b78038bb38787ee46796c1876bd58aae2fce17172f9955f664b30c652a7743c8

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.4MB
Sample260720-te3beafv4k
SHA256 b78038bb38787ee46796c1876bd58aae2fce17172f9955f664b30c652a7743c8
MD5 53bf1ca7c84d9689e8c842a503a28869
SHA1 c94dd116adb8d103eb0a8a10a91ee128b8b840d4
SHA512 168229f099424aaeb1cdb7adc8a8a901fbd79d4a621dadf95363cdaedd4b6ba25f8f02b96c02bfc520212c293b498bd4a919f8f9baa265967ecb706eea2fc1df
SSDEEP 12288:Z57+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:P7yxknw4FYnshx8OfVe247
TLSH
T1236522787681D0B2D44910370A29D3B16B2BB8B16675C147FBAA777FEA704D0E22E217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3384	alg.exe
5676	DiagnosticsHub.StandardCollector.Service.exe
1976	fxssvc.exe
4916	elevation_service.exe
5748	elevation_service.exe
1252	maintenanceservice.exe
1692	OSE.EXE
4564	msdtc.exe
5368	PerceptionSimulationService.exe
5696	perfhost.exe
636	locator.exe
4716	SensorDataService.exe
4324	snmptrap.exe
872	spectrum.exe
520	ssh-agent.exe
552	TieringEngineService.exe
4628	AgentService.exe
5280	vds.exe
5588	vssvc.exe
2176	wbengine.exe
5080	WmiApSrv.exe
3948	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\be0e4ce75a3b5d25.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5320	732	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072bf74ee6018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c4fe3ed6018dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000679c10ee6018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008bd52aee6018dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c5c72ee6018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed5f34ee6018dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fc860ef6018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc2339ee6018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ce2d8ee6018dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c3a0eee6018dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000471026ee6018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027c236ee6018dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5676	DiagnosticsHub.StandardCollector.Service.exe
5676	DiagnosticsHub.StandardCollector.Service.exe
5676	DiagnosticsHub.StandardCollector.Service.exe
5676	DiagnosticsHub.StandardCollector.Service.exe
5676	DiagnosticsHub.StandardCollector.Service.exe
5676	DiagnosticsHub.StandardCollector.Service.exe
4916	elevation_service.exe
4916	elevation_service.exe
4916	elevation_service.exe
4916	elevation_service.exe
4916	elevation_service.exe
4916	elevation_service.exe
4916	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	732	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeAuditPrivilege	1976	fxssvc.exe
Token: SeDebugPrivilege	5676	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4916	elevation_service.exe
Token: SeRestorePrivilege	552	TieringEngineService.exe
Token: SeManageVolumePrivilege	552	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4628	AgentService.exe
Token: SeBackupPrivilege	5588	vssvc.exe
Token: SeRestorePrivilege	5588	vssvc.exe
Token: SeAuditPrivilege	5588	vssvc.exe
Token: SeBackupPrivilege	2176	wbengine.exe
Token: SeRestorePrivilege	2176	wbengine.exe
Token: SeSecurityPrivilege	2176	wbengine.exe
Token: 33	3948	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3948	SearchIndexer.exe
Token: SeDebugPrivilege	4916	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 2480	3948	SearchIndexer.exe	130
PID 3948 wrote to memory of 3000	3948	SearchIndexer.exe	131

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 432
  2⤵
  - Program crash
  PID:5320

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 732 -ip 732
1⤵
PID:5288

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5300

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5748

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1252

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1692

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4564

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5368

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5696

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:636

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4716

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4324

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:872

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:6076

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:552

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5280

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5588

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5080

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2480
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4a8e914d8045fca5688926ab7c729e5adee9775b967c073eb269546a24e1f88c
MD5 bf33932eb58d14aa5b6714e18c7e3258
SHA1 6a977cd9c687e72ee5e62185742cadeed1f7c5d3
SHA512 13365441cd1d765a4bd1b5c320d373197121a944e65aed17556eb06f83a83e755b9ffd6a41d8c8800cd39ef6afa3d861bce9ca19d18ece62e24f62bc7427d931
SSDEEP 49152:3b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnBx4x8EVep:l3q6HjBKix8EVy
TLSH
T128D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 8b544b64f33ee3aede6dcaaa2d679d7dc4999b1cdde17a80617866db30d05554
MD5 4475c65929816b2c5b1e826e7b904e2d
SHA1 aa63d5ccaae958f80ae5f0a5a4a104a30d2b4f14
SHA512 72bc66fbb638cc527fff0e8da89954c2cad6c0b8425e1bcc1bd8aede64b37721ee82b9d273095570adbf09d02d98fa03be61e5cdbd809990224d4e0ad6fe5805
SSDEEP 12288:Y1XLsswWkxy2lRq2czAD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:eXYfDtczADyxknw4FYnshx8OfVe247
TLSH
T11E75F12877D508F9EC6B8139CDB28512E633B8954770E38B03E4A5295F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 a56949ad36a2da222ca55c9cdabdffaaa4f3ae055c344f504244e7348b4739ff
MD5 638fa6b2ce623b6cbb0c2985ad5984f2
SHA1 fa6a37e7bd45b225572ed880c688f5e88f8540c6
SHA512 fb7cc92326a5c3693ba10bd84a85666ade1f1a5cf5eb07e67fc52a2bc0e1503f4eaea8e361b0af276a2976bf82b83db65ad91ac78d68708612a53c2001ce4e11
SSDEEP 24576:80Le5ji0hmxFrMGyxknw4FYnshx8OfVe247:8Pji0Argx4x8EVep
TLSH
T15895AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 731c9316138eacb3ca90cd5a826536fd849fef873d799271f0c272901be766ec
MD5 f53e21f6e4902fdfbdbfe138b1e6d3ea
SHA1 232fba514b2f68b71f27d18c05544456f212ed17
SHA512 169e992bdad0265beb5e0cfc789c337472c4a3fff8fe5d8429b37446047dbe6881c8881a27c39a02ac9d37e0768c5ff4c33a4e01fd539f9c2ffc531bde6f2bab
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWE6q8wyuEyxknw4FYnshx8OfVe247:7/ezSC6vUzPvxHjycx4x8EVep
TLSH
T153756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5e69e0efc2d92389c1d78a15cd17acd7896326234ad7db6dccdcc0cdb80d1577
MD5 231c83cabea2eefa073a2c8035fed1aa
SHA1 8ad8580eee98dbe683c78b0d8753d6fdc2a4c9c4
SHA512 88d85ac10417cf826bfe54abb76858c60585d6eeba0d7e00c3458bc644891b60a7506734a6ccf7b8d34f40e4887fb0eba85bd6a3e1afa54018318c2ebd2af693
SSDEEP 24576:3VbqPb88hv/l+6vyxknw4FYnshx8OfVe247:3VO88hXl+lx4x8EVep
TLSH
T125559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 f1bda9d4d1625f6334e6833e6886e2bc4e4656d99565772087cb05efe3e54b65
MD5 25f5a179cda76f0f15af524c0d65901f
SHA1 85411abce8ced74109c92245025b43fd15695b10
SHA512 a845d9c3671cec373f516363a3949d6f754af45c72dabd3b432f3a3bbf011f93f966d079170dda42a16deed136423d2a8938f8cb1440e6f28dee5b8f7b6586ac
SSDEEP 12288:ZNS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZNSyxknw4FYnshx8OfVe247
TLSH
T1236523BCA7DDA4E1FA5E14331A7572623616F9A4DA74C11BC778B14EE0F0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 7ee93dbae5042b455f25c317c2c06c199a8ca7ec8f8278179cbbb12a4bd4d216
MD5 46eebfa0e99977bfa660d1143f650cb2
SHA1 557f89426961e84c818de0828058264a918af32a
SHA512 7dd0cb91ab93a2d9b35d70dcedd626f56c9fc1ea3ae7aa742f08f04c52fc99c7b98fb25735def2f998c980a6f268ff901c98ada41402f396e7373156437069b0
SSDEEP 12288:veBNUbTVO86Un+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vJIUnyxknw4FYnshx8OfVe247
TLSH
T17075CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 efef08ef00f4ff3a94b33f142e6e60c953168bed40e66999a990cb3ba5ac645c
MD5 1760662f50dbdb4f85f9496aca37a5e3
SHA1 e07e83291d74cad9f51201ed943596ff6be012a9
SHA512 7027312cc3386a5992c1ac9e1a7b7de00a622c63c2894dfe9b39bd2058f9caabc5577a0ce66d2d29522f36f28dc65808d39433c471602fda01ee711546e62b11
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THI:+QvGAdlCEL8c/yRNw5Cvix8EVy
TLSH
T1A6267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 5b444297b62d1aaea741e2e6f75b60a138b89188a5970517a80e29663a27d363
MD5 1d77c9073a3b73117c3063ca08775304
SHA1 a22aaa821d43bc1beffe6ffba94aedd53c631077
SHA512 c77a8255d3dd2dcbe534183a62611880e5050a18a03e30ad16dc744f1cefe72870823e8c8c0d5ec3db4554d78d688bbd4c371b507426f0536db855c2ae93eb06
SSDEEP 12288:iAwSfxL/2Dc3LDLLmt0LDQewsAjl+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:n6ewsAjlyxknw4FYnshx8OfVe247
TLSH
T1B885E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 53c4b304679a22154c11206f099d7fc32e53b7ac9f8fea763247a77ed85b9a53
MD5 def2544fbf80e50ee95aca2150db1eb7
SHA1 48dc1d204e2246f9d2c0770143eddc38579a81b1
SHA512 af1fbc56a55af4d5201f0462a26294a9bde65a323f2184e2fd99378a7476f1a98ad87f6e2a131418148abf64c5fda2e0dba9909cc751de4b0af3a92f40d633fe
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHl:mUEtQevvqc2W1cpV2EI32
TLSH
T185474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 37b91f83a38a562d3545328c97b8a4e643eb2a64a59b74a97361912c620c204e
MD5 5a5e7dd10bad42e234ef8d2f0d06b282
SHA1 7a3a938e00ebce5529d9f6bd2e85282218946ab7
SHA512 2c683bf83d5ea9d0fa9135a24cf1800f3e90e1ea26ab61c98615d829353e8a966bb9e2826b4cf2c750d706ed1318631e8b19dd27fb1584d8b720a35cea624541
SSDEEP 49152:3CbRquA/m2yL5zQfFiV+XenmE3/zQx4x8EVep:goqtVjnm7ix8EVy
TLSH
T13DD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0149fe59d320e2129562409c5f2bee165b7e75da77bd2bc47b22f3b00c87266c
MD5 5cac709a8349aec5d7244e742dff3124
SHA1 1b569e289a7c0094e94aee1e99233b7869f5abc6
SHA512 246d689861dee767de19cef19510fac4fd93adcef96632355674bf0ce4c70812330fba7be57436ec6a7e93f8c62f1a870ba5cde80bd6fb9c07efc1d049b25a2f
SSDEEP 24576:8AhGLJIFoiwtA5l7S534yxknw4FYnshx8OfVe247:8AMyFoiq5Lx4x8EVep
TLSH
T15835AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 69c89e122fcddd7717e98b037a719dc0774fdc0a7119eb9323011093b43662a0
MD5 d12ac6a51caf3774ad6b6ca19a3c44f4
SHA1 96c7d43f537adae41594053eb02c3d6727ee000d
SHA512 261fefcf55c9acfc745f7fdb18e76d6955c7109638b3213219a3cc8b72e932b2ca1619da27b838db3a1daa70697e003fa12eecbdefce912df2d26b2f4b7528c9
SSDEEP 12288:9mw5HEjsChNoBFgl0WDm+Ck+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:4wuFOW5yxknw4FYnshx8OfVe247
TLSH
T19375F14977E81CF9E9A741398657D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 ca0c34daf6881289d84237f7649acb547c932caf7b4723819fa87e7cc733b50c
MD5 195db5feb35949a69e417fa0ed03d684
SHA1 e8761189f1324bca9fce55ef1607d66c7160cff8
SHA512 c239a05980317091d0d7ad51ed28e93714ed5e1e4b2ea0180ff96e8e2d3500cecc47575e1468d900346e5756512ad568f26f16af9fb5407e298dce738b4493fe
SSDEEP 12288:NFZ1Iy1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:PZueyxknw4FYnshx8OfVe247
TLSH
T13F6512AC33E860F1E1A7113A89F15205E76274A2677183CF4764A25EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b920d11006408713e9ec79ab1dcfffedf9f8cd3fa9cad0ef39fd3bce21805913
MD5 c9428a6c5936974daa65d562434b9ec0
SHA1 932207dd5d2f5cc6c84367c77ff40a4c0fe2e848
SHA512 2a901d53d207bfa8b31455ca95d62727f51f2724135d20cc5d2b0271d80a2ad86a0d4aae1c3831ac18730817e5cba19f1272cb77b80c85ca1799c74d07989a98
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Us:xQRQyi36YOcPQLvw2gAf+PN3+ix8EVy
TLSH
T16A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3abfa993d69f42d1d62e8019f4ee87e5117a9bb5c56bf8f444739cc0661cb295
MD5 a20ed53a307de564665cb9bec5fc1d47
SHA1 8fc3764b0e0902e0d16d334d047daa1b0b07f76e
SHA512 9ca7590f76a3fc9f717b844c81ce565c680f2a2dcd245ea820ab55795888df520682744bf9f698802e0b228e5a8e7ce21d5ce50fd58fd11ae7b04e759b2ca6c9
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Us:JQRQyi36YOcPQLvw2gAf+PN3+ix8EVy
TLSH
T17F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5145224fa7ad2cef2d6d838648e18ce3f1b858989c4a3fd2a0285a414f6b08f3
MD5 2205c98313e7dcb9f2a1cebdee2d5262
SHA1 94c9f686bda6e3c8ff2da9773a9d0ac45d71243e
SHA512 58dcf88a75b7854a40c0dfaa8fcd11a86e4d09fe3ce8d728b50b3b5f5b617b9d46956c827fba1f149e08f596fb229f39181a02a3f9555e1154ba7b995d296fed
SSDEEP 24576:wwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Oyxknw4FYnshx8Z:268Qg55nhheWu7PNU3/gx4x8EVep
TLSH
T1F9B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c031b8ded9c1dd76f96bcf1cfc55fe6e33aedcb74d707fe6c06829a39ca64d9a
MD5 18d60038fef209ad820ecadbf4075a84
SHA1 ea1877b627e517fadbd76bfff00e652f91f016d5
SHA512 9c3f8fc985fcfaeaadc76b772c7dd588ef1870c2773112e03f9bff6a4f946fcc60bf17132c4ce6708ca3f530817759eac414292c11f4f1ed7728a9777d2027a7
SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99e:7y5112gYy5azzVvL69nLKnhZNix8EVy
TLSH
T1F1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 23993de14332a0b3fd44b5c70eef8dbc2c5f50f7a623741880831cebda7d6391
MD5 8918d02abba749e7b1924e39d9e0345d
SHA1 47453e78336fe8e2da4e4378d572b5d45678d01d
SHA512 7b28bd3986ea251a327f9b3dce32226943d629e3cba2e863c53c9dd43aa3af88c906fcd1d389ae6964a01a2f601bfd1e1c283a233ff3deb4f37b9b297f34d423
SSDEEP 49152:fB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl2x4x8EVep:hu6JmVxd2d2ix8EVy
TLSH
T183D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 34172015279e877bda61ed59062b8981bb8162b8682a5ec6cfa7579daa202e92
MD5 9cb32987e659e414b361eb118bff67c9
SHA1 4bff7d91492869fbe39d832e08e0ad17d10ffb14
SHA512 29f3c2bbf7daa9dbb50a64de2c9a4fc044a743a8d41ca5f3d9e0d130da9e6884705bce3ca39b87277ac4887e59dc1fb3542a3423f2a5dcae7689f23a500d666c
SSDEEP 49152:W1hpsNoJpF1A6UU44CwH7R4xSx4x8EVep:WmifPbR7ix8EVy
TLSH
T17FB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c2126e694ab5e5ddf5a3a531707004781ea26b45ec60d7e49eb50bfd65aed589
MD5 9f92beb7dac24c1a2d967059df13d039
SHA1 e9226c21974aa8c8498b9af81b342855f7fd0c4d
SHA512 06ac998fc136f591584faf9ab50be2acb5cb2f7fa92a34f4393f32b3983b813415ef56bf383016a70532c32c9f94d34a1ad6b79eb43ad450a41794cb725cc1d2
SSDEEP 49152:SSuZQIY0Be2KRRVtOnks6NMHqRx4x8EVep:M5dKTi61Rix8EVy
TLSH
T10AC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5d5e80502e7101017d41b14223a1c92f6e0dc3e35c8319ec53d9f329bdcecd47
MD5 0ae890e7fa9e62e458dc1df63d11ae5b
SHA1 bb7f91f36dc5965f7239c62b1840079e9b751be9
SHA512 14e98966a79c608e4cc0c97ff3ea5bdb62cecd72a2f0e840503a2fd84ce65846a5e53d57e9b01fee38c578e3c107862d1873b2e9e10e6318b00971b09d431323
SSDEEP 49152:khtSn8EApI0figngiDn0AP5wGx4x8EVep:lX2iyphXix8EVy
TLSH
T1C095BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 c0e6f5a32d2fe4811d1cf4946a1cbd2007353e7e91e52ff5c47eea93417d81b9
MD5 3387c95240dc39c00988542c26f20448
SHA1 05a3aca9cc3a586c79eedbd1fb97018a5305732d
SHA512 e59d41134a1de49a26553ddb984754f64ccd2642a3a8068f8a1a43d35cb3cc673064220142722d7979c97defdc1174cb6a9218e4278830ac9b988331983ebdda
SSDEEP 12288:TK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:TKyxknw4FYnshx8OfVe247
TLSH
T13D6523BCBBDEA5D2F50D11734A7173626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 bbfa11b15ca8ff4019d173d616511f9497eee41b67866a4e4d48c50192189dd6
MD5 10ff4788450ecd0559ba36c99c741c46
SHA1 5c9e50f9129745f7107e65fb955deb894765beff
SHA512 e0f9da6d201dd6f859abdf6e71e80462d6471c711e9eb6e5db44ad15599660c397cbde9eaad90114d3c02ba13ac6f84996493a730a802ef94bb4beca686d127e
SSDEEP 12288:RB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:RByxknw4FYnshx8OfVe247
TLSH
T1BA6523BCBBDE95E2F50D10734B7172666609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 6bec359510aa9ac793d2977cb8b539197989bd2927d23271a510981308a884e5
MD5 b1c924a2c3f55a231898c1d623aabc11
SHA1 2b139ceba88f565130782223838884f3679227ca
SHA512 fa7ad2afa26edc3b25d839e2bd5518c5d1b4ed8413fc4971a4b0fd9b5b0373ae24f1375ee0d59a0a3938bd68107644e6098c6f14515a4d48ca7f99ad51187bc2
SSDEEP 12288:mf+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mfyxknw4FYnshx8OfVe247
TLSH
T1326523BCBBDEA4D2F54D11734B7173626509B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 9e3652b3f4cb5f0c8129869ba04ef8a459fe7430f1a9f9b588816d5726f5ca9f
MD5 75fdd5455804c9dc3ce9cb300c4de563
SHA1 37a4d06c80f8447a9afcafd2734db76662ba19c0
SHA512 7cb3b8cac288a1ac903d7fdb39cf3cb2864f3d5261c5839b7a9c7a2539346257a5d2ae468b2c6b72ba7faad012b91a48f200f2c695ae8ec4806d3792e76e7f1d
SSDEEP 12288:oVY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fyxknw4FYnshx8OfVe247
TLSH
T18165237C77EE50D1E85A51738A726222B365B8E5E731C35FCB64700EE9B0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 a06ae77fb27d0ad8ee857ba1488e28cbbfcd504ac437492f4a0f8f12fd2714cb
MD5 3dd5d51e83e59a49587cc1091601bc33
SHA1 e35b0a6276028bb7fec6c316f70d71365b01d682
SHA512 c8411a9c53dc2b22acc8d3123120ac83bc2f132b66ea35736538e0d07a41417703994ed9b83f7a2a95e95e07beb00ba6af3f2ab4f07977c4b9cb88180a3a0981
SSDEEP 12288:4g+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4gyxknw4FYnshx8OfVe247
TLSH
T1706523BCBBDEA5D2F50D10734B7163626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 86148238558b57616885724b1a074449d1ddef4f9ba43fb381a97ccd176bdb66
MD5 165a431f17c3d69152fb9f25f2de22c0
SHA1 1a871682a3583ccc2cd0df9153825c4fc25395d3
SHA512 08288384d7879df4bfc1941edf1144770e346ccac344ed843ae09d9355febabe803ff8e83ddccc560d3c5f443baf19835803db0ecd2fd7f48bb036705a923ac8
SSDEEP 12288:X9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:X9yxknw4FYnshx8OfVe247
TLSH
T1D86523BCBBDE95E2F50D10734B7172626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 7215c5347ca34a6301d03eb0ccf1667f33fa37fbbc9ea53c5fdde7bf32ef25a0
MD5 441713a4a71c0bbcad9ba2342bfd0f62
SHA1 3d1a0697bceda231b79265ab7a9d368f1c98346c
SHA512 539d399ec979e0b4993d603a41d64279c59b0663bafec9ae466df6d3934c8b8a4973420ec5be69593d868b46400acb8e781e589390fae2431a331a269502a422
SSDEEP 12288:Jp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Jpyxknw4FYnshx8OfVe247
TLSH
T1176523BCBBDA95D2E50D10734B7172666609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 080bfbf063e3532da659a3104fa1c9288c2bd2b82f05a1c720744f5248a5cf46
MD5 bf317a83c6ff4dddb63b931c6223ba2c
SHA1 1b0f6d7be3f8758c5b600740eb7c93db3ef4fcc7
SHA512 73b87642453b9c8a25dcb95a1ee60c3ce3197de4b4e2fbc8c5969eb4a350f1700e026aafa6687b86ee52c401711fc2b727fff4a4ddb0f02bc4f597cba0231f4b
SSDEEP 12288:yiZwbZzzFEoS2cPvyh+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:VZMdzFVSOhyxknw4FYnshx8OfVe247
TLSH
T1367502A8B39018F4EC67413EC9259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 538512ae810c71f463e2ea0b35942e740cd8f351716b4bb028b0716c8b38513d
MD5 f8cdaa93e6cd78e7c576c270ce1d18e9
SHA1 a7bd72425e88103b658ada2b8b81db7def3ec3bb
SHA512 25e2f92ca762d8e3d24d6fc6d5882c3a65f9186899028a9f2ba4943a74a66f0e688e9a2dab9da26b1c5637747a845ce797d541b73df061d060518d4066a76b96
SSDEEP 12288:Bu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Buyxknw4FYnshx8OfVe247
TLSH
T1F76523BCBBDEA4D2F54D11734B7163626609B5E5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 ed6d00bd613571d6311c2e2b2c1b5b946b4a24a3946376539e682dd69aa62ce3
MD5 c2201853a5b8385a5e8c898e04d14840
SHA1 365b0aefc02f04f2e12c03843f3e03f92c9f0bcf
SHA512 2f815e8d69dcdf38d354c2025b9bce4091df8110442d1c53346085510ac7d44a9adb6553dd3294ea843ec6f116b588a8e5fcaa09bac448c84acd308711bef003
SSDEEP 12288:Yi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Yiyxknw4FYnshx8OfVe247
TLSH
T1886523BCBBDE95E2E50D10734B7172666609B5A5FA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 3025e2e3ccd3136a9e8193b72c385126e6b86a470a89c8f17aef8355f0a8f526
MD5 4ec31d881856b6b0d75c683eadbdb22e
SHA1 69b38d0a27181cd0b6077aba0632974bd6f828c9
SHA512 cf80e90399c221b8d78a76c7bbd6a71551d8eea3c6fa3ac0e6bfe26e777db8888d8da07ea8998f5498e7296067ad899c5e01b4eae054e6b4f8b485ea7f305c4a
SSDEEP 12288:RyPz5L81+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Azy1yxknw4FYnshx8OfVe247
TLSH
T18D75125B73E530F5E12A4236C9621612F372B872473086AF87A4527A6E735E09D3FB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 13d48d25ef40d362c83be95599e81767c4422c69cb3aba27f26edc38e51a3190
MD5 11cccdbcfb0d44c0b48e692bd4d2c936
SHA1 33d987038cbd960ef5ad5bae2d086853aa104523
SHA512 ef57ab2cbafe8d12de7745d45b4fb8a8dd99ef75344a171080c5041b5cf6ff2db2894af099487520645e478119f335fc313cd87409776abb6467d223854f7115
SSDEEP 12288:Yu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Yuyxknw4FYnshx8OfVe247
TLSH
T1516523BCBBDEA4D2F54D10734B7173666609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 bb96cfa80b999707367f56b09c9fe82d7bb7e40b14b39fbf7d0451a484e4acca
MD5 eeceb5dc81d8c9c266675a23bb45a2e7
SHA1 e3914f91665c6ccda8495c66ca781e310d856ad9
SHA512 dbcebcd611a04c3832eb5ffc7d5336b5f03487be7938c2d5af4991e55118e7ba7e8f8470b3fde8bc645731f73d163f3bba0a6b8c9c78d8342abbbbdac17d2bb5
SSDEEP 12288:Gu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Guyxknw4FYnshx8OfVe247
TLSH
T17C6523BCBBDEA4D2F54D10734B7163666609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 e80a9c6bf98f286600f67149a8abad3ba8407cb6ba95050db2b69f1172540898
MD5 1cfba9547be78d32fea8f7240b02b9a8
SHA1 0ba23879f9e196b30b5b1ea36f8be24fa0a04539
SHA512 87b9cb9348f2160c28e351b614e87a24fe68f66d27fab774c058e3662fe2c450eb0431afd0c127437e8e0a4f94665b1336f91b7f2753f2c9893f1a73ef6172ec
SSDEEP 12288:yyPz5L81+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vzy1yxknw4FYnshx8OfVe247
TLSH
T11775125B73E530F5D12A4236C9621612F372B872473086AF87A4527A6E735E09D3FB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 dc57ff38045bbdb9ebfcf325a1e1164938e87d2a7b56de03d290a19af92a5473
MD5 a015d726919a1f46296651cb139fd50a
SHA1 cfa9fd684f21d2978d9745476fdf027f8ba2f2c1
SHA512 b36a5d5583f13416f6e8fcd87ee1cfa0a5f63eda06bec620b469ea496f24c75f2d2f19b20aa351555f90b8c580f6197642e4b22e3f38a69685b77f0c6f57556a
SSDEEP 24576:7TGaLl3z0zDPyxknw4FYnshx8OfVe247:7TFLljfx4x8EVep
TLSH
T1677501A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 f1a30267289477176bf27e73b12f95a3f4152cc16b9826d0aa7c6d921bcc778a
MD5 18247bbc1c629774ab2be1b76c3e06a7
SHA1 d4a7368fb25e48881ebcc0cd6a0167574c837551
SHA512 ba0df05969fe3c2e0707e10c272eca1ae01240e19438da0a4999b0405b9cfab0027662eb90c361866cc9f2416a789dedb769521b561fb466074e7683743c93a0
SSDEEP 24576:/3nd9CHKy7GZ7yxknw4FYnshx8OfVe247:Pnd9CHKya4x4x8EVep
TLSH
T10295DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 5f672df9273db72f961cca632f79114f7abd80eee3d4a32db777c143da8d117f
MD5 7e6beab68bcd8080b5fc43bdb38037ba
SHA1 04f6b8985817b5c562083f24347f070ead3956f2
SHA512 0ea5d1e8b3ce487c6668dfccc0ae90ef747d0f437db135c97f618f9de5c9d0ad7a8799d1201a9dda0b1a68f6e568db5ae56b06caa2462b1a28967f71d18a878c
SSDEEP 12288:J/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:J/yxknw4FYnshx8OfVe247
TLSH
T1AA6523BCBBDEA5D2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 b2af920b1289967825fc41d5f41721f2134b0a2e8c9db72e5ce2122e01bf50ff
MD5 ce6f38b10d4793bca70553436a166d4a
SHA1 30aae673891b3624612162f8439c234205688645
SHA512 6f6e16c0adf2b6a4c08a08671feff269292b24d83a83376d40013b12c7906f0ea76357cece0ea7c851c9d928a21e1bee1a8efb5acad730082fcfd00008a31442
SSDEEP 12288:lV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lVyxknw4FYnshx8OfVe247
TLSH
T1806523BCBBDA94E2F50D11734B7163627609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 51f025e608ed7d4a59fafdd00be288437ec53cf9d7e1c46f35d4b6e681c43b8c
MD5 c2319c10ea6b6e05e5d1701c52a41f8e
SHA1 1959218f43d16d7ba33f7245df64d293b6d24999
SHA512 10c3467b89b8f2248ec5963bbd5aa2f870d56f2e6cd1186f82aa39d9fdb4adbf9fc51d3776ed3d721ebb201e705d1c7ec8d37bd47dcca5e33852d51f4bf00045
SSDEEP 12288:H+sfe+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9eyxknw4FYnshx8OfVe247
TLSH
T19475F028E29812E4D06E2236CB625641B3237C6597F1D3CB97D0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 9cd38041b31338f20545db6cce08c77c4f8c558ca5b1f286336aed1a7faba82b
MD5 ece0b6390726b5adf35fe5f053616d58
SHA1 ddc8813caebb92f899d9a344f8f9e1e623ed26fa
SHA512 60925d813ed8c145826cf239c3b4573b913b53a437bb38cab2e8893d7ef0cf49749eed4e13f4ab37e99472276311980ed69140c23a6d6752e4b5d0d05480394e
SSDEEP 12288:FI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:FIyxknw4FYnshx8OfVe247
TLSH
T13165237CA7DDA592F56D15730A31A231361AB6B4DF70C14BD768B11EE0B0CA0E83E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a24c003d1e3694d0eb946ac2c688802d188dcd7b4b2e2fdad75219befab0d2ab
MD5 5f00af2484b8ea1a96ef60b26eedf6b8
SHA1 6d7fc3b81c1b5eb9986c741aaab0f046fa4feda8
SHA512 6db059d798fc9a367304a44e96f8132c05fe6dc4789088394503cf72206ebd9cb778e1ba9e374b45c7a474db0bcce68d893d8ef976c668590f57fb977dd0483e
SSDEEP 49152:ha0h2GEkuAe73q3pp46zwwQBx4x8EVep:ha0hNYG4JwWix8EVy
TLSH
T10085AE1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1150853D7F37DE48E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 0eafd16395027f134a0838d8ef95f318de3bd73bfc0ac36241f33b06baa4f09c
MD5 3814d9db45d42355ceeaad1c42d0d22b
SHA1 8f416c0be648f76aa2733ed3333f3df7563538a1
SHA512 b2edca3309d6db940c312fce1817db66e07a13620db7b74e15142690e15a1cbf5d5480292cfa21fac2e34eb35da0d938b667b4da9acca719c75d485530931a0b
SSDEEP 12288:3hbHjfX8+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:3hbHjP8yxknw4FYnshx8OfVe247
TLSH
T10E65017C27EC20D1F175A17A86A28206D331B8651B3193EF93A5923E9F36CE45C39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a4df7f9b74a9647b243aff5ac6ee6190e9109feb5174d2f1b26db7df8612f4cb
MD5 0e9c20f59e24fa6e49ef1ecb79e61b01
SHA1 2e53c977e13870ce80b6db451153d08febc9e432
SHA512 2822f21a543fbc2862de61458a683159517fe128280d742d924e1189c2230367f3c74947413724bdc9125080e210fb5d9d8ed9d304eb8a74f66adf08b38e75c3
SSDEEP 24576:33YgnJcRTk4yti+R5dBR/Uyxknw4FYnshx8OfVe247:3IgnaTk46pBR/vx4x8EVep
TLSH
T11A45BF2DF3B910B9D8AAD136450143B5FB71782D1F2096CB0174C538AF1AEE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 86a6544fec1e2f610c62ccb27779cfa6317175c3bdb9695fee959dd8f061f118
MD5 eb75707df1987832a0257cf88da44bfe
SHA1 9f2aa26d14e11a56ff083e5c6397b8ba5faedad8
SHA512 fa5e016a67c0e98ae56e1403a12d471ddc50115cd609cc7da15b923fd78ca28c17322b83812b493b4596439df935b365aadc942da4b4431c3e4a22732f42e3a7
SSDEEP 12288:ak+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:akyxknw4FYnshx8OfVe247
TLSH
T1DF6523BCA7DEA4D2E55D15730A7162223605B2A0EB71829BC77DB11EF1F0CE4A03E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 f80e6b357ec944569f5afe5431d7e4605fef3c9b2c0e0cb70aa650a3c46b7ed9
MD5 bc64745e889bb166f8951e68b3c9105e
SHA1 319c9ed7d51cfd787f22613a762555447c236f49
SHA512 89e18bae9752e1987de7282741db8edbb837a5da66264e14a89e986f66e7a00f994de4a81cc739a2259f709920238dcd6cbcce5b9234808b1ba59c9cf9cebe38
SSDEEP 12288:1Ob6A4LWOsvAYFTt+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:yCL3UTtyxknw4FYnshx8OfVe247
TLSH
T1A5850158F7D400F5E86B813DC9729612E272B49D0774E3DF43A88A691F636E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a1b008dbc05a12b1978cb3563269afb3172e3e089579f8c74167c58a7c7d4e17
MD5 b9c9f475947526e0e3bf42d3652f29f5
SHA1 3e20326cc36540112566916d6eacdcb3dfe80e56
SHA512 f7079195f3fc5c913b2ac8176156d9c7cc4bf03804ea468e05aa0aea789c6b383f41ed6bd12554930874cfbd9e97de94c2925de97f9a1e98223230d930da158b
SSDEEP 12288:4pFtkO5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:TO5yxknw4FYnshx8OfVe247
TLSH
T1D565022C37ED10E1E179613A8AA25309D371B465473253DF43A0916E9FB3DF8AC3EA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5a948e8591fa5f5def742a30c462d898c2cea128b978754fb35fedc52489c71d
MD5 fe22c050c32ae5fcee2f83c2606b42aa
SHA1 f109509b2402380a6bf7e8091101b7cd9ab02595
SHA512 697b5b02b36f9d6ab6d46e4482306985c33b5fa8d969b74fc8a389799d93aa1a53867639857f3345b935008adfc1546c1f2676449eeecb1160d94f558f16d951
SSDEEP 24576:Q7NM9YqZqmWMUkPjZM48Mv6bEhsYyxknw4FYnshx8OfVe247:Q7cBWMpPjN8DbEh6x4x8EVep
TLSH
T17B659E2D6BEC81D5D476D13DC9A28205F6B2B4611B318ACF5162833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2b49cdd8a6342bda12a4fefad31982c6b039d82cc2c7bc696d7a283128053d19
MD5 a8fc39bd4fab31368de2f2100e99da3e
SHA1 0676ae51193637df4ebcc8a90d90581336891a05
SHA512 50cd5303a278c9381adbf52da3db37831608b4a998db79431b9ee4a9e75c24c300f33ed7f854d2ed4a2c57e911605edd83796ae11bfe3c13703bc6ab19e38774
SSDEEP 24576:wW6BApg2YuyuNDYTabvcdvNYf8km1Cyxknw4FYnshx8OfVe247:wF2YuHNETovAvNYf8kmbx4x8EVep
TLSH
T18D858D2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 c723b3de2b8c2a7a17cf33f229d9329bc512685a76e38bd6fd10cac397ce6a2a
MD5 b0895adf8ed91bcbd5a09261a6474b4d
SHA1 26e832acb0a144c4ef3c8a54ffcabb787d752b24
SHA512 b709b420e6842960fa23b5403d5c8f549a3e171a1729f67dc19d3431dc566dd6bb49fb6dd7f5370ad00fed21a5b71ba95905a534517fb6b4a6dee73058d6ab57
SSDEEP 24576:AAFs06+Omlf3NXEbToVyxknw4FYnshx8OfVe247:VFs060lVXuhx4x8EVep
TLSH
T11165AF2F62EC00D5D07ED17E8A97C91AF6B17463072556CB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 4e2d0ad65bf25c83f30f4a87cb5ea4ee074963485adbe0453bb26ea1cffc1fc8
MD5 d26c6ea6d9e2171b827d1dbcf6ff017b
SHA1 f00864c388175d728da391ebd53e63b5f68d8e85
SHA512 0f50bc21fcbe52d4269989e74db7fddec5244d13903607b941bf78de12a618762d0c027d985c2461162fae54f9be1ea2d946736ca0efb9de40297be83f93d0da
SSDEEP 12288:WCJnJ5D3Vkr8zx4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nJnJ5D3Wouyxknw4FYnshx8OfVe247
TLSH
T14785D03CD2A810E4D4B7C274825A2756FE72343D2F226ACB58B4D5397F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a8f14f61b9db4b4b33e960a5c2c9a155fe3a48867e215ef51db8633f39b129b4
MD5 5c6b912a76cee03badb200eea58a9d43
SHA1 dc34a337a6d96816483b73211e9fffdccea6b4de
SHA512 eaab7d51ac4d2718169f936ef5e6c355857f480bf359a61eb5a18256e3d046d25709ea59a5b2fc9f02f0657e4b2e926c3505c7c3dc08b9e514ecaa4cd7e8bf6f
SSDEEP 24576:gEPghm6/7IIXdwcXrif7qQncjlP65i3Vunyxknw4FYnshx8OfVe247:fg06DIKdwc+eQnSt65aVHx4x8EVep
TLSH
T167955C15B7EA5294E8B3CAB1CA62A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 7c5bbdfd89c6babc2008c744094a19d8f6b58077f7ec853de6fb86666aab18f3
MD5 e6d5b9fa6c545b7ff9e785805651640f
SHA1 d9f525ea96862470a59aa16a7c21c9c026bb6c98
SHA512 6fd20f3be1044be8b07f6d1864e37cd23b14675e5b1d34efe02cac6f0abbd2a19eba13903147bdb60526fefe67bb66576a84a3795008a1c15be7b0cc96a02d42
SSDEEP 12288:REP3RMh+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:CMhyxknw4FYnshx8OfVe247
TLSH
T13465126C779DB0E5E12A503A86A18205D372F0706B6253EF87E5D23E8E72CE46D3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 f207aae28aa33b79358d2705c970b34d23718caeb12014ebe20e9fbacfcefcf0
MD5 188cd3088701039e9e65c3514bad41f3
SHA1 471bf8508aaf78b8f4df23ed21ca740da8517792
SHA512 f5d4d601cdf86eb3a0cbf94b5538ab78d524fd69b296fd6f98bc69bf403b57384643fb6a32bac2ef96adb5153389f7a5ceff51a3fcfe8a0199bd7a39dfd6aff2
SSDEEP 12288:Zjkyf+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZIyfyxknw4FYnshx8OfVe247
TLSH
T11175121C63D8A0D1E5B905369A7352A19A35BC709F3193DF9290F23EEE71DD0A839B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 00ff44b9aea6fe98ec5fadacca91ca945279c4fd3b404b828a42fd8c9add030d
MD5 f5efb495de378013e4fc356e3e6a4a4e
SHA1 a312cd815e33961f95336e32c8c848d3d765e7aa
SHA512 1d4afb6ca0ed582d3d63c4bd132854f47f9b72bbd960668eb6a0d7f27fdfe2e7327873a356a79d813b5e143eb1a65096ca7f9170b810a2f47d70582d23e647de
SSDEEP 12288:BGp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8pyxknw4FYnshx8OfVe247
TLSH
T1A165236C67EAB4D1E9191173063163626225B1B4AB7191EFC7F8F13EE6B0CD0A03E953
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 149f9f6ce0c488c0f521c6df2601f95ec176924f243f3cd30e2b6180b7f8f71a
MD5 f006713a3196750533ea6626e75c70f0
SHA1 92733ba7ec1314bd218c7670f6a6910a41af0ef2
SHA512 8b24ed8c0cb2ccb1fa8ea561c330d9c00590c5b811ec9c26452793770ea76d3db952452d26b824e4752e4e84e6794edbd9fcec07c8d26781974a98a5e97e2039
SSDEEP 24576:dQ9MxZKdcz9dw3gyxknw4FYnshx8OfVe247:dVKZjx4x8EVep
TLSH
T152558C2DABE905DAE177D23595B250C3A633B4311B31D6CF2448D03D4D7AEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 068be15f5d0ecf41eed06ac64a71994c7107383c205492431459e5e923519838
MD5 a0adb707757084c5f5678cfec4d48f32
SHA1 febfbbe844be28480c0c0fef96a292bff306e34f
SHA512 8669dc42eb9a3424135258b7697b8c98130af6219ba37996d78279a6abfee5f7b8ca0030265f5b19e33900e3869ac2e09c9ce72604521a847d3212f18f581ce0
SSDEEP 12288:tyoKo2SRple9p7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tyocgAp7yxknw4FYnshx8OfVe247
TLSH
T15775E01FB7AE40E2E166813C89958345E773B0705B6253CB9691C33D8E739E8BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a4b0951dea0668f3ef2ffd60f97189d9fe3c273ce7828c7eef97d86ec2232c22
MD5 23588c0f7680f3321c57588f1dc031d4
SHA1 292696baf38cbc5a955851f04d8c4db4ae2daa73
SHA512 eede4eab2295d41dbc750b2f5740d717d2b5829d0a808543e66159e0fa1376d3418df958455513150db19959f2e3501abbe52e65b366c4331d8e160da9eedc77
SSDEEP 49152:oWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKex4x8EVep:K0zuNIYix8EVy
TLSH
T12BA57B3DA2EC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1df9ac49542b3379f6e3f267c5afd15d1bcb0e7366b855a590b75b67b3c70aa4
MD5 984076f15c2bdc9aeda799a770b8fd68
SHA1 946c598137eefaf63a9a5229b23246704eba0eb1
SHA512 5910110d77a79db03a712f79ab9287ffb2e3c633197f0cb849d7df0b59c7c96a7432fca9f6a2777bcc251f0f49cafc0c868b51b17520a4724a70ddd82cfbc708
SSDEEP 24576:Y1QT7EcpfxR+N5AWAz3ooiYtjMqbhyxknw4FYnshx8OfVe247:lTDxR+N5YzTfjMdx4x8EVep
TLSH
T1AE55B02EA7F815E9D1BE85798B23C512FA727821033193CB42A0C17E1E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/520-299-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/520-306-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/520-300-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/520-413-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/552-415-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/552-310-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/636-329-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/636-277-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/732-8-0x00007FF8E5670000-0x00007FF8E5865000-memory.dmp

Download

memory/732-32-0x00007FF8E5670000-0x00007FF8E5865000-memory.dmp

Download

memory/732-1-0x0000000000790000-0x00000000007F6000-memory.dmp

Download

memory/732-0-0x0000000000400000-0x000000000056D000-memory.dmp

Download

memory/732-6-0x0000000000790000-0x00000000007F6000-memory.dmp

Download

memory/732-31-0x0000000000400000-0x000000000056D000-memory.dmp

Download

memory/872-287-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/872-295-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/872-293-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/872-410-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1252-60-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1252-68-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1252-66-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1252-71-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1252-82-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1692-83-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/1692-80-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1692-74-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1692-240-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/1976-92-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1976-35-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2176-546-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2176-327-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3000-450-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-438-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-418-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-420-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-422-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-423-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-424-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-425-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-426-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-427-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-428-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-429-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-430-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-432-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-433-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-434-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-436-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-437-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-440-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-441-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-442-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-443-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-444-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-445-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-446-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-447-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-448-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-451-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-452-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-453-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-454-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-449-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-439-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-435-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-431-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-419-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-421-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-417-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3000-416-0x000001D0EE0F0000-0x000001D0EE100000-memory.dmp

Download

memory/3384-12-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3384-206-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3948-405-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/3948-361-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/3948-553-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3948-335-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3948-411-0x000000000CD90000-0x000000000CD98000-memory.dmp

Download

memory/3948-345-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/4324-284-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4324-407-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4564-317-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/4564-249-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/4628-315-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4628-313-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4716-414-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4716-334-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4716-280-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4916-43-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4916-45-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4916-37-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4916-238-0x00007FF8E5670000-0x00007FF8E5865000-memory.dmp

Download

memory/4916-46-0x00007FF8E5670000-0x00007FF8E5865000-memory.dmp

Download

memory/4916-237-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5080-330-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/5080-549-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/5280-480-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5280-318-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5368-254-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5368-253-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/5368-321-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/5368-260-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5588-545-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5588-322-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5676-207-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5676-16-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5676-25-0x00007FF8E5670000-0x00007FF8E5865000-memory.dmp

Download

memory/5676-23-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5676-236-0x00007FF8E5670000-0x00007FF8E5865000-memory.dmp

Download

memory/5676-22-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5696-272-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5696-325-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5696-273-0x0000000000700000-0x0000000000766000-memory.dmp

Download

memory/5696-267-0x0000000000700000-0x0000000000766000-memory.dmp

Download

memory/5748-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5748-239-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5748-58-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5748-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download