abe326e0a902482883b817c756727ecb027de8ce8cc7f9092d97cbe00a8ee7dd

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 01:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_2a1322121688dfdcc97512225b21747f_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 1.4MB
Sample260511-b3t1tscy6m
SHA256 abe326e0a902482883b817c756727ecb027de8ce8cc7f9092d97cbe00a8ee7dd
MD5 2a1322121688dfdcc97512225b21747f
SHA1 8c7aa1e63d484e36a28e180eb6abcd89d866274a
SHA512 2b56f8e8ecba4b8a660beac6571b13b68c367a855c7369fedb030dc2a84693c6065f91bb2ecf9a5ca75e1affdc5050ff76333159c015a12ad00b32d759e7a6cd
SSDEEP 12288:w/Xs9YqrQBNLB3TqvbqWop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjptB:w1qwNL9TSaNDGDn7q6dZhsCuarQSj/
TLSH
T1D0651221B180D0B2E93B483146A8CD7049757CBE6870550F67E9BBB61F713E086A9BDF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4996	alg.exe
3340	elevation_service.exe
6084	elevation_service.exe
848	maintenanceservice.exe
3120	OSE.EXE
2520	DiagnosticsHub.StandardCollector.Service.exe
1548	fxssvc.exe
2248	msdtc.exe
2052	PerceptionSimulationService.exe
2952	perfhost.exe
3148	locator.exe
776	SensorDataService.exe
3088	snmptrap.exe
244	spectrum.exe
6128	ssh-agent.exe
2276	TieringEngineService.exe
5604	AgentService.exe
4544	vds.exe
4236	vssvc.exe
5436	wbengine.exe
4916	WmiApSrv.exe
4008	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_2a1322121688dfdcc97512225b21747f_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1d6bb229c682cdf5.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_2a1322121688dfdcc97512225b21747f_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001dd2c760e7e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003acc6261e7e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ea43c61e7e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005bb3cb61e7e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4cd0561e7e0dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a61c3361e7e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034433a61e7e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe
3340	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
688	Process not Found
688	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5636	2026-05-11_2a1322121688dfdcc97512225b21747f_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeDebugPrivilege	4996	alg.exe
Token: SeDebugPrivilege	4996	alg.exe
Token: SeDebugPrivilege	4996	alg.exe
Token: SeTakeOwnershipPrivilege	3340	elevation_service.exe
Token: SeAuditPrivilege	1548	fxssvc.exe
Token: SeRestorePrivilege	2276	TieringEngineService.exe
Token: SeManageVolumePrivilege	2276	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5604	AgentService.exe
Token: SeBackupPrivilege	4236	vssvc.exe
Token: SeRestorePrivilege	4236	vssvc.exe
Token: SeAuditPrivilege	4236	vssvc.exe
Token: SeBackupPrivilege	5436	wbengine.exe
Token: SeRestorePrivilege	5436	wbengine.exe
Token: SeSecurityPrivilege	5436	wbengine.exe
Token: 33	4008	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4008	SearchIndexer.exe
Token: SeDebugPrivilege	3340	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 5172	4008	SearchIndexer.exe	105
PID 4008 wrote to memory of 4140	4008	SearchIndexer.exe	106
PID 4008 wrote to memory of 4604	4008	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_2a1322121688dfdcc97512225b21747f_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_2a1322121688dfdcc97512225b21747f_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5636

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6084

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:848

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3120

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5664

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2248

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2052

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2952

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3148

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:776

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3088

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:244

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1240

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2276

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5604

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4544

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4236

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5436

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4916

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5172
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2876 2888 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4140
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2916 2912 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bc0e63b2e05372a1edd7f340477ff5f0d06cd009319dd7342ea1275822e7edc4
MD5 69e1bfb980fbeba7baf9968149790d10
SHA1 21d4f1ad6959d9d8936fe4f6e2046af6b56a58bc
SHA512 d290f9436fc501e835f8feacb70ba22548f9551b49ae406cbeca7c87bb3f866c0c1c812d8b62ae49310ff8ab420c9aa150d63a9e09bb8e618ae2258219213b19
SSDEEP 49152:+b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnedc3L6CuQQSz:A3q6sjBZ2+CCSz
TLSH
T11CD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1179281a40045d775c952513c78a3ab85555376b8449f6a120578034f44ab6d6
MD5 caa2b356b1c82d58063133fdce6b2ff7
SHA1 93d7d73faddd41b9bafbee98e75835333d7c8ff9
SHA512 0014f5c77196919e816e05b3d06de5c1f63fda50ce442d82d2530e7e65b171b4b62bfcd38aba60b0933e81a24b4f9dda2e1e8097e19dc1de8f46bec7036aa04c
SSDEEP 12288:61XLsswWkxy2lRq2czAEop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjptc:QXYfDtczA9NDGDn7q6dZhsCuarQSj/
TLSH
T1F265F12877D408F9ED67823CC9A1C411E632B8954364F79B03E4DA661F336D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 cedbc012e2482dc0d05a8ea5ef4059362f114c9265b719867e6693f64473ae73
MD5 306dcb379e86cb7d984c9a8f60733de4
SHA1 fb5a208e07c647936abac0d3bb3d88399280a58f
SHA512 e02cb8c70b78319180681549b0100cda1fa5f200943e71f31f644b0172a1d668c7497301568c8c963cd597e7a4830550d7b82a72e63b5b04e2ed63ed70d8c5ce
SSDEEP 24576:E0Le5ji0hmxxrMWNDGDn7q6dZhsCuarQSj/:EPji0AjDdc3L6CuQQSz
TLSH
T14B85AE16F6748375D073C0B9C5D2A68EE971308657308ACB4286D77C3F67AE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e9990fa42864c5f2c3c45b2298fa59e974e615f56a18d2d66ef74cbb45ddbd69
MD5 fd0aad01c728c2742341f4eab77b8353
SHA1 e09f1955514e8596b6c5931213b4237d12e2b6e4
SHA512 b71236b6ddcb4a36e0e22b6910eae8a30f9d5860f57bf26531831971b5d2d8d0ea3c1c79e60a426a362ded6382e79e3c04b7b59decef61215c98f3e317989e34
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWn6q8wyuINDGDn7q6dZhsCuarQSj/:1/ezSC6vUzPveHjyXdc3L6CuQQSz
TLSH
T11D756C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d7628b606da2010a4dabbfa0fc92eb174d43eae0a6272e20bbfba71cd16e1166
MD5 959497277a57f264d3ced97648f41bb4
SHA1 fbb30dbe1a60800321d3337a6a5d8c130223dbf8
SHA512 1b9385fe6ba3a02503edc819401d9e5154d4aaa8a91170281bd90da79d2132c04f10529e424de292a20210f43a77b23ad33a40b842f887dfa9838e9e348c3c7f
SSDEEP 24576:NVbqPb88hv/l+YJNDGDn7q6dZhsCuarQSj/:NVO88hXl+Qdc3L6CuQQSz
TLSH
T1B9559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 98942425ab8e39bd95a49a13feb452e4745f04f34035346554fb633730047bcc
MD5 ae3b0233f4880a94b539164d9a291589
SHA1 3228492970c33485bad23b72e273d2ea4d247ac8
SHA512 2abb2b6eebf51029ebee7034406efd6c88a6cf6b0a8116ee329db2f7dfcf3a51ee5641e12d9dd4a438ff175646e41a31c52ceef0ba44e58abe13111108972752
SSDEEP 12288:/LZop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/K:/LyNDGDn7q6dZhsCuarQSj/
TLSH
T1AC452349994460C6FE77CE382614C8119630ADEDB0697B2581D2FFD61E384F0EED1AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 d8204c3f6689a512bed7dee2dfb4a6597e5b82d3712f55e3e90d748b413f9c30
MD5 30187f6b74ab06b51ec7ae0fa791120d
SHA1 989cb3d4ca7b237011a830547179f82f64ae544c
SHA512 8967fb5723565b820af9c8e89b013a45b5aa11c8f44faf69f483dd4b2cb937fa4506823f0b5f344dff5232a2565c8e743d0d0c9587cdc648de71b80c1abd0288
SSDEEP 12288:keBNUbTVO86UIop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/3:kJIUhNDGDn7q6dZhsCuarQSj/
TLSH
T15865CF2BEE28FCD2C67A8DB85B51C600D77278704B62A3CBD165C34E9E235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 81a7c0184fb917c81cdd3322b51ec989fd3ef7b8e90f80b12db671d83c055c03
MD5 bf3baebff0624bfd8c2b61bfad4483de
SHA1 94418d3d02e939fd835a91c3b426ae361c333a0e
SHA512 a75af427a5b0e8c3e829ff734a8830520545df008a4104ca7d1d2e2e89f727a24371744079e1ab741afbc47091b8206fe594c7a2c6c7aeaf79e594a0b4e81a7d
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THO:IQvGAdlCEL8c/DRNw5C42+CCSz
TLSH
T1FE266C656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f842ee8a965eea4d29bb884ef3d992f077f0d5c5d49b8c071c8593865a185004
MD5 18eb4ec1df3e9c2e2e2a9b87d94e75e3
SHA1 b1708e54fd45e99f69c1937d4271f2003e6faf80
SHA512 08c67dde4caea9fe0e8b22d7c93b73fb0bf3a9b1197b059f39a10bce609c388fad63f48209208540ba3df92389e504c0ae99aa3e2dacda33ef8acae060e6f715
SSDEEP 12288:RAwSfxL/2Dc3RDLLmt0LDQewsAjyop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwrow:y0ewsAjzNDGDn7q6dZhsCuarQSj/
TLSH
T1E575E031FE74E036C67B0DB61B25C716543CB9604B612AC3E3E89E9E59301D22776E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 082f13eee967aa0971ad2e0b2a5a8e9c1740a0c432a6e822a6d24c39e7783854
MD5 5f1853e49ca7a4ef2b130af29a53aab8
SHA1 1c6b5f7f3a3885e237c582d5ca1db73430f25fc7
SHA512 f537d2d6427429ac92ddb430eb524ebc7ba3b93da748f84a56fa407d190b9738d02ca52468104307cea9ba7e1c8047d59a04ccb8bb4cad6a083755f172956ba8
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH9PS:KUEtQevvqc2W1cpV2tI32FS
TLSH
T154474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cfbb78091f03d0eb62fdf089947dd37fa22b8a2f1f6f7bf7e5d7399e7f77a302
MD5 121d995cac2dd89e0d354c958407875b
SHA1 ed49b67a7ee0abf2f85305b03604271e7c809fbe
SHA512 18bf6031130dbe9b49062c35c9144bd01ca0f5d6fd2b2cf262b79cef754efced6940f3df12c4efca58327480732c201fec38bf3c8731e50c301db029277112f2
SSDEEP 49152:FCbRquA/m2yL5zTfFiV+XenmE3/zTdc3L6CuQQSz:SoquVjnmc2+CCSz
TLSH
T130D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7bffd61704dba7d7ab28d71f335985da3a9d12081a5fe24e9d6b41a78efdb9f8
MD5 9e077efc118503a8d88d3566557bc537
SHA1 c274d8fe0888d26c179e6a245eac81adaa4d354a
SHA512 be34a98ddba7e672dd8877362d518bbcd3b26e5228d9bd531277e54ab05091c18b3410e80b0ed0ea1b836af28642ddaa5bf64fcbd6a78a22f29b8ac98f4536bd
SSDEEP 24576:NAhGL3IFoiwtA5l7S538NDGDn7q6dZhsCuarQSj/:NAMUFoiq5Mdc3L6CuQQSz
TLSH
T18335AE80E7F955D4F5B3AA7899768470EA76BCAA5E31D20F2150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 44d4ff927b95175f60577c3addd0b2f15aa78eccbd8024463ef88f015fd0ff82
MD5 f1691169d3be70013c9f3c38eb167514
SHA1 5d73f11b331b09571f067d5fdd4afc278ba994de
SHA512 8ca3bf7398b943fb441064f26f691ee2e0395045893c185b1409b7be99d5d582ea9f9456ac39e481548a24405daac34c4503f9a0ab659a126c3ef997499a7ddd
SSDEEP 12288:Qmw5HEjsChNVBFgl0WDm+Cnop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWp:Nwu4OW3NDGDn7q6dZhsCuarQSj/
TLSH
T10C65F14976A41CF9E97786388657C432F7B2BC123625DB1F03A0C75B5F37260AE29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3a861019c18719012d54aa92c6e441bb2a92eaa564aafe3a217255a5d1f2511f
MD5 f806636bdd054b7a49379ab3479b06f8
SHA1 4c02f5a3c086a02a837fbe35bc6dd2e8dc76c1d6
SHA512 0c2e37bec54aa11dab81434bd5ca2f77d42137109a276e1475f122195c644b33b63e694c6f20d344416c52ef49382659e2e18ae4a788c5a25c54e4368d1ee64e
SSDEEP 12288:ieZ1Iyiop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/r:vZuONDGDn7q6dZhsCuarQSj/
TLSH
T17455124A269430F9F5B7CA3C99A08901D37178A7733553CF02A197A62F329E09E75B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 17e1dedee6361f51e129741beb85758d03c24c75846eab6022c032f3e881e652
MD5 4368d8f70b5ead3ee10f4de572a65154
SHA1 004bfdace699f1b6711830a41bbaab195d761716
SHA512 7ddf0445b0c6b4db0836e90597fe61665bac4e10b8ab1181a12e5bdd6d96fa19a0c9143084e87dba34832f86ca4bcb5011d7398f386f1a7e5b374fee5d5c65b8
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ui:UQRQyi36YOcPbLvw2gAf+PN3V2+CCSz
TLSH
T116667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5b130b937fcff2d9f9a4bb7fbb0736002da9b91b8a42f239c7cbe460764a285f
MD5 585e68ccceb06cc12104dbe220459ba5
SHA1 d5366c56b53672da6f6cdff8e9c18333a1f6a7f0
SHA512 67cbae1bf5166c735c053d9a64fd8516919ec06f6a2df297b507bfd31051a15fd99cf2c3947ab10409454e7d0c1c73ca4a0fff4056bef98f294780c140a2d583
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ui:aQRQyi36YOcPbLvw2gAf+PN3V2+CCSz
TLSH
T163667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e59be02f4216ef45043b8bfd8c973267e7d842bc4824b1155e196e579e1f72e8
MD5 efb6a1b1816d605749e28744e45cc8a4
SHA1 06d424c622e0263d7957ab9d9457b3ec23e32e89
SHA512 d25edd426cd2d185c19560b6b266210513d81843390e386d2ca35890cad2e8da508b5c33e799186843d07f44658e2cec9f75fd92a9d9e636257c6cb526101681
SSDEEP 24576:5wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0eNDGDn7q6dZhsC3:l68Qg55nhceWu7PNU3/Ddc3L6CuQQSz
TLSH
T1E2B54933B2F600A9D44DE1769F4A872196E17C758FE0E3DB815172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c1529fc7dc3a395d94f2624775c182821fbf297d2f9f3849c4c27468e20d957c
MD5 0c8169184832c337e6f9d6a576d6ac3c
SHA1 8af6de833453eb794ceddc26542450b6f047df8c
SHA512 5fd3fb093808aa6ac3c3ca8cb85f41f6502cc2df5b05b8bedf3efc967a6911ea7053612a79602ed45381764d59e21015981724c751c5d0e83a4b2e06e229cce7
SSDEEP 49152:J3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99I:Yy5112gYy5azzVvt69nLKnhZy2+CCSz
TLSH
T1A9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bb1cde51e98a0baa336c00549c37b95aaa55897dfc83af51fc4f40cce2a89f24
MD5 fc0329605ad8f8293c913d081d20d2ce
SHA1 9dd88639cc46071cc6f16526f4103de9eb369b2a
SHA512 6fd67782a118bd6d1fba394721ac9ed27a064a2dc0018320b8e586496be0617fbc7b8c1506ec369ed37726d006635065e24f7a51f2b67a0617a7604025647318
SSDEEP 49152:VB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glNdc3L6CuQQSz:bu6Jmdxd2dN2+CCSz
TLSH
T157D59D13F1D901E8D06ED478974A9233EA62BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 37aaf56a0c85b5fb53f9709afac30c11e4608f38503c5cde185b212d0ca492e2
MD5 d5b9ac10db33ef01baf92c1e730185b0
SHA1 149d8d3383d78270d96d5ce1f293e6103fb9d46a
SHA512 996a8bd7d95eb9a5ab8d9dc21dec49780a1457dd894c2ed52b644ccf588ba545498383b4722f838fb27ec38212bc5dcfaac9cfa359f9b2898917223142cf6306
SSDEEP 49152:X1hpsNoJpF1A63U44CwH7R4xBdc3L6CuQQSz:XmifPWRc2+CCSz
TLSH
T1F0B5BE13F2D800E8D06ED17887569632EA61BC460B34B6DF0A90B7961F7BAE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d71b8c1493f1b4a368921a08ab61a5efbd17d59b4bfffaa0d858fdb15e1785fa
MD5 8ad25e30a493067a8d4d28a84e789cc7
SHA1 238d83bfb9e0197929d166e3e1dce0d9632c6e50
SHA512 f001c65183152ec8b5de664a04f061599b7a9bd48fcc9f93c0e41a25d8e8d24f7906742126ca277c5379145e519584ef8ef25a1ad508157386020569d7660495
SSDEEP 49152:NSuZQIY0Be2KcRVtOnks6NMHqOdc3L6CuQQSz:D5dKii61O2+CCSz
TLSH
T105C5BE03F2E940E8E0BED67887659632EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5bce98b867d1636b82983c4ff825114c28d56a1693f434b0bf382ce9448b5f77
MD5 93a7bb3c0f8b9b1ad036873171b071b3
SHA1 c80b737ec0772c7afc4a71af0257aca155f0cfaf
SHA512 88a5ca6d2286dfe46c8979dfb250a3987beeb0106340add7a6032ba8c4a56e25544ab475ad542ec8cc9be4d37c46d0a419d74f8364c61144ebaeca11ece02691
SSDEEP 49152:2htSn8EApI0fig3giDn0AP5w9dc3L6CuQQSz:XX2imphA2+CCSz
TLSH
T1F295BE13F2D900E8D06ED178C7468632E962BC160B35B6EF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5fa062eac0beec591474da9208ba1ff616d72406cfa47769328ae7cbc541b42d
MD5 bc285577def4660e3876e0b4b8c2a457
SHA1 4bf7be3923defa75a4243c550d9e8af48ac1afe6
SHA512 c47b3c946a85da3b7a1321ba1f6230811c05184eb412bb541a6ef024f49eb754fbe442da0aa1a29fd10f82cc0fa56452e39db8ad2bd3e35d9e22b18aa4f50fe7
SSDEEP 12288:Oxop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/F:OqNDGDn7q6dZhsCuarQSj/
TLSH
T13E452309984450CAFD76CE786614C80195206DEFF069772592D2FBA26F348F0AED1EEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1b9371d5a1cde8e60b8fd64a2dabdfd6949a9cc2476c103f64e22671ebcc0e7b
MD5 952e288000f03d4538d4a4cf3699c810
SHA1 fa51a23e1fe549d3a0f61a35c41453c6508cf873
SHA512 31984b6c1fb61e167807eac33260ceb81468d59831ced29ff87385d24892f2aeedd7ea3ac8da7f3742e8844094f0e9b33f99656dc75fcbe2051fc79237cd5c74
SSDEEP 12288:Yeop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/5:Y/NDGDn7q6dZhsCuarQSj/
TLSH
T1E9452309984450CAFD36CE796614C80195206DEFF069772652D2EBA26F348F0AED1EEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 af5a5bf4e1022d4c9ab07afc0877e603502fa44f060c31c688e9640be528208c
MD5 d26840f74ec54236fc0aa1982db733ef
SHA1 21e82f5369bb131eb2812168cc40e74583f1740a
SHA512 be3692563903d6994680afb562a47254b72b9b13dceac5c43c298a0231550a9ced1af0cbcd8c1bfe292af8e86d8301e8871ee4ccda1c51069140aef082201db7
SSDEEP 12288:SAop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/5:SZNDGDn7q6dZhsCuarQSj/
TLSH
T160452309984450CAFD76CE785614C80195206DEFF069772692D2FBA22F348F0AED1EEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e117f25013def3cb5c61451bd37ec7f4e8c471c876eaa683411e614cfca720df
MD5 837c451b439e8cba51cb7dc1eb28dfe5
SHA1 57c1b5d7bb7bead82513edac3fe5cd3d1eda8c4e
SHA512 af373f4cef08a8292d4ca131d7d31ef891cfa29ba22c66ecf3ac47b7710079cc0b31d8608b8e0561293f5a1eae8110600b3efbad03badbaf362712f3df9016f4
SSDEEP 12288:PVLop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/a:CNDGDn7q6dZhsCuarQSj/
TLSH
T1554523095A5850C5FC77CA789A10C411E270BCEAF135776F5281AB961F305E0AEB1FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a66a69a838e6d33da840786f82177efec1edbebc93ca531aada0bb1db44d83f3
MD5 5f190636751adf8ba58e36d40a8ac910
SHA1 c81136a02de08bcdc74ce6b00198f81358d6f319
SHA512 98dfb4245fe5f07eac8febef10472c1be5050cc80b64e41900608e016ae20509a897d38ea3cbe47547e3cf395888bf882e4d8c7731e1fede458c4c78da175605
SSDEEP 12288:Vzop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/F:VkNDGDn7q6dZhsCuarQSj/
TLSH
T17A452309984450CAFD36CE795614C81195206DEFF069772692D2FBA22F348F0AFD1EEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e80b2c9302544c31b3d79795fe5ce40d805de39e5adc96b5c4aaf67871e024d3
MD5 fae74e208923547afc7c32d1fce09108
SHA1 49979fbd15cb4e64c50ca73e63244d4495b0c622
SHA512 b59a1ab0ea3b9a114713e42065194bce31a6565335b04aca46dd0c48da5c9995dcf702e7c74812f36125f8f0fd072a5a3a24b72184c819c6a1f014a043a37afa
SSDEEP 12288:XKop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/o:XLNDGDn7q6dZhsCuarQSj/
TLSH
T10B452309984450CAFD36CE786614C81195206DEFF069773652D2EBA26F348F0AED1EEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 82119a2c8fdd333b452c572e20b50b202caf605569491f6703525b75f4c278b9
MD5 8fd221abd114b4936e0e6eb18316e693
SHA1 d7c19c85885400f4e7654b3f76341f7a16b6a1eb
SHA512 daf13f65e01cd5861d7e5a705d085af87c2d84888fab1dbe87ab2e97d5759862044743b9969c3222ea2744518968e5d99c50403e63046708f2692a526003ec75
SSDEEP 12288:ymop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/w:yHNDGDn7q6dZhsCuarQSj/
TLSH
T137452309984450CAFD36CE785614C81195206DEFF069773692D2EBA26F348F0AED1EEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 24b51fcd0d79551194adcff61013adc97774dea0d6b806acd0c28509fdf9361d
MD5 44f5c42ff0e9b947fd7f79481372383d
SHA1 dbfdf433446c01950b4530e1fc1a56bdf6dc03fa
SHA512 449218a82ce96a5ed1aae8233e65f466aa543a9ae422113efedbdb653a1c7cda91204c634d62a418f0eb86744048d6c86818f562f614d1ce6a1a3e5171b1793d
SSDEEP 12288:SiZwbVzzFEoS2cPvy+op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/D:1ZMRzFVSOfNDGDn7q6dZhsCuarQSj/
TLSH
T18E65F199B39018F8EC67863E89158806D6B17C6A5670C71F03E437675F332A05D3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 12de35cb8a6ede3f7e7cc273a9ed00453da1564dd5e7d263c579fc2614f0f0da
MD5 a3298516b540e2e901da68b8fb6c3d44
SHA1 56c41583839c77f981a34e7668ac0572b212e71c
SHA512 4db2baed50226ba42f655a5fa82288ba638185f174a504361e51832f72d0df21ee459629cc24f0f7555bf8a3b94f4137b41749cb000d7f645932c8e1a4750aad
SSDEEP 12288:aFop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/l:a+NDGDn7q6dZhsCuarQSj/
TLSH
T109452309984450CAFD36CE786604C81195206DEFF069772592D6EBA22F348F0AFD1EEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1b0d97b10a00443b39ff4180e9b38eb5f8c7e2fe240088734f54e895cef51109
MD5 c2b5f03d44483908c1c97ebd733473e0
SHA1 b691d32b972654b1aa5c77dd0e2b3c4058ad7e5c
SHA512 8aa10031670bd149598fd5ea0f6f62aa972b07547293242230160a98b558a2d5ae2f5ea39778760d78f8c2a2a27620439460aa06a05326cc8934f7fc1aab1fb2
SSDEEP 12288:DJop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/F:DiNDGDn7q6dZhsCuarQSj/
TLSH
T1F3452309984450CAFD36CE785604C81195246DEFF069772692D6EBA22F348F0AED1EFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 3d232004af7d81acc7f753e83e34cea840e193bf995fae205eed081f8174b891
MD5 50dd3d60dd287ea823b1d2be074ed93a
SHA1 9abab8d44afac241d65d252531e7404958e22a9b
SHA512 575aaf329ed44b2fefc14e27fd7514b63f12e4e3badf1e2ee03c51ef617f32aea644c4cf82248b519ecc450f1289de2f5443ef86264144249df5327be1266c43
SSDEEP 12288:dyPz5L8iop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/r:UzyjNDGDn7q6dZhsCuarQSj/
TLSH
T1F755120776A030F9E537C63889514902F371B87657249BAF13A047B72F366E09E7ABB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c1072fb9c6be9872e1eb06efd63c20c9e34e11dce79c54a6cfbc9ae4575f9444
MD5 a4e4c3b63a353c5ca90b23fbd70559b1
SHA1 1789d06d2de3dac67f81e532712fce7189ea5524
SHA512 36e2c8128baf798cbf14fe78d3217385a290b08a9dd0277f34c341b1a8c7466921cb801bbc4bcd92c1793eb81d6f74510f85419878b7d65e4460576edc1ac989
SSDEEP 12288:NFop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/F:N+NDGDn7q6dZhsCuarQSj/
TLSH
T1E3452309984450CAFD76CE786604C81195206DEFF069772592D2FBA26F348F0AED1EEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f23bc990b4c961102c9bbb1c2180fdf92fa3498abab7e05b338fd5bf5b8a15bd
MD5 0bec73fd7f2ecf9d86937b5f4ce8b8ef
SHA1 9afbb87f57c6a24f296f09da5b2cbadd6ed1ecde
SHA512 325c16bcc5ee1a03210994333cb72b2c7562e14a9dfba59577185d50ffb691bd11025a0111db407b1b19e053adca74a97b704838799e0c01f371e18dc5b97de2
SSDEEP 12288:bFop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/3:b+NDGDn7q6dZhsCuarQSj/
TLSH
T1B9452309984450CAFD76CE782604C81195246DEFF069772592D2EBA22F348F0AFD1EEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 2c1642b299a22f436a1217ec3daeb389e674b5a812a8ece1c4d7d902cc6d69a0
MD5 59a7fdcafdd99a4575bf2fb4f54a6aa7
SHA1 5acdc9f097cfc25e15a2c56bff5cf4cd07181f25
SHA512 4d9b34d0cdd56d32996a004a141975d59558fb677d77f7fc94616d5320a3392093c376998f31dba389ea286b2ebe1e68b332c22d4488faab9a30252cb3b114ca
SSDEEP 12288:3yPz5L8iop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/F:6zyjNDGDn7q6dZhsCuarQSj/
TLSH
T1BF55120776A030F9E537C63889514902F371B87657249BAF13A047B72F366E09E7ABB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c4645250eb0af06ef9bb593ee85fb2c63072b0a8094370b492500e366159df92
MD5 73209e7fbbb365269edeacf145df70ab
SHA1 b7aa17a57deb1f2a997d432cb4cdea460d2e6ef7
SHA512 74a17caeacbe88710b82000fa199a82fc07ca0310428a71a32314a0fbd11633479817a1c452fd2f37111926e215d3eca5b80d2b41ec6f51ba0ed8066b019e953
SSDEEP 24576:RTDaLl3z0zDpNDGDn7q6dZhsCuarQSj/:RTuLljIdc3L6CuQQSz
TLSH
T18665F199B35018F8EC67863EC9158806D2B27C6A5670C71F03E437675F332A05D6EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 4461309647e542823517b51afa62add4e05d881eabf16079835435a31fd4d4c9
MD5 21485904992317108986d544bd88521d
SHA1 2a3970316180dcab5d130ee077f921a69cd1ff86
SHA512 0e1e08c6342c43a4c1d9ad1c0affa049505259debb75320d274d5ea8ebc0481b54633dd6f76a37830ee2b871ac89046166c66b7e0b2025f5eb563e031af43a0d
SSDEEP 24576:73vd9CHKy7GZ1NDGDn7q6dZhsCuarQSj/:bvd9CHKya7dc3L6CuQQSz
TLSH
T14075CF90F3E410E8F0B7CA3589758511DA767C9A5B31DE8F03A4665A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ee60940592d422b951d6d48eacb5f50a306e18551fb806af37ed6a2c0a3ab2d4
MD5 084a588ebc2602dec1d129535b09781a
SHA1 c3ed3b0a3384bcde5ca35a5359c70cca2c115e17
SHA512 02bda04c65d55662d8bf542313b6f05d8595f921baf929fd8b5aff6b3ce5dc1305c739cfe7e4b58dc7efaaa8d99a5dc0818e379e55e72f64aa360c8a1b77d502
SSDEEP 12288:tgop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/d:t5NDGDn7q6dZhsCuarQSj/
TLSH
T181452309984450CAFD76CE785614C81195206DEFF069772692D2FBA22F348F0AED1EEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ec8996bf4e7a529cfdb25f1be18cb0a12227aaa827d0112e852d2c30fc86e644
MD5 0945165ad03970b552251af58f83e3b1
SHA1 5fb712f5955954a3eabc4f85cadf2e09a44f8310
SHA512 afaae8c42b111cec56ea60988e6e5d9986001e401e302d0a0c65e803f8f052ad8afbf909da487c2d024415b301dc772b0ac41121c81782287cb9346f842cfb9b
SSDEEP 12288:9Cop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/F:9DNDGDn7q6dZhsCuarQSj/
TLSH
T1A2452309994450CAFD36CE792614C81196206DEFF069773552D2FBA22F348F0AED1AEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7870ae6cd38ef14fccbe53a7e3e38ec45484ce178fa4efbc0607a3e067fd243e
MD5 f40da0a98bc88a5ef9dd4b91606cd60f
SHA1 12077e1ab18f49411ee2b52446517a86dff36dd3
SHA512 dd68e18995d49ca78e3439437ea8de9a51a98a73509e98c54eb332b4b771a34f6356102bbacfdc57b593cd210f62e4be569928d32a783e5e411af0727c4c4a1c
SSDEEP 12288:aPop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/B:awNDGDn7q6dZhsCuarQSj/
TLSH
T109452309984450CAFD76CE785614C81195206DEFF069772692D2EBA22F348F0AFD1EEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9e941944875a785d3d08e259aac1a5036ad03b80d29cbcb82f2513fc768aad31
MD5 595a46f14cc670fd3665b86941da7bbc
SHA1 b625059c137e8e04a2b40d292e5d74d79b44302c
SHA512 8d48abf607b65dedb0ba5d9102e4d02cb98d62eb268a4657bc55c5172be79392ea716568e4c78f221be84e9b9ca97055115a358d0f5c1236ea2f86c9b40d1854
SSDEEP 12288:9Fop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/B:9+NDGDn7q6dZhsCuarQSj/
TLSH
T1E4452309984450CAFD36CE785604C81195206DEFF069772692D6EBA22F348F0AFD1EEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 9d010b7b5e0aa17759a9e4d454b91179cc6b7c132b6afff9c7aca21941b53315
MD5 d12396a7635993d8ad1d3a0ac91d811a
SHA1 73a043b6548e527dd83cec895b91736a4d3566a2
SHA512 c17cf526129a78cb1c5c65af36fd267aabf207fc6d0837f10da087d028979ab1bddc704a948fd849bd5cd5eb4c544eeb52af91c37604b2ed544d3e86d56a288a
SSDEEP 12288:ObsfVop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/C:VONDGDn7q6dZhsCuarQSj/
TLSH
T10855F009D29801D8D46E9679CB158901B3337C6A93E1E3CB52C0FA7E1F355E09EEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cc968cb1fc5fbd74eeb19d3b284c054c8e1608a7715a0fa0d4b3684e29ea8f81
MD5 87795b442d7723e776c70f6893d76f0f
SHA1 dc12899485a3e7b0fabbfda4eb32de00e9824a2b
SHA512 abc6d5a72b971446db27a960e2cd8939c3a2329e0287b632da45b037fca92478644ed34ccfe73af49fe85db3e808f4f0097c61cad3b276a0b2eb693654cf6f44
SSDEEP 12288:7sop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/8:7FNDGDn7q6dZhsCuarQSj/
TLSH
T103452305964854C6FC7ACE341614C421522479EDB728B7A7A181FBD62E348E0EEF1FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 770e0860a1ca73a86f3f8a91c7e2b41a7641017f51aac7b9274d3de90d5edf32
MD5 4fd8a26c68b73410ef51f8e1a2ec39dc
SHA1 25728c030fa91dbd4c1457159c0fd776d990211a
SHA512 ad98a21515fd23eb17188002f8882ffc6e9f07ee1c965d4f1e40c61b5fef88377f2e21f28ce06e3fda26f3ba0ebf85775456efc2f0470be3b6775454c941dff0
SSDEEP 24576:g8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCTNDGDn7q6dZhsCuarQSj/:BRZwQCyiHiQEaiPnMadc3L6CuQQSz
TLSH
T18285BF1E62DC42A5E0BAD278CDA74407E6B278165731A7CF0291C27D1F27DF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 326cb54b002ce2d84610ada051b04cc8eaede9f29df1fb65aec6057cb583ee58
MD5 c0958c511dd0396bf94a3586432f005d
SHA1 05a32eebd1ddc227df678c49aa52645b954eee2a
SHA512 a2b3bf0da2fea4869c75237bb75df34596bb65ea71b8676660bbf059754dc1d422772d18b70bcc45b851b7c9da375890b2285191e00fa0b917a572f7b1f1a23e
SSDEEP 12288:ebxA1U7K8op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/3:ebxA1UGVNDGDn7q6dZhsCuarQSj/
TLSH
T13D55011E669C24E5F576DA3D89918002D330BC6A6325A3EF11C1C3BA0F3ADE49D75F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 768eeadd8838541a82597d764756380266b2202f14d6fa17a3112188e070765f
MD5 64ba1e17780c6c93de79e3eec8b6fcab
SHA1 4c93f5da402a177b5fbd4f674069fc5d704316bd
SHA512 e4392988a78fca88353ad6c422b6a8d17e34400a77497f2be97dfcddc374bc15a0063d0e4a497f3fa7ee9a8ccba42fcfa87cda23d5e4c850e6b7ba2c95337235
SSDEEP 24576:yjsmP0yHaqrVqHra44KDzMsrnMNDGDn7q6dZhsCuarQSj/:yjRP0yHfVqzlAsrnMdc3L6CuQQSz
TLSH
T15745AF2EF2B910E9D8AAD136454107B5AB71782D1F209BC70170C635AF0AEE89F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 938c959b3b1d6ddbd8af07f3fa6881f40807b21f2b45a5c9a08f366325f535fd
MD5 ed6686996862f38b00d21096035e1898
SHA1 f964b24fb14de4bb1d6cb0c14f431cf02fe62538
SHA512 9469800482ec8882667c829bc9c4ed9d31b3acd783e7ee67b9881861890d7c1aed9d27ed7df9af6524ea3ba9d20c8b90b0ee7ce211c0a1f85facdf0e07d79bfd
SSDEEP 12288:66op/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/d:67NDGDn7q6dZhsCuarQSj/
TLSH
T1B5452309994450CAFD76CE781604C811A2207DEEB12977A751D2FBA21F384F49FF1AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 1ed83ac7bb29aacdfd032c75de2670e3459e23c5dc3e3e1a736a518799beff45
MD5 01df978e139a1a78b7a0568d2efb2fc2
SHA1 ffa788aa5c5ffaff98be06c34dec5ffa8fae3c27
SHA512 2898e5d228f2a1215afbec60877be810a8e4bd2c0ae53423a9f5f6f6bbcaebade785a4f228eeb9889897859beb86fb43253f04621e53a2d618e9d320bc2ecb76
SSDEEP 12288:GObfA4LWO+vAYFTwop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/r:vbLBUTJNDGDn7q6dZhsCuarQSj/
TLSH
T1EF75F145E79400F9ED7BC13CC9628916E271B89D1364E7DF03A88B661F236E14E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 fe0c5ac11a588d0b57895d5d77eacf75aa1b45ed86673ecf18f0cfd251e28d89
MD5 51fd7bd8a01bcfefb82050b02688a362
SHA1 7c28e415b639f1588844df89053e989ece2850e8
SHA512 180204a37ce4fcc65f4e716963dc6a87adee35820420e23e3a54712282e0ccaffd0f5b9fd376ecea2e453a1951c2dda75343d3757c0f6615b0b7fec989cb49fc
SSDEEP 12288:m70Vm9IYNvUyBpVop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/h:3pYNHQNDGDn7q6dZhsCuarQSj/
TLSH
T12365F11E56AC18E5E57BD17D8A828505F27278A61311A3DF01F0C3BA1F27DE8BD3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 80b6c7d962d9479f48b390ff6e470d06c238f605b5d87c55ef445f8c4844a490
MD5 3c390dff62eb006d85a20b58186588cb
SHA1 2bd3a9b2292d3319ffed16fdfba807a8e07fd8fd
SHA512 237b17f26f9e056438d8a6a20ecd71661a2f2bc311da3e10e8b953c14c051932d8f3799d3e13e050a14e8633e5afcdfe628f31b6ac229325c2bb0013d0572845
SSDEEP 24576:wnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKk:wnXoJJYH84VVS6AmEOJas+cHBjSSKHPU
TLSH
T14665BF5EA2BC04E8D5BBD17DC5828506F5B178661331C6CF0261C2BA3F27AF5AE35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 26d1f717263c626d608e9b40d0b984b8e324f74c852637370979e0dbeeedba12
MD5 6c995527e7b7e08fd664289ea18fb4d8
SHA1 e758a2f887f843a41645a6346d17b8b65ff64678
SHA512 8d50c2d6f50c478b796e141c766d73272cb792393aae422617b2d4fd7fb4c31d994ef060b2bb21c5950cf2db76604eb20bd49ce07bcb99bebd7ddd16d1b7efe1
SSDEEP 24576:lv7Xbxd9Tuycf8M/TYlSuxrr2PCWNDGDn7q6dZhsCuarQSj/:lDLL9TuJ0M/TYj2Pbdc3L6CuQQSz
TLSH
T1D9858D1EA2EC42D4E47BDABD85B79046FAB2B855173091CF0291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 21dde683b2297c483836dbb85933f84f0ea73303626d235ef514891edcc33a45
MD5 20f43639df1febcb7209d6e9ac256b86
SHA1 45fbf60a6ca63e1475e0a26325817e34a1b36878
SHA512 9d557f3a2ef2de4dda5790453141685b2a4e569e7c7308ec1b30060a21ad32eaecf213776632ba3431e86e5b925dd4fc05761c5ddcad21c6bc1e663286b1e101
SSDEEP 24576:UegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wJNDGDn7q6dZhsCuarQSj/:UngOJOmPOHzJdc3L6CuQQSz
TLSH
T1F955C02FA7BC15D5E03EC17D8A968816F6B0782613355ACF0190827E5F2BEF46E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 5b1e3f35153643a04121e70a8edfe6baae7ee55fa76d832d5395e73df2a27fb8
MD5 c1bfaf10d72d9a4213a0f394783f548d
SHA1 e9381d50933be342c8d3c5748fbf0ffa434ca70f
SHA512 5d866d051aaf484c3bd1b8609b1c47d4536d628a0d4c2d1ae83a47ef00087b009fe1822eda637df77254f5d14ea57752a1b42df52766cea55c4c236e6e25814e
SSDEEP 24576:ALJnJiTk3R3waE4JrObNDGDn7q6dZhsCuarQSj/:ALJnJK8R304l8dc3L6CuQQSz
TLSH
T15675E12CD2A810E8E4B7C2B4825A1A56FF31347D3B216ACB15B4D5313F11FE0AA79F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 719d6f24d4d87b072d3ca7b9f47f68acff02d0cf314fe1719e6867254defd89f
MD5 2438e68f041b93212825994d9f3def18
SHA1 638859085a3187510bfe1162a0de429bf90e932e
SHA512 c11a9e6fd9485874e962bfe636c35f007cab971469f00d37107f217e23857dfb32040f6547f2d46f8490aef15bf931483b9eb2824037c83c91b7bde717473d2e
SSDEEP 49152:L9mqCzDScAZmlvTcFg8Ph6Hdc3L6CuQQSz:Pw2+CCSz
TLSH
T1D9955D05F7EA5298F8B3CAF1C96294159B327C509734F7EF4A80CA6A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 c6453ea0401a26a3ef6e23553497dacf82523f8b0c927d8f180f4581ffc4b278
MD5 c57c9cd1a640a73742ce7c328a86b29b
SHA1 22d535f3290253efdb554ac94025c1e092ff9399
SHA512 af8df74f4c8efcc196968a60bc88bf9c639a52dce2e536abd35dc9171a4a3be88c3d9af64eae226dc820fc78a2aeb7a845e25ca42a4bfe3a74dc22fb00d696e3
SSDEEP 24576:plYJeXm5jUuEfNDGDn7q6dZhsCuarQSj/:plYJeXmRUuEfdc3L6CuQQSz
TLSH
T11855124D6A9C30E5F53AC9799A518800E330B4BA631167FF41E0D7BA4F359E06E39F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 6b740535a12a680bb301dcb27d718a23f91a2559259a857e263995449dd4be3e
MD5 2dbb9c898e1d9f23ecf462c26411edfc
SHA1 ceb0d0cc6a6e847987bf1d22dd24b6b227adf6be
SHA512 50bc29e4125d2068b08ff87758b1a17a892d18581faa63d895982307341cf96f054bd6319002c18b6cbcea64f726117fa25b52143732e244a5247ca6e0dda809
SSDEEP 12288:Mmu6kybop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/i:M7tysNDGDn7q6dZhsCuarQSj/
TLSH
T14E551208669460D8F9768A389A628050DB30BC75AB2463EF51D1F77F2F346E0AD70F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 05f5fb5dcf4588af4e6b2f499142404e320c140ee74346565d1a4b341930df47
MD5 c8646e7f8c7886ef08698c4bad6abbf8
SHA1 be3ed087854bd64a37ff5e9a2f36aaeaaafaf316
SHA512 4015e3960465d1f3b18452ddcd66c5cfa108cbaff7a26399421926da8d13786d95dc1c7a5b77b7a9e3800837cdcde83cf89235aa010fa1ca640cd0046f820683
SSDEEP 12288:+Pwop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/C:KJNDGDn7q6dZhsCuarQSj/
TLSH
T10245230D594460CAFD36CE7816148811923079BAB12977BB51D1FBB25F384E0AEF1EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c48750ed3127e12cc5f96c572cf523151015ca6d6aa08a2cce20977108bc796b
MD5 d938a33eed327e5e5e16f3d3251405ce
SHA1 cbe3a2252c7b188fd2348fe8f1c2a85ad686a6e7
SHA512 303dcc33b0917fd46318a12634358d83530219985a951be06057b34151587166504dd0b7175382111bcacd5e91f73f10f48acd92a40b3deb6fe2f1437f816460
SSDEEP 24576:xC+TyQIu93VAumZr7jmCNDGDn7q6dZhsCuarQSj/:x/TfIq+YCdc3L6CuQQSz
TLSH
T15E559D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C17D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 a1c19ab598bd161ad49b0f39fb75755702a359a77beff4f986dee93c0ddd0e27
MD5 7854dfac4a9adfb72b60b921c56e29f1
SHA1 76216622ec72a3117a5ec558fe5d4b5652f07927
SHA512 5d2555f7d7fe86661505e4a4ce0918a2ed4a316888ec0a6f036ca8ab53ab80ada3f8783910e0a7a380abb839bc5fd1630d20ee356585e2287540e6df3183452f
SSDEEP 12288:4cyrWOstaa3kcsUop/wOU0h3x0Dn75fU6hGzhC1LhsCX+kcwro5aurWjpt/2:9LQikZNNDGDn7q6dZhsCuarQSj/
TLSH
T18965F00EB6AA10D5E4A7C23C88458112F6737475571263EF42E0C7BA0F775E9BE38B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d43bf4e740fac19ab80080dd6ef83c7931660e8dfd3c03ac0901316c5514f6a3
MD5 2b79ebfef1d095df3bcd67d51d4e77d3
SHA1 74418e7213d83b6e564e89576effb0871468dc0d
SHA512 958203fcfcb9d6c0e8ce0f9cc24daedb951d2a7b219a86437d59dc6ab84cc5482af2062620a229ee3fb4719c8e7f7c304e1c8d44a61b066960019f661a8b3274
SSDEEP 49152:RpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPsdc3L6CuQR:ipC7b4+80GTk/2+CCSz
TLSH
T14DA57C3DE2B810ADD8AAC775C5461665EE71382E3F2015DB00B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-338-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/244-527-0x00000000013B0000-0x0000000001486000-memory.dmp

Download

memory/244-339-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/244-520-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/776-315-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/776-450-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/776-526-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/776-525-0x00000000016E0000-0x00000000017B6000-memory.dmp

Download

memory/776-317-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/776-523-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/776-309-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/848-61-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/848-75-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/848-73-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/848-58-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/848-52-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1548-254-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1548-277-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1548-265-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1548-260-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1548-253-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1548-271-0x00000000008B0000-0x0000000000986000-memory.dmp

Download

memory/2052-287-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/2052-404-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/2052-281-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2052-288-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2248-275-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2248-267-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/2248-268-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2248-392-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/2276-522-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2276-365-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2276-362-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2276-356-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2520-248-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2520-250-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2520-364-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2520-242-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2952-292-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2952-417-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3088-329-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3088-321-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3088-327-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3088-516-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3120-70-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3120-229-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3120-64-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3120-72-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3148-298-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/3148-428-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3148-304-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/3148-306-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3340-226-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3340-37-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3340-38-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3340-29-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4008-433-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4008-535-0x000000000BCA0000-0x000000000BCA8000-memory.dmp

Download

memory/4008-439-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4008-555-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4008-451-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4008-498-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4008-514-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4008-482-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4140-538-0x0000022AB9550000-0x0000022AB9560000-memory.dmp

Download

memory/4140-537-0x0000022AB9550000-0x0000022AB9560000-memory.dmp

Download

memory/4140-539-0x0000022AB9550000-0x0000022AB9560000-memory.dmp

Download

memory/4140-540-0x0000022AB9550000-0x0000022AB9560000-memory.dmp

Download

memory/4140-541-0x0000022AB9550000-0x0000022AB9560000-memory.dmp

Download

memory/4140-542-0x0000022AB9550000-0x0000022AB9560000-memory.dmp

Download

memory/4140-543-0x0000022AB9550000-0x0000022AB9560000-memory.dmp

Download

memory/4236-405-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4236-533-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4236-529-0x0000000001490000-0x0000000001566000-memory.dmp

Download

memory/4236-396-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4236-402-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4544-532-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4544-393-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4544-390-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4544-528-0x0000000000670000-0x0000000000746000-memory.dmp

Download

memory/4916-420-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4916-554-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4916-429-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4916-531-0x00000000012E0000-0x00000000013B6000-memory.dmp

Download

memory/4916-426-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4996-24-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4996-228-0x0000000001880000-0x0000000001956000-memory.dmp

Download

memory/4996-195-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4996-16-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4996-25-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5436-418-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5436-408-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5436-534-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5436-414-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5436-530-0x00000000006C0000-0x0000000000796000-memory.dmp

Download

memory/5604-376-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5604-374-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/5604-368-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/5604-379-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/5604-381-0x00000000006E0000-0x00000000007B6000-memory.dmp

Download

memory/5604-382-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5636-8-0x00000000022E0000-0x0000000002346000-memory.dmp

Download

memory/5636-1-0x00000000022E0000-0x0000000002346000-memory.dmp

Download

memory/5636-0-0x0000000000400000-0x0000000000600000-memory.dmp

Download

memory/5636-14-0x0000000000400000-0x0000000000600000-memory.dmp

Download

memory/5636-13-0x0000000000970000-0x00000000009EB000-memory.dmp

Download

memory/6084-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6084-41-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/6084-227-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6084-47-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/6128-521-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/6128-353-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/6128-345-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6128-351-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download