04f559a099fa45cfc8ef939794e752abef95acdbe606c5c0980a988296f39644

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
Size 1.5MB
Sample261102-wpv17afg77
SHA256 04f559a099fa45cfc8ef939794e752abef95acdbe606c5c0980a988296f39644
MD5 f548b29ecc291b0de89633365f13e1ba
SHA1 835be5bac05b6bb23a584451cf863f3b821cd178
SHA512 2af863ec7ff37d7b2020328179f7af59a11b9e0ca76e1788d9d30b123e4575e0e5aa5b90508821a5a342359dd88ae4ee560d68313a1e3539e9151f4007c790d3
SSDEEP 24576:PeomdTqMoqsBYsywPc8peO3r/UN95cS9l0Tp7:GdT1MBYcPe+m9SS9uTp7
TLSH
T10175122032C1C0B3C062117585B2C7F59A6B3CB85664AA8BBBC7BFB94F352D1E61D349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4860	elevation_service.exe
5272	elevation_service.exe
4752	maintenanceservice.exe
4080	OSE.EXE
1924	PerceptionSimulationService.exe
3624	perfhost.exe
4256	ReFsDedupSvc.exe
5508	SensorDataService.exe
4808	ssh-agent.exe
1516	AgentService.exe
4692	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fdbfcbfbb68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000929bb7ebf46add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d14fa2ecf46add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019d678edf46add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fd3c3ebf46add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
4860	elevation_service.exe
5272	elevation_service.exe
5272	elevation_service.exe
5272	elevation_service.exe
5272	elevation_service.exe
5272	elevation_service.exe
5272	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3108	2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
Token: SeBackupPrivilege	4256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4256	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1516	AgentService.exe
Token: 33	4692	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4692	SearchIndexer.exe
Token: SeDebugPrivilege	4860	elevation_service.exe
Token: SeDebugPrivilege	5272	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 5736	4692	SearchIndexer.exe	100
PID 4692 wrote to memory of 2748	4692	SearchIndexer.exe	101
PID 4692 wrote to memory of 4160	4692	SearchIndexer.exe	102
PID 4692 wrote to memory of 1804	4692	SearchIndexer.exe	103
PID 4692 wrote to memory of 5240	4692	SearchIndexer.exe	107
PID 4692 wrote to memory of 3844	4692	SearchIndexer.exe	108
PID 4692 wrote to memory of 256	4692	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_f548b29ecc291b0de89633365f13e1ba_elex_rhadamanthys_stop_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5272

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4752

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4080

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1924

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3624

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5508

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4808

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5736
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2748
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4160
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1804
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5240
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3844
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d7d5cc15f2f16012c70eff9766193a7a3c31c8db9bc040b00357039a0551bc9d
MD5 d7613cdebcb8185890d99aef0881e93a
SHA1 5a289d8eae48ad075d4f4f34c95975e8b52c8a31
SHA512 c42e5eea51aec718ff05f312fb9f6d045271de978604fc7d49781c7dd8a726fe3288138233dd3ff6c4298190b39de9e028d066d7a1508e701ee46e9268890cf1
SSDEEP 49152:Fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn4BYcPe+m9SS9uTp7:b3q6HjB/BZPe+m9ut
TLSH
T1F9D59D03F2D900E9E069D178D7469133E9A2BC890B34B6DF0790B6562E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 36cb0409ab98604acd372cb8d0d33378db96997a92b8194561493fb040e29654
MD5 205d1eb14884e10f4026048e871e422a
SHA1 687cab32542a050eb2de2534cad32cba54f20459
SHA512 714845584e77510bb940ad1b937b862004a1506d56e7578bb3cd53072709de4c2fdda95be432ae521e3e975741551b679790d5724080eb6ee6c4aaebf191ad5e
SSDEEP 24576:hXYfDtczAvqsBYsywPc8peO3r/UN95cS9l0Tp7:ktcqBYcPe+m9SS9uTp7
TLSH
T17975F12877E508F9DDA7827CC8A28501E6337CA543A0E78B03A4E9695F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 c7b03ccad07477ea04d5079eef25b19ac7e3c82586efe7c0e923ff4e2db84406
MD5 8a0900da8ec710ed7e59261bb41de8eb
SHA1 3485869a96d6b6ce91200981b19f4f75d2cc82a3
SHA512 e015380149b65da3ea451ccfdd367d754c33749e37ba9f6104de53d806673efeff3416b73f99e3bf2cc5f21efee6863846271a531c12e71dacbd7f32e1d0e8b2
SSDEEP 24576:40Le5ji0hmx1rMMqsBYsywPc8peO3r/UN95cS9l0Tp7:4Pji0A7pBYcPe+m9SS9uTp7
TLSH
T17795AE25F6748371D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 333f06e82b51af7516b30c2baa2bb8835a9b7c46f87012c8600d0149600b41b8
MD5 19bf54cce3b276bd7fea544457e70681
SHA1 880fd58db0112a7af427aa56d28cc327135952f6
SHA512 f4fdf42d77593d897cdbddf67bb96af7fdf45791d1735393f3954232202e522b015c4d634192d27ba2ce00f90bf72d4823126e386d628068334fe90896efefbf
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWE6q8wyuSqsBYsywPc8peO3r/UN95cS9l0Tp7:4/ezSC6vUzPvxHjytBYcPe+m9SS9uTp7
TLSH
T1B0755C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 89b6a7c4291ae5a4294387ee8ef33e22a43e25fe15c1547bc9a5d06c4f333258
MD5 9e9d095336ad4e00f888d87f0a4dc00b
SHA1 46c9be79f9e8d6d5bee34754c19bcd3ba99f1383
SHA512 2828c1b189874db964c4c2a281cdfd8591cc320cdf429f75f9f0c5899401804fda3937098e323263cbd1e3cd342f93d784961802125ff264c7e51f2ba5150b01
SSDEEP 24576:zVbqPb88hv/l+6LqsBYsywPc8peO3r/UN95cS9l0Tp7:zVO88hXl+EBYcPe+m9SS9uTp7
TLSH
T1A3559E66F5748331D073C0BAC5D3AA9AEE3234424B318ACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 5de4097d376a1fa33289b04fbbef3ee04a51414c2c0f129fec37c45c25ed8aaf
MD5 02281dccb891fedb452456b77182b9a0
SHA1 7ed27d22107bc2eac00332f98d0c5aca5aef4b61
SHA512 096220818d561758c7803fed4c22fcee0868ec6818cfb25e9f27f99e33d42973180a3e3085a898f602c4435c89b35cf340f4d7b88d239c233b12bb0274540aa4
SSDEEP 12288:1NIC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:1NIqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T11D6523246DAA45E6CFF423B4EAE31F06C0463DFC8184DB471692F99DE4BCA58F49D920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 dd1c4ca9066a6af35cb444e46c3003d8c0c15a9e5f504e303b7a2baba7fa78f6
MD5 df71b17d3962d74cd470fdc1ff176c43
SHA1 40e62011ee6691b69d9d006400459ca754bf6d2d
SHA512 51350d3997f462d6b3f6b8e8a5777089f3be1b4e24fb2653886c22f31faa701019c8897cd3abd3d90af52917b63dffe4cda5089626172396b1b45cd948d75a30
SSDEEP 24576:tJIUjqsBYsywPc8peO3r/UN95cS9l0Tp7:tJIUHBYcPe+m9SS9uTp7
TLSH
T15975CF3BEE28FCE2C27A9DB85B918700D76278704B51A3CBD165C20EDE235E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6ed2577e5a4b8d1ef773c15695c7ea820b08da22abf4de2c3e68d625d1ffbae5
MD5 fb1afaa047faf8d41f15b5f4287a30c9
SHA1 48572c3786cf29785c4075eea1f5ee999aad4421
SHA512 f5a2445455b3c107f5a069f6e5a5b1e4e0efaa40286e94cd6526bfef18be1adc279488eb379608e828a75eb4380005924ea5e72250cd2fe563bfa736e303d522
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THP:2QvGAdlCEL8c/yRNw5CKBZPe+m9ut
TLSH
T108266C656BF880F5E0B7E178897A8672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 660a77d5063b12b996697fec4aa7d3cf835a16923679c5a0afe4af250dbd89fc
MD5 98a21d364e60b535e397d5a195c80e23
SHA1 1a354252cc2ea6b9e14d1cb39ea17a61c58bb8b8
SHA512 fba2acf870297234c3df40370177749761529e006b26aeeb868f9ede4e5ab2fcd4a72d7c5dbd7cdd8d44979de167412a63db733d5f92296c372d2c92d29e999b
SSDEEP 24576:O6ewsAjxqsBYsywPc8peO3r/UN95cS9l0Tp7:xljZBYcPe+m9SS9uTp7
TLSH
T19F85E030FE75D036C7BB0DB21B36C706542D79604B911AC3E3A89E9D99342D2637AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8b58f0d3e063deff5ce3b37e3c04df0a8c1c8f7b3ca68a0c36f579dd1d883ae8
MD5 6448ae32f8d1507058ae1dc2353ca06c
SHA1 9e232435ac1144f0fb78481bfcb82c6eaf9bb89a
SHA512 908c55ea9e7b17c5a7ed03d9954a0291d5f340047d1af2d3696a4cc9132cfaea0221d6d49db094019f3c9f8788fb42ed2bf280fbc2df4694190c485049de8db2
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHhi+m9ut:zUEtQevvqc2W1cpV2EI32hSIt
TLSH
T191474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3024893b3bd484b8189206ae62c8b8d338ddd094888d2c0137abe41e84a6b022
MD5 3a7bb2476bdc576d62ee0b58d4abfb55
SHA1 334c2526d187e8e9f796f13efc7b44cc71410ff5
SHA512 24454ee85c04f31d7ba86838565ab1ef462f2463e73115c06b7d8908ff209b9f8ac5bce54cfd6f4c11868e386e2684ded28f549b48e3da61ee0d8b3f78f088d3
SSDEEP 49152:aCbRquA/m2yL5zQfFiV+XenmE3/z5BYcPe+m9SS9uTp7:voqtVjnmuBZPe+m9ut
TLSH
T153D58D1976B8C2E4D1F6C77886A2C647F37178154B3097EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8fa25306003a2e23b623acacb4d12ddf9bee8269ad27a8b1d1ef810b136f30d4
MD5 a564009c36fa711fc55d7895b62d1695
SHA1 0e08006d96407f879163ddefe1e7d1e0f6d3875d
SHA512 4d5d391e989a7ddf41e00ac6b214bf904cd3b1bb63b0bc711dd09226a816d8ca8d2190fc216ef176c5ca2e999e73fd95bfb8dbf0ce7bd7d9b28c9ce881893485
SSDEEP 24576:MAhGLJIFoiwtA5l7S53mqsBYsywPc8peO3r/UN95cS9l0Tp7:MAMyFoiq5eBYcPe+m9SS9uTp7
TLSH
T148359D80EBF945D4F5F3AAB899B69571EA76BCA95E30C20F2150D11F1E33E409D24B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 4a1e9c129b3942dd575ccf2fb3895df42777e4cd6b91b720fff17cb1e58b304c
MD5 cf3ef8a791ac8da45abc95a9868f073d
SHA1 8ad0f79d45f25a232e618871158c47d9eac3698f
SHA512 a472766945514e793285777a7e529095f5f5c5c10069a2416238b78150914dead766dd7cc57b3675dfb7d5cc0d1eafd62d77d1ace330a7890a63dbbe4886ce5d
SSDEEP 24576:PwuVOWlqsBYsywPc8peO3r/UN95cS9l0Tp7:PwaOSBYcPe+m9SS9uTp7
TLSH
T10175F14576A90CF9EAA65238C6978536E7F3BC552620CB1F1360C65B6F37320BD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 14f07361deb2e881db82ce35c88f0423408bf757299091152306d0b183465095
MD5 d5772a50b185836dd6c74231b3f53d52
SHA1 6d2d050ab54609f342d648b5d6fa74eeffc6029d
SHA512 b8bc6936c413600d6c9a03173956e5251a2817a695d872a1fbc6d2f798c057b4fb1fc5628170a35e1fb1a6ca13fd21864a06a9bf9faf7559f28fe07a6aca7189
SSDEEP 24576:/ZukqsBYsywPc8peO3r/UN95cS9l0Tp7:RBYcPe+m9SS9uTp7
TLSH
T17B65125936E910FAC6E2537CDDE20B05D3623CB6537083CF1261A6696E76AC4AC3DB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 11edfefc96d2839bf49c409e3185c0b6b7c0d5e184c4708809a8ca183f56fa4f
MD5 ddcd4f60ad7beb24e27df0657df9fbea
SHA1 fb7affb4fd1110030d55fbda787ee96082fb94a5
SHA512 f74824d1392634307b1e01fca9a786b31db8b34ecafe4a1ba7059aed767d4f8e7786eeec8c62e3b8c4633a72b0365d4019acc6207bc6e207ea54c684956276cd
SSDEEP 98304:eQRQyi36YOcPQLvw2gAf+PN3rBZPe+m9ut:FQyiKayX+PN7i+m9ut
TLSH
T1CC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 81389b1849f3c4a0eef593604a0cc021b0dad8dea07528ba33d0828b2f33f9e1
MD5 1c769a9b2d30ac94c39e698436d6b52c
SHA1 8c160cc3f088df23383dc2f5671b280325d878ab
SHA512 1cebadb72ff5771375072f334cd712022fdcaefd648fe1fa26796e54b52f42bd238c576e4d326009a3b54f507c7d74fe68d2bbc771458002305bac0c139f1bcd
SSDEEP 98304:sQRQyi36YOcPQLvw2gAf+PN3rBZPe+m9ut:zQyiKayX+PN7i+m9ut
TLSH
T178667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 96128e30412843f55c2d46ed2def5b15180958325a13664905a2417190e3f1a1
MD5 664c156899b93beb4f052ed49285ea2c
SHA1 803ad586b0628f069b98d8337228ee0238f99ada
SHA512 36f4bc9db4cc6b33744484ada1b9a1b4335c9d23a357a2bbd8bedb7ca698b3bfa99c1e862bad6c16001bfdd2db088b9729cdba0b0531e7cc64f3e2dfc54d64ec
SSDEEP 49152:668Qg55nhheWu7PNU3/pBYcPe+m9SS9uTp7:othWRc/pBZPe+m9ut
TLSH
T1EDB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f7b27f11e46ffaa093cb984e6dcb20317171ee5bb0da81d481d46475caf4ef10
MD5 008a48c42d8a07bdde4a39e8fb00a78f
SHA1 db668ca28f556f52283da63e0b77bd02d6d98027
SHA512 d86290e93ac27abfcdbc72500822eecdf3224d7fad4bff451ba720ad97140a4b7d9d8b16b3bf16fa40550bcba333e4af9d54ea54fc75591c60e0f04a9d2f040c
SSDEEP 98304:my5112gYy5azzVvL69nLKnhZsBZPe+m9ut:XLIHmWhWi+m9ut
TLSH
T1F0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b6771b09a1ed8bf6c426224eac092d7ea09103cf098d004bf9b411ff3408d0e2
MD5 b21f94af0b55fdfec3b5e897e32c288b
SHA1 f2364b03059d3e8c91dd9d3802e0131c256c4379
SHA512 7cb1ed5b5de75a8bad5cc19cac9e084950a3c77b530c9a5b0763ac5497530a7876e23af250f100a73efe1af2b6c87cd712415429ae95217aad69e92161e306ac
SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gljBYcPe+m9SS9uTp7:Tu6JmVxd2djBZPe+m9ut
TLSH
T13DD59D13F1DA01E8D06ED578974A9233E962BC490B34B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e8c679b7089e85bf434df8f064bfe91de59af155e401956c0928e3eb992c5655
MD5 d816969eb3a43ef82a65f7633c8e8d2d
SHA1 c24291ebebe7bca8cfb04bf47955fc9e4d47654d
SHA512 ecbc7d3153833b07c7e6ea05daacb23d9fb56711e157a779e0af78d73c3499f05d56c5e52393b52f4d047c1906b2ffff3386df12e7dbed429afba831a3968c28
SSDEEP 49152:71hpsNoJpF1A6UU44CwH7R4xnBYcPe+m9SS9uTp7:7mifPbRuBZPe+m9ut
TLSH
T13EB5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 125f146c5e4e818ac212c16dc8e6d5b994bf854718e521c78afa56c4c32467e5
MD5 040639a23f69c6fd2e66bf8e2602f057
SHA1 0e68ff419ad45c10e1f9fee30e7033939b6e1784
SHA512 3099c19ae6e38ce422839d5ba74d452fd78604b926a51e39f07ed883525151f395ea413e14faf5ed59c8e7f8a6305f9a2c64d1a8c11f0eca182b01b3690371f0
SSDEEP 49152:CSuZQIY0Be2KRRVtOnks6NMHqoBYcPe+m9SS9uTp7:c5dKTi61oBZPe+m9ut
TLSH
T1EEC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6108e9b7303632d533b32040b707d4b2edf66de6dcff291451d43e7caa119540
MD5 bec4bf322f1f4459397de9e86f988804
SHA1 236aa84720b4a3fe2ef211483bcc13c2c627d198
SHA512 54e151c17a1bbe99a8b1fff17dc0c7290206ca59fe00678281ec21972035514ed43a1669c3e15f0e840bd9d48933759d7706d4eb2ff175a7648b4077f36bf442
SSDEEP 49152:7htSn8EApI0figngiDn0AP5wTBYcPe+m9SS9uTp7:aX2iyphyBZPe+m9ut
TLSH
T18195BE13F2D900E8D06ED178C7568632E962BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 fad3eb7a2b995bc3f4e6a0c1f60c3b629efccd5ab7a793a68004f54520505d25
MD5 272ef6b0d38fd0250a0fc273da601499
SHA1 cd78830eb5ba1df610f2d0c4958cc651333ceb32
SHA512 47629d45026f99c07ed48fcd79b8a08b75d403170b0ca68b7e07579d110f96e90c00f4e5ab06abaed662b201f7b5a1c59c07b631d8b3f722f7b26b0a41d6943f
SSDEEP 12288:AAC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:AAqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T19E6523247CAB46E6CBE463F4EAA31B05C04A3DFD928087872756F419E4BCA58F49DD60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 019f7ee9336710be4a911779635f5bb025818560ef22de1d7d8ebb894dea8c85
MD5 04ea6d467af3e666d4280c1cf44d3af1
SHA1 2e891f776a3ea42cbe118a2382d22999d170439f
SHA512 200b0b197cd188175721089f48856293e0106e07dc7fe043d555b4556f6dc7c5f665dec61f26684338200936e13fc836af84a39543ba13ae06a6ae99195f8aaa
SSDEEP 12288:dNC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:dNqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1A86523247CAB46E7CBE463F4EAA31B05C04A3DFD928097872756F419E0BCA58F49DD60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 91fe749a40a81801480ef17e3394ccfeaf89eb1a8e4cffeba4433a390193e4c5
MD5 e96308afc6f4a51c02569c626e4b6c7a
SHA1 2c46a01414e801d6350ce10666a9d6416243683e
SHA512 b38a16ed13ee1ee80e7850e43ecf750744016b9b74a4927fe6b33ce173ac8dcd06c5eff65e49106d39787914c643a489e419a0b4b29c2f971151acd8be76952f
SSDEEP 12288:ubC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:ubqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1E66523247CAB46E7CBE463F4EAA31B05C04A3DFD928097872746F419E4BCA58F49DD60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 97f81aca0eec20e8b88a38429087b9a2be55da0c8923df3df60844a01d9a6329
MD5 6ef9e83e3e10064651531e7caedb47f5
SHA1 64921e90a6a591f1687b78b8137ed7a350bd044d
SHA512 3b558e8c60fda04d9738ad58f5c6cbeecc04f3046e1f02dcac04419e8d3da825e9652ad392f4513b84ecab7353b0bd3d60ad2d403be5bdaca429b52bba477666
SSDEEP 12288:QVGC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:DqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1A56523243AAB01E6CAF4A3B8D9A34B05D1963CFC9350978F2741F85D99B5758F87CE20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 c41bdfa191cf5943feb53149555bece9ca9499835e46c89c0db0c554f436f734
MD5 b7780fa1eb1e335a57f1e96000d0b6a2
SHA1 5fbd3e177887b3242137cb95607769134d87bbfd
SHA512 69aaa157b86595cb2cadcdd6efa591039197c285a7c9e4cc2208547a619b3740ab39cd350d9da49bf393cfd3265d599baa49ba6dcd9c97510e36f18249b5cb44
SSDEEP 12288:gOC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:gOqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1716523247CAB46E7CBE423F4EAA31B05C04A3DFD928097872646F419E4BCB58F49DD60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 4a8b2d3e881a91a0a131767d779414e7c0f256c76c0083cf0c86e5e0f139734c
MD5 f3d8882119fe83ec9b55b541877a90f9
SHA1 32481b0041fc90dd4dee1bea428636d868aab099
SHA512 c66f0f16aa0c6a37ac766507214461754331d310b5d2907572a37af5537ca58360fe2aaa78578ca0a01fa3cbe5574151a49a3b985fdb41e1609f64c984a07280
SSDEEP 12288:lJC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:lJqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1B76523247CAB46E7CBE463B4EAA31B05C04A3DFD928097872756F419E0BCA58F49DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 313406138e7199dfbe234ab2e30dbd8391764a5977c037e9325eb5e97ae54c3a
MD5 4dcca77b120540d648c008e683266267
SHA1 c97f987b78a1e853bce720f86e3857d486180b94
SHA512 c26c8c7ecb17e7919aaff93631ba11b79e59438441e2edfb542ada5953e857922791f66f6c5413b666bd3e0597295e192784fe2835aa4fb6e2478511d9875764
SSDEEP 12288:n1C1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:n1qsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1386523247CAB46E6CBE423F4EAA31B05C04A3DFD928087872656F459E1BCA18F49DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 823361abb8e01077ddfeef524af83da03927730c354d8c341ebac0f4933c8db8
MD5 690b487e04ea2f620d25fbd83d08c353
SHA1 db2e9e59347c8a614d3054d42713b20de80dfb75
SHA512 680a2d63f833a0a9f4e2f0c8f54cb411f3e4afc8ed5176cfc9d51cba20c221a159377c8599b06b25861c074702970abc8d1c89555c5345c2145c7fe94d567a8d
SSDEEP 24576:NZMdzFVSOtqsBYsywPc8peO3r/UN95cS9l0Tp7:NZMdzfBBYcPe+m9SS9uTp7
TLSH
T19C7501A4B39108F8DDA7823DCD628906D2B27C690760C70F13A4766A5F773A15C3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 2cc18e526477de3a8737ffeb5599ec0ae6774c31b452633b3f26d653e1a65e20
MD5 6ca63448018d770ee48d36430fa9b7db
SHA1 21c5ad5f8f998db40d2040d8a1dcea5a8cd7c04d
SHA512 f403c804cf4e2bb5d9151228d01b619c9a595e2995cf7366f5b0ef6cc8aee0ca4fbb863206b1fcb193d3d50b8ec07799dca3ab2acbec76f5115cb760c374d777
SSDEEP 12288:1UC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:1UqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1476523247CAB46E6CBE423F4EAA31B05C44A3DFDA28097872646F41DE4BCA58F45DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 d26979ff912155f1d4be762df1b922bae8d051b004083776de00e02a49b1466e
MD5 35a8f3be2e351745534f970b0e9092fc
SHA1 da111a3cebb343467e5e02076978d04dc2f3e4f7
SHA512 cb8ab74aef9c3bb1a013263b5e2238175133c02a45907af494494b146df0fa5ac25b14566a55b41dafd55ff59c7191bd45ff195bec8106e85670646cd355f4b1
SSDEEP 12288:54C1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:54qsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1976523247CAB46E6CBE413F4EAA31B05C04A3DFDA28097872756F419E0BCA58F49DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 0ae3e6b11ce884b9d8e76e0d63c6d3aa28477bc8a5c39709b71828558c690df7
MD5 83d4e33c73673f653a30225e7d774fb2
SHA1 12acde884673083562292c74ec284d73cb3c0abb
SHA512 451d78aeb4a20a6625909aa821589ca6993caac3308084e4f309488bdb82f0eda091719e9980367714e72c59dfbd92bf1409a7c1f30479fefb5a8152119e878d
SSDEEP 24576:pzyhqsBYsywPc8peO3r/UN95cS9l0Tp7:pyBYcPe+m9SS9uTp7
TLSH
T16F75121776A620F9C5765378C9A30A02F3727C7547608B9F13A0667A6E37790AD3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 d5dbf35bf3bbe91628024f5f55c5dec64f38c5217d7c43ea65007dc85eaa8b14
MD5 86327bfaa8ee2a242c6ce72b2922f10c
SHA1 59c25749c299aeef4df33ff0aee01e21684f46d6
SHA512 5368079237a3d8b5881031ecc1b613ade1f03143e8e29bbe3c6a846987f3fcd9d83b75bcdcb47c0edfd9bed4a824652b01e1a70158301bd107f57cc93c42b9ee
SSDEEP 12288:QUC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:QUqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1F66523247CAB46E6CBF423F4EAA31B05C44A3DFDA28097872646F419E4BCA58F45DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 226cf05ddde6e8b77792d0744599b62e2c4dfe44207531bea3c990a496d89f6f
MD5 45674f70c240da1530290c462a750ccb
SHA1 64c5d7c18bfa1b0aadde8bd4c562b090ad694ec8
SHA512 a6ab03a5341f52eb7a8e982fc25c0c55ae49a103ba8bf7c7fb19048c50ed70f13593cbe8b4b3985cbdab0cd24409a9ec4356b429180faeac868d2a272d3ee092
SSDEEP 12288:rUC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:rUqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1A66523247CAB46E6CBF423F4EAA31B05C44A3DFDA28097872646F419E4BCA58F45DD60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 1d07db503eca640105847b03fda839b624002801631a3bc86944bdd462f638e9
MD5 656026e70572448c98c0558ac52e52ef
SHA1 15daa989d8a90be8c3a4226854df4f2c9cfcc795
SHA512 6ce96ed10ef4d62a7cc39c0d4e2ef8ec6affac05cbf18c81e8311bd557d3fadc1b23dbb28ee7f3087c94abee63040e73d820842b0382c33e1cebb836986ddce9
SSDEEP 24576:ozyhqsBYsywPc8peO3r/UN95cS9l0Tp7:oyBYcPe+m9SS9uTp7
TLSH
T11275121776A620F9C5769378C9A30A01F3727C7547608B9F13A0667A6E37790AD3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 ef987cc453c5b524f88cd21506417e86ce4f538aefd5a3651df654dcb410b4df
MD5 3a35917a0fb75f9208a75aaa54844d9b
SHA1 2c4ce107b9458c1466dcef92ca81c5b623e5a379
SHA512 4500d0974d0ef67a474a91d615a081bd0caf8aba3ce3bbe610b06554751e0f5108d39f516da44201bb191eae4c83ccaeea8ae345bb4035252bf087ee65e11abc
SSDEEP 24576:kTGaLl3z0zDrqsBYsywPc8peO3r/UN95cS9l0Tp7:kTFLljaBYcPe+m9SS9uTp7
TLSH
T1FF7502A4B39008F8DDA7827DCD624A06D2B27C6A0760C75F13A4366A5F773A05C3EF65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 65df2ed33661c90531347f2b1e6cd9c50bbc7948a49a13e108da16a42d29b37e
MD5 7b4e82fdf8c0729794571ddb6a61e891
SHA1 980646d6fca2b287ffaefb90694bc2baa2e94e6b
SHA512 fb0abcb56adb45bcfadf5ad5ea0969b7d898b18f01e7b5c30420a7b61fe663e61556b111b0e432badf8bf3bcbd57ef1eb20502209b73f73a0cddac057b0e5b2f
SSDEEP 24576:w3Xd9CHKy7GZnqsBYsywPc8peO3r/UN95cS9l0Tp7:6Xd9CHKyaBBYcPe+m9SS9uTp7
TLSH
T1F395CF90F3E414E8F1B79A35CD724501DAB67CA95B60CA8F03A4661A1F33BD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 14cbb40d6e866b2aaf8dd7f10fe70354936572481c9f5c57ff052dfb74860c37
MD5 1963bb5525d648f4604f80bdc6c00c7e
SHA1 003ab1585199e2430d196a78ada01ef838b5868a
SHA512 a43cd2e4ee93f0fcb28fda20e1ed0eb1a690a85425b3bb99dc8a1738d3b2c8b1265a98342b4c8fb163876ee04c56c6180e5d19a01f0c5ae489f9649c98560565
SSDEEP 12288:R7C1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:R7qsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1B16523247CAB46E7CBE423F4EAA31B05C44A3DFD928097872746F419E4BCA58F49DD60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 dde95454a9333131763865c1bdbfce931e9487d449de69f33be0691286094cc7
MD5 5a1ebafefe34b09883c6d2ce6588b1ae
SHA1 1970d21e3943bc1d6087e253e6989921a2beb641
SHA512 28ba01bad4ee4c46ece849189d9061bd6887a3820f12ff9b1482c3fc437083cda4792462886bfbd70c6bd1b226af7b0ba2e2d0abb4bcfd4fb996c457e0c92065
SSDEEP 12288:EBC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:EBqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T10F6523247CAB46F6CBE463F4EAA30B05C44A3DFD928087872792F419E4BCA58F45DD60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 3f1f247deaa56b1695c1bd52cf1f06a783a4376c24e84a5630b56b01f32ac14f
MD5 c83f626e89dfcdc649867e44a5337153
SHA1 95f776c514ff0a5ecb62a82e352a78dcf95a59a5
SHA512 85aafa8daf77366c2229e3bbaa69c9ac716c7f2a1b46fae5cec744f8ca777b50b4aac3f5a07ffe0d62d7d0302a030b8998841938eec5d6b8be3e40e8aec5515e
SSDEEP 12288:q6C1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:q6qsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T12B6523247CAB46E6CBE423F4EAA31B05C44A3DFDA28097873646F419E4BCA58F45DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 b91a5b5da3751b24d069108d5f228b2f0c411b3d4222c2444a5cf33208b63e36
MD5 9d06619d512b02fdba7e0e7ab11bd7b9
SHA1 92cd779eaa7aa16a0da194470b2691b57f277822
SHA512 a22e0c3c048eca906b84f72fcbf4baaf2194bf6d7b6b053c5ce7b5082524f09b2ed0674734c225beb0edcdfd5fdde170caf83e2da01de1a0d08672b76c0a14b4
SSDEEP 12288:mUC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:mUqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1046523247CAB46E6CBE413F4EAA31B05C44A3DFDA28097872646F419E4BCA58F45DD60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 d824b6a462c1ad105add1982f628a0bdf46ff28477f7ee853ffe857427e60ae8
MD5 cda09617cba35c309e0e60d67eb10f3d
SHA1 9508c9d48a86b403bb4dc9219dbfa894e642bc9a
SHA512 e9cf27c92fa77ee2c3b6e388192e674692c1403871c9a95fbe79d3d7f5b519b24f70c177cafbf855d18cd0a582ef209472462bc7ffafd1564bdc7ed2e8490ddf
SSDEEP 12288:+7C1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:+7qsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1DD6523247CAB46E7CBE423F4EAA31B05C04A3DFD928097872756F419E4BCA58F49DD60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 dda5f7c5a9844c352c4ec87b1717b6c96e958674ec9b369309e58a3ecf992fe3
MD5 1fd5bbadb011524aab5a15c9385c8839
SHA1 85895d9e8f63a5dd4be4969dd9469740e033fd9c
SHA512 63cca18369ddafc04f1192d4c4f94a7e8f88a5165a2afa844a4c226ead8b184c8892790e4e387622c8db3a4034ad3abfad348eed3ebb3ba34971b8ad6be6519c
SSDEEP 12288:JcC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:JcqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1F16523247CAB46EACBE453F4EAE30B05C44A3DFDA28097872742F519E5BCA58F45DD20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 82e6c2aa2cc67a924b8d82128b03e5ba296eaedee47cf1a52eefd1e85be38566
MD5 a591d2d58281a50f4ae680c77b94dbdd
SHA1 b37ddf8bc6396c298e24e23614d9165b8209f509
SHA512 da32ef701e24b8ddad9dbf1d699708659b1126f0f00a27fa626363bd0839aa1a367687fc44e9e66447cb9b391c3d8a45f3b1c64710373ba972ce440de861e105
SSDEEP 12288:wOC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:wOqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1CE6523247CAB46E7CBE423F4EAA31B05C44A3DFD928097872746F419E4BCA58F49DD60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 42123a72ad3140123c0e2eb641b6543c757e033b94c54cea5223c509e78cc6ce
MD5 44dad38fd22c2aecd4f3e6a88d566571
SHA1 31fc654fb857a255eaa04fafe960746f6a251200
SHA512 6132bbed61c16c596655c65b8ac203502a7972222dab63ae1e3bddf243c3bfa565028f78129c406b51aaccaf437526ec8ab99352e11e9cdef2667694b888924e
SSDEEP 12288:WTC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:WTqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1E16523247CAB46E6CBE453F4EAE30B05C44A3DFDA28097872742F519E5BCA58F45DD20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 2f37548299cc9ba3034307bee13b193364394e1bc5c2860d62bfe33745d69c5b
MD5 f2da2dfd40936b5d9a1899818c275e1d
SHA1 b0c040484eeb5411b3c5684372467058f49d3915
SHA512 76f3fb933f02363863dbff453e6d803fbca70188e6a2dd49907f513cade21c960653ae2f8e260ef45c0dd07575d83d5f01c917cec21be3795147d4ee48e16898
SSDEEP 12288:tOC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:tOqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1746523247CAB46E7CBE423F4EAA31B05C04A3DFD928097872646F419E4BCA58F49DD60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 7b1a8dd9d9a1b9bdc37fc84a45cc6e76c6d34d33b2a7a49df81ce0fbf7cfa55a
MD5 5ac96cce74fad4bac2daefb848c4913f
SHA1 11ae25e6a4d9390d5a08b763343773a37baf3427
SHA512 dc76ca0bf4b37c94ddb78843331e485ac15eb31ee2935a9288e7b36f8671096e5c63e67828f7d14c521417d0fb6f48e0d6b373cc02906986464c96a72af31a3d
SSDEEP 24576:YfwvJk9RX6wkyAIoqsBYsywPc8peO3r/UN95cS9l0Tp7:BMnYIMBYcPe+m9SS9uTp7
TLSH
T1E895D029EBDC04E5E1B7923C99B3460AF2B178691B31C6CF125A536D0E37ED4AD39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 992d23935cbda253a37e4febb2d076893c4ad64573be0045611e808456bb5e48
MD5 9f3b26497c805af245354b83a1aeae67
SHA1 a60990b6a629fc5fa4797597cc904098fabb4468
SHA512 9f4ef762d788c29fd855b2311c5c78ff8bd211ddd021069d0d5c81f63d509216c02a4f502ad031cb51f6c16c8d80ba4f6ef6e1167e6a7448f609f686882a9f6f
SSDEEP 49152:AYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zBYcPe+m9SS9Q:uySzPLBZPe+m9ut
TLSH
T17B066C56A1A801D5C1B9C1B98F1BCC1BFA7134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 318baa3781ddfb35313956de2358e6e7728fa7e2f3606366ad8ab93b27b65b8e
MD5 b61e433b092d1f464f28caf5d1c2f534
SHA1 5c20912422eaf5482b393a63dabbd6ce27255263
SHA512 c5b1faa85d109bb2e924ca09f1b0521fb6dfc2b7041b90f0a95f3456935d8c23a67b0aa3f9c80aa43eb0fc162f912daa00ea2611556819ea2d6d558e30c223f5
SSDEEP 24576:N47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYdqsBYsywPc8peO3r/UN95cS9l0Tp7:N47JUQj1irIhCnDHUPfF/jBYcPe+m9Sn
TLSH
T16A65AE1DA3EC01E5E1BA927885154A1AEA71782D1B31CACF1270937D6F23ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 7e8cb83b41ad3ee457ae75fc124438ab216afb19299e8277ac7404b9317b539e
MD5 f0c0f51a51dd5d10c61c35a5b8818870
SHA1 69d6ebf83b0c3843abad82a886612f588a481c07
SHA512 c3c45c3a79f5d8bce7a6ffe5c0de2ee68c53c364b3befa1b2bc925a2ddde1d66127100660cdf4238a032bf73ed2f771082685ae9f1d0614cb90640ce192387bf
SSDEEP 12288:7+sfkC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:5kqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T15F75F119D29902E9C5AD6278CB524A01F3233CA593E0D3CB53D0F53E1F79694ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b44aa2d4605882fc507bb60814d8d577cbf811fc4883564bcdf6eaf78311e8c5
MD5 be6bc95523bcc489d97f1c146c4401e5
SHA1 84745b85d401b7b09224d6da0fb2addb645490ec
SHA512 bd638902a53f11d88a02c162efa158eca83acf82edebe6473f8fbcd778c2baeec040ab2695abf7d77bfede67f9f443816c348362a378474cede32c41707d619e
SSDEEP 12288:0u1zSo+05AEH0J8WCKagqC3gUWT1Y6+XlsgtbAAie:0u8OAEUJYKavC3ZWeVXljtbA
TLSH
T1B24528007666CB4FC6A940321E37D1CCAB707D51FE04AF0373C9973E9576A59BAE2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 3ad0f350eeb929f044df90b39caf7ce162a2600cb7f90f1ae65db86a9a697278
MD5 e5526c64f20e15bfb4070ff84ee4a8aa
SHA1 9f339d7aef0a11d0845af51d1404c350e0d80f11
SHA512 71ed9909d0e8bbd457662cea698790b11e32a7c25edb777c347313bbd9bd7b8366642df2ff3b9effe3b11b19cddd705cbdab2ea75a2337defe54345fd5d0c5af
SSDEEP 24576:tB6MTvaJlXDJr30m6BukoRz7i6ovxmjKj5Xy1zu7:tB6R2Mjah17
TLSH
T153750841A537A7CFD1FA1032072A9B8C7B74EC16B7095F22B3C95539C82AB55A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 0288e52ba8ab5d09e8fee39345eb38f288efed10e74e97dc0d543a2a69c10690
MD5 7d0b07308dd42b0a2f35dee191b8323a
SHA1 f5ac30e2373f6700730833fe79b7f38eac1d5183
SHA512 f34f1951527864a02b91dd3b55a8bbac72b3d7dabbd83da538ab04c05b60e77a037fbb30055b99b38253c5e38d1c69f9882993d727b0db08b124d731f3b87629
SSDEEP 12288:b47sC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:UsqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T19565232069AE49E6DAF423B4E9A74B05D00B3DFC8740C6C77641F559E478AC8ECBDE20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8a5883ff49298c98d5fdf47096d45af80cd3227a2ff70cb585e966707dc8d80b
MD5 99fd07efff6d1674b7aee418da42b0af
SHA1 7f2be004b64d3e32b5c1291f8f84b5130b5d3bbd
SHA512 31ade499ee9ba2d920a99704f1e23709fb391f0631f62e94277b3cbefd3992c9afd39301496bf6d155647250991369c7147a79d4632604f29520ab19d7751a06
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYSqsBYsywPc8peO3r/UN95cS9l0Tp7:ngb4mBIBhGFlBYcPe+m9SS9uTp7
TLSH
T11F65AE1E22EC02F5E1F9E2B8DDA64417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 0b045fd4181d845eb2d2b399b705e7ce8ed7ea165f7c0af429a4eb0a16539044
MD5 6586fa71613ad99d4f5e83111fdc5db1
SHA1 1f316b0bcbeae44c4a867f0e41b8ada706bcf107
SHA512 81f8c3c58387482b6f054921f54b48eb8f2e907f168a189ae50f19a81d384f91209744b392ec8cafaa02f352e3ca8eda426e50b2fb4cf9409dbe874651df673b
SSDEEP 24576:dG88u8FpJqH1azria7/mtqsBYsywPc8peO3r/UN95cS9l0Tp7:w7ZFPqVla7/CBYcPe+m9SS9uTp7
TLSH
T12195F16576E101F1D4B7D138CA824663F6B2B8250364EBDF07A88A551F33AE44B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 9704e58ab27ceacda1d6f33afa8cf9c763486d3a5699038508c85c4f2862ecdb
MD5 ca38ea0f5d7fedb85dc2a4431171e96e
SHA1 71c745607a905a08738c3b79f369236e97dd707a
SHA512 67b62067610fed3cecb501618b83ec4d4a53855faf62e0c96270fe8a89b0147d47ff85abcabd3deaeec96f044f84fcd7280d3b334ebfa370936210be6b3b6d8b
SSDEEP 24576:8PUr+NQ5qsBYsywPc8peO3r/UN95cS9l0Tp7:8JQBBYcPe+m9SS9uTp7
TLSH
T16075E12E26ED18E5E675A17CC9824709E77278A60311D2CF02D1917E5E77EE8BC3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 856215940a5e54825bf443ddb62e73b31525250ad6e8a000a285718bf823760c
MD5 621db5d30ce9b6931af63b9f7f4b51e2
SHA1 862bfb7e7a52fa074c3a454143b0812954c762d0
SHA512 7ea980f91e661d9d31ef11592fe3540a17eee274479bc0932ba493efab8127c8778dc1ce067c86a2672d56d5a1a1c79d0d8c3acec7054b23d8a10ae6bf34d0db
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRBYcPe+m9SS9uTp7:bG05lO43b0BZPe+m9ut
TLSH
T141D5C06E62EC11F9D1BBD17CD9C64A0BEBB23825032456CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 49aa8e04e370629f8a91e6df9f083200dafc4a2fd487b9ec9b4e6b70f92999eb
MD5 ac15b26db02da9cdfcc00a2e159e9f61
SHA1 1c52b45092efb9a285bb91aa053ceb01ba4116c6
SHA512 0713e411b99b5275b7cf80a9473de24311ed55913d75a7acb8093f61201d9469ece94598aa7029dca79b35200fbcfefe32f8fb687ed5cafd17e97693b097ced6
SSDEEP 24576:Pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnPqsBYsywPc8peO3r/UN95cS9l0TB:3a5POZ3+Jt2pasx2+mpBYcPe+m9SS9ul
TLSH
T10165BF5EA6FC01D5D5B9D17CC5834A0AF5B1346653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6fa53f9e09e8c10796a2d51d136bd858d5eea13ac890a13c26a002adf2a712c3
MD5 adcdadb9985756b005ada433febebe4d
SHA1 1c9ecb111f744c5d10b5a37e932cab6285d1d97d
SHA512 d184a3f3bf3024bf12d1ec75f1c448adf59bc7bebcc5d3d56ceb510048162351e7ad5c9845de09aca4a7723dd85e1269e7dd4786fb757476c5f5745230842fcd
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkFqsBYsywPc8peO3r/UN95cS9l0Tp7:NNc/zEOVHFiBYcPe+m9SS9uTp7
TLSH
T1CF858C2623E901E4E5BBE1BE89779546FA71786913308ACF0291851F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b8891e898ec6d08042ca652474c3f9ad298c6abcb9610987111afb2547d27fca
MD5 ff5dc3bb16cc47397d560ad0a4d48562
SHA1 a98df0974d1cfb4c0a5e036214defef57a2b45bd
SHA512 689ab496b6962fd3b22eeba08801e16585b430e0fed5cc3e71782602391d8ee07d72c6808b9c834acccf15a6829fdde4a286d870f628f962376d4bf16d08b0cf
SSDEEP 24576:q8kNvNnaFeYhJNtmZBmTqsBYsywPc8peO3r/UN95cS9l0Tp7:q8MwBtOm3BYcPe+m9SS9uTp7
TLSH
T1A455AF2EBAB846E4D1FEC6B4CD238512E6727861073293CB5390C13E4E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 5575380bc795117807db14447b631a65298a5493ed8e88c5f98345932df97bcb
MD5 d61f700e24ec84c732d7fc41f3effe6d
SHA1 622e0f2ecb527ff549c9573a2fceceecc9a3ad5c
SHA512 7bd8d957858ee495d84b548fde63590652da0ec310a64052289f8fbc246f6a6d5c0b6cbe2f43dfda6009e5eb57eb03fc1bf3cb7c4381fdb7205bb41ec59f76f7
SSDEEP 24576:BD3FHshBIYQgAgqsBYsywPc8peO3r/UN95cS9l0Tp7:BDVHeBIAAkBYcPe+m9SS9uTp7
TLSH
T17B85E13DEA9D04E4D57AD2BCDA638A06E27138AD032156CB0290D1B95F6BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1516-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1516-139-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1516-127-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1516-133-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1516-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1924-294-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/1924-67-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1924-65-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/1924-73-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3108-312-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/3108-0-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/3108-6-0x0000000000B70000-0x0000000000BD6000-memory.dmp

Download

memory/3108-7-0x0000000000B70000-0x0000000000BD6000-memory.dmp

Download

memory/3108-77-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/3108-1-0x0000000000B70000-0x0000000000BD6000-memory.dmp

Download

memory/3624-84-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/3624-311-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3624-78-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3624-79-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/4080-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4080-60-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4080-54-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4080-268-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4256-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4256-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4256-96-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4256-90-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4256-380-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4256-364-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4692-369-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4692-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4692-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4692-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4752-47-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4752-38-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4752-50-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4752-52-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4752-44-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4808-368-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4808-115-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4808-121-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4808-113-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4860-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4860-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4860-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4860-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4860-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5272-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5272-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5272-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5272-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5272-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5508-365-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5508-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5508-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5508-102-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5508-108-0x00000000007C0000-0x0000000000820000-memory.dmp

Download