9404e068a1e249a0acd9b2f1994291000802942073ae1d0da60e46945c3884ff

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 14:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
Size 1.3MB
Sample261102-r65jqsvsby
SHA256 9404e068a1e249a0acd9b2f1994291000802942073ae1d0da60e46945c3884ff
MD5 9178ea05e93516f35ecbf1c1f3681bcf
SHA1 b38f6daaf5d66ccf336659c3edf4119c50611a08
SHA512 e8c7dbc8078813a37d7ff9c272c1c851aec20e1e0df4ddaf6c2bcdc76551fda49c053d8cd959f9e15fec6111e1016f8aff5abb772475bb6d1979106d401217b9
SSDEEP 12288:S3XNwe+oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9e+osqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A8552316BAC4C0F7D85101B64146D62A5D7B7D3B2F7000C77BA22E9DAEB11E48B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5020	elevation_service.exe
5840	elevation_service.exe
2820	maintenanceservice.exe
3464	OSE.EXE
1148	PerceptionSimulationService.exe
3444	perfhost.exe
3480	ReFsDedupSvc.exe
4812	SensorDataService.exe
1096	ssh-agent.exe
3372	AgentService.exe
6020	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4abf66df31e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d8c5d66d96add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088aff5a4d96add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037fafea4d96add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004247d265d96add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5840	elevation_service.exe
5840	elevation_service.exe
5840	elevation_service.exe
5840	elevation_service.exe
5840	elevation_service.exe
5840	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
836	Process not Found
836	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2348	2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
Token: SeBackupPrivilege	3480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3480	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3372	AgentService.exe
Token: 33	6020	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6020	SearchIndexer.exe
Token: SeDebugPrivilege	5020	elevation_service.exe
Token: SeDebugPrivilege	5840	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 2980	6020	SearchIndexer.exe	101
PID 6020 wrote to memory of 5464	6020	SearchIndexer.exe	102
PID 6020 wrote to memory of 1504	6020	SearchIndexer.exe	103
PID 6020 wrote to memory of 2396	6020	SearchIndexer.exe	104
PID 6020 wrote to memory of 2592	6020	SearchIndexer.exe	106
PID 6020 wrote to memory of 3788	6020	SearchIndexer.exe	107
PID 6020 wrote to memory of 3748	6020	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_9178ea05e93516f35ecbf1c1f3681bcf_elex_manuscrypt_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5840

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2820

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3464

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1148

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3444

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4812

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1096

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3372

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2980
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2412 2508 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1504
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2396
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2592
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3788
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2412 2508 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 99faab10218095878b6565697d332b50988d426e09ab522b8b58e0956f1022c6
MD5 b4ce40fac84ea4f20dc2f8b8e3ec676f
SHA1 0f655cc50be08fd1864bb5d6d83ba2ddc0c023cf
SHA512 4f6bc42e39f86a674acf0fa546ab69ef04202dbb34236f9d93c731a3e3001934dee6c6247c611b829251078f7809d1fee2cbe0f55b77b11a902a9b8707985569
SSDEEP 49152:7b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnWDmg27RnWGj:J3q6sjBJD527BWG
TLSH
T1BCD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 138158fc29e597c3f23b38cc2d1f05ec73b167e810ba4168480d1a0a1b783b12
MD5 47f201e214d51e1bc13b2ac35c75ace5
SHA1 cd2678f95de34ed342c429b840cc7a92c2b2f9a2
SHA512 337a0f7e7e8bc27a8690a7fe9c3fc27850e9890f2915c12ff6134fdb9a463b3943048ef482a2ac7e59974cd3bd7cccfd9f4472c7f8fed435d8a55488b4734160
SSDEEP 24576:XXYfDtczAJsqjnhMgeiCl7G0nehbGZpbD:CtcoDmg27RnWGj
TLSH
T186650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 355abdc34771025cbe5e3ff0f5821d8b26246a4e642a02b6a38a0d3e6fa739c4
MD5 6dc906a4294d0c78c32dcb69c27b9989
SHA1 87f0ea40127c43e19f1f00256e8d372e04d59200
SHA512 18e15cc0495a70c89de7f0444279c4e8b7398f89b433424d647bf0e5bca0a94235925fa1a82ac4a546d2a081dd5d51bbbd3539112f26262f2b49b75a10be3565
SSDEEP 24576:k0Le5ji0hmxxrM6sqjnhMgeiCl7G0nehbGZpbD:kPji0AjrDmg27RnWGj
TLSH
T129859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 72bcda8225b86e202a74ec6d2ec648ee18dea556d3b4c7f22683267c6d8ba4c0
MD5 5668b35ece0e90be3cc1fcbdfc06fc8f
SHA1 26a8eaa4b5ec5ebad0b0772d73531bcb04cc08db
SHA512 c29fb4e37b742e3e3bc5a3aad424c2cbc107bbc09c2f052443a3c26f36e6c7bf15ba1cd81583a8caa3d0929aa0dfa388da84b28cb2300ad6bff90c0dba63c70b
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWn6q8wyuMsqjnhMgeiCl7G0nehbGZpbD:T/ezSC6vUzPveHjyPDmg27RnWGj
TLSH
T15E755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1bee4a0366c9f42c8d94760822aee20137f5687115662b0a5cda86183b8b55c3
MD5 4772996bbb335f164d32c28ea7a32036
SHA1 bad496ec16db41c704a516712c1d7bd602c45d1f
SHA512 12a12a65bbf29161b043c83ec833d9b628db560a04a96c9574fc5a31ca38d20b014b7e0c3a43c2d096ad21a9750d2070bb3e7716cbb8cdf396240a920e18f7bc
SSDEEP 24576:nVbqPb88hv/l+YlsqjnhMgeiCl7G0nehbGZpbD:nVO88hXl+gDmg27RnWGj
TLSH
T111559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5afc8271fd7fb5fe674c52b97231f550b28aa605afc34297b175c53343b51596
MD5 2cde73ea12cfd9bd55668bb5d8c281e4
SHA1 dd896805e32327ada8ed624015d452c6e92da2e9
SHA512 3e39d166692439e9e9f2a81cca258b8975fdf745c5d28791582cdda1e610d11ea502d890cc226f17e83a8a1223e5b923e843c24036817691449381ca442f18a8
SSDEEP 12288:hL2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hL2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA4523BF964C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f2ef4fe4c3c08e39b3172e62626709a3b4aa422f2831629563136efaf5fa8c34
MD5 311721c3e8d226ead38576b840cddcf6
SHA1 7eb8e532a452fe03198f3a3f693c181fd359089d
SHA512 822df95bc4bab4bdef1e556f82cbe13fc29f33f93c7b502c09373eaccf99175e7239bbdf81bb00261d3e45c8ba32b94a4db1d09757c05fe37ed9d5cec3e2e465
SSDEEP 12288:KeBNUbTVO86UNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:KJIUNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C365CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 947d08fb81f4cff60ca68c13734c37772d8f841489e36d3d8a74f36a9efc8571
MD5 02fd49557abd98dc55bbe64f0677f1b1
SHA1 d3be92bd97ebddcc660f837ac2403b2e1ad8f25c
SHA512 8fb23b596979531567af9cc19446a751c5896b25e6facadba65af305f6e5f5656f98efecd4302a99290df0c81a6d31439c89c72837d27fbba3a731392f2931d9
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THk:eQvGAdlCEL8c/DRNw5CID527BWG
TLSH
T19B266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c22971605740c3e75a9c73115a67522699a42244d53eae339eb0ed98fc488295
MD5 856b8d66161c543a55d1c12c12349a54
SHA1 255f0d00e195595662e9c507179403f45b3fac71
SHA512 c7b270f0a6f90113e1c5947aeeedd9694c6550f4bb002f5e55647d392035d5e52b14ee8ee3a3564fb6cedcb273609929076cddceebb98ca30367e07b230e3684
SSDEEP 12288:6AwSfxL/2Dc3RDLLmt0LDQewsAjnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:P0ewsAjnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AD75E031FA74E036C77B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0c3172bf20d9a51a17b7009ad24674e02da3a9aa1802f72ac7406404247b7ef7
MD5 1c610bd188178e8447bc57100b6848d9
SHA1 cd3a545f586a451739dfb04f6ffa63600ccc0e88
SHA512 090733dba6864b9b54045193ab77584b533b9908f0c0acafa9edc5039c05fee0bd8d556c43876065b7a4ba519310f468e5d6ed2d4fdef33b1ff152cbab7ac72c
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHjVQBWG:YUEtQevvqc2W1cpV2tI32aB
TLSH
T16F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6035edfd33be85f850e24ebeb431042855f5f96d1d20c83dbec8f528e378f7d0
MD5 f07240a7c7d606f8ed0ddb89d3065dde
SHA1 2efb893f4eb2c31c1ad66bf5a866605c14b38127
SHA512 2d0872c097eff15359d7e5df00969fad8079e358d4045c8c26cecc01f72ee1bc03ef2b4795c2e582c3bf1825b93dfc6585a840798d961ebbab8313cc892484d9
SSDEEP 49152:3CbRquA/m2yL5zTfFiV+XenmE3/zbDmg27RnWGj:goquVjnm8D527BWG
TLSH
T183D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c94f27ccd76c934fbc59d9d78c2243ddbf36cecf3ec5ee7004c815b4c0cd7306
MD5 3e33b0a55effcaa5efe2bd0f831f3994
SHA1 23588b5184480affb6dd26a3e8eddb3b5f158714
SHA512 0794108e96b60fd1f535225f8c0759c571d707989e892860687efcf2c03ccb78da39c1305a73717364eb4eddabb87199d36c62ffe5044e9b6c0a8350fe043141
SSDEEP 24576:NAhGL3IFoiwtA5l7S53gsqjnhMgeiCl7G0nehbGZpbD:NAMUFoiq5MDmg27RnWGj
TLSH
T1CD359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 354cc8ab9a60333cd4a95cde72cae2c21b15d7cfb8e79584b7491d980d19f473
MD5 28c45556c2e41905bbad3396d05e138c
SHA1 94d4d984c331e8f29b4617e21a0badc7e56d476a
SHA512 236569f5593a1e051647479fcdd74024d7b537747f965e9d8100b8d9c15c77aff6e91e5e14a4e6d1584dd8999b2233a8bb1abb9a1a35390632cdd844c2e4573b
SSDEEP 12288:jmw5HEjsChNVBFgl0WDm+CsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:iwu4OW7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A265F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 46b18f31ea361917712161acb4b233033be71431d310fe1d946842be842ee9d4
MD5 a222a494235b38ca294b108a0b8824f9
SHA1 785d9123b1362c1eff2bbb9e9fb126e1e848da9a
SHA512 9f72499204cbeb84931ce0bcd5481ae203b4a4d4d0d6edcd65c559403b5bcd74b0417bdfff8f4310536105db9ccc6ad5b30abfa25831afb8c37013be37c9f886
SSDEEP 12288:BeZ1Iy3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UZuisqjnhMgeiCl7G0nehbGZpbD
TLSH
T17D5512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3a8aac6bc860656ecb5fc55984b04b54d1a6037beaa7ae96f498c755afd893b7
MD5 9da0de2c1d25b6808ed1da1c13284e28
SHA1 e5c783a3de5b399a71b1d52440b36196b84b31aa
SHA512 99a71c308a73faf8e09be3a2bb6f0021b0747ce44ee7c1d6c378bc1317a74fe8b1161c37258e06188c0fb8b2c922da3dd5d307a34f12ca14fc5dad90ceb9a410
SSDEEP 98304:NQRQyi36YOcPbLvw2gAf+PN3FD527BWG:kQyiKa/X+PN1VQBWG
TLSH
T1F9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 375c5b96f11af53e1d3b7f57c571e817035ec0b79ae87771d483ce921c0332ed
MD5 028f4285565496e6a77bba032e785e8d
SHA1 95f96b85303d958b5e7124f96875354cfac267ea
SHA512 86e1ed24a081163b0d6d03b156318c9a38ae4015b8c1b83496e11517aba27f542cad348257c39668c3761f8c8d67e54e7ed2e4b08cbe9c072bd1c44c77682bf0
SSDEEP 98304:OQRQyi36YOcPbLvw2gAf+PN3FD527BWG:VQyiKa/X+PN1VQBWG
TLSH
T189667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c736001782b9fb77c88bdd627199be2cfd9dcdd7081bc555c5617b816dc7283e
MD5 f51a7bb2dbd8bbeb16e5565da2c187b2
SHA1 993b787e178079a385b86999f322d128598f8023
SHA512 d6b2be7dbc597b12b0ec9e38e43e454e7e640ce4c446e8aba7ef175490425ff340c7cc739ec4e1e530326e9a1194e41f79ddb2396a81ec47d95cc22fcf02c27f
SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0SsqjnhMgeiCl7Ge:G68Qg55nhceWu7PNU3/rDmg27RnWGj
TLSH
T171B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 160f5a2a82c53b3712ff15c80aadf6eaaa24d7f6eed15daa28e1b254544f3064
MD5 79773bd9f53526691b802945fa898fee
SHA1 8c6bd11e697093c4af435c8e8368e5e51c4c4aa5
SHA512 f526156a56b16addb583ef0e1b491a4b917ac8c605bb175839ed7339a7483ff69209415e568eff5fcfedd3005f223997166ca005fc8c030571ef2eeacedfb49b
SSDEEP 98304:4y5112gYy5azzVvt69nLKnhZ6D527BWG:RLIHEWhEVQBWG
TLSH
T195167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 38a7cfb73a8af5b72587e905a8f4fb5687791fa5965b434eb9ef935e50aa1428
MD5 fcf0d2a876d5d33cf399fe63e6c446f8
SHA1 c2ab4bb7e443c0aa9d743761d5ca9a7e6e90404b
SHA512 14e732c40c3b3069b3761475c6ca80aaf56e59c559015ee75664e00256181ebb557f5978d195e96475061f4dd06758f6ac0f64b70899b70ec7c3ff3370550108
SSDEEP 49152:8B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl9Dmg27RnWGj:Wu6Jmdxd2d9D527BWG
TLSH
T1ECD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7d4b7ea4670bd0d2213d8423a0996bb1f0dc493fe4abd689e70f6b8ef1fbc889
MD5 5a693fb11d88340fbf495e77523a4591
SHA1 2fd80f4cfb3c6832938877510405843800b0df7d
SHA512 361cd895edc2cd55b7da84c05768c729408c292ab5825ec0fafe1c2c335186cc7311c0c44451d629e90fe681c9a71d92b719ce5d805755db378fb62063d1251c
SSDEEP 49152:H1hpsNoJpF1A63U44CwH7R4xRDmg27RnWGj:HmifPWR8D527BWG
TLSH
T1B2B5BE13F2D800E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cd6c149413ee5c7abb313ef9b91d46d52356b64b792bd08a226f26e1be254e4c
MD5 0322be1df2238b7940b2b2556d8d0303
SHA1 66e97ac49262030ae6af4314accc2c3e11b8c9f3
SHA512 88d023d8c29a1f8acda6011028bb0dda154151582b3e5949d6d4a9d283bec4982770d4a7fbd4b43b10a861e5edecbdd3beef78d8e95862aeabd8503661dddfb1
SSDEEP 49152:KSuZQIY0Be2KcRVtOnks6NMHqmDmg27RnWGj:U5dKii61mD527BWG
TLSH
T18DC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 32dd11bbe79ba572c8450f694b9f94901b03cf059d4815ed4fdcb2e36748134d
MD5 fec9936d9fd9be3127e1f05cfc63e06c
SHA1 f0d2f0cf40e010e236df42e283cbd7cd9ab63f1c
SHA512 66a497bbfcfe5ba088171e478bb0b67b98447d7c5dae8154de485661196315da8ddeba393c4d1aba29cb0ec530a4c862da16df8662bc30c21891d08f2e27697c
SSDEEP 49152:xhtSn8EApI0fig3giDn0AP5wNDmg27RnWGj:gX2imphwD527BWG
TLSH
T16695BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a7a270f68ed64caa7ace750554a884d5c18853e1597c11a1716f6585279fd5f2
MD5 de35f00660bf0e8f8216ff17e574e23d
SHA1 776ff0d3e159327fa2c1c0cc7ae9c318e2186133
SHA512 79227b4fc30aba344e3713ffac52377503d9cd9cfa9a1fb6ac9bc90cc72426caf91683d13ea0d41011d31c3fb74f7ebd445179c545d0234460dee97b4c322b8c
SSDEEP 12288:R+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:R+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1724523BE965C41CAE52648F5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fc84448ec943e891a713da60a29e4399dc231aa5da4faee47b1038a5a258080e
MD5 c06790121793555fa7b8bb7cbba0993d
SHA1 0bc5209ad920701ffea6f60bcfc72b66374ff065
SHA512 126e4fe3931c74c0202fbf8dd29022e3c9a86b5381cfe5beb93230b0fafaadb375d600b959c64b9286a899216bf8eff81bf1794c771816af147c0f515a8df17a
SSDEEP 12288:yTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1174523BE965C41CAE52648B5C3E5F10DAC073E5BE92004937AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2d335b09ce1058b934494f6f3fe04105fdc00df34b8ce78a561bd10caf4ae256
MD5 ada1ab16015a6ac1ef930f7647e1e640
SHA1 85544009d0db6b6bcf13579b0b5f799e02871210
SHA512 f86c960a508d90f90177e787c8fc89f58f0180605fc932f811cce11c3d192b70879c60af70436762b15f62a8ea7bec21b28810d2398de3af93ed375e3776a874
SSDEEP 12288:sVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1844523BE965C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 65d3f760969ee2175dc232da2dbc5aa7ef055c47deb7750304e80b35e255732c
MD5 7aaf40101303228cfcc210e7851e3ea2
SHA1 7b0926ad870265d0994e3412950dea6caaecebd5
SHA512 48da475d5c5d4b8c1fb0929e4396a2306c51216fc0bc5263f49646f6df4378a4625dd9e9885d02e73bcd50ed2417c0a66ed2cb8e33617319b06036a06e82708b
SSDEEP 12288:wVAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E945236B635C01C6D83285B5C2F5E11DE8237D56EB3005DB6B532CEEAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e60ea78a4e7aa8951287ae3b75ef2daede3ef3ab5f03495655ef9423161950dc
MD5 67f65e99f1f538b50ed6f030c6a7d563
SHA1 b04a56d81ee76fc61fcc09c8a778ea5d3083f584
SHA512 e0b645796211cf6a87ff9ce2548d2bd223e996ebcf80926da53e7a4855c57b7c0c7d8722dedb9a44864ef4ec37fc8f15fcb5e815f4c91d487539348762c5fdee
SSDEEP 12288:Y4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Y4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D4523BE965C41CBE52648B5C3E5F14DAC073E5BE92004937A9B7CBDFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b686052dc30302159b76d92548d34a66cc02c0449dbeae8b3d7ffd45dce1700f
MD5 93c9769745a4caf2535f40bad99c190f
SHA1 a41ee2b442cf0d746f82bc16d05a735b26592986
SHA512 bd7515c14dae21c79d57a8f7516a94646420c2ddb9ff91734f143a634925ae935506ae309078fad0607a655f70da055cd96a69c74e66478202ccf68c8595c457
SSDEEP 12288:yPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1574523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 495132d7bbeefe02beb426e766985b046aa06b4142876ed02494188539859d34
MD5 2b035d0aa7be377a652012c372cf3f8c
SHA1 3f830a08a404ec1d7b94821cac3c2bceaaee8ee4
SHA512 f3ef7e7ab28cb34eb289e977c397d70ec01136d4e5fba0d13462713b13fde2e2d8cff4b0f97e9eee3cef16ed5398014f8886ba8c3623a61b7daad03d91d4ae8a
SSDEEP 12288:yrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE9:yrsqjnhMgeiCl7G0nehbGZpbDb
TLSH
T1374523BE965C41CAE62604B5C3E5F11DAC073E5BE92004937A67BCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 c73aa6912c315e8d403c75209a6f6d969037719740cdd372f2548512d44a5e9c
MD5 a87e237aa344bf27376abedf68e9e2b3
SHA1 7c86e722dff9f8e9040303a749e48133e93e9f90
SHA512 c557ff384c1d468004dd7694c51a902181b61f8504b46e68943654cdce543b43846e29250ef734675d22c52c73dc3323fdd2b710fbed9fcb9460fca2bfab66c5
SSDEEP 24576:GZMRzFVSOzsqjnhMgeiCl7G0nehbGZpbD:GZMRzfDDmg27RnWGj
TLSH
T1676501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ed53ff078e47758f024dd4450df58f39cb5982027fd041146de847a0a8b3e18a
MD5 3505a9dfee45e6bf4ca26e9e23f8288d
SHA1 1286d4fd136a82e501692d107ba6cb9a922226eb
SHA512 0a3b5cc4a7ccd390a2551d9e4b62dcec398fbc665484ebf35174bd30c6b1cc343759526679226a071125a544f45b9e536c6d793d7365e483933144ccf18cc1df
SSDEEP 12288:iyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iysqjnhMgeiCl7G0nehbGZpbD
TLSH
T17A4523BF965C41CAE62608B5C3E5F14DAC073E5BE9200493BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c7d467fc51085af291dd7e9a203b789bf9f174e53946cdac619c731323de3d5f
MD5 e0103f452e11e4a562033cedc0e1d111
SHA1 7f33fc9151a03f00e1f1cdf7577508f38ada893f
SHA512 629659b4adb8349c1916605887a4572f7da9f235c39933d39f0ec90baf156879439557389fe693b1e196062be3dfe403b3267ed5f8481d9245d9893f61c5faa6
SSDEEP 12288:WGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A84523BF965C41CAE62604B5C3E5F14DAC073E5BE92004937A6B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 86eafd0fe28d36d8ae545ccabbe666a9077c4118c38a3a1ecaef285bd74d4e45
MD5 28349139e3f86cef0e3a843257fc464d
SHA1 ed41557569011039b49dea8c33b6bb2aa5794cad
SHA512 5116cd0a76cef71c3a3716b474304b55cd2c4e30145d1b9062b6868e4e6121461e59de0384715f710e197c21a3f904ff83ca2141f247c2f8b6acbc1294bc3ea2
SSDEEP 12288:iyPz5L83Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/zy3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A55125B73A530F9D1378178C5A29A06F7327C3647204AAF17A116BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 60a3d8ff9d17981ae8aa955d5a1a18e26e2ee9f2fd2efaaaf2f06d5e53232ab5
MD5 5aa6b61802039d3954159406021fd128
SHA1 a24913703cdf3c96086bf2bf248d972a3ea6d78d
SHA512 9d2adb482878e1aa87ec301416b855a2119aa9493e2476dbce8976268ae2b01e958bead670bb6c1e69516edaeee52440ba5ddd5a59e97ed31fe6660be26e10b8
SSDEEP 12288:CyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1174523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7fc120fbe139712c2eb6252d914635505cefb53e9549d65db0f8568f79d5894f
MD5 c020a706bee11c1cdc36cec8c6c39448
SHA1 8a48150a8a8d3f7e97ec1396cc1a8ab8cfd2df08
SHA512 4059cb996bb5c2e03628b6eeec7a01f0fcdd3d652675c3af1b084f57ba3dada244a1aab42f512f0bd7fde555bfcacb8f6a39dde9ecd2789f797a8c0239603741
SSDEEP 12288:myXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A44523BFA65C51CAE62608B5C3E5F14DAC073E5BE92004837A5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7be500615dce5a2671b7664cc60988b31e8e6034fbb8e13838d217d3fbdbb170
MD5 4a78937d084eac34b613c7965e02f763
SHA1 cf0a6ff095d3ba5528719ce2f5145d81975475a7
SHA512 1aeddce36616110b75fb6b968cb1816d8c57d7bade7dc358b7600b219100db1b1b0a5bf2e5fb0d3230ffd85f87b50478926b0b5da0eac66e51f8e64da21295a0
SSDEEP 12288:lyPz5L83Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:szy3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A755125B73A530F9D1378178C5A29A06F7327C3647204AAF17A116BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 9a216eeb0ae3f6be85da3b0330cdf87edc928a0f5ae94cd8191287e3d2905c94
MD5 e09563b1d184cc37b365141d9844c9c5
SHA1 873869b0d86fb6c36748fdb0623e3e91bb658e1b
SHA512 bafd28866095c2153f6d68e3f649d241b36912d6ba2361376aedfc99ee7e4294e9b60e654ae6e9adc01963a2f344ad865ebf0e461bd75823bd3bba027939fa0f
SSDEEP 24576:hTDaLl3z0zDFsqjnhMgeiCl7G0nehbGZpbD:hTuLlj4Dmg27RnWGj
TLSH
T12B6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 b9b61e87b5c8a4c21121609106e8ea79404b91fa10726aa48f1b57a3838f09b5
MD5 b2adb60474edb7170f87a7b127e73263
SHA1 f0f42dab9cc4533d895dac4f9edf293133a0c7db
SHA512 545dfddbfb44470b9e78d22c3f52dd9d5df0207564336327fbdf0ff41752f0915ffa597a8d470265514f4b5f537a84c8afae3cd8308535f15c6ff5e5729ad0c4
SSDEEP 24576:q3vd9CHKy7GZRsqjnhMgeiCl7G0nehbGZpbD:Mvd9CHKyaDDmg27RnWGj
TLSH
T14475CF90F3E810E8F0B79A35C9769511D9767C5A5B30DE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0500acc7119de0e79d68294ba960e68747edd0211eadeba8188eeb764b3aa1e6
MD5 bfa8771160e6bd77a03047421f47517d
SHA1 d6ac5d621cc4f9c288457e2374919dde2d05bea3
SHA512 d47dc0c1f3de29759b5a1b8055f15182f63f5b690e5ffc06d4499f02e1fc47202fc7f6a453f29de52e9e00643ce3c76083088879b5d3fbdb6839fb8ff5c601cd
SSDEEP 12288:11Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:11sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1644523BF965C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6dcfcf33a0f059303a06a36df936b5e7784a4cd0df6efbade51bc2c1863ca564
MD5 73641638095dff5c998d9d58d4000027
SHA1 3f29b4aa62b191f64a4a21e40393af9ea4f6fd7d
SHA512 548501a2437a397ec10a92120c9ca9e1776465c023997c299c7109cb4344ad599d48e861d3218b6672c1fc1ec5811e3c6cf5b4da47144a3e4b3f666a83bde172
SSDEEP 12288:9XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9XsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A34523BE965C41CAE52644F5C3E9E10DAC073E5BE92004937BA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e6a5162b395f17520c3bf4152e82d680c238b198b4f8409eb6dea15733bbf441
MD5 fd266f580eabcb93f026f72a634f0609
SHA1 41beeb9f276a25ad01f975fa1cab4cccd6610035
SHA512 6d369eec54180f0f8c72f8d098081d4fd2f4272288e8fc5a30425ea045e6d1d788ef27fe664dbd96dc692ed7640750966735d661d3445be27b82f2a6a3998dbc
SSDEEP 12288:ZkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZksqjnhMgeiCl7G0nehbGZpbD
TLSH
T17D4523BE965C41CAE62608B5C3E5F15DAC073E5BE9200483BA977CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ba2288c5ff9b2baed0a52d29efa8ff415b3b91e88cd44a5597d1ea0f3a916338
MD5 db8a862c3671c1377fd957a73b84a203
SHA1 df75ed5e1a9114aa0dbb5494af2ae1a3e4ea98c2
SHA512 e6cf5dcc49639217a0839c9b5827d96c27e14a3cca66b913a7ee7a78bed496c53d5fb3cd513ecf46086d9fbaef9b76763b5c5666ce3fa278352b44b3c3546728
SSDEEP 12288:QyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1894523BF965C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1927f051aff25a148c3f8cf48b1fd2da22652d51f8828acf31089f493b9814d6
MD5 a61d6f4be8d6df0d296ee2caf08dc33a
SHA1 87fe91afde6dea36dce5fcd56a4a8f171a14898e
SHA512 fe0964a1bbf8345781c2034eea69e181639ebd800f4cd253cfe75bbbb4ee22be675d4361a068686d3aa6f9bf2b4b01deb8df42a98f250a67e80ea1f2b3dda112
SSDEEP 12288:L1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:L1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A54523BF965C41CAE52608B5C3E5F14DAC073E5BE92004937AAB7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0189310d57bee4ed517cce969fd89d40d37741561533368cae85e1a383080743
MD5 9c1327f89989bdff1b84de6a64aacd94
SHA1 660164d948b6731509c133292aedbfe209eb0f79
SHA512 21ab99c45663cb472eb4bfef873c7f7b3ae4811faa3eca289739e1dcb1b0d6f4e450ad301d4a276dc8842ab4c807d056cad50c73cfa0393efac526dc956dfd87
SSDEEP 12288:ZqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A64523BE965C41CAE62648F5C3E5F11DAC073E5BE92004837A677CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 52db851fd3dca85f5f2df1e5154763fb200362377488edcc1ce89255cdcfa3c0
MD5 656d21c8ac9723b2f8b483aaccf23190
SHA1 e20e3d535ce60dc10d5af634ce12702bac5e9bcb
SHA512 30bec40a4d853b879d6df8756de82cb40b2c2eeb04b140446f3c0c8098197a405cf314f232b75b13a229100a437c61aa503b95db9484a9fab42f273bd5446e9e
SSDEEP 12288:Z4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Z4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F4523BF965C41CAE52608B5C3E5F14DAC073E5BE92004937A977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 00276f78fbb07f2172f3020bc906e3147a65dffcae505018960ab6fa28c97d95
MD5 3d13dd09266fa588631ba34203bf2326
SHA1 2b5f3a808e00a6990e45511cf4fcee6db35d117b
SHA512 3b5c69b98a3df9f1546366a3099057fbe7a6c11c6830fb3e1e1f826e76093963c7cdf9854927953d112d4236d34247eaf0dcfa04d98f4a28422b8c9633105588
SSDEEP 12288:gdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1254523BE965C41CAE62648F5C3E5E11DAC073E5BE9200483BA577CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 0cb0720cbccc7fde67f36fa539f4d2e9714cebf3def371994826191908b0bc0e
MD5 6a7ffcc11a42e3ec7ae354c0d88e9cdf
SHA1 e51b4c1fb1fc5f0d46bdb3b6aba3a9fb0bd0967a
SHA512 86455473abc7b6afe7cc7d3b7985a100527cd11879c92230e7042e02752a3daf030ae882738fdae8655f85229612fc4cb32c80c18564e7e0be81ce1db7bcb779
SSDEEP 12288:F4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:F4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17A4523BEA65C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 5117e981c5178ecd70f4cafac34f45f247fb65d5916b473b1fac365dcbfac8a2
MD5 4d2e72413f473e3bcb59f0a7bf2da92b
SHA1 89856d637cd31af8649c2383a12cc7910d7d1035
SHA512 e035f6edf07cf2fe8d254cbae6ee8173a7ee346a10b1c6e7c4f455b5cfd5b065dafbffbfc2b3760b5365e452b5369755eaf39ca60b313378c865eddcd2513a98
SSDEEP 24576:KfwvUk9RX6wkyAIWsqjnhMgeiCl7G0nehbGZpbD:aMnYIaDmg27RnWGj
TLSH
T1E485D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cca4db5e2cd1ca714dc3d96d2b9e4f6c313c041d0fa850a0a7f9b7f4e5dde10c
MD5 c86d1f3c46d327a354dd904ef5af798a
SHA1 e239602940380c3ff305fbd4080a777ac1d0c5a8
SHA512 4284fda94fcb742bc4b2ceccc1f6d70c2c5ae41c8a68b1de1b94f55eb6f235d03751c5377b74f804bb1b66be2005a491a7288cdb6543ab90fa6f085f2efc857e
SSDEEP 49152:lYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0tDmg27RnWGj:IySzPlD527BWG
TLSH
T1CA066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2bf250704dcfbdefe87c5a5916a94552ef9bf7cea9eebec038ad340fcb31268e
MD5 acad09c1583b511348fe9f370d3853bc
SHA1 57c4dddb49b0b12999b29cf76527665eb80f22c7
SHA512 7777775120aed9a8e7a29e368edf4933d74f59692c17abe79a4b1c80d9647b4cea833d24eba48dd723a34ed9b49fc77e6926fdae95f20a71dfafb19ad262e327
SSDEEP 24576:I47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYDsqjnhMgeiCl7G0nehbGZpbD:I47JUQjTirIhCnDHUPfF/9Dmg27RnWGj
TLSH
T13A65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 af33009d2b7d9780ae5e85ca6e6c89f31f21c7ea2d544bcc75dd53da5536191c
MD5 de488c7b0e815e753134241e43fab50b
SHA1 6c169a3c40f0463dd33cf1f69fc1ab0a026f3475
SHA512 21818fef9208b149c2c544c9c90a649f1b62b5ce43615ac9cd8ba2d3bf2f68fac95b68705d29a34cf357563e2a92ade040d039fe11f68e498fb7e52d60dbed78
SSDEEP 12288:QbsfiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3isqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C855015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 61f450538f10fb1a31345184aed649c22303c6204a9cbe6fadfea352b0e6f8a5
MD5 cda91dd2e602cdbc66e39cf4f3e6e7e3
SHA1 9c2374228ac73eb7c6e7b92f8d92b91c76eb91e2
SHA512 07dc484eac092d78850985bf5fb4e01eab88c90fc0e7e7d2d1fc7f3b7a7f35a920c3c497edf8264b7fbbe48fde1c1d9593220a2bd347614b64de4ea76d0a49d1
SSDEEP 24576:Ml4iUP/dhbm172Obq4I44t+RMMh+bZ+cvA:riUXdhbm172Obq4INt+RMO+bZ+
TLSH
T1E0351910766ACB4FC6A940325E32D1CCAB707D45EE44AF0373C9873F9576659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 c86e06959f6dfdb10e3c59291054880cda716b4b8851f78df611009065061067
MD5 f54a7c652b636444ec2a40be17fd7ab8
SHA1 ecd47aedfe9a18036282de94b949702ec7dfdaaa
SHA512 53abe6125f13f338bb8b4924d2b639a9b71f66bbd8a13c0b6fa6f0e76dd1ee6be857d590396b0fe3215c6e6a5d11778f870442d921d1b9c1a275887ee5e0ae69
SSDEEP 12288:AxVyU3ECzC5jHif/bJn6Empm172Obq4HzWC4Ca5C4CrpCd3C7C/Ko3Hoka2n/T:AxVym/bJnGm172Obq4ToesSeHoka2n/T
TLSH
T10765F9409537E78FD1F76032072A5B8C67A4EC0BB7496F22B3C9453AD86A715A0B93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0ed56b4fadb5fda530e58dba09c5a18b20c2ef5523378d2fd974bbdc62638673
MD5 bb052636ae646b877a901d2a7e6d42e3
SHA1 fca40d02bf10cd9f13d515ff30e408170a8459b8
SHA512 c69c2b6da608b6688450799fc50b9b4b7ee4d1a9401e156835b62e8bee2f5dddd3aa3a7545654bdef0b912f5696a69f08af2cadec5b449795ac5bbb983ff4090
SSDEEP 12288:707aXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wasqjnhMgeiCl7G0nehbGZpbD
TLSH
T16545237B934C518AF93605B482EAE12D681B7E669F1044C3BA1778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3c89409e6bb0530ec49fbf3ca320868fea055af0151571494a04bd63fe3878c5
MD5 880f62d90b294352e9f638f1efeedaf0
SHA1 03b0a9a759312a59170f97e92a870bfded14473d
SHA512 1a3c529f9d30424eda4445c867b90e593cd683559a93b7b75f3ff7ee06262c790cf4cd58770c32aef25949be7bea279157fe5e00a6ba24813ee97e0cfaabbceb
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bYMsqjnhMgeiCl7G0nehbGZpbD:igb4mBIBhGFHDmg27RnWGj
TLSH
T192659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 3ceb138b5c862adfe71d68cb6b7bad1d4caf4596dfda93315a8f17b2d0cedb1c
MD5 02a9826bda077110086cd0e9efd0f535
SHA1 f3f72fecda8a618dd1e178ffe3e4b09614683f86
SHA512 d013627afd6efa5ec839fe04b0f2550af321ace2daa37304c8c1dc7ecffb56e78757bf69fbc78e0a694c8a01ab2771c34352ace586af1191f779df9b45c0034b
SSDEEP 24576:lG88u8FpJqH1bzria7/mzsqjnhMgeiCl7G0nehbGZpbD:I7ZFPqVea7/gDmg27RnWGj
TLSH
T1D185016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e2e2e1d7f34db455a50af81804bef40f6e832eb0121b1047e1036f2cbb123165
MD5 382d5fd43468469e7d46a21fdc271556
SHA1 42dbbf69bfdbf3e3a8b5a9f17761655f6c9ee9a3
SHA512 04460e7f8769665e9993da0f57c65dc73a341ce7b593ffe677f5051c2d57360d854e14f51aca87a70891993018f4fa16e1a5c8bbe208ac18591a43da2c195146
SSDEEP 12288:GHvUrBFrEjwaQfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:GPUr+NQfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16465F12F22AC18E5E676A17DC682C70DF6727862071192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 51913da260e9b37c0ffc5b4596650ce7d1a2f9c125afc380293054d6c88a8457
MD5 e4e70677de06d7438b00173c04988586
SHA1 6bab604acbffc512970ceca4e016138928ea15c5
SHA512 b604191492c7787198081ab1a732ca591a5392b6bac5dbc3f17bd9580fc3fadf5d167122b4b20d8012a92282a93b14b902de503d731db3b85f5cef0f9e4358a3
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzDmg27RnWGj:nG05lO43biD527BWG
TLSH
T1E9D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e4374558cca693857b1aa9685fe2f2c7e3e12005624433422beffe87fd782fbf
MD5 77366784edb7d01fd217cee2b2179905
SHA1 25ac52059c60b8de88bbead926059d3781a16c0c
SHA512 ddf4f82e156afb6467fed2cce76d53d6eb974481c88e3add72368de83077c1a4755fcf4b8c7d9f159c78a06b0aa5340f044d9415cd741426a50c77bbfaac0cd7
SSDEEP 24576:yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnpsqjnhMgeiCl7G0nehbGZpbD:aa5POZ3BJt2pasx2+mrDmg27RnWGj
TLSH
T16265BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b1a6484e67eaffa244671bd5feb47eca24788774d0cfe676f6e5be65a2ef3f11
MD5 8bed706102d37549cef7cf3a67f78bc0
SHA1 f490874f28d722a9fba3e061f32d02ae6d0b67e8
SHA512 b349007b937db90e26fbdacd6a0d241d1fe7803bb45cfac26fa78655af3c2c6f71cb7aa2a3d3d110d2faa97298921dc25172481b00075843ed93161f6d5286a9
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7FkbsqjnhMgeiCl7G0nehbGZpbD:QNc/zEOVHFADmg27RnWGj
TLSH
T171857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d10adaaba21fc34a5728781cd9f4e864012fc461846a8ec8df1a3934e22957db
MD5 599739c324d9d7829302d2b7c9ce6720
SHA1 bff2757b1e3469617ab54d8a64f251f06fa1cf35
SHA512 f074f32a49f6666b2e142717543aa2620a1b5db10bdfab0504a9d5309edfe7e8bd9c50f727594094868f3ca7ea709f996e1c8a75640d6c19ba555b7358aa8f0a
SSDEEP 24576:RTkNvNnaFeYhJNtmZBmdsqjnhMgeiCl7G0nehbGZpbD:RTMwBtOmBDmg27RnWGj
TLSH
T14A55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 26d457713a20abc65da285e4f5af7cdfc2f6d496110d5059f0260731ab3f9681
MD5 e6c25e8d2412489d3c8aecd6b4f462a5
SHA1 e122db7badeca5b04689725654bb4b1c61840542
SHA512 bc6dd2756c81050357e4c40e66b29ae3694feea2278321fe3163341cc058e26019d0d1e71893db37cd0d2673a5dc9d12d73a2127c538241a8cff03a00c1c0b51
SSDEEP 24576:ZD3FHshBIYQgAesqjnhMgeiCl7G0nehbGZpbD:ZDVHeBIAAyDmg27RnWGj
TLSH
T1EC75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-106-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1096-113-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1096-359-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1148-242-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1148-73-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1148-67-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1148-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2348-2-0x0000000000BE0000-0x0000000000C47000-memory.dmp

Download

memory/2348-254-0x0000000000400000-0x00000000005EA000-memory.dmp

Download

memory/2348-6-0x0000000000BE0000-0x0000000000C47000-memory.dmp

Download

memory/2348-0-0x0000000000400000-0x00000000005EA000-memory.dmp

Download

memory/2820-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2820-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2820-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2820-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2820-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2820-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3372-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3372-126-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3372-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3372-128-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3372-120-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3444-341-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3444-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3464-204-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3464-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3464-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3480-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3480-344-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3480-373-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3480-372-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3480-82-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3480-88-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4812-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4812-94-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4812-100-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4812-355-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4812-346-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5020-13-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5020-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5020-22-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5020-20-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5020-80-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5840-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5840-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5840-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5840-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6020-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6020-360-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6020-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6020-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download