9a72985a53ec7a10d6646bbdc0fbc5039bd2e7626a43f26a9fe6b042d21dc2a7

Analysis

max time kernel
150s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 770KB
Sample260714-epe7asdz3q
SHA256 9a72985a53ec7a10d6646bbdc0fbc5039bd2e7626a43f26a9fe6b042d21dc2a7
MD5 3f1b24b17867e8c740b3533e04b52b80
SHA1 fdebf3dafb957581617d9d6ee3b7fc96e92012b5
SHA512 07ba013290b6fc4504b58ef6358aa82cf88024521b0086af34b277d428572a7f40a87256b92a29910e2ab8f01a39a13e60cdb01eb9e5a342e1394cb3a58f7f2c
SSDEEP 12288:3tg61sYZv3zdXSaU4Txv9EiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SKS:3u6JB39Sa9T79ijLGQ7t2OaBN0sW4T
TLSH
T17AF412B1B0809031E42B54B285B4DEB009797CF984B0941E37FC3A7D4E737E1966AB9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3224	alg.exe
5168	GameInputSvc.exe
4484	GameInputSvc.exe
2964	elevation_service.exe
1552	elevation_service.exe
2720	maintenanceservice.exe
5832	msdtc.exe
5760	OSE.EXE
5860	PerceptionSimulationService.exe
1588	perfhost.exe
1620	ReFsDedupSvc.exe
4636	locator.exe
4428	SensorDataService.exe
3364	snmptrap.exe
4624	ssh-agent.exe
2092	TieringEngineService.exe
4888	AgentService.exe
2080	vds.exe
3244	vssvc.exe
4280	wbengine.exe
2384	WmiApSrv.exe
5948	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4d537af823e529ce.bin	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	GameInputSvc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	GameInputSvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078a40c474613dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000153229864613dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9cb19864613dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001899d8464613dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af266a484613dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a5745864613dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079848f4b4613dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4484	GameInputSvc.exe
4484	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
840	Process not Found
840	Process not Found

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5032	2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeTcbPrivilege	5168	GameInputSvc.exe
Token: SeBackupPrivilege	1620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2092	TieringEngineService.exe
Token: SeManageVolumePrivilege	2092	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4888	AgentService.exe
Token: SeBackupPrivilege	3244	vssvc.exe
Token: SeRestorePrivilege	3244	vssvc.exe
Token: SeAuditPrivilege	3244	vssvc.exe
Token: SeBackupPrivilege	4280	wbengine.exe
Token: SeRestorePrivilege	4280	wbengine.exe
Token: SeSecurityPrivilege	4280	wbengine.exe
Token: 33	5948	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5948	SearchIndexer.exe
Token: SeDebugPrivilege	3224	alg.exe
Token: SeDebugPrivilege	3224	alg.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5168 wrote to memory of 4484	5168	GameInputSvc.exe	90
PID 5948 wrote to memory of 1364	5948	SearchIndexer.exe	111
PID 5948 wrote to memory of 3312	5948	SearchIndexer.exe	112
PID 5948 wrote to memory of 4364	5948	SearchIndexer.exe	114
PID 5948 wrote to memory of 3444	5948	SearchIndexer.exe	115
PID 5948 wrote to memory of 3296	5948	SearchIndexer.exe	118
PID 5948 wrote to memory of 5876	5948	SearchIndexer.exe	119
PID 5948 wrote to memory of 1012	5948	SearchIndexer.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_3f1b24b17867e8c740b3533e04b52b80_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5032

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3224

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5168
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1552

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2720

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5832

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5760

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5860

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1588

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4636

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4428

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3364

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4624

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2080

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3244

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2384

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1364
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3312
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2976 2960 912 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3000 3012 912 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3444
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3000 3012 912 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2976 2960 912 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2153499486ef728304560e88a8131568c07d6ff5a000794e2b6a3448075f0de4
MD5 8c9b25048693e8f71b089ea35025cef8
SHA1 c4c34b6f1d78265f2407eb212ea66f35ee754175
SHA512 90b87ce1a8ef84ea733901debe0075a4c2840e5211a41cfbd079976605962ccb25a6ba4a5d741a5e97eb19e12eb30d8dd10b23ddc1f01c819b523df49bddc20f
SSDEEP 49152:cb+632BuPkFKRrdE6oh7stBhuXjfS4LWxn6UGQ7tBabc:G3q6gjBPUVtUI
TLSH
T11ED59D03F2D900E8E06AD178D7569132E9A2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 3a51926f5dc29bb5af5ab7b217d117dda4b950af5dd0e1eb44731641222d4244
MD5 e0446d7f5c2b2cf45f3c149980b937af
SHA1 737d52a2092ad5c123456eeb8bf4d58056093f16
SHA512 5309c898c2f169012ebd6dcc2960a9161d9611790498062dd341f79d3f128f8195b5ccb119e0c828977bbb59d4cfc2f96898f695cef7f3e23fe2ef3bbc649317
SSDEEP 12288:W1XLs4gIkxy2lRq2czAMBiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK5k:UXYn1tczAMUijLGQ7t2OaBN0sW4T
TLSH
T13005F164A7D008FCEC5B8179C8729511EA3278D183B0EB9B13B496794F236D86E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 39975431139a1cac39d60457920ece840a6425de8de7b5de8709fc5a654488cf
MD5 db3d94d99e7aa27c71b75830bbef176d
SHA1 f746ce97a9b756315fb28903a58c5795dd4d4612
SHA512 fa546e25a1e5d7a50865ba2ef3ee421b22160c219b515a498f09745c0898b32fd911efd90366e716d46f9bb06f356199fc81a52ff8e49359b5a712667ae5f428
SSDEEP 24576:E03eIaZ0hmxOrMVXijLGQ7t2OaBN0sW4T:EeaZ0AoeUGQ7tBabc
TLSH
T12A45AE66F5748335D073C0B9C5E2A68AED71308247308ACB1296D77C6E67BE6CA36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ec207de63dce1f5758ff2ac8864703f9cdeef6fedb5060849e7426e4b3f03994
MD5 c204747cd0968b152ceb8bdcd4fbbee2
SHA1 a3943895390e989aed615a3674040b61f4e8a064
SHA512 0732c7c357880d5e152e41024a300becc5a44ed605207833c6b159333607fd760a56d655760e3d12dea57fd0accfe0ee66d34eab414cb3c92a613df4093b2da9
SSDEEP 24576:xAc/ezSC6vUyD/aqgrvW/6q8wyuaijLGQ7t2OaBN0sW4T:J/ezSC6vUzPvuHjy/UGQ7tBabc
TLSH
T1A7756C25F5788323D0B2D0BAC5D6BA99FE323086573089DB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 92d046fb8e7f599f059527d9044918a25cec4bcd8ae88df2a32a8a63a2a5e8ca
MD5 1cea227d7c094cdccd59ce8906f563c0
SHA1 809beb6d87f7de2d81ad9dfd785c29126cecfc58
SHA512 223a1babffe416ac4b71a60ef5dae436e0bc483c11f7048bbaeb9e51e08ccaa96a5cd4436ab44b89b3efc663a378720078430af5e030cc9ed0655ad7c90626e0
SSDEEP 24576:tabiPU8Zrv/l+dwijLGQ7t2OaBN0sW4T:ta18ZrXl+KUGQ7tBabc
TLSH
T14655AF66F5748331D073C0BAC5D2AA9AEE3234414B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 c8834ed86dc9e009d79506126c3e0bc87702bb0b8c6632db66b17469a7ba956f
MD5 0a5dee1d063f9bc258f977341a41e913
SHA1 c01673190b1e82e9ae77d14d267b7b6c420263e1
SHA512 41c76e66ca5d8fd053fc93de713b679fafa17223fad23cad96a2ce6a05e182d905b7aafead4b16c465bc1ec2082c8aec760f5c685564939adfe16cdc2c1a54e4
SSDEEP 12288:AbtiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:AbIijLGQ7t2OaBN0sW4T
TLSH
T17AD423F1D890250CE80ED6F359717AA02925ADD0C0B6EE253178677CC813DA5FEB3DA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 54378abc3b1724698e67c86495a63cfaf7fab61ee6fbd207e79efbf64b89d69a
MD5 0bc8c75bcb0e0776e5fd82830708de3d
SHA1 89ef3f29c32b9cc5e2eccc111c10347c07a58d2d
SHA512 25ca22fcc56af66131be3a207180e0d97d2bb6eaf5a884ce428ea3a1cca96751396467306deb1f95ef43b1668f5202564b4e691a7ff186bba4f5e6a327562072
SSDEEP 12288:2eBNUbTVO86UXkiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:2JIUtijLGQ7t2OaBN0sW4T
TLSH
T1AE15D07BED28FCD1C27E8DB95A618640977278708B62A3CBE174831DCE135E05E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 630036fdd22edea4874256e0f8c59fce9bfab6177fef7d40b07a6b566c493a9a
MD5 2eedf29fb436250812bcb533c8e34e48
SHA1 2ffe97d1bf29a8237013a83b4313c4c48545d8ac
SHA512 ce6dcae2e0278a6eb5c395d1a4bbcc67f4d2720c17ee0b6adb04a9319a0e63f6e9ae2ada4e050c30d15fb290a9798171278fe8e171336b12ce66cef2958530aa
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJJ9DN5JkNRV3THN:nQvGAdlCEL8c/JRNw5ChUVtUI
TLSH
T15F367D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 44955004d689159e0b4e6663e628ef5f99afdf825e6d26969eb299795d64124c
MD5 ed1c05662c04306874a93c6818e48a5d
SHA1 8de9029b555b88c77653174433e9a584ec73fd3a
SHA512 8b40efc1908b376282f6aaf25bbbf476d10f63fd721a95f350e3d32ce9acd883f94381e6ffebd451f2997b3a58db9f6f227f07dea58b1ea3f0f63fa860928a78
SSDEEP 12288:jzwSfxL/2Dc3bDLLmt0LDQewsAjViYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QG:PmewsAjwijLGQ7t2OaBN0sW4T
TLSH
T19615E071FE70E036C67F0DB21B36D716183C79A04B612AC3F3B84AAD49215D26776E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cc1a9c117b7390f0ab9b3021f45c32327b812ffb30034004b56836a723f3bc11
MD5 c21fdf7e0df331e82c44718b7ca9ebfa
SHA1 a7b9cb2e36540d13c5de88ffa6a05056de57eb81
SHA512 08624c52a9acbfc3ffc9998bde94235c098fb79fdcd1c3527a078ed204d12191fecb88de482f7ceacdf0dce54a2db750454d8edf421794dcf016f6a6616b49ab
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrzdPlbuJHke:BUEtQevvqc2W1cpV2Xrh2j
TLSH
T175474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e61a66d8d582371de84ff26071a2b051a7a32f535ff9af1e438348c2c352bd7b
MD5 9f16e6bd82641d28332c9e8bc06dd7c2
SHA1 4fbd08e2568dd691db5ece2d12691ecd746aa63d
SHA512 68395a7a3b400f1b1bfd4fb55f2cf4b14b12b2c27eb7b04db1e0cf7c626dbf0ccbd1141731574038a4d73d60b2b172d1aec55865272cc9454a2bdcdcd9cccbf9
SSDEEP 49152:OBbRquA/m2yL5zMfFiV+XenmE3/z8UGQ7tBabc:yoq1Vjnm1UVtUI
TLSH
T135D58D1976B8C1E4D1F6C37886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b4487f9148dfc8218edb51de7f7e3e08dad15a81ee0cef7a7bcb13aab7bbae5c
MD5 fd423d34b27f43cea757b8d57a122e15
SHA1 f63b213c9d07d1b7895294ad7bb422f4b9341db4
SHA512 75178d425c968a427a2fcbdae7930961a7b649430235651c5aca449ca426216b2fa67927e094ac54f4fbe034dda6e40102057709b06a69a0299c6f3036d1a81a
SSDEEP 24576:RAhGLvLFoiwtA5l7S53UijLGQ7t2OaBN0sW4T:RAMXFoiq5EUGQ7tBabc
TLSH
T12145AD80E7F955D4F5B3AAB899B69170EA76BCA55E31C20F2160D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 3280843f08429fe051aff5b7c731ff44cbd2268ceeef54336f7294bd3093ba9b
MD5 2996c82bff160ad149230933fc047b89
SHA1 12f7e1fcf19ec12aae72296697868808ee105ad5
SHA512 815913a287b947f2cd3badba74a3cea8f8e0b6c5dbc7c28b4827356165f938f348a5eb3667c72f17e03a870a75a349310ff23ecb51d48e77482402fc1ec068a2
SSDEEP 12288:Ymw5HEjsChNYBFgl0W7m+CLCiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7m:VwuROW8jijLGQ7t2OaBN0sW4T
TLSH
T11D05F19576E41CECE86782798563D531F7B2B8811631DB1F2370C76E5F23261BE2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 a57a80410aa73fa86d2f858a2ae46f5a006645cf0910ed57b83b4f4d16704ca6
MD5 9ebee4f2886d896f55b9eee9f4987e0f
SHA1 45e3bed23852dc43d143a81bc976972687aba5a9
SHA512 bae2e77c864e5451299a8b12aff9150e2bcf9869a0366f24d856cd99d6bc547e271583a2ab6f3581f52b576e716527b13f56ec9ac7b752e006e2503c28705f33
SSDEEP 12288:lVW1Io1iYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:bWuhijLGQ7t2OaBN0sW4T
TLSH
T1CAE412A661E030BCE05B92BA89B16A40A77174D1837697CF3274437D4F13ED6AE36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 aa595c5b96c8d90f068aede1b3fecd0b4c204f1f7bb43ceb20967bc0f6aca45e
MD5 97b576e39326c42e515914a67f170127
SHA1 d861bd30ce4aa69f17df88522c3779437e2e68ca
SHA512 74afc6c2079f5f1a851ab2a3613d8855ae25a412a0ec25c95960d25bc15d74dc8a578f1aa76927f942ce8674606ba531756549022959da8dd893de69390a47e8
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Up:aQRQyi36YOcP8Lvw2gAf+PN3OUVtUI
TLSH
T135667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9ee48da04227a9d2d32c0aee460e405a6121f3dcbca12535a9aa12b600c3a53b
MD5 d2e389e8937a00c4866fcc35a1aa719f
SHA1 04dd8e91fe1fcbd70d15c417297dd52738b87f17
SHA512 347cec184b348c4f6155c7e1cd868b3232dd8606b221775fcedd7d318e6c092ac131d3919c72460e5e6592d6aed7368b6195ab7384e4fcdb32ea3e880d722b54
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UO:aQRQyi36YOcP8Lvw2gAf+PN3vUVtUI
TLSH
T1B5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cf707d7dadeb44d5af63fb901ef75f93775fd47684af2e3406cd40904e91a5cf
MD5 802dd1995d72c4f5e2219f4cb9449d5c
SHA1 8139685feb31e97037e372533a7233df9e555e9d
SHA512 ad7cb545ca0818d27edaab80658da43018cef61a56090072eb2e716d061a219300a546576e093493127d495a04b78c4ecdb3347308833390001dd8b0642624cf
SSDEEP 24576:BwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0UijLGQ7t2OaBN0K:N68Qg55nhMeWu7PNU3//UGQ7tBabc
TLSH
T1ACB55933B2F20099C44DE1769F4A972196D27C71CFE1E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 05368b878565a84a91cb6deeda1fb5ad101c2a52e1553f1d37ba4fc182b82064
MD5 95fa7a8ee7fd86e6c0d1ec5b4abb5c42
SHA1 f469b5abcb8890acb04a5f9660a344748ae3c01c
SHA512 ea10a3ee30cd9150a1b8c28b847929b7e0dd27b96e536686faa4f8456410d329b630cefa19b6de4c41400ee4d28080fc5d06f9c92fee11f9dfdec84faf43eeb1
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk998:Iy5112gYy5azzVv569nLKnhZqUVtUI
TLSH
T1C1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a37058752a56dae271ad26d7b72b5f744faf477f7ed3bc6df9544a9ebde9066f
MD5 531e1e5afae0e42bd9fda376a607601d
SHA1 8973dfe354d1cfe3b99f8381b6a4275307507948
SHA512 7109f78fd575afe10da30325bf70e64cdb1cfe947347addd31a1307ab8497cd13a37e9e3b4e3b8c3da4ff181d534621bebf7fb3c34489258f66c2c148790ca3a
SSDEEP 49152:5B+taZ3usBWOBr4tEGp0bqx0z+n217aau1glmUGQ7tBabc:vu6JmTxd2dmUVtUI
TLSH
T189D59D13F1D901E8D05ED478974AA233EA62BC490B35B6EF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 693a8185055cfec268b506b7c2af7cc1d6a29090c1cc021177d328ddc4b4764f
MD5 62814ee5b6e2110dc1180999905c6826
SHA1 d98545990badc716ae0997b6975ef6abc122f55c
SHA512 d7927504f0fc46c6606011db01fff2e3763ab36de07a574141db14f813aa812d88e5a4c189cd8d1eafc9936c76b464a97ac8624a3b32e8ea8ca0d2905abc9e27
SSDEEP 49152:L1hpsNoJpF1A6UU44CwH7R4xVUGQ7tBabc:LmifPbR2UVtUI
TLSH
T195B5BE13F2D800E8D05ED17887569632EA62BC450B35B6DF0A90B7961F7BEE46B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6d9f2fcaa997c344baf8f97a18ce8b6225b6d58ee04158262f5ccd61664ec6e3
MD5 f7339555c5bfad031bd00e373abf94e8
SHA1 da6cebf8e5bf82c58bf3bf8a495841ad63d9e17e
SHA512 0a8ecd08741218ce66d5325a5e1f4d704c27a4dff432226d13cebe09c8e802d162d1cc23556a6bbca1b166628f03408079cf101f3f20c3716592cd130aef1c23
SSDEEP 49152:ZSuZQIY0Be2K6RVtOnks6NMHqGUGQ7tBabc:35dKoi61GUVtUI
TLSH
T173C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 11ee45a9fc0b2991ce2152be7913fae11234be7da5bdc2464fb173d94d4c01b6
MD5 a1ec438691c6688ce08334eb81d7f8d5
SHA1 4eabfaeafe881f7fca1c532791c4d7942fec7b4f
SHA512 e6c0e2efe18f9c44bb3b3698d4305f3571d3121cf40c762cd7349ac3607a0a3e818d358d03135e44922936631faa67a71855d2063368817a42f9c3663abea5b4
SSDEEP 49152:VhtSn8EApI0figTgiDn0AP5wSUGQ7tBabc:kX2iyphxUVtUI
TLSH
T1B1A5CE13F2D900E8D05ED1B4C7568632E962BC450B35BAEF0A90B7561E3BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 88ef22b21c06ec8dfeffde7c5facb8037161c84184d4882c10bdb24f3b9bb86a
MD5 e051e79aa4732efce4425d938ea546f5
SHA1 2acb5bdb01f64600d8fd0faa0f581f249d892d4c
SHA512 3e0717ea5dff79bdac87f58712c864eb60c00da1d10601be8d3455ec5e73ba3ecf30aa610d7d9777dad67aae96a5b35e2980196cf7e1251a8f83f616e59cffb6
SSDEEP 12288:hbiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:hOijLGQ7t2OaBN0sW4T
TLSH
T146D423F1D890250CE40DD6F399317AA068246AD5C1B6BA74367C627CC903D69FFA3DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 2b3c93719530bde91a053b561c2551cccb80aee21c1a6f67cb044f952cc7a17f
MD5 71407d899d1216a046248bf4fc0b448d
SHA1 4f6c676fd587985e876d987a88efbc23f6873098
SHA512 c8d960874fe2ec53e94d1eb1162ad0404f821955c63556c9fae073138f6336fc11e11880d85c63fed696a86fdaae636f3805974c1a9125b482b86fbcd63f53cc
SSDEEP 12288:zQEiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:zQ9ijLGQ7t2OaBN0sW4T
TLSH
T12ED423F1E890250CE40DD6F359317AE06C246AD5C1B6AA24367C667CC503DA9FFA3DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 e8d80f01ae12b1031d72b8d6475fcd4c25c84726792c6dd2486409f2da3cabba
MD5 62cb61a18f41829c990211d5aa83e779
SHA1 b5173deef2b7f7ad08a30795157943d4996205f5
SHA512 d7bccfc5edd77ec8bfc82dbb3df325298e65ec5e981f0717a04f710fca96a30d93607b728720e271ea30c9321ecf19f6a25816a6426065d8aacd44f173a183dc
SSDEEP 12288:FeEiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:Fe9ijLGQ7t2OaBN0sW4T
TLSH
T1C7D423F1E890250CE40DD6F359327AE06C246AD5C1B6AA64357C663CC503DA9FFA3DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 da351cac55605a48912587508abecff2b43eaa3b8b2a333526cfc99913f779f5
MD5 06b6cbae27dfe8daaa137f97cb4db4c4
SHA1 c6430d2929c6c56234f5e61be6c396bf384d3d73
SHA512 9bd2d8fe96c51dd65200928fb5f2dfc0efcaf54738260f42efade2fafa7081dbbfee8787bccc2d1e06afaca68556fa21c3e2b0ee71d2706d94faa52cf5f2ee3f
SSDEEP 12288:0lTJiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:u8ijLGQ7t2OaBN0sW4T
TLSH
T1CCD423F1E490148CE81AD2F2C93175A0A974B9D0C172FB6B3674167C8D13E65FE72EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 583c229bc39c48a8633b3ee3b800cf5b35a8f50a559cfdef080cb0ca0328c986
MD5 b6559206d75e047b370f9c4eea1b032b
SHA1 a8f72731ffaa44f3a8d203d3183cd7dbc77b830d
SHA512 a2f1a1aae50f4f7accd7795a76474a73fcd70a56d08d6a5c0602091ebb319cd417bd3cf6a6bcd269727a4e3a97a5d94304199906953f28f6871ffb09d89648b8
SSDEEP 12288:U5iYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:UMijLGQ7t2OaBN0sW4T
TLSH
T1C4D423F1E890250CE40DD6F359327AE068246AD5C1B7AA65367C523CC903D65FFA3DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 eeeba0ccceb9a9035de8e550097e6e780242cc93ef013eb45ef69d7dc392921a
MD5 3e803f376335955eaf058de67bad1586
SHA1 5a517fb9fa7e6eb15dca85d7bc13e4c02dc523e1
SHA512 c56f25acca7ae4c577dca997af1c1e8fc092c0361d830da3d3b0756a36715e9a412ed3e598b021dc7cb71f944e526c3a697f0484db38fc2f47a3eca13f292230
SSDEEP 12288:nsiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:nFijLGQ7t2OaBN0sW4T
TLSH
T175D423F1E890250CE40DD6F399317AE068246AD5C1B6BA25357C527CC903D69FFA3DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 f2fec22a571c7bc952ed7feb3741a2de0046027fb5a4b7c21a839a2521c0959e
MD5 b780b7dcce92e34345f07a144106dddb
SHA1 34ed8360274c2cdd9f25b1f5d78d45482b1c5322
SHA512 e7fce8775095d64d20fa57cab4b5ffacf1cd249d2cdcfd1f0c9d4260feaa755816cf1e76b998339cee004d61915d8064f6cac88abeee6bf656cd3d38a4ce75a6
SSDEEP 12288:QSiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:QTijLGQ7t2OaBN0sW4T
TLSH
T199D423F1E890290CE40DD6F359317AE068246AD5C1B6FA24367C567CC903D69FEA3DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 5b698c2f164901d6e5285f944652d9fadfd45e172225940956ab0dc7d75ba75e
MD5 21492e48fe3dc60569f897e974a67045
SHA1 aee578333c65bf04a2d367cd2973d3c1e7b61a07
SHA512 08ad8c36b8df819f337abd87a28f989aa93fb880f9ed8f7a87c2de3b54a99cedc4e436b97d445ba1164ea0245cd8739f4bbb6ca4f8152718e280b0103de6fa43
SSDEEP 12288:uiZwbEvzFEoSKcPvyHiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:RZM4zFVSKCijLGQ7t2OaBN0sW4T
TLSH
T1371502E5B29018F8EC67817ACD219901D6B27C954670CA1F23B4363A4F337A15D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 802575c5080d8fb1e92eb961a1332903b2e8c14d2424d27b8a883249b3ffa369
MD5 6023e54e3eef2815a554f438c2a52f6e
SHA1 5ff399d6fabb0dcf4c7bcdcabf41609a01ba4362
SHA512 eccde61de64e59cba017c87d03733e6fa5b9fbc30023f5a91929c919318d07cf78fc7f9a8648f71d497bf0dd50b6a6d7f5c196ce7e8bdd4a4b53659753d1dab5
SSDEEP 12288:z1iYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:zQijLGQ7t2OaBN0sW4T
TLSH
T188D423F1E890250CE40DD6F399317AE06C246AD5C1B6BA64357C527CC903DA9FEA3DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 f00a2d818fbfcb33c4e5477fb67b082029d617a10ac3a342efdd8f2a80f7f55a
MD5 158541cc0b8e92b14a5e79afdc28539a
SHA1 2168ccec048201c27d3df9a147af3978c80e6319
SHA512 c86c283bb5358fa9b8da1ec279dfd5bcefc8e9711308de7c609375c838cfd272da08f91dcbf4693bb79b89e4424272c365b74be4b755ebcb6177ca078abb0258
SSDEEP 12288:pviYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:pqijLGQ7t2OaBN0sW4T
TLSH
T193D423F1E890250CE80DD6F399317AE068246AD5C1B7BA24357C567CC903D69FEA3DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.1MB
SHA256 156e5547243a44b60e1e59fd99437eff14577f02715c6da15ba257d0ad79ae8c
MD5 b83618435cfca0e673cfc8877a15056e
SHA1 676cab92f5bc3de94b370018e92610e754f24a0e
SHA512 430c85a6169a3ed42fce2d1880e733e46a6df6727b6fd2212307e3df622012d27eaeef9c7ef9ef2395965f07b7c8afd003190785ea695045d18e05b08ccb8a89
SSDEEP 24576:pKwvtk9RX6wkyAIymijLGQ7t2OaBN0sW4T:1MnYIFUGQ7tBabc
TLSH
T1F135D029EAD804D5E077D27D89B34606F6B178994B31C6CF1269537D0E33ED4AE3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.6MB
SHA256 e18e6f3f459dbba8aa0e919dbce11f36f2abc4118330f696683cd89c9561fce9
MD5 b604ea261a6e5a4a542f8587a4c2bb7b
SHA1 dbfb3159152f644586b5837010ec1607e87904bc
SHA512 849202f55f36d1da26389c4289cd021df38fcd0f4602cec0a37ce3a3a0ffa9288d49b38c996a7362fe59cdcf67a8b4c43ed5394b1734a03d1b947ad96ae36db8
SSDEEP 49152:SYyKNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0PUGQ7tBabc:9ySzPXUVtUI
TLSH
T1FE067C96A16801D8C1B9C1B98F1BCC17FA7134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 7cb1c2b54554eac9d7ded6b573ef7f6042fb4b4a8a0dcb1d60fe0c137f565f4e
MD5 be8c17a9aa17b85b51e7f0c6031dd8f1
SHA1 e8e973d4714d24d08f5268b8b43d04130f62c829
SHA512 f1f316f75cd355530b937e8728832738d7f897a9c74767422cb3748d2dd86dba0fb43ffd0ac071e5e3f341f90ec38b1f2033aba93b33d4302a8712aa5dcfff10
SSDEEP 24576:2v7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYDijLGQ7t2OaBN0sW4T:2v7JUQjXirIhCnDHUPfF/BUGQ7tBabc
TLSH
T15E65AD1EA3EC01D5E1BA927885154A5AEA71742D1B32CACF2270837D6F23ED49F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 5d811b61acab219c54ed488a016177d4b24df9da151cd6f5064e77d3b5c254c9
MD5 f54a57d40f70db8efe4ab7f57c5ec574
SHA1 a50eb477d283ce8eaaa947a319a5072c93c2fcbf
SHA512 d857f4deb4f832b815262692db4f7d7c034b8cef3bde86f9756d0ccb10e39a510662716f98a600114b2678dd1e176dcb4c35b475481c1fff99590d7dd2bcabf6
SSDEEP 12288:Whsfm+iYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:LmnijLGQ7t2OaBN0sW4T
TLSH
T12DF4F165D19411D8D01EA2B6C7615A40B7337CA583F1E7CA22E0F53D0F33A94AEEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 010b3717e3a181e836d7c8f448d4d78795a3f36c368d76eed9f83d62ee36d93b
MD5 c1d0206d14ca5076cbb8423b3da1a994
SHA1 66e6c367e0f4d8203eb2acaa8787a9d6581988fa
SHA512 b3ba97a367f6bbea7e2274eada40a1cb60c20db7e2ae8692acdb74ccf5d1f2b9e3f64a402cc8a8dee797b5c3b35ff69cd80704f6424bc9255732cb58480828b1
SSDEEP 12288:RY7S2iYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:+S/ijLGQ7t2OaBN0sW4T
TLSH
T1CBD423F2D490290CF81DE6F24532A670292976D0C776E9A37138637C8813DA5FEB2E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b9fa317f0bcbb2dad5ac23a89f66815d37064a0b9c83bf7a36e88a7242b116b2
MD5 06493c1a9d1bd7e0940b7cccd6e503fb
SHA1 c46346a452747963a2493374059ac07c5eb6508d
SHA512 f3658eba1951c4bb9305c0894443c37671126fff32317e6ea2b30aadfc084e12d3fc3352461ae088567ffb53c08ea261477ceab2d2453f8d989dca68edb07bbb
SSDEEP 24576:9gb6bmBIi49WNNFpg1rSvFv7bY8aijLGQ7t2OaBN0sW4T:9gb4mBIBhGFGUGQ7tBabc
TLSH
T18965AF1E22E802F5E0FAE2B8DDA64417D6B278164732D2DF1151423D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 438305d3587a8d9096276ddf3ebc68b76ee0d3026b51e821d8e533fcdeedd655
MD5 cf5adfc0fa9b2e73336ad6efff1ded91
SHA1 55da350d9c65b246d78a890560cdd918e7800c4c
SHA512 327595ceecf9cd1e51ead0c91a44633fba5ab42d097fed03b8fdc6f969312d0cd79fa5a5d55d2802d55f9ef24f57a489b39b55d0db1cbac027951d877b59e6c5
SSDEEP 12288:lxGSjiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:HGS2ijLGQ7t2OaBN0sW4T
TLSH
T179E412B9A4E1344CD839D2B6483165A1787075E08375AAFF35F4A27CCA03DE0BB76D98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 c7b8e8895ee0ce5b96c14f3bec7746b52a254ed6fb85e584126348b5a35c1126
MD5 9e4d7a6568695b53f723fd3519b14701
SHA1 8a824fc32632bd67608d157d9476cdfc59071ea6
SHA512 b619583c51834187969b3f37b9716f02a32b65ff7762110f8053af1016ce5b6d81cf2831f2242d292a965992c97af193bf9937032dd93a56b8afacc089d3784d
SSDEEP 12288:N6aiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:N6bijLGQ7t2OaBN0sW4T
TLSH
T149D423F1E490250CE809D6F359327AA0292466D0C3B6BAE33178627C8543DE5FF76DA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 bc96a5c47a4cf8867a7bb7da7980726fba4a6aec7907e2dac9db582ac0cbffd3
MD5 834508de1bcb5ef72019c3b99358c271
SHA1 1387f2c4f173696bb3cd12381cbab67aebca6c94
SHA512 622c3093f96ea2a33974fed26206dd8cb222fac693e8bda3cc10efd492a65c786ea810cdfdb4614b27c40820f3a0ad577b162c0d634c05830ebb8f93a8ce6f1b
SSDEEP 24576:ViS8u8FpJqH1Jzria7/mw7ijLGQ7t2OaBN0sW4T:8hZFPqVAa7/nUGQ7tBabc
TLSH
T15635F161A6E001F4D47BD138895246A3F6B2B4610374EFDF06A88B650F23AE55B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 1b6043e225bb7b2cc6c84ae7982324ee23509109733bc8875270e7c26a843093
MD5 62c56a50726462145af4f2494ca8e2a9
SHA1 b1b08d04f91aca5c214c1327810015c5ebbfbbc0
SHA512 651ae92966ad916cb9481ab7aa5154260ac854e345aceb7b949e796f40487f74e1851159cb378527e737bfe7e4efd01a8703880050d9727e2e65ab1521b7f2ad
SSDEEP 12288:DHvUrBFrEjwaQHPiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:DPUr+NQHKijLGQ7t2OaBN0sW4T
TLSH
T1F405F16F61E818D8E57AE17D89528719F771B4A20312E6DF02E0817E4E13DE8BD3AF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 39b5f19b7e128ece0e49636fc3bd99b958033f24bbe2b30483b29c6161db2415
MD5 093af65f53fec1c3a82039c357c32340
SHA1 2f04dd9522dcb4af525aefae02083a242a992a4b
SHA512 031d789e25cd8424882d8e86b0376a803f95f38f0d8e3bf6cb33763f7040f4a95bae225f3e326b1042026fded244dcc1ff55591fea8efadad381acd3d936ef05
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjUGQ7tBabc:WG05lO43bEUVtUI
TLSH
T11CD5C06A62EC11F9D0BBD17CD9C64A0BEBB23415033556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 99bda9a76b302c614d86f3bf383a695cfdb83b3f4fc09f799009d5682db71838
MD5 e893d2a2b86ddd1c8c00b8751d2c4ca8
SHA1 cc7e42ab295fc8ed890e3173d14c4611ec6685f8
SHA512 b2bdf4bbe6f606701545068aa3928373f14e7f68161561060d02181369e8578947e07cd52c874513259586cc0dabbc427b977e772a94f259523bfc080b5b13cd
SSDEEP 24576:aJa5POZ3dpbWVM50JicR2hG0lasx2+47eidnLijLGQ7t2OaBN0sW4T:wa5POZ3wJt2pasx2+m1UGQ7tBabc
TLSH
T1BE65BF5EA6F800D4E579D17DC583861AF5B1346153329BCB122182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 238d6904885aab841c5dc651defbd7401bc26c88ad3d766d29e30a4294db3eb2
MD5 66cc03e171b3b98987e243c4e6bc68af
SHA1 5af113803945e3cb741488a4f0a178cca4003f56
SHA512 5774dde6b77e7036f013d8f5a6811f32620a4b1644b72349bee2142ce6d6660205a6e5277687313e6cbdec9630f16fb549404c5f880e3ece865592c0f6a6a022
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7FkNhijLGQ7t2OaBN0sW4T:6Nc/zEOVHFCUGQ7tBabc
TLSH
T1D8858C6622E901E4F1BBE1BE89779546FA71786553308ACF0291811F1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 57662afa8f4e31bb0d209e075e3247d190887be690666e26528936cb5edfdcdd
MD5 f331129c48bc67c77780ce48cae6dff8
SHA1 bdb9ca80648a9b82c824a90ee7f8bd702afa3e97
SHA512 c1f83da29df9b71d3dbddfdf2bba020d8a5de70ed8247208c2d0517be8c50a2243424a77a7cf722576e96bbd7426c33428efbeaac6009faaa24d02d133ee93a7
SSDEEP 12288:RgHPJnJP6szeCs6Rl28d9diYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SKS:sJnJPbzB4S9YijLGQ7t2OaBN0sW4T
TLSH
T18315D07DD1A810D8E4B7C2B4811A1B55FE3138BC2B2669D729B4D5343F13EE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0da73a9365a40e9a7efe15a1402c12e78d03916b308809e3b20486f5803dc4de
MD5 0b99ac9f49f7c6f91f3228d02c1a49a8
SHA1 9dd650d1a9b819d723bfaf58d0c4ee5a081d8345
SHA512 4a3cbbb855fbe619984a3476ce6bf11d6156a1d67187757bad8b3f10fde0795dec194d3385d43460a967917f532d660bef1796f532efe2bcb36bca782be15c56
SSDEEP 24576:0CLHGL0MoeVtFumTijCmlKQWDkXijLGQ7t2OaBN0sW4T:0CLHGeeV5ijCmlDWDkXUGQ7tBabc
TLSH
T1BAA56B05E7EA5188F8F3CAF5C92294169A327C549B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 3108f9f87386796a7b06c410de4622367bbaff4aa06818c1d598121fcd1939f8
MD5 009f3bbbd026c5fed4329150630d3bdd
SHA1 5c4db318225b7e1358572023749e89d683a2ba55
SHA512 6acf05f03dab2503c7afc54a84c0023f7649285b834669675e3e1ea2a1d0049fc6553375cd890b6626eb8f22b3d82132bb9b24c3336b22b0f39b0ce08a5ed6e9
SSDEEP 12288:M1Hck6j5ZI7HNiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:k6DI7oijLGQ7t2OaBN0sW4T
TLSH
T1B50502AC627610B9D02BD07AC5930551E5B2B0F0C3626ADF26E8C57D8E93EDCBD39E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 45c2da7e213184758cc75047da435dbb70441f215c960a7742e01ff05e0665ef
MD5 0ee255dbefe2f93dfe75aae579e0d65b
SHA1 9253e495a6c3042a41bff97ea98d4b6b02411bfe
SHA512 04482db46d812b4d2641d6049e8cf234c745c66b50b2fffb4109ccef073b28008dfa1c97a7fd6bec5cfa66d995cf5a9708047dee05c421979f688ed5f7fa5796
SSDEEP 12288:/G6ky85iYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:Oty8MijLGQ7t2OaBN0sW4T
TLSH
T115F41251A290208CE86992B5897351A05E34BCE08772A7EF31B0A73D5E33BD4FD71F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 f7e8a987516bd82f0575ec54be62ec2cfdef52905ba213add1bdd30363451976
MD5 57a8de079bc78741f2c935250dbf594e
SHA1 f2e31c3c2ff4cee31179ad78c81bce7992be412a
SHA512 001d85ba3c2827301c0023ae4bd04ecf2c36a9a5af8cb8bb5b76f56875155d8513b7e99735ec8caf8c4993830e20561d0f9d2b9eb2de18befdbce4f28617e00e
SSDEEP 12288:c7aMviYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:EaMqijLGQ7t2OaBN0sW4T
TLSH
T169D423F5E490350CE809E6F245326AA0282475E0C777AAFB35B8967CC903DE5FE72D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 620c69cca39af60c7a588b5e07cf9a078af84716f369ca1c1b452a2d9902ba20
MD5 ab2078193372392bbb48e51e981f0778
SHA1 42ad5e176794be85de3732515dd251ac00b7adb3
SHA512 e9ef8c58117b478b1731e23453c4d066abee63ae1b56105906737d4456ad5394887972ed3e9c3d6dfbc8f8b8a44c6cdfdc67f905154fa7b5e32c0c2574562d7c
SSDEEP 12288:QjgIuZyFDK3tT5Tr7aVLIH9lH3cIeiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8F:QjgILoTfaidZhHijLGQ7t2OaBN0sW4T
TLSH
T1F4559D1DA3EA05CAE2B2D275D8321493D633B4715372D6DF2458C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 7fc40a07d94751fd95467b5d7e2200fba4a650026286bf721e263b7db370b7c3
MD5 9330e88ef83c9275e4b6ffaaab877144
SHA1 6947bc61d1b60ad2cfba55b634843b349d941fd8
SHA512 83ad87fda07526b23f0cd1000d67a146a4bfa16e5547c3b71f2a1385639023a2e3f3166904e25a0125176a9bba9b09f834a4c9941c4ac72fb9ade29856abaf37
SSDEEP 12288:HpJcm8CNwiYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:HrcmRhijLGQ7t2OaBN0sW4T
TLSH
T1A605F19EB2AA00A9E07BD27CC8524651F67370B0536267DF12A0C77D8E139E9BE35F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 bb728732df46a927bb7361d54367fa84ba742994fcd75652f82022de4d153cbf
MD5 4a6558ed71d85e5946297d90ce4a2ab2
SHA1 b12a3058892f7d76a95456a5b8090c68375d7a27
SHA512 6781b784551e09f8ce8f1e4af4b7b1f4891bb01106b57037008c1f4462d558bedc475050e49995a99f344e6edd3ecde145b02ec044566bc446e00a07ec40110d
SSDEEP 49152:NDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS39UGQ7tBabc:u3Upow8sBeUVtUI
TLSH
T1B9A58C3DA2E810A8D8AAC379C54213A6EA71782D3F3055DB0174C178BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2d4bcf86a6622042e49dbbe4f0822654217f09aefde18f808eec0156d6a0e129
MD5 15c2ad01117072f5c651694d26bd9670
SHA1 66ac5ab8e09c8b9fa7f03181bfb03930dc349745
SHA512 4b17325c89f8a5f859f9ca5fb962849398d1cd4c64376914245bb8a479f165e2b81dce478d2647c63463d7c0161404c7e7317a0e0e05f3cf6f3981badddb44a0
SSDEEP 24576:8TkNvNnaFeYhJNtmZBmArijLGQ7t2OaBN0sW4T:8TMwBtOmOUGQ7tBabc
TLSH
T11155AF6EBAF406E4D1FEC6B5CD238512EA727461073293CB5290C13E4E279D89E76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 992KB
SHA256 b43972b273745385efeb8bb343253eed84bab586f4c15eb30693126fe4318145
MD5 51db9fdd3a989f2b3fd49832171fb479
SHA1 a24b1b6b4cbe7bc76778228ef958473851f58dbe
SHA512 dd203fe00a2e3f406daff4ee7005f92c9bc6fea8f43ece7b3fb136a5758db4618c282713ca64fb13291c5598ec6f15cefe36e34815c29c70705e9e159963b57e
SSDEEP 24576:OD3FHshBIYQgAlUijLGQ7t2OaBN0sW4T:ODVHeBIAAiUGQ7tBabc
TLSH
T14C25E17DE69804D4E47BD1BCCA638A06E67138E903326ADB12D481B95F17EE47D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 772KB
SHA256 45ab7f4c3db0b7557ae2d4b36513c38d664c6a92f91d759bc63e4fb3b94b0692
MD5 9424e60c1d14b97a965e511582fb09d6
SHA1 ebb8de5ff681ba9989eddb6016dc8677e80a7fc7
SHA512 01d0264536b9f0ff9eac07c05498a148cb833da0bc7ec1f7c083053ae25e70f44951a5dc1deed0afcb370a2aa49c6c63b68caaba121fb677ad736452cd4ae4dd
SSDEEP 12288:4yS6b3IkxjbBzU0iYs4Tko/jGQ7wzuyBrIqOHzLC+eNDowlb8QyVo7SK51W:G6UqjpUNijLGQ7t2OaBN0sW4T
TLSH
T106F412A995D0249CE43982B0D93191614570BCF143B6AAFF31E8967D8B33DD4EA3BF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1552-54-0x000002A010000000-0x000002A010066000-memory.dmp

Download

memory/1552-53-0x000002A00ED40000-0x000002A00EEBD000-memory.dmp

Download

memory/1552-55-0x000002A010000000-0x000002A010066000-memory.dmp

Download

memory/1588-188-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1588-110-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/1588-105-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/1588-104-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1620-119-0x000001BA1A6E0000-0x000001BA1A746000-memory.dmp

Download

memory/1620-117-0x00007FF6704D0000-0x00007FF670C14000-memory.dmp

Download

memory/1620-276-0x00007FF6704D0000-0x00007FF670C14000-memory.dmp

Download

memory/1620-274-0x000001BA1A6E0000-0x000001BA1A746000-memory.dmp

Download

memory/1620-118-0x000001BA1A6E0000-0x000001BA1A746000-memory.dmp

Download

memory/1620-204-0x00007FF6704D0000-0x00007FF670C14000-memory.dmp

Download

memory/2080-184-0x0000029BF1480000-0x0000029BF14E6000-memory.dmp

Download

memory/2080-182-0x00007FF746A70000-0x00007FF746CFB000-memory.dmp

Download

memory/2080-260-0x00007FF746A70000-0x00007FF746CFB000-memory.dmp

Download

memory/2080-183-0x0000029BF1480000-0x0000029BF14E6000-memory.dmp

Download

memory/2092-254-0x00007FF6331E0000-0x00007FF633375000-memory.dmp

Download

memory/2092-163-0x000001172FF00000-0x000001172FF66000-memory.dmp

Download

memory/2092-162-0x000001172FF00000-0x000001172FF66000-memory.dmp

Download

memory/2092-161-0x00007FF6331E0000-0x00007FF633375000-memory.dmp

Download

memory/2384-216-0x00007FF7CF070000-0x00007FF7CF19F000-memory.dmp

Download

memory/2384-265-0x00007FF7CF070000-0x00007FF7CF19F000-memory.dmp

Download

memory/2384-210-0x0000027E49F60000-0x0000027E49FC6000-memory.dmp

Download

memory/2384-211-0x0000027E49F60000-0x0000027E49FC6000-memory.dmp

Download

memory/2720-62-0x00007FF6E2470000-0x00007FF6E25D8000-memory.dmp

Download

memory/2720-63-0x000002AFD0EF0000-0x000002AFD0F56000-memory.dmp

Download

memory/2720-64-0x000002AFD0EF0000-0x000002AFD0F56000-memory.dmp

Download

memory/2720-70-0x000002AFD0EF0000-0x000002AFD0F56000-memory.dmp

Download

memory/2720-72-0x00007FF6E2470000-0x00007FF6E25D8000-memory.dmp

Download

memory/2964-46-0x000001F58DB40000-0x000001F58DBA6000-memory.dmp

Download

memory/2964-45-0x000001F58DBF0000-0x000001F58DD6D000-memory.dmp

Download

memory/2964-47-0x000001F58DB40000-0x000001F58DBA6000-memory.dmp

Download

memory/3224-16-0x000001AB43C80000-0x000001AB43CE6000-memory.dmp

Download

memory/3224-18-0x000001AB43C80000-0x000001AB43CE6000-memory.dmp

Download

memory/3224-61-0x00007FF787CB0000-0x00007FF787DD3000-memory.dmp

Download

memory/3224-17-0x000001AB43C80000-0x000001AB43CE6000-memory.dmp

Download

memory/3224-15-0x00007FF787CB0000-0x00007FF787DD3000-memory.dmp

Download

memory/3244-193-0x00007FF7E74E0000-0x00007FF7E79B1000-memory.dmp

Download

memory/3244-191-0x00000209F0750000-0x00000209F07B6000-memory.dmp

Download

memory/3244-192-0x00000209F0750000-0x00000209F07B6000-memory.dmp

Download

memory/3244-263-0x00007FF7E74E0000-0x00007FF7E79B1000-memory.dmp

Download

memory/3364-145-0x000001EFE2DE0000-0x000001EFE2E46000-memory.dmp

Download

memory/3364-144-0x000001EFE2DE0000-0x000001EFE2E46000-memory.dmp

Download

memory/3364-143-0x00007FF70A530000-0x00007FF70A5E4000-memory.dmp

Download

memory/3364-220-0x00007FF70A530000-0x00007FF70A5E4000-memory.dmp

Download

memory/3444-449-0x000001B22D280000-0x000001B22D50B000-memory.dmp

Download

memory/3444-374-0x000001B22D280000-0x000001B22D50B000-memory.dmp

Download

memory/4280-199-0x000001DC8F830000-0x000001DC8F896000-memory.dmp

Download

memory/4280-264-0x00007FF6BE500000-0x00007FF6BEA07000-memory.dmp

Download

memory/4280-205-0x00007FF6BE500000-0x00007FF6BEA07000-memory.dmp

Download

memory/4280-200-0x000001DC8F830000-0x000001DC8F896000-memory.dmp

Download

memory/4428-136-0x00000196AC3A0000-0x00000196AC406000-memory.dmp

Download

memory/4428-257-0x00007FF6FE070000-0x00007FF6FE487000-memory.dmp

Download

memory/4428-255-0x00000196AC3A0000-0x00000196AC406000-memory.dmp

Download

memory/4428-215-0x00007FF6FE070000-0x00007FF6FE487000-memory.dmp

Download

memory/4428-134-0x00007FF6FE070000-0x00007FF6FE487000-memory.dmp

Download

memory/4428-135-0x00000196AC3A0000-0x00000196AC406000-memory.dmp

Download

memory/4484-35-0x00007FF62F340000-0x00007FF62F409000-memory.dmp

Download

memory/4484-114-0x00007FF62F340000-0x00007FF62F409000-memory.dmp

Download

memory/4484-38-0x00000186F8100000-0x00000186F8166000-memory.dmp

Download

memory/4484-36-0x00000186F8100000-0x00000186F8166000-memory.dmp

Download

memory/4624-153-0x00007FF789CF0000-0x00007FF789F93000-memory.dmp

Download

memory/4624-155-0x000001B68B5A0000-0x000001B68B606000-memory.dmp

Download

memory/4624-154-0x000001B68B5A0000-0x000001B68B606000-memory.dmp

Download

memory/4624-237-0x00007FF789CF0000-0x00007FF789F93000-memory.dmp

Download

memory/4636-127-0x0000018BE50C0000-0x0000018BE5126000-memory.dmp

Download

memory/4636-126-0x0000018BE50C0000-0x0000018BE5126000-memory.dmp

Download

memory/4636-125-0x00007FF6201C0000-0x00007FF62026E000-memory.dmp

Download

memory/4636-206-0x00007FF6201C0000-0x00007FF62026E000-memory.dmp

Download

memory/4888-172-0x000001992B140000-0x000001992B1A6000-memory.dmp

Download

memory/4888-170-0x00007FF797910000-0x00007FF797C31000-memory.dmp

Download

memory/4888-178-0x00007FF797910000-0x00007FF797C31000-memory.dmp

Download

memory/4888-176-0x000001992B140000-0x000001992B1A6000-memory.dmp

Download

memory/4888-171-0x000001992B140000-0x000001992B1A6000-memory.dmp

Download

memory/5032-242-0x00000000004C0000-0x00000000005EC000-memory.dmp

Download

memory/5032-2-0x0000000002960000-0x00000000029C9000-memory.dmp

Download

memory/5032-6-0x0000000002960000-0x00000000029C9000-memory.dmp

Download

memory/5032-7-0x0000000002960000-0x00000000029C9000-memory.dmp

Download

memory/5032-42-0x00000000004C0000-0x00000000005EC000-memory.dmp

Download

memory/5032-0-0x00000000004C0000-0x00000000005EC000-memory.dmp

Download

memory/5168-94-0x00007FF62F340000-0x00007FF62F409000-memory.dmp

Download

memory/5168-26-0x00007FF62F340000-0x00007FF62F409000-memory.dmp

Download

memory/5168-27-0x00000287127A0000-0x0000028712806000-memory.dmp

Download

memory/5168-29-0x00000287127A0000-0x0000028712806000-memory.dmp

Download

memory/5168-28-0x00000287127A0000-0x0000028712806000-memory.dmp

Download

memory/5760-87-0x00000193CCF40000-0x00000193CCFA6000-memory.dmp

Download

memory/5760-88-0x00000193CCF40000-0x00000193CCFA6000-memory.dmp

Download

memory/5760-86-0x00000193CCCA0000-0x00000193CCE1D000-memory.dmp

Download

memory/5832-77-0x000001FD64510000-0x000001FD64576000-memory.dmp

Download

memory/5832-169-0x00007FF7682B0000-0x00007FF7683CA000-memory.dmp

Download

memory/5832-75-0x000001FD64510000-0x000001FD64576000-memory.dmp

Download

memory/5832-74-0x00007FF7682B0000-0x00007FF7683CA000-memory.dmp

Download

memory/5860-181-0x00007FF675170000-0x00007FF6752BA000-memory.dmp

Download

memory/5860-95-0x00007FF675170000-0x00007FF6752BA000-memory.dmp

Download

memory/5860-98-0x000001A274EF0000-0x000001A274F56000-memory.dmp

Download

memory/5860-97-0x000001A274EF0000-0x000001A274F56000-memory.dmp

Download

memory/5948-266-0x00007FF631860000-0x00007FF631B9F000-memory.dmp

Download

memory/5948-221-0x0000020883D40000-0x0000020883DA6000-memory.dmp

Download

memory/5948-223-0x00007FF631860000-0x00007FF631B9F000-memory.dmp

Download

memory/5948-222-0x0000020883D40000-0x0000020883DA6000-memory.dmp

Download