31cd03bec204e5e2c05c026b163133366c205ab21966c4cb01cf5a335bbfcfde

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
Size 1.5MB
Sample261102-2rn9badw7z
SHA256 31cd03bec204e5e2c05c026b163133366c205ab21966c4cb01cf5a335bbfcfde
MD5 c97610fd980fef04a6c83949e38f2737
SHA1 1a959cde8085ad6dc8ee5fe16c89e029ac078e2e
SHA512 6ff36f78abb0dfc96b72fc543644abd37674088e9791347baea2684e5787912f440da44655941f3f05b7e33be24e4900a4e206eaae074a214cc2f9fcdfe17d9e
SSDEEP 12288:yeoISzcQeTD2MG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:yeomdTqMGyxknw4FYnshx8OfVe247
TLSH
T17C75012472C1C0B3C02714734675C3F16A6B78B59A75A64BEBCB6BBD8F304D1E62934A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4584	elevation_service.exe
1520	elevation_service.exe
1456	maintenanceservice.exe
4616	OSE.EXE
248	PerceptionSimulationService.exe
5012	perfhost.exe
4852	ReFsDedupSvc.exe
3468	SensorDataService.exe
4880	ssh-agent.exe
4508	AgentService.exe
4168	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\93d88ab53a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2ca66ab1c6bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000192cf9aa1c6bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca91ccaa1c6bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066c41c691c6bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ac6e1691c6bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066a4326c1c6bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4584	elevation_service.exe
4584	elevation_service.exe
4584	elevation_service.exe
4584	elevation_service.exe
4584	elevation_service.exe
4584	elevation_service.exe
4584	elevation_service.exe
1520	elevation_service.exe
1520	elevation_service.exe
1520	elevation_service.exe
1520	elevation_service.exe
1520	elevation_service.exe
1520	elevation_service.exe
1520	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3212	2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
Token: SeAssignPrimaryTokenPrivilege	4508	AgentService.exe
Token: SeBackupPrivilege	4852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4852	ReFsDedupSvc.exe
Token: 33	4168	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeDebugPrivilege	4584	elevation_service.exe
Token: SeDebugPrivilege	1520	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 2164	4168	SearchIndexer.exe	101
PID 4168 wrote to memory of 424	4168	SearchIndexer.exe	103
PID 4168 wrote to memory of 708	4168	SearchIndexer.exe	104
PID 4168 wrote to memory of 3748	4168	SearchIndexer.exe	105
PID 4168 wrote to memory of 4596	4168	SearchIndexer.exe	111
PID 4168 wrote to memory of 3180	4168	SearchIndexer.exe	112
PID 4168 wrote to memory of 5544	4168	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_c97610fd980fef04a6c83949e38f2737_elex_rhadamanthys_stop_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1456

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4616

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:248

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5012

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3468

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4880

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2164
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2972 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:708
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3004 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3748
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2972 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3180
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3004 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5a58488ca52921632972749a504d72aa20579ad3eed39ca5f1df103d9d94684b
MD5 0db4cb178f25ffecfc4dcd550f16cb8f
SHA1 cafdeaa2ba7449d4f85843fb4460c473c554d600
SHA512 3c5004afcb7bbb82210e728895a2f52b14db945d0d5c14fc6c16daa52130b65f4f4c98fc10dad40213c075edc03567fa6a29b16a29d630d096c48055956bd38c
SSDEEP 49152:Fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn6x4x8EVep:b3q6HjB5ix8EVy
TLSH
T137D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 0daea5c9f7fe45a9213958d842315e5cde1ea02864ab611c3b923bb0d552e00a
MD5 7155b3425182621a2a4d03d0c76916f3
SHA1 c7157e4a4d8ad20c3de3b90cf3b6f61fcc0d91c5
SHA512 07a7c8c808924b81ea6c0c333eb348c136299abb5e61135a70c935300c67831307049519f486903d8b5e9fa30369117b03211576c802d063df0637a746b96466
SSDEEP 12288:z1XLsswWkxy2lRq2czA6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:pXYfDtczA6yxknw4FYnshx8OfVe247
TLSH
T1AD75F12877D508F9EC6B8139CDB28512E633B8954770E38B03E4A5295F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 3fb0fa014d3da996fcbf618e2124215a8b000626b4e45994e62c698d98f5d60a
MD5 202d6b401c2874bddec7f28d1ddf5671
SHA1 1908d4ad8be87e5e56b7daeafccec5a47f213208
SHA512 d67495078c50cfa34a249e7b950ede5faa158d4fac68246c6a3d2df6bf65562fb419aafdd586d695bac2d7b30de75a8467ed703bb37fdb53bf59a6ae4c3bddae
SSDEEP 24576:Y0Le5ji0hmx1rM3yxknw4FYnshx8OfVe247:YPji0A7Xx4x8EVep
TLSH
T1C495AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 162e6bca85188615935baf729ccf11d798e129c35157750cee1427ff448dc19c
MD5 029325e5d03fed7d88b88c83089b6913
SHA1 da98726bfee2fe63d88203b2f470fb9c2cfc0514
SHA512 aa412aee4b780248bcaea3b3a6abffa68cfdce8181cfa84afdc0d056d190aaf0f7127065dcc12172c85f84e46d2c030d8c766639b6016514e9c8a33e6c1d3ae8
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyutyxknw4FYnshx8OfVe247:+/ezSC6vUzPvxHjyzx4x8EVep
TLSH
T19B756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e9f1e882ec883d736b6bab0e5a9f96aa663eea02f0dfd2bf012dfcb5213963d1
MD5 eb4593df6941957245821c8d1dca6a68
SHA1 43b204a9e27ea3c64bd55b4be26ce91883f7edba
SHA512 043a84ae8e9d7e45d9049a1fdecb332527bf1759d5fa90afbdab3f0387c769b5eda6d26faad5554d90805b746edd8856893b4b0f09dbcc10a2f25b57c37f7119
SSDEEP 24576:aVbqPb88hv/l+62yxknw4FYnshx8OfVe247:aVO88hXl+ux4x8EVep
TLSH
T14E559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 fa686525a5c472d5edfafcd5c136e363316e728336504194ff1486cd7d6bea0f
MD5 c88768bca305db5c171560f6547a362d
SHA1 1c7422dc432e5bb987491a4dbe5f444ea38240e7
SHA512 b2362f2e5114488e46577e58afaa634e3935867bc2cc2aa9216e2d8b405004aa6e658ee37dafada232cc68627124589aa03d065c2fe7df0819e66dcfd7af2200
SSDEEP 12288:7ND+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7NDyxknw4FYnshx8OfVe247
TLSH
T12F65237CA7DDA4E1FA5E14331A7572623616F9A4DA74C11BCB78B14EE0F0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 b17019c7c32174e94b4888e9b4f9a1636b9a3e83ec7cae1cc320d1f159670f17
MD5 3ff00368a3f477656c3ba61e3f5fd423
SHA1 93276996d359578a2325894cb55a8e01c7cbc502
SHA512 e44eb003e88b3ed12c284a49d48a65c6b8d08d0c936cf48126de60b4d8238f8d23390390fd037e3b21c8d1a8f7ca7ebdbfd5c7efbf9897ca056873c5adf79f6c
SSDEEP 12288:beBNUbTVO86U++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:bJIU+yxknw4FYnshx8OfVe247
TLSH
T1AC75CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0225b3157001c359ad6fa31de79ebb05020d66fcd183afa8d2e97c365629db03
MD5 9d7d83caf56e3a2bf86cee9aea61a3a5
SHA1 74cc7bf5872f4425003f6dda7fd890967e8fdd36
SHA512 f898aa60df9197fd1ec41a6a21bcc39b96cce33b22bdbfda2c3f92282783b712a382c96af549b546d6fc2dafc613c81db2c61e4f6441ab7e3b4989eb614b8fe9
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THp:EQvGAdlCEL8c/yRNw5CIix8EVy
TLSH
T160267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 95db07ad13dd909e5e70d8d40be802be9326c4e2a67fe77c82b25f5068b93f09
MD5 6a1f788a77e01582bcdda1c49a52a57d
SHA1 69d9e08933048c27d95379fba4a438be80122806
SHA512 b1279e75a08bf9aa1012822fea83f775a2db7e3f2125c1e1606d2b957fe0f0622d25f60427768f0146e1e648beff64d6b7f32184400c7cbb775196c0a11f59de
SSDEEP 12288:vAwSfxL/2Dc3LDLLmt0LDQewsAjs+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:46ewsAjsyxknw4FYnshx8OfVe247
TLSH
T11785E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c79b3020b11ca24af5c8fd92de90fdb64ff2a43b6fe83a0bb6b45c0c84b1f6b1
MD5 61e721e3796091b1a1828272593dc02d
SHA1 3ef77bc137efc1ef63dc3c42b391b412cb13a627
SHA512 63db227fc45c9462b50d0326db3f75b217624309465ba125a311ca57b08b248ab99bc0ceafa7f19fd8a2c0e50b4c7ce3a63d1de79ca2a582b32261bff9553f60
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHa:LUEtQevvqc2W1cpV2EI32
TLSH
T104474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 877e022c299f89ff25e19a8e6def7b7007968a12454087501faa98d2584523fe
MD5 00a32d2a2bb76cc2389048aed440302b
SHA1 7fc8b75b6833f8275ba131d3947156cbbcde6844
SHA512 096145c9f7ebce03e1bfd5c2d7c2ed787e7ccc7a4880451777bc2cef4a67229c4eb9fda9f23497650ab7ab574e12b525bd230305294b9776338bd26f78360165
SSDEEP 49152:5CbRquA/m2yL5zQfFiV+XenmE3/znx4x8EVep:WoqtVjnmkix8EVy
TLSH
T140D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8167aef8588b249f883dbcbaf9588a4c5d69dcf9b43a779f53f22ae2d1ea35ae
MD5 9db862b1e632a3d5669f1c445e798f4a
SHA1 f3d49871d82684a0b858dda8348b483dfb71a199
SHA512 27fbd765997f83904540b2835383cb16edff5c9bde798b9800f8feda299b44e0367f3dd826007099e477e895b357a593561d737c8168b801a44d125657aca949
SSDEEP 24576:KAhGLJIFoiwtA5l7S53Byxknw4FYnshx8OfVe247:KAMyFoiq5Ux4x8EVep
TLSH
T1C835AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 82e198e64b05c109219cd20b75c1b1cbe572badb2a821ba6429c22bf042e0771
MD5 0fc00d4bd3d03e64fb201c795538933e
SHA1 04289774dd7bc7ae2c4efbf35869ebe1488b6178
SHA512 a1ea28c9c963b71c2b72f32e2869ccd28e9ab5fdd69d740d8ad15950eb990ccccaf2761ff28d693c8d9783cd6e65f1b27b0b60c76d6c7f6218180742b89450fd
SSDEEP 12288:jmw5HEjsChN4BFgl0WDm+CN+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:iwuVOWQyxknw4FYnshx8OfVe247
TLSH
T11475F14977E91CF9E9A741398657C136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 149cbdb5436753f41d005bc8e695cf29b73d8fdfe3c713f03db5f026dac73219
MD5 a0972e836b8f04363df1483e43e8e673
SHA1 91ab775adc9397b64212ed589dc48b65116875c4
SHA512 5c69ee734d569c8dde4d513fa0d186532447c8fa86057055d32a586eaf6c8a53dd8c563d58c564de30c566a4e990af29656308d933f2fbf61e0de8cae2c952a1
SSDEEP 12288:cFZ1Iyc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+Zu/yxknw4FYnshx8OfVe247
TLSH
T12A6512AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 60ef181b57b9388ea85d161458bd8b5ab95e8e3f402913cb8f05300a8494b3aa
MD5 0cc9d7aaf638d84ea9d4c9a49d46e45c
SHA1 879a6632bb72bd3ea7cbbdd18f63ba0f6eea814b
SHA512 e61b703db0ef61f530dbddd74526b2288309d505185ae7148e55e005d51bca6f71cdb6d9641eef1873b80d75dfbc8530bfcb49648c2d05e4dfcc118d7f4e1d2e
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:HQRQyi36YOcPQLvw2gAf+PN3dix8EVy
TLSH
T13A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 66de256183d05064f5fb3597431d5b61eaaf1c42d750622f581b1e9f78fbb914
MD5 7451a80d8dbd32d14273da6b4ba7625e
SHA1 fd3c21a53120c79c4784f7fb1bfadfcb3d4c1e65
SHA512 95d1fea2c751c88a7e210e632a2738ec76da8e72c52a8b97e193254e622f43250e6fe0933a9ece034efcbe06bad135f2eaaf6581a6ae572b9820ee24fa6a5583
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:bQRQyi36YOcPQLvw2gAf+PN3dix8EVy
TLSH
T101667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ddc6e5affec513a2efc1dd80f82b2767550b0d7f813286e26050e9a62d20a751
MD5 a3ca53dfe336943b60310694aa0fab9b
SHA1 83cbb0d2692efcde83ad48461b7d579975edd8c8
SHA512 c4dc32e43a334a55b887b08f55cb4ece5e589e960b63735c9285a312ed5e4d58dd0d593e95c6b80e024d124cc12c57bfd1eb3137430200e56364e7395c618cf2
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Pyxknw4FYnshx8Z:w68Qg55nhheWu7PNU3/Xx4x8EVep
TLSH
T140B55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3bc784fc95ff59a1b24b257f4160021c3b1dfa8ca86ae7ec1b0bcee2da013465
MD5 2ad54c2bdce47aba604a7ee290177fa5
SHA1 f0c25321c27c1b0009c7aeec3c8e388ed0e48a67
SHA512 77c6c6182c45ce9a1a8183715f7883842ba15dd8f06ec17c697950c7912f7d5ef29d06fe8df96bea1868a469dbd1346ee4cb0426e796bccc2b5e54fb05417036
SSDEEP 49152:93aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99v:sy5112gYy5azzVvL69nLKnhZGix8EVy
TLSH
T11E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 793ab3708045d1e64895477650bb01a68060d5494abb92b1a07677716315bbbf
MD5 f4596686a20e062132e8ff35609cb40e
SHA1 5cbac3d68a88a267c57a431f547369b2057c1859
SHA512 f29005ac86b77c58b38ac7fc79b83c1b22354782282881273ba0fd5a3aa22b9ea9a8c3d19ce194e576e02626f3e87b63db53f1d431398885137e406e3821e2fb
SSDEEP 49152:jB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gllx4x8EVep:Vu6JmVxd2dlix8EVy
TLSH
T12FD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 47245d4ab394d1cf7fb95f1a25bd131427f9c0326df3e6b49fa943c9b79e93cd
MD5 a7ec30dcbb771a92798d1256346c3b7f
SHA1 8bce0a0830cb195c9ad88398737870ce9a47fd36
SHA512 827039676d796cf671278a5c6c1ba3b4809e91796a1aa6490966ac9608e429e4b69143c5464fd360183147827ac5804b936f4f9f2641c10b2ecc64a04e40dcaf
SSDEEP 49152:q1hpsNoJpF1A6UU44CwH7R4xRx4x8EVep:qmifPbRkix8EVy
TLSH
T122B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 629bb01f088b8a8e8a59762a687fa15bcb50c40bff0d9019b9b5ee99b77e0950
MD5 922c861a7107ba3ddf9c0dd2dbe436f8
SHA1 b4d8075ad28b512d7551ea3aeae17961e9206940
SHA512 f25580283285b54e5d77c5f44b5c0e18922bfa027de5a9dfe6fdee871bcb45b937e83d82e95c0fdf779ce84732ceff85ee69e0017aa1b376c4c4049704321eb7
SSDEEP 49152:WSuZQIY0Be2KRRVtOnks6NMHqqx4x8EVep:45dKTi61qix8EVy
TLSH
T173C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fca0161e7103ebffba01b53815dfe2269bd7b01a06e70f5eafc953b24a5fe875
MD5 ef65599805dcd8c53ce428fa5d223991
SHA1 30fa9be98096de694247bcc3a769c7d3396c1f46
SHA512 260bd66c30e3c4b3d43963dd212f5712ba5ec59866919e7d4e3c28bd5d80736fb8664d9bdfdaf7bede668682f7316079ae3c1ff7d8e64f5b179872a94d6f0fdb
SSDEEP 49152:khtSn8EApI0figngiDn0AP5wVx4x8EVep:lX2iyphAix8EVy
TLSH
T17C95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 316ea9b5fd584a0e1945c82e7d427bf163455bd277aa05e9a09a6b6c2c020784
MD5 d2cac7d6b840a57d883f00c39d2f99c3
SHA1 72d759ca21e7c6db2c2afaf3c1fb2bcf1775ea46
SHA512 621dd3871af2597c01820e599aecbe9a952d2a7839af3ff54be390c4afe2c56aac3322a94d2eef5531892496be54d1117873b41ba37da2414c12621960599f93
SSDEEP 12288:YL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:YLyxknw4FYnshx8OfVe247
TLSH
T14665237CBBDE95E2F50D01734A7163626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 50cc44dc7e5a1908c45e6b40196ac9d369e44e7e3a95848f50af0de8fa14fb92
MD5 a86957bd1fc3bb1cd2a8ed5443bf1bf5
SHA1 b36ef863199a0b31351ffabdbc6a21598bcb2f94
SHA512 b0404a77f98c3b57d5a1cd24c9b8aa9e8c4ce8e6b90abc1bc9c403d3aa1852b9be2981797ce8ed2e6ef420ce5bc7e779420303e692ea3a75fcfc656a75e910ca
SSDEEP 12288:Mo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Moyxknw4FYnshx8OfVe247
TLSH
T1EF65237CBBDE95E2E50D11734B7163626609B5A5EB71811BCBBDB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 a280a5a8e6a8dbf306dbb34047da01b4efd4b1a62f5761325379f8975918f45d
MD5 c7a013093ed61c08ca87c07ba5a2efeb
SHA1 41d7d2e55a327efc07ccd1dc7097af6896db7a9b
SHA512 a2c671f562054f2eb0deac181a0826ef653a1364df52f9e149f4394c51151e60bf4994b9cff45e1a41e9b578915bb21fec548a66c5796b79a8d67d686e6d86d8
SSDEEP 12288:TG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:TGyxknw4FYnshx8OfVe247
TLSH
T19165237CBBDE95E2F54D10734B7163626609B5A5EB71811BCBADB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 51215f2e99e06febdd8318baa3afd5755b093e92e0e112570d36ca59ab050793
MD5 211c79a5e3488bd0d214661c1b5940ed
SHA1 53c895a3cda087dabcb39086e8c9b23d1a6e6727
SHA512 1c75e8359800ba3fe03ab3b047a17fb57d0074cc30f3cd0fd08acc7709ebd0f101baa7f1d0574d16293a9ded9fd8647f2adf61de4c2111e35022633fec4da3e2
SSDEEP 12288:pVh+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1yxknw4FYnshx8OfVe247
TLSH
T1E665237C77EE50D1E85A51738A726222B365B8E5E731835FCB64700EE9B0890E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 f118dc166cc1dcc6bf624d45afc7f99e8485fd9930b70e15637b10bf273fa0e1
MD5 ba3ab11a343843cbc0b4f8a5923a80c6
SHA1 0d97aecb7921fc750f075bb42479623471b4bf3f
SHA512 422993a917316ab1603b402bd2e433811dd1a7fc9b2174e74305c0a2f73ae134efb4809cbfb6af8e064854f5256ad29e90c06709e3e37db03ae3f5b85dd317c5
SSDEEP 12288:K5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:K5yxknw4FYnshx8OfVe247
TLSH
T1EA65237CBBDE95E2F50D10734B7163626609B5A5EB75811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 aa97c7866e4524817d22137f36c1010f3fb7d24c0ea02ab5846da70912fa324a
MD5 08198a1ce0b716944fc1fb2a1176db25
SHA1 1539dca78525cb8a5f5f4dd6278e9149140bedcd
SHA512 783d51fcf0b8b4aa2cccad8567b7fc41f272dd8636375dde7381462a11ef9a2132452b208c5bce93af4e4770b4159cfe24d8003dca800e3183e3ab9f8d48cdbd
SSDEEP 12288:80+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:80yxknw4FYnshx8OfVe247
TLSH
T13665237CBBDE95E2E50D11734B7163626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 6a48128289bfd8a9d8816b0f37255a25ea81164a57ca2ee90de04a26e8146306
MD5 4e29331b9a2dcf6bdc60809d60d20198
SHA1 e02a3880eae93ab8b71e0e398723374b293d763c
SHA512 b9c89bfff68e028dabf334192dc4addda7640a854b1d38ce7c6ff0a9b6b5660e0af7eddaa465e275dd796f14ce9358ffe01fe20e5a0e7c1a60aa8b50765b56e7
SSDEEP 12288:cg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:cgyxknw4FYnshx8OfVe247
TLSH
T1B665237CBBDE95E2E50D00734B7163666609B5A5EB75811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 0d30fa9a75c3340bc8326da82acc7e10ad1dbe9471a2a969a381b9a274629872
MD5 4a9902d8d0d05ae8ae43d714a5fbd3af
SHA1 4a4fc305c60c89b7de79354b148bff212736f561
SHA512 282fde540495a5867629a7330761edc127295c1bb97e2b58358290527f253a001beeb06368dc378f3c67e67305fcef352e10b2b28c41d19bfe8992a92de959fb
SSDEEP 12288:ciZwbZzzFEoS2cPvyI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/ZMdzFVSOIyxknw4FYnshx8OfVe247
TLSH
T1A37501A8B39018F4EC67413FC9259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 9770d7a0a3fd61f166b091c5a73f987d6c35bf2840ed74f006d40c67dc68b47a
MD5 7605086ea6a0e59eb1fdafec0094ceb4
SHA1 65b404bb7b386d3fa58ff5e08127e4cdf3d00921
SHA512 5308c692e9fe2106a2aa7eca70a1054cd12959204d3655cf16f512c7c3b9c64904b9dc251bd1924937a2f0b5bc5220921631582497ba419c1c7693657a14c69c
SSDEEP 12288:Pv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Pvyxknw4FYnshx8OfVe247
TLSH
T1D26523BCBBDE95E2F54D01734B7163626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 657cc7c196b048ce4bd59ee41c183dd2527b71abffd8c6cdf8d69ef8e30b6d6b
MD5 9602137c37f41f923c2cf951a88358bc
SHA1 639ba9d15f85bb31978fcf076933f6a46764fcf0
SHA512 8a346dc0f544eb74b2bbdcba76f2d31d010d2a00a624ffdd4ee37e9428021baf6d33327ce89dc5104375e131e9079e80e2e5399c30fd3d4b26e314b6a12da760
SSDEEP 12288:cz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:czyxknw4FYnshx8OfVe247
TLSH
T1C465237CBBDE95E2E50D01734B7163666609B6A5FA72811BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 7622b4383c0daef7f7e0d449571af4ad7087c46b8099a94ce099b8a7105d4f6c
MD5 9d66e93655c9e8c4c9bd1a5d5aa17e51
SHA1 1cfa6a20020756556b7d8292ee8cfd7232501f44
SHA512 3d0b8a44e573ee90690882159c84230039bd85f119d3bab2526808a45bf569047dcc5e8c17099c7a2848f307513a1c4a075e97b0e4afc3587a1f48da42bb6299
SSDEEP 12288:YyPz5L8c+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5zycyxknw4FYnshx8OfVe247
TLSH
T18275125B73E530F5D12A4236C9621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 9ba4ccb4125d66d93489826feb5024a3ac6c0258026858dde6fc0859558eaf9d
MD5 881866fbf8719ee7da91e6eaf9d869ea
SHA1 abfd0fa4855f2bfab4411c7ad5f648b54a12f641
SHA512 217f3eb9557c0042137daa448512754c7a594a19ec4261fba8b8a863ddc36faceb8baec9b1315771f6aa2572c873d1f9e940d3b9a680c268fca0eb6e57c42f45
SSDEEP 12288:6v+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6vyxknw4FYnshx8OfVe247
TLSH
T1026523BCB7DE95E2F50D00734B7163626609B5A5EB71811BCBADB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 05b60c7fdd6aaa6379aa14ed4e38c0c405d98ba1f0512c919aca931d4106d7c6
MD5 a22960e629d9d361e4cf106b760046ff
SHA1 605b9b9948d64b7df1adf22da248b2d3ef23bb3f
SHA512 5c04f2ff58593477dc7c33429d58bbe10b83b02cdfa34807bfe07ff5fb8e1ddd0847234370f63a93fee39e8b27323e0ef96b1bfd58d49762a45598af75356c9a
SSDEEP 12288:cv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:cvyxknw4FYnshx8OfVe247
TLSH
T1036523BCB7DE95E2F50D00734B7163666609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 af331fd1beebb6bcfbcfbe41381c596cb66dc0678d7bdeaf9a38c72f8f4e8e54
MD5 b33745e8c86ee5b45131d15809beb53a
SHA1 08a689b598be864c5855cc2905897648e5208712
SHA512 1e0fe8576c3653584edd55556d4ef2496d601cad0a874e123c89a39c7f1f9ab28e8ed1781328e6297aca32aa90e04ccce6abdcd0585b0d1742927ef1ec35ee06
SSDEEP 12288:CyPz5L8c+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fzycyxknw4FYnshx8OfVe247
TLSH
T15575125B73E530F5D12A423689621612F372B872473086AF87A4537E6E739E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 5b8b8ea183298c367f441d6530352eff3e79bdd35b2afe01ad3b469b76ef7cc6
MD5 2625e95a5bc46f923eedf9dca5010692
SHA1 9375de073afee37e553771d341d73d52b4b9e119
SHA512 9d9004cd9d1ece221462da0a8446baf5b17a8f2cbd717642309cd6b6ff2fff1b0c2ecef32ccb6da2c56db0fbc48d379bed967033220d58dbfef459b4d468a08a
SSDEEP 24576:9TGaLl3z0zDWyxknw4FYnshx8OfVe247:9TFLljYx4x8EVep
TLSH
T1377501A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 b64b996a1586581949202e4e545798bdc488298057ed525f1ccce45c0e368ba6
MD5 9528ff8d5c273ce53be4a7f746333873
SHA1 358e1979538064ebf1a80b5d1638f20ec91c4b31
SHA512 a7913124309e563f9efb84c7f4bcc5d4c0e19a019bccdf3758f28b229e60f63f9d801aaf1ec8622eab5a937a6cbc665a0dcaeca3051ae251d457740fee2580c4
SSDEEP 24576:l3Xd9CHKy7GZCyxknw4FYnshx8OfVe247:FXd9CHKya/x4x8EVep
TLSH
T1AA95DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 50cb41d8fb412e233a7d69196b008843c9260f219d47dcb09bad5463fa19046c
MD5 d04e63a2c7acbdf29b4bfc165f5bc845
SHA1 392230a16cb95bd51ccabd38e3b8db7fa5a6cded
SHA512 af2def2a915e228d81eb3c30937a6e4c0b8e4203e29e0d8283cfd02e122e5b56edca4b2ea47998d4a102acd364885400b909612bd052596f8eb0594115db0f9d
SSDEEP 12288:Hm+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Hmyxknw4FYnshx8OfVe247
TLSH
T1B165237CBBDE95E2E50D11734B7163626609B5A5EB71811BCBADB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 596f37d00351ddad50c8dfd2f3f4b44a729082e0a664adde6a35bf11a59d3b25
MD5 79595e1c6e63e2a75753703c5d15e80f
SHA1 a18e8d5d35ebee267dbab1b5563f0c0187060b96
SHA512 4c3d6179d3da35a72d5ec1d6b77ca707007ed10fde01ccef029e11dd48688e6c1028b3651a79713fa4f51cfa11a6c56e2336fd45a1f8065c450cd556a8a81540
SSDEEP 12288:d8+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:d8yxknw4FYnshx8OfVe247
TLSH
T16665237CBBDE95E2F50D11734A7163627609B5A5EA71811BCBBDB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 a992dbb85a4bffe54a8aca67364411fa0f9ec02e9c1c375ab4c55452bb1d4862
MD5 64d55af56dd09d5faa5e8a9c03eb27b8
SHA1 82d0082e69edede110ed505e801e506e3576152c
SHA512 8f8a449cf8101e5280eb52ef22d3983bc447d708531ec866f5523598380c809a1dbff1ae6f0ec0fd7922b507e1b0c96554190f677b89c7bbc48039a1f104a55d
SSDEEP 12288:Ql+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Qlyxknw4FYnshx8OfVe247
TLSH
T1D965237CBBDE95E2E54D00734B7163626609B5A5FB71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 aefa53e55cd27b5758b275203f2be8b4d79dbd6af3e0d96737f9263cf94aff1b
MD5 ad5aaac3d4b1347bf8f92759f11b48f0
SHA1 740e0115c607469a8f8c5fdf794d4dca59eb5492
SHA512 52186a703069215df3ceb135446b0f5f9d62d729d09a9e93d3076a35589c25211c75bfa097d32a2619dfbbfa5f5555ad4f414d8a22d0c7db611ddbd5d7421079
SSDEEP 12288:Mv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Mvyxknw4FYnshx8OfVe247
TLSH
T10065237CBBDE95E2E50D01734B7163666609B5A5EA71811BCBBDB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 cae6baca9df9efbd53bb4553faec02ffeed0682c2bcd7c553e6fcb5578fb3c09
MD5 d31b5fdd8ad9b49cd02df1607d48dbc0
SHA1 b5f4f48d16c738e4301e9fe517d8a1fcb6bee1fc
SHA512 c6baa5e4fdbdc798a682565d26a84bbe588d48a2d91e0fbf3b9642464fcae2a58eae3cc016286ad474fa2e810660b0917a27a2384d1813b84de8ab24c34f8a0d
SSDEEP 12288:dm+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dmyxknw4FYnshx8OfVe247
TLSH
T1A265237CBBDE95E2E50D10734B7163626609B5A5EB75811BCBADB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 26bf6f7a118ce8e55063f02db0de84089bb7e05e877d90fb66b0d71b7f6ac980
MD5 5f7ba41f201a61450e015379c908f678
SHA1 62839b3092ad76e5da789a1078cc4d64ac94bb6b
SHA512 11930132ea1214f3c42c34be076331925282100464d113b7191afab8bed64502f092fff17b4e059328f0c846a49b619fc6eb3b15749629e852ba0fea015cf3bc
SSDEEP 12288:uH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uHyxknw4FYnshx8OfVe247
TLSH
T18665237CBBDE95E2E50D00734B7163626609B5E5EA76821BCB7DB10EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 1776ab16a5f957867d1628d8b627ebc628ddc350b307a3d0c8eab8d948184b7f
MD5 521d818a1c5a67b49f9339124702237b
SHA1 be139ccc6b4fe28593c37e0865f16bbffa589a54
SHA512 08c56a29ed61631467402079fdcf55b9fc30f1393c0692848b4445e77ce7800e547b76e8880d3ea36abedc47e97947e980fbc517f151d861d421ae6e5d0da2a3
SSDEEP 12288:B5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:B5yxknw4FYnshx8OfVe247
TLSH
T14165237CBBDE95E2F50D10734B7163626609B5A5EB75811BCBADB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 234fa927055bb89cfe4429876abd5f19476b44ea33108ce275342eeed2b8604f
MD5 f0c4fb4af330f1d8419db184f3043401
SHA1 f5c7cfb6ef329f6c6699a5068c503cab8b3c7b4f
SHA512 396ae1e5f04edcebf48e08a8b6066bc359d12fbb2d45556fa94c0ebbad03ab67e2e3130a49131b0a0f0706b0e6ef2a48d6a6be6675deda9db33750ba6a2a100d
SSDEEP 12288:Nu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Nuyxknw4FYnshx8OfVe247
TLSH
T1F165237CBBDE95E2E50D01734B7163626609B5A5EA76821BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 6d90e74eb12df00194b2686b61a7e9f54a23f7cc5d731e8f94f98d3e28831ca9
MD5 534ae5647cfc293d43a86fe861b3a865
SHA1 c020e6c47c562146f18cb615417f076568245735
SHA512 4b22678e2e6c484168c2908d7c64c7cc7c0426d9caa247ecbb0a019be539d34328e074bf0b4f73f2992aa715d695dea7c2f840a00cf55dd6cb62476427ab0a4e
SSDEEP 12288:N5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:N5yxknw4FYnshx8OfVe247
TLSH
T16965237CBBDF95E2E50D10734B7163626609B5A5EB75811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 f91a155ca3ec4305bda63ea18cdd09da92af7b86625e060eb7ed4a35fb265814
MD5 23ee75346a1fec93513ae85038ab982c
SHA1 301334b89f5493e7e5be06ed14c5707806f039fe
SHA512 d507b931f0e6c08578565f8fdab7f994a8ebc7f0f1cc0ef369e9b4bc5117fcd6612a49f5279401676b65370ab48daca7052e920d1c178e2611738629d187158a
SSDEEP 24576:UfwvJk9RX6wkyAIjyxknw4FYnshx8OfVe247:dMnYImx4x8EVep
TLSH
T18595CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 92bd02c6dbfd0ab25baca96ab9ed1c33a739bde061143960943062b48233ac7d
MD5 d839a8930e224489db32f290e8e82d3e
SHA1 896745888d99c3528efa4fe10d5168b54f7d106f
SHA512 353c0a952e5f643067fa746c3dd5e47919c2892b52f00366d36d9d96f6080d014512efdc7ec496db180ef2ec1ba95513b775c9db7a6e897fd0fd3186ef4d4de8
SSDEEP 49152:sYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01x4x8EVep:SySzP9ix8EVy
TLSH
T184066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a2f2a9ef2d1eb7c4d7c64694dc4e6683bfef92de69ded1f3db3ee100ffe65c2e
MD5 220673492628bf69566e288291c6b1b5
SHA1 c572e78680012f72995c6135ece29dcbf1409dd8
SHA512 d863bd49918d0df80b828851cfc323b6d599b127c8bd1eb3f46754866e99cf7fc2cf6188ba17c0185909e7d68bdcae6663d19a0afbab8619010965b4f0ca1462
SSDEEP 24576:U47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY4yxknw4FYnshx8OfVe247:U47JUQj1irIhCnDHUPfF/lx4x8EVep
TLSH
T10365AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 1fa9432c95530c145ad50c49c638582033fcac9f284a6203bad9fef985520eec
MD5 ae79c5af6de3c72a78919c99c89a13a9
SHA1 8ff7aa70954cb41511bcc9868f15892ac422e34a
SHA512 b7dbc14131ccc76270fb61d61193ac30ccd48b40777e79c8f0ffaf0142b5a7d1cd34a0ccf0735eb6d4228c7b7e8e79446d8af1b8169a224d2c571a8ee3ce2fae
SSDEEP 12288:i+sf/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:y/yxknw4FYnshx8OfVe247
TLSH
T17175F028E29842E4D06E2276CB625641B3237C6597F1D3CB97D0F13E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 3f40d878c7a61b42e28c2021e3c251387b971a013e6a948a80302396a7ad3bcd
MD5 47b992b10d253b724484bdbaa0bc300c
SHA1 d338d5fe189eb71a59bff125016980e2f2177eea
SHA512 09d8a736aa64b833f738195af6ab762a7ceb474f364a7aac04e9c8ef7737d7c1975a415bcd9c53f93d620fac10d1876b0e21bc1590865e9bdb483a76cd89b37d
SSDEEP 12288:acVaRBqD/PzZLGjon1n3QwWOqu6aRMTvEEbhmT8:abR8qbOT6aRMr3bh
TLSH
T11B5528117666CB4FC6A980325E33D5CCAB707D01EE08AF0373C9873F9576659BAE2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 0b64a9db5e8cb74f1e55ed2dd85d70cf010f21cfa8e07cf7b612ef8ff4720407
MD5 508b4b9027424d94bfe687c017d8c0ae
SHA1 04a1500288895ad1660d9f06a85adef97d4719d2
SHA512 fcace0097254b32659614ee5e91667bee1f629b386be9b14e2aa2ecb63117089f2e95de90c5deb9706141150a371083bf88deb279fa2cef55b225d2f9cb6a992
SSDEEP 12288:ntWZuik3Fwtn+Zs2ZGTGqSyCkunKftxZcB7TBvkeq4v6:J3Fw6cfpcB7dvblv6
TLSH
T1B4650981A136E78FC1BA503203365B8DBB74DC12B7096F16B7C9453AD82AB55B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 ed3a9f4b63401a98b787c39ce75f406f675895f92c01a1b1c60a70a52a302305
MD5 ca7079535fb0c4276304afa2c5e902c3
SHA1 48c2d375e917271ef54e2f86a714cfc30211ec78
SHA512 4108b97b53d5f4fee791c74999b6ea8d8a574c2b1f21a0ba27e36b2f0435ca4c23a34f765dc04d67ee26afc1d842f117632ff0c44af4439b3e0921f79ba5bd68
SSDEEP 3:OlH/lzOPZTfMpKV/lcgnMdPH/i3mCllltq3mCllltGlslslslslslsl6Nhu:KkhTPVtcZZH/UmCtSmCtEEEEEEE
TLSH
T1468192889B800B76CA9A203140A08B84D734D049A44083EB094C64124C9A2C90C06B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 66aec3c40ac5786baeaf9fab42731539b1868e9c8485fdd312a6757c5573af4c
MD5 c49a1026af67334af6f46ca0c929e11b
SHA1 915f30c40aa320cf229dedd5416343f5a24fabde
SHA512 b6ad87fcd627de950e217e6cc5aa3056f47fa4d2efb5d89ed420939237b964b0c3fe6c81f865be37db4de88ca47089418eec7e62b3a16b74b910c86f71863be3
SSDEEP 12288:P47X+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:wXyxknw4FYnshx8OfVe247
TLSH
T1F465237CA7DEA892F86D11730676A231360AB5B49B70C1DBD728B14EE0B0CD0D97E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b393b533e80436f40aea886a467d2432f10b86ac1860332485c91f9350ab427a
MD5 7afcf4ee9efdbd590ddf693881653a1b
SHA1 23b19b63776bafa86f3633f5f6b2dc1b295acf2d
SHA512 629f5c6a1d89fab62ae5de8d26ea609be41aef92d10e3eb83c5d3638e17f1e08e077e252b958f631e19b674b496c36495bd21eb6d330bc88e49dd634b6f00012
SSDEEP 24576:ggb6bmBIi49WNNFpg1rSvFv7bYtyxknw4FYnshx8OfVe247:ggb4mBIBhGFbx4x8EVep
TLSH
T19A65AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 6258ea594e13e4c6b32c18d95524f934afa78fa49d03ac39fe96b0f675a2a728
MD5 3a99dd0d30d4c777349d385e44680f20
SHA1 a705fd6980f3ad7b86b2773934c15f81e00303c2
SHA512 aaf9a7be5b4df845b006ef9df127853665a86f3989c89e3ba95ed445dc7bd36cb8a7104f4e2b81a142e9dc2c494017b14426ec1269ad7721dec0cbd860f32ff7
SSDEEP 24576:LG88u8FpJqH1azria7/mIyxknw4FYnshx8OfVe247:K7ZFPqVla7/Qx4x8EVep
TLSH
T12F95F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 5f061d491fc42126e3fbf5b04f3c43f416f23222e7ed6ebe395d46fea1a653eb
MD5 12bb8e0eadac86784d0d4df9f905e788
SHA1 f911870bb820cdf1a6f270315f27f497fcb48e96
SHA512 a679b5114cdb77291860afda8a619f54f3842ae4d83c24d18c1e0dc5c117d7e8542f55dbe873cd81920c093a678ed656977a771e2a8cb18fd4654826ac41d872
SSDEEP 12288:0HvUrBFrEjwaQk+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:0PUr+NQkyxknw4FYnshx8OfVe247
TLSH
T1C575F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1e11db0ac54b38c5edb44805653c63ee001ffbaa5a9bcf6563e693d19dee3421
MD5 14a69d2b89750190dd22748d4a3dff1f
SHA1 66baa4cdfeba85c7d7796374faee9efd681df6e0
SHA512 097342c5074991ba5d7f6e22b9f87ae0821414ce58d8ff61e2d25d8754558d61b912034d08436bcd924ee82e9af2390da1c9399481cf929d7c09d7f8b73b2e63
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPx4x8EVep:NG05lO43beix8EVy
TLSH
T1E7D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 60d31e6767055239b91e34d2570e10cf40c3bad9fb8fcf75a9f7c71aad278e86
MD5 d5cfa636ef6741cd085774fa0ac3eeed
SHA1 316b82022e76bd72ae7afc4b76e9313c163e5ecc
SHA512 1f0df9807ae247823e0e85511ce3de9deaaa781b29bfa01dea12853d42784417932f21887e1da61515af488d99a3277c49a511f76649be314519420d8580eff9
SSDEEP 24576:6fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnayxknw4FYnshx8OfVe247:Sa5POZ3+Jt2pasx2+mXx4x8EVep
TLSH
T1CD65AF5DA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3de53d392d936ebe5b9d6526e38c6326294acfaece28e83bc13cc193513418ed
MD5 127a651bdc5e6b946764d8a96b7a7960
SHA1 ff38b3544116bfe341c287d6f8e9e7732bedbb3a
SHA512 a81a1cfe9a6d2b893eb55de87c550ac75ac61f40e574f4fc82c0954fb4b6aa7d7335185bff0d73d32c49ec335bb22e0bc7bb564b50ba9278d3dbcfff32d39145
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7Fkwyxknw4FYnshx8OfVe247:eNc/zEOVHFwx4x8EVep
TLSH
T1E1857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0c6a50e38acc30ffa25cc1607608d49ed2964febc2fcba4d5a2f3e9ab4a341dc
MD5 42a04e3d31bb8412edc0930e55f6653f
SHA1 541dd1442af35cfdcf71c6c14e5b20a111d58ee9
SHA512 382a38cce8e74035d9eb23353bf323220e231b24676e58df5ad2ac208a7cdc7c285390a0edd04ac3e499b8fae24c5537a4f805dab0284dbe9b888d530cd47eb4
SSDEEP 24576:k8kNvNnaFeYhJNtmZBmuyxknw4FYnshx8OfVe247:k8MwBtOmhx4x8EVep
TLSH
T19E55AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 9299060c71035a192381522a52618a8f42badcd424ce419c2cf594466dd646e6
MD5 fbb59c9eec1464dd795d6e4eff1fb1b3
SHA1 2ded2ee9dbfbaeaaf9c3a8c617b5ff46625b7083
SHA512 60fe652b1b56369969835a6ccb26be715d9c0eba10600a17516d3c5cebd1f27cd8ee968ac1f29a4c9d0488d7253a63f13d18cdc91370e140eda8a79225d3950d
SSDEEP 24576:YD3FHshBIYQgAryxknw4FYnshx8OfVe247:YDVHeBIAAOx4x8EVep
TLSH
T1E685E17DE79C04E4E57AC1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-311-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/248-66-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/248-74-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/248-68-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/708-379-0x000001FC3B470000-0x000001FC3BAF0000-memory.dmp

Download

memory/708-401-0x000001FC3B470000-0x000001FC3BAF0000-memory.dmp

Download

memory/1456-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1456-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1456-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1456-53-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1456-52-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1456-38-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1520-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1520-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1520-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1520-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1520-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3212-7-0x0000000002480000-0x00000000024E6000-memory.dmp

Download

memory/3212-6-0x0000000002480000-0x00000000024E6000-memory.dmp

Download

memory/3212-1-0x0000000002480000-0x00000000024E6000-memory.dmp

Download

memory/3212-0-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/3212-110-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/3212-314-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/3468-365-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3468-104-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3468-98-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3468-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3468-112-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4168-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4168-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4168-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4168-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4508-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4508-133-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4508-138-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4508-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4508-127-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4584-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4584-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4584-125-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4584-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4616-56-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4616-62-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4616-309-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4616-55-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4852-383-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4852-93-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4852-369-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4852-123-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4852-87-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4852-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4880-119-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4880-367-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4880-113-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4880-122-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/5012-111-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5012-78-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/5012-83-0x0000000000990000-0x00000000009F6000-memory.dmp

Download