a6358edf008c7d942c95fbfbd9e7c0dc2
MD5 796a3fc49db55cd2204ad569dffd368b
SHA1 0efc14fcf45e162d7a792d6912c3f05f6fe77675
SHA512 2824cbeaa0e913014a756d19da3e62d04b82fcc1498c03452b8f39e91c5cc4b2e861440d09f3e140114fadcbf69c048d025d2e259c323a9a9e6d5031ec2ee436
SSDEEP 24576:0VbqPb88hv/l+6Tw9N3MA1JjFnFbGth4XtXh3haxs1:0VO88hXl+EwIQmth4XPhaxg
TLSH
T114559E66F5748331D073C0BAC5D2AA9EEE3234425B318ACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 aa235a3cfbef25c5ecb0a4152e50f2d07e069a80161ea682583eb5b0850cc858
MD5 f4f05511362730db71bbd033c2a876d8
SHA1 2c0a103e3fdd42c7163c3bc637d9315a5c6b3915
SHA512 8705aa6cbb0405c796115421fa282ab470237e3dae73c0b70df7898eab0f05b5e619a6b198f474341d049ac71eb83802baf4e7a89e2a785f1a586e9e61902e1e
SSDEEP 12288:fjLt2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:fjMw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T19B55234E264AF863EF2F27359BAE229DA2604D71DDD4972C418679CA05F0764C2E73C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 763dd870ada3a27b7a4107c38a6070c23ebabe71253b476b19c4fdca6fb7aae5
MD5 ac91856720ffc0f4ec0790cf4936dd6a
SHA1 e24f9a80eb51f7b6a32eaf852f0dbd5434957ebe
SHA512 4c41dda74079f3cd7abe6a5bb3dd9ed056b85b895aadfa058fd5290e12c3c17a6957476d9ae4293b5f076a0587d8e9b1c8ecd3715f929f8c78b587ca6d2f4b2a
SSDEEP 24576:0JIUrw9N3MA1JjFnFbGth4XtXh3haxs1:0JIUrwIQmth4XPhaxg
TLSH
T11365CF3BAE28FCE2C67E4D785B918340E77278304F61A3CBD165824EDE235E05E7A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2dde791df4d5b2c714acd9b3b676c0c0cf95373bf03baaa8d62cbabed53f320c
MD5 2f36225f6cf1ec186c6c0ee9464aee5a
SHA1 3ebe65ee1ba837b09308c6f53c8bc262e7c0e48b
SHA512 fd5be20e5fa67f9759d85a16e8c3959b8158867813a62c4ea5aa9d2b6bd68c55e076a0a3e6d5a018b8c66a70f3443767d335dfe921687fa743910f62ff2ff175
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THM:2QvGAdlCEL8c/yRNw5C9IQmthEZ
TLSH
T198267C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 7295f9e5943c1fad736af64f1275549a4e51607efbdcd13ef58b816bd058d9c9
MD5 93d3dab3080f05a58f55b431fad7bf89
SHA1 391730b47ae124928ed0bc64127d97ea92b0bc7d
SHA512 8888e2b792ff997ece979b208e020f976ea92e131c0f00415ae45a8a32c6b449129f0ff3ca169f063537e454fdedd9b362263815e1ba8937456e5a494c1ff406
SSDEEP 24576:6gewsAj9w9N3MA1JjFnFbGth4XtXh3haxs1:jlj9wIQmth4XPhaxg
TLSH
T10F75E031FE75E432C77F0DB21B26C71A547C69204F911AC3E3A89E8E59702D263B6A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0e47b6eb9bc8dfee37d5d4af2e41fe04ec2fa422d2de8b4bf374c74871cf17cc
MD5 a8aa4089deefc20ae19e9b7267b08c2a
SHA1 c23bbb90423230ed2e08574d9a1248b6a0adadbc
SHA512 77b3b4cb1ce5869a8032163c00b6f59f4ab0ae486e00c22d721b6628c183f9c7519beceba8038d7f18ff5094dd0325eae1cb3d2aa776855ea4daae0af8c0d20b
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHu0s:qUEtQevvqc2W1cpV2EI32u
TLSH
T1EA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 261fc91e3695eb30221dc347111311fe4f4c9531621a4ad873dc400a828dc19c
MD5 eb37b9037dc8649cad140cb5ce7654ed
SHA1 8f565d34652a3b83a75144d5764953b70f0901e7
SHA512 80af0fbf56e1101aa1485d1bd27a1e5a26cbd51b2d0874e7da056c4423ea44a0066e576f1d497834ca3605dbf01b5fd738518b033f92c8794bbd8e2dc16cd579
SSDEEP 49152:DCbRquA/m2yL5zQfFiV+XenmE3/zdwIQmth4XPhaxg:8oqtVjnmRIQmthEZ
TLSH
T17DD58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1523796b83ec841ab4780f2da07d9a016112e2e0d601778e0fcbb3128855e5b0
MD5 b31145ab3ce51de9be215ed3b65ec070
SHA1 35ad62047f7b5c1f771e8617a9216cdb343af8ee
SHA512 848d708be3760b7bd6b7c54015375724fc48d39db75b9a78cb22d36687466e73c0f6e04bf2997756744fb62b852f584347bec1f1db5717c2384511fc783b3eb0
SSDEEP 24576:bAhGLJIFoiwtA5l7S53mw9N3MA1JjFnFbGth4XtXh3haxs1:bAMyFoiq5WwIQmth4XPhaxg
TLSH
T112359D81EBF955D4F5B3AB7899BA9171EA76BCA65E30C20F2150D10F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 c603a6c2c1cd72fecaa3cf4946a36d8c17a8f2c7e891fac1b945b17b2c1760c0
MD5 dda975f6d9f8e2e809a89994e28fdb21
SHA1 9aaf1f513929fac2888b02f48dcbcad00a375410
SHA512 ef2c77bfdec3c248a1937328c212f92fd16c09b4f5941e5f57b16015b0041311df95a93bc9fdd2fbbb041f22a0653e17a08bb5d3e9fcac1f4ed84c9c72709817
SSDEEP 24576:MwuuOW5w9N3MA1JjFnFbGth4XtXh3haxs1:MwpOSwIQmth4XPhaxg
TLSH
T1BC65F14A36A95CF9E9675238C65BC136F7F2B8122A60D71F0360C65B5F33321AD2E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 238c51559ebec1018ad9a3a7b7990affef784d1b5cc2fb7ad543599ccc1a4f38
MD5 c169026e1bde2586bff29c8618b8b82e
SHA1 4405529b9f816d9a9b844324c05c6dcc3eab446e
SHA512 6936e0fe92848467752435bcb019b2c8b60621264f7298e415f1c3a6b076576c880725bf1053bc8b952631135f8f5f571aaf6d80b4a37eb8c39abfb3975d7bb0
SSDEEP 12288:7HZ1Iyet2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:jZugw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T15D55124E3398B0F6EA675338CAEA0249E37174726BF043CF0155569A1F72BD14E7A362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 dcef7d86168fb1363577b63b3137e6226181f7b8f714b577578765488d4fb1ed
MD5 8c52c6a2bf54ed050505d2190928de29
SHA1 5678b42d78a8ba95a91f5208c6f735de27f56134
SHA512 18cada76fe9d7ea404ecaeaabe21849e62f8d38fb95c584bc1d87658fd5a47fb5880a0afca2f37bde69ad54e05ba65f31c787b427010e0a52bd7645f4e6f19c2
SSDEEP 98304:RQRQyi36YOcPQLvw2gAf+PN3rIQmthEZ:IQyiKayX+PNb0s
TLSH
T137667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 65490efe971704e72d584cecf597851482caf9ce7d7fc2d28eeb0b088bdcdedd
MD5 ea8e372d893a3d4bd4f5280024f1f565
SHA1 a0c6e33cdcdcaff324d0ae6511cabde67ca089e0
SHA512 00d38fdb6cfd11cb6bd3d2a294a320fbdc67d4b27940b8bed33129cefc0f8dc220b72b77bd3d45afa8dcc25aa7dfdff96e3dc99136c8e1e1ea288df206ee5784
SSDEEP 98304:CQRQyi36YOcPQLvw2gAf+PN3rIQmthEZ:ZQyiKayX+PNb0s
TLSH
T12A667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d391392515b2387995a25e870c05e4eb1915bdb2233870ba3087da75f09ee7db
MD5 5fe34392e64736e4ed79b22ef2a358f7
SHA1 8e2b23b6fce13579ad75106c6f39ecfa5bd3b31d
SHA512 7d8e4f279a669992f9a4bbbf986336bd451a2e9fa8c9ffccc7e48f4ec02e931aa21f514ed97fa05f201b3ae1663deded400fa82a3c096371fec2eb6a19cae61c
SSDEEP 49152:Z68Qg55nhheWu7PNU3/twIQmth4XPhaxg:nthWRc/WIQmthEZ
TLSH
T161B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7144926e0329ebfd0cc254d63ba273992c8a0df0e450df2034f496dfc634ad82
MD5 6f8be3a9b801b6537eae4f2d109b1a95
SHA1 d71654ab0627b735f53ba09dd0bd1fb5cb336d17
SHA512 aead077454b5cf5cfc07b2e67947ac117ea7fadd690a158de708f91a8dd29a6a0c03ec6680812909ac3c1bb79ec0da58fe3aadacd0c69fb4ffe49764be3dc71c
SSDEEP 98304:iy5112gYy5azzVvL69nLKnhZ/IQmthEZ:rLIHmWhZ0s
TLSH
T174167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 25adfd3b25212b1299599a77b2c660d0c205a538189aed334b8ef28752bdb43a
MD5 fd0f06663380071a9fff8954f982bafe
SHA1 88a3f2dc3a7cfe38c89394962b43be2f41eb0868
SHA512 81c814edea93e846c4ff176f2121e304eb2e8fcf21e5119c0f77d523820ff126ae8d672d3aaa217c31b092a4656ae6fa0fad5568850742d88d5f803cc68246dc
SSDEEP 49152:YB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glfwIQmth4XPhaxg:yu6JmVxd2doIQmthEZ
TLSH
T1E6D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8f055513410748a74178c7197acff50f18198afffaf0a1f5025a7615bb90bda8
MD5 486d6d1907fb43e57bc23ba655b3ff71
SHA1 2b119d77ee7a435811ebd4b3e62857caa9212bec
SHA512 73bb902f13cdb35e2c90cf5c0c2bcaa849e333df3c43ff897053ed9dc4c87c7c31eee3c9e9f4f6342d8c8dbda7cfb557a19c4a32417124d4e8c04055bbfae573
SSDEEP 49152:V1hpsNoJpF1A6UU44CwH7R4xswIQmth4XPhaxg:VmifPbR2IQmthEZ
TLSH
T1C7B5BE13F2D900E8D05ED178875A9232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bc3bc06bf43bc0ffa5e66b0a5fad1e4989dd9ff7fca9034c10af1de76d9ec103
MD5 5756ac8a1b319e45b11fb9134065ccf6
SHA1 b3b7f6982fb478b8afa97bdb3b708a558eba199e
SHA512 bab07be4088dffe4e89f4ef2d47d88ea4049f2eac11af0f6e86305a8a5f0c55f86645f0d00654ac035f049307950966381527db8998ed5f181d60b1b175177a4
SSDEEP 49152:wSuZQIY0Be2KRRVtOnks6NMHqvwIQmth4XPhaxg:q5dKTi614IQmthEZ
TLSH
T1A2C5BE03F2E941E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 be88a55e28d62adb62ced34f553b5f45297c0cfccbf336a038ac17dee269fb7b
MD5 0cdfd3d67a7042b834f6f9aeb6b9a519
SHA1 35b3517e2058f0376bf8fbbec771c791c86a8ed6
SHA512 d541ddfa3566349849f94d084a4b1e4418fd7b65e13c05464309045cff1489cb7e59f427fc3dd9305f9496c0f47edc48dc53a0b4075451188b7fbc4e8c5a341c
SSDEEP 49152:0htSn8EApI0figngiDn0AP5wowIQmth4XPhaxg:VX2iyphSIQmthEZ
TLSH
T19995BE13F2D940E8D05ED178C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 538f31df7076bae3315a23ea197debe86c68eb1852ebca95901b632087224659
MD5 329a9714f0d726c7480dce50c76d618d
SHA1 5e4c1b3ba752096f793316dabf4ff977064efd28
SHA512 8a7d7194324fffc581a26461a4678bdf162386c60c1e657edc7cb79e2f414876192841f89fd7090e328295786a2b45c8bca34e942ce15e3bd9b413e23479ef15
SSDEEP 12288:qot2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:qLw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T1A355234E254BEC63EE1B2734CB6E12DDA26049B3FED4536C418A74860AF176496E63C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5593ca5b00b8e26e6e9ead9224c5be85709efead11bc8b0ef2ab54acea055c25
MD5 2db7b1eb8115334d574db8770dd198ad
SHA1 547c907c55ac3b55f41c8378544e23d0f6b53846
SHA512 f1cfb3af6d1e599bdda5ea22601195f8491263411949076db58b8b050bcfb6a8450b8466275f365a02bcc3fad8a3f5e372219e144eceeac2072d81691726e1ea
SSDEEP 12288:gtt2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:gyw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T1D955234E254BEC63EE1B67348B6F12DDA26049B3FED4536C418A74C606F076896E73C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 bb56c280361aaa020ae146409c0f0300b3ff405915dc6e1ddfadeace10255aa5
MD5 33789055fe5f526bf289d9be407e160a
SHA1 cf2e2a76b5e8d9bf1d4c453ef7f1eed529ae1d86
SHA512 c1960cc957f6150aacf82edd6ca674ff10972ee65ea7267309a586f307405a6e824216b90d29af8472a5e75b61ed557c160be8f5249ac937dc1cc6eb189ba255
SSDEEP 12288:pDt2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:p0w9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T1F055234D254BEC63EE1B27348B6F13DDA26049B3FED4536C418A74860AF176896E73C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ec391e4aec39e270768f40707a70d7776bf3ee636b0fb8c68f494997bf97e430
MD5 29916383b40ca7705174d254a3791917
SHA1 61e5eba5652e4fc608bf9f1ecbbe2a6106935c46
SHA512 c45f7a8ebae8d3bfff56017379cefd63cb2f9cbc04ce977fdff47898d9f0daed189966174a6d59d9509cd3a8bb11ed516c0023a4853a848ce264ded9000a4fcd
SSDEEP 12288:jVet2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:nw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T15355230D264EA4D3DD2B9734CA6B529DE2B078B2EFE453AF414128CA0EF179495F53C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f85fcaa0b688c12dc2e80de4c75dbfad30b3fc7df60c8833680307b1cd3e018f
MD5 dac59090334667184e34e527b470133f
SHA1 82822359423ea6c5d2e2795215375fbf3696a965
SHA512 62b8adf62b441bcd4485b67842a0836eb79da60fcb216cf7b0025299ab401b828eb52bd6b52697bb15df4b0532fa0c1e556c2329af71580b38adee1aad93d977
SSDEEP 12288:HGt2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:HFw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T10655234E294BEC63EE1B2734876F13DDA16049B3FED4536C418A748606F176896E73C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 81c01d20044483e3eb9dd91433a8759ba116eca0b15507312754ddc4a92f38fb
MD5 05eaf020ad72481bf27187279372a3f9
SHA1 84081709145728d4e23cc8b38c7603dcbc57c8ab
SHA512 107e6805b0bd79d44f40f216b28c1a896090ea891ec4f0730a7a38c20d032d4d949926f180ec1cf5ebee4e607bf5e4b552ea85bccd3fdca2a65fabff2d13f340
SSDEEP 12288:Hpt2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:H+w9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T18555234E294BEC63EE1B2734CB6F12DDA26049B3FED4536C418A74C606F076496E63C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8c876d437b25f2f95684ace567a439a103c8b451a4ba253cf52ae898d4a152e4
MD5 41b81c71f4bb872f383783cdd4447e14
SHA1 9c072e37519d0b02e49961d5ed2f8b32e53a02df
SHA512 5671c492a09ef2cc09eb8400037d0d48d98e12c46baadb9920a91557cfd193fad74a9f6aaa25bad83f40cf7f0a161bacb3c4cd03a8b3910374af5bcba48ba8b4
SSDEEP 12288:B1t2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:Bqw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T1E055234E294BEC63EE1B17348B6E13EDA26049B3FDD4536C418AB4C616F076496E63C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ee9211ad3455bfb22851cdff46ae1520b839866595d68d1692d9a9ab31f0d661
MD5 0819bc78fa9efe52b30465fd07d492c8
SHA1 348cdcc9d970238d8698444ead05d57a0f518b79
SHA512 eb4d22ac4eb3357634b0c2194a2a4559d19623e902117c2649f25c575ef8f74fc47c954a549fb93615e669ce7822bfaae2a47bd47f53e5bde52a8bbdd7721b38
SSDEEP 24576:qZMnzFVSOSw9N3MA1JjFnFbGth4XtXh3haxs1:qZMnzfOwIQmth4XPhaxg
TLSH
T11E65019973505CF5EC67823EC966890AD2B27C664BA0C71F03A4365B1F733A01D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 318e97f748d7263d68588385ef937e7a55efcaed09804551d604f2bc6b24e705
MD5 c0c15883e6ca1270b5741d2c06997625
SHA1 89ee82d781e1158c118b74d9eabb3decbbb311c8
SHA512 222b5d19283099afad23410ed35378416bc243b2c1bde4ddf8ab05024f2dbe6868fbf876e9b314b5470df07214a5e466f4225e3ec5bb0f0dceee67ffd59f1634
SSDEEP 12288:Pct2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:P/w9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T18A55234E254BEC63EE1B1734876F13DDA26049B3FED4536C418A74CA1AF076896E63C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 2af7caf8f6c45a65b8ef1f96a9acdec0ac55eaf8e2a2ce8f1f3d433d0171a7eb
MD5 9ca8178425e09ad4e24e0e3f3c0480bf
SHA1 6959a6a51a4ef8279a2ccb2dba43b31db2ca071e
SHA512 e50ce1fd26291f44567eac6a187c8c000a2e7a7a49721b898b3f230ea5f06d27a454ad882a914cc8ccc459f8d1f40c183db04ff80a14aaa3fde906e9cbf6f9bc
SSDEEP 12288:+At2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:+zw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T12055234E254BEC63EE1B2734876E13DDA26049B3FED4536C418A78C616F076896E73C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 cec48c6781f2ae9e848ca142b7b18f7d85d40dde6da616f8c3a9fd95961e24b7
MD5 8045d6cc29fddff3de9184ace4cc4b20
SHA1 1e22828edcf12467f0ac3c68c6e9290afa35872a
SHA512 a93d5bb76f8580837ef9f5fcda49f140d21ec9e65e801ff9c796739f41245333d4d11a351ec3936993fdedfe0f3d40ed8dafe9b479c6648f552261d96b3ddb45
SSDEEP 12288:dyPz5L8ht2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:Uzymw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T1B365020B339630FAD5379338C9A61645F37178325BA08BAF039416B61F737A09E7A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 504be43497cb7309d1513a35709f6f9ff1a5efe98866f5de82c3670ca66f079b
MD5 c23bd3a938d846740fd5169e06841344
SHA1 69d65ea06186279a0099def21485eb152f2784ee
SHA512 5839a0e0d487351eb0fcde3718fa8a2250fe3fe0a882545e4b7c741b920bc22bbe29f169db52bab33b35c292f20a62f7960d0e1d14272c159759313b4c9f110d
SSDEEP 12288:Hct2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:H/w9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T1FE55234E254BFC63EE1B2734876E13DDA26049B3FED4536C418A74CA16F076896E63C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 785246520cd2a19ae962b0543ce7a71669177e8bd1bbb1e578518b011ff24383
MD5 a3bc720322668b9c5c2d3823aecd8feb
SHA1 0e87f5f63363c12fea170b605c6e6257a409eef2
SHA512 b57443dafc9f8f4ac9bcdeb41815fecb3d9f55d9e7585877683d6313927bb97fbf8634bfa5a5e2c81e9423e11eac2fcce41ae64cbe763cb6191b0cd824d69bb9
SSDEEP 12288:7ct2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:7/w9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T1B255234E254BFC63EE1B17348B6E13DDA26049B3FED4536C418A74C61AF076896E63C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 eadfe70b53d87af121bf2990097fd4f55bd32f507ddea03c05f7c6974044ec6a
MD5 47ca239fb4429fd7920395d00a837245
SHA1 5db6057c6388fe0c17a90eb415652db1bfe33691
SHA512 979a43fe90d078af7759c1e5320331fb19dcd0d6e4cce7418dfa50681587bf31680cce468129e02787891bbe3e4959947ab4887162158ce66eb2bfe033be43d6
SSDEEP 12288:3yPz5L8ht2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:6zymw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T14765020B339630FAD5279338C9A61645F37178325BA08BAF039416B61F737A09E7A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 a18ac8a08744413988aba0d0e09b9857474053971749a4ace0612b5bb3bf7026
MD5 ed2db74ac1b2f1b0f4b70d5cf8190586
SHA1 fed68ae85d8c195dfcd92e64dd2984c4fedf56d2
SHA512 d2ab7b53b26f44a95a57413a80b609ace1152abc21b2e7487221c982281a6f84ea9a521f563f3f7470ab509722be7df10a4869ae3af4c0ca31ba8fdb45eaa2cc
SSDEEP 24576:GTkaLl3z0zDkw9N3MA1JjFnFbGth4XtXh3haxs1:GTTLljpwIQmth4XPhaxg
TLSH
T17F65019873505CF9EC67823EC966450AD2B27C664BA0C71F03A8365B1F733A01D7EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 1595f4bb91f99ae642a0a19408f3ab753816c9fce844cb7e6a8e7e29da58f073
MD5 6dc64e266cde7fbb99f122d8afb6a080
SHA1 0efa688914269e8927f63046fa828a2a8c331f04
SHA512 f394faa02437738af6a7a4c2824a69739a02668e4a0b775947b01da56368506f9455e35c57acb1591e31cacc6c106680620dcf28f2096da9885a32c77fca0362
SSDEEP 24576:o3ld9CHKy7GZQw9N3MA1JjFnFbGth4XtXh3haxs1:yld9CHKyaOwIQmth4XPhaxg
TLSH
T19C85CF90F3E414E4F0B79A35C9764511DAB67CAA5B70CA8F03A8255A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f5f5209a95b87e709e30a3155cd5d8bc5aca0d94579deffd5a25de10399e323e
MD5 f5be450ddf03ecf3c6ddd0d2866c0a5f
SHA1 7b84b437c06a79efe7c5ef68f06f328ebbcb9122
SHA512 585feec6950df7937e0ae0e9e99fd57e3f2ad62370082f3b48d6d60a1da03a621b15dd024331e9a4de30959647f5918e21df3c37de455babb77bbe5a9dd9729a
SSDEEP 12288:Ijt2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:IUw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T14055234D294BEC63EE1B2734876F13DDA26049B3FED4536C418A748606F176896E73C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 62961cc7eefdbb0a37307d9623945870eca7c5535b63f88b6aef08fd11bef053
MD5 6ada270e6ec18538fad434deccd1799a
SHA1 5ea90e2a7676af724565104d8a65034cf4be3e13
SHA512 43c3b43eda7ba10cec1489ed9eee9e1bb2b17c119e27ba54ed48cebea16930ac7b01a6e0a106ccdd10bcb3848c9cd9c2442001aa778687750d8534f3706abae3
SSDEEP 12288:IBt2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:IGw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T11E55234D294BEC63EE1F273587AF13DDA26049B3FDD4536C418A788606F0B6486E63C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e5c6144ea944ea960277f2a699f36e89e0af89ae01d70352ed87de2a9c5c52e9
MD5 05291bc2c2a530ed293c2a5ad6a5ef77
SHA1 9087df75ec09da6e911dce6b59c1f2c947929da6
SHA512 00ead9c9577e50457cea1280cfaa822150239b2f03089923a9101260aed84532ffdd434e38a6b2eea120f11179317f8b6e42fa5c21482d1e7ea338b30acc6d7b
SSDEEP 12288:ACt2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:ABw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T12755234E254BEC63EE1B2734876F13DDA16049B3FDD4536C418A74C61AF076896E63C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 996a38e7d8f97fd77f0c8fa8543a963d9bda9f5509184572bbebf063d68e07d0
MD5 09b59b8fd797aa6763f5b4401e28d4b6
SHA1 d78daa9a33af91b3c274ccec4c75b496464eb9b5
SHA512 665671469bf1f094528bce313d056166aff7bbe2a052e8e3982d686422090646066bdbe956ecfbd09c9b934cff5eabc7e2507ecd263eb1e959fa8c0364503584
SSDEEP 12288:/ct2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1://w9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T1BD55234E254BFC63EE1B2734876E13DDA26049B3FDD4536C418A748A1AF076896E73C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 73fb5d70352738fb2ffd2a143628426f367360362627e3d7ec87a9b8ce723188
MD5 bf45b0f506604edcce2104a4f2da9fa0
SHA1 7ee958b7ab81972ff0fef66925a6923686a22741
SHA512 6a7444574e48246a0b04e87e3f406dc1389125a6fd2c64d529aa9d06862734e6253d5f5bfbe2707cd74999e25acbf69c6ae6e41f31c5ad880554cb423a9ac5be
SSDEEP 12288:Jjt2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:JUw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T13A55234E254BEC63EE1B2734876F13DDA26049B3FED4536C418A74860AF176896E73C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 438f77614526933eb1843d8cb7e927b119bd8e8f14381b991bb44232c38b09cf
MD5 1d3dcea34e1106feb8d392d0224020e7
SHA1 881898ceeb84dc99ef8736269cd1f0f185b16e80
SHA512 5c6b68b68d17180840f3745ee10ad9e4e4539e744c576530ef3051b46a2739f529f39bd5802018dc269789b40efaa056c5ac49f50b59f68357bba9fb0394ec78
SSDEEP 24576:NfwvPk9RX6wkyAIsw9N3MA1JjFnFbGth4XtXh3haxs1:MMnYIswIQmth4XPhaxg
TLSH
T16585CF29EBDC44E5E177923C89B7460AF2B178695B71C2CF029A53AD0E33ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f0b79460d1e4ed0cbe63aec2217172bb518d3956525441f72ad098e4ed2bb314
MD5 786850aee0909bcd3e3ce2b634e2e4ce
SHA1 f35e7ef79ed9f25188c7600ae9918ac8d9aa4fa8
SHA512 e00f20ceb63cb6980086df212ce81acbcc412597aa4ed452dbc11dda7f2f8cb426f2c27dfd63d8555d541d965c962859fce6f54d11b6e528aab28a1acf1c1672
SSDEEP 49152:1YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0PwIQmth4XPhaO:1ySzPwIQmthEZ
TLSH
T18E067C96A16841D5C1B9C1B98F0BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 be12b7f266fdeb42fff93fd338edbd6701902e6c839c552986943d21cb0d769d
MD5 b691ff2b412acc5760f8116fac42fddb
SHA1 9a7472ef9810493bd0ba0f9076b710c970b7e242
SHA512 96b3e2bd644251db5669f3dbe6fcd922c490946f01ef0388b7dc08624aa01f32609f4f4472456b1f389e5cbb253bcdf3e2cebaf062c1513b891d1a43645aac89
SSDEEP 24576:P47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYxw9N3MA1JjFnFbGth4XtXh3haxs1:P47JUQj1irIhCnDHUPfF/fwIQmth4XPx
TLSH
T1F565AE1EA3EC01E5E1BA923885154A5AEA71742E5F31CACF1270837D6F63ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f8bb34c42ce15ce30cefe837cb4f725b2431c54bc1748dd0686513c7149ad5fa
MD5 32e7eacb3f99ebb5520d3c5c25f767e4
SHA1 6c3d1c957c3502cc03f83a5026d8d62222e6a07a
SHA512 dda5356f9aeb73ecbcd7afbc49dee82d0dce511541caa62d067f7f0a63e9db8ca5844dd4fbeaca09ad0bc31b8160cb87ef4c9621ee7bc13592caf62ced45af41
SSDEEP 12288:qHsf/t2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:Zgw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T17655F00AD28851E9C46E6239CB5A5645B3737C619BE0D3CF42C0F57E0F726909EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CacheMgr.exe

Path C:\ProgramData\CacheMgr.exe
Size 1.3MB
SHA256 fea6f0ed43c21522ec1836290ce63f55d2c86db344cd1b23fef177c33d9ff16d
MD5 84f57e76d32a98728f2c098c4191856d
SHA1 c520eabdeb652f948531ad97091856d4d51d1afd
SHA512 4152da6d6ba15301eb889b8be5cc2f7a97df285ae4c3fbfc30072693c42c4172bf4d3d91430fe3389800efa4bd8a1cfd715c3baa1a69e580b4aab186b5ec7c65
SSDEEP 12288:l7BJHMcEet2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:lUNw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T1285523093946F833CC354B358A4E52AC635CBC729EE6D65A514A39DB3EB02D099F72C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 06d0b4941305e63a0fb0006fcb18bc5a4b7127999da758c4e3a77593ce7e2543
MD5 bbab2dd96923113b2e0d0f82ea73e89e
SHA1 83ab6d290d02596a94cba6df7ffe215b6890ab74
SHA512 69c7b66a8a28065e12ff643e9a139633fa832b3a9e1c47b83712dd0f25217c5447066743c9660906809c30a4f2aba491be80915b3f255ffdee2d4682cbd83808
SSDEEP 12288:zcmggBqZSZS/lgcjGulh0LYlEwOEBmFXo1aRMZy:zAgJegcjGulhUYdBBmRo1aRMZy
TLSH
T1B94518507666CB4FC6A980325E32D1CCAB707D41EE056F0373C98B3FD576A58BAB2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 e5950dc3b18e8d8ce852af8012952adc6785969b9527d8d0d872bb38adc84ee6
MD5 fc3428fe6cc7761a63b61d2ee1f2083c
SHA1 5fca5431619c6ebe5838165a668db51078604ee8
SHA512 97836fe21b18c5708c11f3e6cc777f7eafbd399f6513baf6d54b407889eedd24b29de959a3ca7916af719f1135f07ec4c912d5d081b9a28c8fecc6e9f45be238
SSDEEP 3:OlH/lkRjT1TIc1PZ5Q3mCllltq3mCllltGlslslslslslsl6eSyTa:K2RVTPP+mCtSmCtEEEEEEEcy
TLSH
T1E38112858B0C1738D2B6B7321025C3484334C586694087EF510830328C843E50E13F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 849ae154a0a2c684e1b646d62581de3166bc03751dfbf7eef88d030582741e41
MD5 03273487c4325643134e33fd9814ccac
SHA1 4b56c631f23309ebeb3fee6651c3ee32c0f91e28
SHA512 c209a608bf3263c495dbef17bef02efcf83e7907121cbf226981a8f5a05f9e5e7e6db7c14f0303ae9bbbbd5586490210041792ffe685e26a669d239651b4f863
SSDEEP 49152:tgxaj3tlDgxaqgxaj3tlHgxasgxajzYlXgxaHgxajzYlJgxajzYlAbsGuZ60H8:PbsE
TLSH
T1FB750940A536A78FC1BB503203355B8DAB74EC07B7496F26B3C8057ADC6AB45B4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f559a8c3a35217a.bin

Path C:\Users\Admin\AppData\Roaming\7f559a8c3a35217a.bin
Size 12KB
SHA256 0d7f1f76492c07fd690a3212e75e53a0a8545f7a203bc3e8bc66f65483c0aeda
MD5 f7556ed21dc341e8d8132edf78c8e41e
SHA1 85455d72f4afc7ade4cb6550d9221b2f5902668c
SHA512 3fa5759bf39aceb25928979d78b6313314383b21684e5f3e134f9ce79fc2f0f976bca8da92d37b036d44f09428dcb75fdc23c07db14485a1a064c79655a143f0
SSDEEP 384:vc02ruNIVF4vfSSAXC0yTqovpKm4G3mvboS:vcza6T4vKSQTFKv3mvbH
TLSH
T19942B0C55254F8E762238494DB53A2F9C91E417A132056FCC1073730BE8E3B8ACDAACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 49f81a9703ec90bbeb1de6af1c33764b798d0bc67e32d1d0d33abed0fefe371d
MD5 ef88ee8d8d2446c0a4133ffe966e462d
SHA1 9912277bdc4b0e9517ac2f9fabcd8b9b5b1025e5
SHA512 fcbec6564d14b0ba8ec044953ed0d81164df4cd3613f0e2492139c045a480e7e3a5e923b0191b96cc394e620a7ebe970863d20d9008c79bdb73b674d13447990
SSDEEP 12288:9q7Xt2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:kIw9N3MA1JjFnFbGth4XtXh3haxs1
TLSH
T1AA55230E664EEC63ED3E2730866F526C6221A9719FC493EF804575CA15B0BD48EF6383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1c0a707b2bfe67ceb454d61f7068eeac1e7f652553bc25b25176c1e0228440d3
MD5 1e984fb855e2bed62c21d2bea2f20b4b
SHA1 54da151ea462581d842b82170e5c5980a9fc5084
SHA512 de04d86fb570bcb4342cdd8c85ac4a605a95a15c1f32bc6aed2f0b2a2291464c295da67a13c7b91313bba5545bd214f3a55a8accbe78ab6639f26b67912fe95e
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bY6w9N3MA1JjFnFbGth4XtXh3haxs1:5gb4mBIBhGFxwIQmth4XPhaxg
TLSH
T19465AE1E22EC02F5E0FAE2B8DDAA4417D6B278160731D2DF1151426D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 6b16e5444f28e86438bc65322664e94b6ab2966b563d9325801a8dbab000fff9
MD5 c9552912f6220d5933b1e994b62ad448
SHA1 8932582b5d808c78b6ee25e64faaf4db93bd6f03
SHA512 f193cd39039b90e39b8884d6bc391edcf15471ce2aa8e68aae0eecd54df3646eb31be35c719b5082321c7b722c97e25f931ed63ef534838a62bf8646d76335ec
SSDEEP 24576:iG88u8FpJqH1gzria7/mhw9N3MA1JjFnFbGth4XtXh3haxs1:57ZFPqV/a7/iwIQmth4XPhaxg
TLSH
T1EF85016976E101F1D47BD1388A864667F6B1B42103A4EBDF07A88A511F23BE44B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 688768787d3b8542fc1c00669311036fac2e48be0f52cfdb97160d4e29f85abb
MD5 9dba839ce8460fcb187f0c7e31427760
SHA1 20a0c53f8f98f7b34163be2ddbdce49c0c067503
SHA512 71d7ac2187dd7736a531d65e93d61e83ed533290617558f03092195dfa6d09d95e8f1ca44d6b9d9b0768e4e945d2650a4fda8de84b5ce1318cdbc37cfe73a434
SSDEEP 24576:mPUr+NQlw9N3MA1JjFnFbGth4XtXh3haxs1:mJQlwIQmth4XPhaxg
TLSH
T12F65E11F22AD1CE5EA7AA13C8A86431DF771B462175192DF02D1817E0F63EE8AD3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 355e85b31750ccdfdfed8aa1449bcc09259563992181f636e4bc170179856499
MD5 48d1d3165bfc04d0fb4212269013c715
SHA1 daecc5e96cbfef6a375e5b94dea05cf89c2475d7
SHA512 5d6922879e73a4660d4ce6a0674c09785fd6e21de7dea106d66ce56ad777c2f9f72134e48f39d2338f5359a38216818037e7ac90f34bf076de8f25ae5ffc797a
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVwIQmth4XPhaxg:dG05lO43bnIQmthEZ
TLSH
T125D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425032556CF02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 aee6cb11ef1bd0294a423d4378ebdf10427c8e76c955f6c21e1f85a6362db21a
MD5 8c25309ece8dc9ebcab0e30ac70d91f7
SHA1 67f4ade49bebd3cde9cf7e60a6efb1259b2d7d30
SHA512 3fc89c3a82e5889090789cee9dcb1908e7711dab3e58f3be509b2b0101bd58a23675ff1d580982d803e789b5f234312e80885406e629a16816eae7c6f58fc3de
SSDEEP 24576:gfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnPw9N3MA1JjFnFbGth4XtXh3haxs1:Ya5POZ3+Jt2pasx2+mtwIQmth4XPhaxg
TLSH
T11A65AE5EA6EC00D5D5B9D17DC683461AF5B1342253719BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d1c34843d7cf183962b87fca5844281c2df39256423f5ff849571b5608f8398b
MD5 475022fa6d018649817d13d092f8249e
SHA1 313bead5a37a512563f65cda4b4cd9c644c3eea6
SHA512 89ee9c77b06fe67b0924576d1b3bef94a57031b44c18829b98e3143745139adcda096cd0b06d0db4b4fb7b3a3c8d43ba5033933446e5e11a0821e474f7bbc1f5
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkZw9N3MA1JjFnFbGth4XtXh3haxs1:PNc/zEOVHFCwIQmth4XPhaxg
TLSH
T1F4858B1A23E901E4F5BBE1BE897B9546FA717865173086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 85c638ee27cb922b22430b40ad34a342307793ffda92161f606ab00e5215bd9f
MD5 9f1e4abb4cb699074caee686c7afe987
SHA1 cb18e0c9d4f3b9671e7a7e86371709825b054a0f
SHA512 c97662fe6c491231631726da39b16352feb79e5b91e59a11bdf5113cca80a5c579757f533f83ea8da7f302ee66d57ecf18ffa5d18a7188b096a00277c851b00f
SSDEEP 24576:F8kNvNnaFeYhJNtmZBm7w9N3MA1JjFnFbGth4XtXh3haxs1:F8MwBtOm7wIQmth4XPhaxg
TLSH
T1CC55AF2EBAA845E4D1FEC674CE238516E6727461173293CF4290C13F0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4cea68c1810a6181bda200704df21b0ab8fc0223a018fcd4e701ed65034e3a43
MD5 dfb4eb3c44660db1d09e4a3944098bf3
SHA1 a8864e755dd528cf1e509a65701f7bb4385a788e
SHA512 67cb6ae8196a2d4c048942b90e6b16668b1f56f345cc0404c71da3a5cba97635a63f1978703a3f9844b477ecb42eb15d68142677e0832f5aaad0d88b81461402
SSDEEP 24576:hD3FHshBIYQgAkw9N3MA1JjFnFbGth4XtXh3haxs1:hDVHeBIAAkwIQmth4XPhaxg
TLSH
T10575E13EE65C04E4E57BD27CCA638606E37138B9076166DB02D481BA1F67FE46D3AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1832-114-0x0000000140000000-0x00000001401E6000-memory.dmp

Download

memory/1832-116-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1832-348-0x0000000140000000-0x00000001401E6000-memory.dmp

Download

memory/1832-122-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1900-317-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/1900-79-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/1900-84-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/1900-78-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/2712-50-0x0000000001E70000-0x0000000001ED0000-memory.dmp

Download

memory/2712-53-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/2712-47-0x0000000001E70000-0x0000000001ED0000-memory.dmp

Download

memory/2712-41-0x0000000001E70000-0x0000000001ED0000-memory.dmp

Download

memory/2712-40-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/2728-96-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2728-90-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2728-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2728-366-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2728-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2728-364-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3108-183-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/3108-178-0x00000000007E0000-0x0000000000847000-memory.dmp

Download

memory/3108-376-0x0000000000400000-0x0000000000557000-memory.dmp

Download

memory/3108-336-0x0000000002B20000-0x0000000002B36000-memory.dmp

Download

memory/3404-7-0x0000000000AC0000-0x0000000000B27000-memory.dmp

Download

memory/3404-11-0x0000000002C30000-0x0000000002C46000-memory.dmp

Download

memory/3404-188-0x0000000000400000-0x0000000000557000-memory.dmp

Download

memory/3404-6-0x0000000000AC0000-0x0000000000B27000-memory.dmp

Download

memory/3404-0-0x0000000000400000-0x0000000000557000-memory.dmp

Download

memory/3404-10-0x0000000002B30000-0x0000000002C30000-memory.dmp

Download

memory/3404-88-0x0000000002B30000-0x0000000002C30000-memory.dmp

Download

memory/3404-189-0x0000000002C30000-0x0000000002C46000-memory.dmp

Download

memory/3404-1-0x0000000000AC0000-0x0000000000B27000-memory.dmp

Download

memory/3600-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3600-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3600-17-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/3600-24-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/3600-23-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/3732-351-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3732-349-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3732-346-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3732-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3732-108-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3856-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3856-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3856-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3856-352-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3868-133-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3868-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3868-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3868-127-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3868-135-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4188-411-0x00000209E4D10000-0x00000209E4EDA000-memory.dmp

Download

memory/4188-363-0x00000209E4D10000-0x00000209E4EDA000-memory.dmp

Download

memory/4412-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4412-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4412-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4412-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4752-55-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4752-177-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4752-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4752-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5440-74-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5440-66-0x0000000140000000-0x0000000140173000-memory.dmp

Download

memory/5440-68-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5440-315-0x0000000140000000-0x0000000140173000-memory.dmp

Download