b78038bb38787ee46796c1876bd58aae2fce17172f9955f664b30c652a7743c8

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.4MB
Sample260720-te3beafv4k
SHA256 b78038bb38787ee46796c1876bd58aae2fce17172f9955f664b30c652a7743c8
MD5 53bf1ca7c84d9689e8c842a503a28869
SHA1 c94dd116adb8d103eb0a8a10a91ee128b8b840d4
SHA512 168229f099424aaeb1cdb7adc8a8a901fbd79d4a621dadf95363cdaedd4b6ba25f8f02b96c02bfc520212c293b498bd4a919f8f9baa265967ecb706eea2fc1df
SSDEEP 12288:Z57+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:P7yxknw4FYnshx8OfVe247
TLSH
T1236522787681D0B2D44910370A29D3B16B2BB8B16675C147FBAA777FEA704D0E22E217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4620	elevation_service.exe
4336	elevation_service.exe
4888	maintenanceservice.exe
3308	OSE.EXE
1856	PerceptionSimulationService.exe
5660	perfhost.exe
5048	ReFsDedupSvc.exe
1284	SensorDataService.exe
4808	ssh-agent.exe
5108	AgentService.exe
4788	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cfa0e338e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4440	4300	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a50739bf6018dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015fe51bf6018dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001173afbf6018dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8e7e4be6018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079bc5ebf6018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7aaa1fc6018dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e69fbfc6018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003aa265bf6018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2f84ac16018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4620	elevation_service.exe
4620	elevation_service.exe
4620	elevation_service.exe
4620	elevation_service.exe
4620	elevation_service.exe
4620	elevation_service.exe
4620	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4300	2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeBackupPrivilege	5048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5048	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5108	AgentService.exe
Token: 33	4788	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4788	SearchIndexer.exe
Token: SeDebugPrivilege	4620	elevation_service.exe
Token: SeDebugPrivilege	4336	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4344	4788	SearchIndexer.exe	102
PID 4788 wrote to memory of 3712	4788	SearchIndexer.exe	103
PID 4788 wrote to memory of 5336	4788	SearchIndexer.exe	104
PID 4788 wrote to memory of 2420	4788	SearchIndexer.exe	105
PID 4788 wrote to memory of 2800	4788	SearchIndexer.exe	107
PID 4788 wrote to memory of 1600	4788	SearchIndexer.exe	108
PID 4788 wrote to memory of 2676	4788	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_53bf1ca7c84d9689e8c842a503a28869_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 476
  2⤵
  - Program crash
  PID:4440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4300 -ip 4300
1⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4888

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3308

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1856

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5660

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1284

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4808

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3712
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2760 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5336
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2420
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2760 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1600
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1fe8473b5c15b0b3edf6630318753116fbcc000199e683995ceeb7b164eaee05
MD5 c41f14d9bfe213560d7d63fe2b07100d
SHA1 3b34e55037d479932356bfd7b738d8170c8bcc74
SHA512 a1dbd89218fba1bc235ac2124fcfd41cd7220184cd2541fc414c5df8f990ffc9630c644f370b3aa114b08b69e01fd2360e94933511725ab39eceb837838d0e83
SSDEEP 49152:rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn6x4x8EVep:53q6HjBRix8EVy
TLSH
T1CFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 388256d34b17af7db51b95d09cfe746ac3483d6bbfde651d8ac17b8b15bed8fe
MD5 8992731ba374c7c487d2434ae8b1de2e
SHA1 b4ebcf25fa25f4e5dfde17017af2bd8c50b8ac08
SHA512 073dd0bdc3c1fb2111b11da71874e084e58a3b6c0a810c81060df533cd333ecfa58af661a195bc9386ad79e9637ce35bc734650a075458fcbe1a441d20e82fd6
SSDEEP 12288:E1XLsswWkxy2lRq2czAK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:CXYfDtczAKyxknw4FYnshx8OfVe247
TLSH
T14575F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 f7a206dc9ebe9c97d37c42145ac583b71bfd6d1b251718e0a3f3816912d77955
MD5 4af51c8352be0814e3feabf5fbe0f590
SHA1 f88f9b1d3b7c89f590e99e37160fed7da2dacdb6
SHA512 20026ed64d2d368efeab27670c2fb5d2b17eb427ce802cde4eb6ac5515a33a05fe3d37b33b2c5d7a4a0f475f49cf9884825659b2ff535776653df6a6351d103a
SSDEEP 24576:L0Le5ji0hmxFrMHyxknw4FYnshx8OfVe247:LPji0Arjx4x8EVep
TLSH
T14F95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2d0b78f434f896caf81fe97c977d05a51d2d5a506d981c813895bc1499f6f3a1
MD5 defb7fab05ec21484290821740b51f33
SHA1 0d738e9ce5c7baeb0f337e52dd8188a13a1e9dc4
SHA512 bfb7dce8a9fcd5c6879e487cb427bd4ce6052eeb02ad4a173b29140336cd304497edb408c819010304e9f5b0b2d654ab642b8eef36c12719002f0f8eca4ea537
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyupyxknw4FYnshx8OfVe247:E/ezSC6vUzPvxHjyHx4x8EVep
TLSH
T1E0756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 713eb3d3a91967c772f8dbeba734185567429e6b7ed60e5acde4bd6399af4a08
MD5 1c0d53240989ee6b1f8f61400b035172
SHA1 53d278d036373e7e222a3f5a939cc05920dcc0de
SHA512 35e5628da58ae2fe60783da7d564e6ed50f263a68c0d358f5a45d8d51ea929f88135feae18c25782e460df69d9af2928cc0953fdd5f80c52f79ac9225910a73a
SSDEEP 24576:CVbqPb88hv/l+6uyxknw4FYnshx8OfVe247:CVO88hXl+Gx4x8EVep
TLSH
T144559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 b26bafd6408d7dff1dd9bd7255f179828907d95e76f598d04481ff5a508332b9
MD5 9176ec2d89f697c2884fb8996e52cde6
SHA1 68625d52297d1170aaf98b61ed2eabdaef2c8b0e
SHA512 36ba3b310b4c331e2257fb8a7022ea6c7578b4dbb565b090775cd95831c176ff25d74aaea10840a7d444c2c02a372cf307fedc14a8e8ef145c87b795825259e7
SSDEEP 12288:iNr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iNryxknw4FYnshx8OfVe247
TLSH
T19F65237CA7D9A4E1FA5E14331B7172622616FDA4DA74C11BCB79B14EE0B0CA0E06E613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 41507fa4b00e086602fbf05a3389cc1d02513f1726b422146eb73fe43d5b5ff2
MD5 78ed13e5794bfa3455b1196901a90ad0
SHA1 f0c19c183bdd0857a180628cc4869bc7d532c6b3
SHA512 94caaff70f68e361b999a3a226ea4fc346f8f311123266c4ba98a56b56ae7ad41168a2940345f5f3797dd1866e2cdf26c9a55a9dafc4a2b135ecb8100662788b
SSDEEP 12288:oeBNUbTVO86UG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oJIUGyxknw4FYnshx8OfVe247
TLSH
T14F75CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0e664d09c749add9328b20e38adab83095feeae0d1c92a688f623524b4b6bce3
MD5 bb572b49e6de0ea8a07efc2c7fe4fab9
SHA1 4373ae03c8aee53247a1cb505582f61ef1122e7f
SHA512 9c6a7ffa37a2fbe85b8508ea9c8e75111a338fbc5e716670581eed5194405fb3d5edc5120fbae68fd583b2096e8b94a74c1cb8f0c870f9e8d85f343df0ca7a6d
SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THx:vQvGAdlCEL8c/yRNw5C8ix8EVy
TLSH
T137267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 35c0db9c2106e8932a891795f875d2c0e4ccc15c35411036ebf85a6f607e2c4b
MD5 d896c5a17484e3ff5856d33f6cbaac06
SHA1 8f336165599169a557ab851028b400764d88cd17
SHA512 7277813f701fd1cead65ce0e279d7bcec3bd1d794887499590ac23a29717393496ade9ef8e98ed5a9f9f60cbbbf65ecb53b7c3a5239c92fdf804844d2c369ebf
SSDEEP 12288:lAwSfxL/2Dc3LDLLmt0LDQewsAjw+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:G6ewsAjwyxknw4FYnshx8OfVe247
TLSH
T12485E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c910c9debd167908c18282e5220198ff9527e099d1932d1c088a95a1dff08e23
MD5 865cecbc63bdd0d1e6f3b236a724c2d5
SHA1 4652b60e3d1fee003ae4429b0df9125830fbddb6
SHA512 7bacdc89af1a9afbf97b67184a1fcc1ef6c8e8bc5eb71b55485de968813b06ffe645083106d6f54f3b877e74a13d9ee226d14451555032310e5131188fd8c912
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHu:qUEtQevvqc2W1cpV2EI32
TLSH
T15B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d6ee4144f5b08b2d4a3a4a7d8b135fcd77d48ef3487b5eeadd74d83db3c49a64
MD5 c8884d3d792828a70bb08366ea8eb4f5
SHA1 ff9580fe244dec2f42a85138ce52bb658e2fec7e
SHA512 0595ff6fe6e7b8ecf315664298417945fb5b1d1854f4c839c4541a3cc7bb22d589910425895775ba91f875b407e07e702d932b0cc9615a5b91ab8c19d24e9cc3
SSDEEP 49152:cCbRquA/m2yL5zQfFiV+XenmE3/zTx4x8EVep:VoqtVjnmgix8EVy
TLSH
T1A5D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e743e00ecae425a675f3f363bbd40d595964d67ad9f7ad0ff9dbb68dd360f5ff
MD5 5f1795145fdde3b88d72e5e93f5534c3
SHA1 69ab69dec5f321d87d96721a4013a5a2ff035f2e
SHA512 add28389aa314fc0524c145bd95524f44e80073d4eb802d06e6dc64f6c7437c7f48330e442f420774435ee0a8cc45290c2b5008b2bf4038a49b5adddc66040b3
SSDEEP 24576:DAhGLJIFoiwtA5l7S53ryxknw4FYnshx8OfVe247:DAMyFoiq5ex4x8EVep
TLSH
T1AA35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 a38678fdd5e11ce13ecf616fb48f97a3b59551ed7a0b481c80ad839584ef6c97
MD5 430a5a7918b44f1d517d6e3622ee06e0
SHA1 cfe2842db858f98bb26bc342a996110f3c1b4605
SHA512 51b7db0b0107405e7811a7f2d2991db656a16018a3b82672d6dabc03f3109c9c449b998a324bbf6da647e35a5571380c1d7b9452df37c858290bc238987f35eb
SSDEEP 12288:kmw5HEjsChNoBFgl0WDm+CJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:BwuFOWMyxknw4FYnshx8OfVe247
TLSH
T1E475F14977E91CF9E9A741398657C136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 91edccdeb48e55a212fabd1c42567dbf853647fe09ef99c068a482a81e226f0f
MD5 284179ec272a91422f54527fce2769e5
SHA1 77eb2175b9d0c2d465e9dbb3cf7ee1165f0f3db3
SHA512 b9d86c6d91e469bb523743e142bf6e43a866b1589993febfd8ce35c499a92b80c7d959656a8835fe1693404cc3c94b0013163d5051bd3ea71e7337bd2195b867
SSDEEP 12288:EFZ1IyK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mZu5yxknw4FYnshx8OfVe247
TLSH
T1546512AC33E860F1E1A7113A89F15205E76274A2677183CF4764A25EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a5bd9e342efcfb83a4e6724111d8e2f9eb9c2c36fdca7ea74cdc4c75b3a60ab3
MD5 c618d33c607bf565a40cf8465c59d436
SHA1 a764c6be1b80f7e9fbaf9b1afe789ecd18969b3d
SHA512 7ef31187765a68cf88896a0ad408f19107c4648b2966cb47cbf56e8da9c3d8b524d2ca283c10652ef1b1a677c7ba987dcc98087b69481a5eafb9ae84e4c8941d
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U7:zQRQyi36YOcPQLvw2gAf+PN3Dix8EVy
TLSH
T12F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f6f57a08149e6c143e521c8acb29161d3565f86c46833b81f9cd0516d5ce030d
MD5 eedf416a50ab0fe9f10363f241293aec
SHA1 1d2964ed0207dd7b2dc9581bf5ecb9fe96dcfcf9
SHA512 50259f83750a9d50f8267fe33291be00d5225be0a18aedb23959a737ae374682a2f6233d9f7ed273ea00920c8499581006479365c10bb1eed5415750e25b90cc
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U7:rQRQyi36YOcPQLvw2gAf+PN3Dix8EVy
TLSH
T1F9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5e6600501aa4476c91a7781f0bfb77a2947f2226b22863ac9b2d59633272c4a2
MD5 b4038ee59b8e4386f1191f189c82ffda
SHA1 b9fc36828bbb4f5a0bcaaa1b16d5a1c3110f55fe
SHA512 a7797b256a51fe734cec286edd434bbde28a547440ec2726ad95c42145f4dbbfa24c52958d711927a61ef9d50abbb45ea849e7a66a041fc8264559644c324b0b
SSDEEP 24576:awvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Jyxknw4FYnshx8Z:U68Qg55nhheWu7PNU3/Fx4x8EVep
TLSH
T14CB55A33B2F600A9C44DE1769F46873196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b2d8459cc1df682505ee7ac286009ce6df89fbaa449e275b4fede1fb41a41d81
MD5 7672c401e21cec2138468a8626c5e7fa
SHA1 84e55167308b8712c84b98c632f766861dd3b0cf
SHA512 4f25386db3c939bda8c4f998b590ae73a4e35110bcbaa97ab038db6ee2a9da2959a3f2d48a252e06b768fa82fe19a72b2aa32ed47fa7c01695fc5c4c86d388d9
SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99N:Jy5112gYy5azzVvL69nLKnhZ4ix8EVy
TLSH
T13B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3d7dafe00b880dfa45a00e3c5242ee065cb7d44350d7a910df089bef746cd1af
MD5 b22b4bcf86b0f534244ff8bdacc481e9
SHA1 2c376fc319943b8dd1a1cc30abf5318caba27a5b
SHA512 2d7af39d451a3ad155b5943a8efb82982bde38749306f51493058c563861febb6a8dd45e98be137328552d9fdd9f6d361d87c3513bd2465d0a7a2eaf608b889f
SSDEEP 49152:fB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glVx4x8EVep:hu6JmVxd2dVix8EVy
TLSH
T169D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bef7d9c628c1b8ae91d409a4e7f3d24c895f5fee4d8c58ad7fc661b2b14211ef
MD5 254d09810f6511e6e18477212fd706c5
SHA1 0f8c77cc40dc28d5138a756b8f6c1813f35a9633
SHA512 209fd7f838ea93de978491ae2a2bfba218f2cd4788d8e70ac7a6abb9951be5249db796780780108eed108b85360834a4cf3cb993b1a6356d92ab568e58b7c39e
SSDEEP 49152:f1hpsNoJpF1A6UU44CwH7R4xHx4x8EVep:fmifPbRuix8EVy
TLSH
T155B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 498de289bfd3f4a3b5f9994adbf1caaf2d8b1f5b98f554a2ac1f00be83f4ae0d
MD5 df5b28e0edac2ff03489e1a06f88f8e4
SHA1 0b77bef7eba9b05ceb909d37f40e0db411ec0f6b
SHA512 cf16ecc36fb48c04201947be903510ff1f79d8bffa988a53dcbef451aa40cbef374b55ce427b5a8b1dbe8405f61ab67c3c7bcf209112acd1d891430127bc5b35
SSDEEP 49152:2SuZQIY0Be2KRRVtOnks6NMHq8x4x8EVep:Y5dKTi618ix8EVy
TLSH
T135C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4604aa5d40a9c98f77862a432d671a67b16636c1380eb222c641c6eda3e547cd
MD5 f031adb904a971897f79bac72a9aba4f
SHA1 80d831b4f879d2689a00f2286653481ab0de8b1e
SHA512 6941c2fb3fd17441d68ad1c26be3dcd2e406fef27e1d8e9e03ed19d096ff39c64b45d0fe7d7c4cc13016c4a15f130fbe716a3f68af850e4222f175b72b9e5b0a
SSDEEP 49152:whtSn8EApI0figngiDn0AP5w7x4x8EVep:hX2iyphqix8EVy
TLSH
T19C95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 365eeb7be7b1f9b4b0347130ec745fd8b5d40288fd42037e53e7be99dfd82c99
MD5 e2c8948e430d8a26b3abebb792926292
SHA1 882b1bfb58d9b4b0253051fcf1467af26585f261
SHA512 fe0548963964b3db5e14a6e6bf4bf871114b5dcdb34d516f4ee6be61b77892ba7ccaaf5592e4569bc8591015c3a4c049c290ec64651e62fac1e9877c6c039263
SSDEEP 12288:fV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fVyxknw4FYnshx8OfVe247
TLSH
T18E65237CBBDEA5E2F50D11734A7172626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 bdfe10cd8dd6921a050540739b7df9089431b17c8e6f136a55e3c1e15a4080c5
MD5 65531b0830851c3d5c0bfb6beb4d3eba
SHA1 0c25a098ecaf7253ad94d794789a288a3a4588e4
SHA512 295822804d2db0e1e1cfc534b306288b1b40476d38fefc603d33f5716456f42af363c5cdf33c04d58492777a187f8b8c3c003dad3111d6b0ce569db6b2efdf89
SSDEEP 12288:eW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:eWyxknw4FYnshx8OfVe247
TLSH
T10E65237CBBDE95E2E50D11734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 b5ea125338dd919ee748ed582a5e87ae21417fbee405076f9288c034846736bd
MD5 7c460daadbc9b6d08c19f8416bf4353a
SHA1 6c0cb94a086c5b8db924d5895d63ccfd0659663f
SHA512 9321adf2d38e82090ef500f157b44d6149d162b5c9b56008b3d34b6d937f7f09d9b22c13282d6d6b6dc8b74d50c15bb80d2278c7186cadf4536dc5e83d5a7c1a
SSDEEP 12288:T0+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:T0yxknw4FYnshx8OfVe247
TLSH
T17A65237CBBDE95D2E50D11734B7173626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 ffba086512927f96eeab5fd4b0eee8e7496045c4644841d755c37e7aaa0f4d44
MD5 e35ce4d0a3cd5908ab2803709c0f6ab7
SHA1 98b81a8f9c616b3a9a9d63a60e6e74be27a2f1a5
SHA512 6c10ad690b40646510d856d7361e7ebc8685957066bcdfecdaf0d8293b8bd02914359be3c3913e50678867392612f877cc5eebff6e57b97c9791adbb193e1e95
SSDEEP 12288:tVL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jyxknw4FYnshx8OfVe247
TLSH
T1A965237C77DE50D1E85A51738A726222B365B8E5E731835FCB24710EE9B08A0E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 c533cbfd249ea5169e882d360294344fc5879db25a21eb96fbbfdc16275ceee8
MD5 ee6d160831aab0474b5f7bc68c8e5e21
SHA1 ed7240077319248f86534e082397cd963f6ac605
SHA512 39b929654b9a08a89de1912771684fc54f15c6025d7f9a86f934802eba31c4be84acf109295834e16840d1895df4bd5cbaaef54c747c0203ac9d1669e1969ccc
SSDEEP 12288:iD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iDyxknw4FYnshx8OfVe247
TLSH
T1AD65237CBBDE95D2F50D11734B7263626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 596d28f0316d17b008cecc8b1a1dcda2363604f7c9e083ab1b31acd4d4f5bfe3
MD5 239601e36e10d090951c02e3343a639f
SHA1 0e96acdad62095c041662d7360428dab893af3a8
SHA512 c9fd90416ddd7cac368124b075c2510f44a6d3cfcb614844f096ad37f52d5aec60e491c81dde6de66314de3e75cdd78e0da8719d3d811916228dfb20b460dd6a
SSDEEP 12288:8C+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8Cyxknw4FYnshx8OfVe247
TLSH
T16165237CBBDE95E2E50D11734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 888b0ba761d5e553b33286672d0bf384c25221f8a682727ff47b934a51f59b2c
MD5 3a02a62bf8d7e8e9bb15f72f938ef196
SHA1 ac27d698ec1027795e8e3f6be2e1e4485e996aed
SHA512 5a0e28a87cf7e626860b242ce3691fc297c87a8b4cda0104c08e3698e0ccee64077c7ca6c0297fe8a7afdfa8a484f4956ace751b6d53c5707e5ff8eda2b9f894
SSDEEP 12288:aO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:aOyxknw4FYnshx8OfVe247
TLSH
T1C065237CBBDA95D2F50D10734B7172626609B5A5EA75811BCB7DF00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 ec5a6275710b973d4a11e7ab40bf3f4543cfbdd7c7c47e5fb35fd1e089ea6a77
MD5 e60a6d8c3fb39f62b6e70c8232f53ab9
SHA1 5a574664306552518e4ab137690c56ec67da409a
SHA512 09a88a7e2e28a2c9bb8568697e66a42b0f93a5952e02e154cd79bcd9f6a6b131d6c1c80a1f34b97b44b8bd8d0f31af4dc6426ce90ab5777927e3a27068fe2562
SSDEEP 12288:yiZwbZzzFEoS2cPvy2+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:VZMdzFVSO2yxknw4FYnshx8OfVe247
TLSH
T1497502A8B39018F4EC67413EC9259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 8056ad1e4e70c62a2a60e13dcd93cc286fdfdfb1e17dd373b180e09d0d2a4fdc
MD5 43e9f65ba5c27665bcd67a50f19f1906
SHA1 8d2a8003064cc027825ad535acb369006522e382
SHA512 f14e85cde069e1108b0e3011b17b6bf6c39f480951656e192302c6b1b7ff3a7f3c4824ab17331c6fb0ad8151eea5821f8b0e39cc43621edf8c1b1fa7c981f359
SSDEEP 12288:kp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:kpyxknw4FYnshx8OfVe247
TLSH
T10965237CBBDEA5D2F50D11734B7163626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 76c4d5bee85abee6bd63b458bcf089c2544b81b15b27a669a728ef9c86a07cd9
MD5 07bd26b5fb88e7fcbcdb4d8029b96d0e
SHA1 e44bfa37de30897c4abdd396ee2a0249131d5a27
SHA512 024e046ce6b8a5edf1012051f5cd62babc02037e6d02e9b69e62fafc75c782c480ac7dd4d40107857a85e111074652659b35bef7bd9b90bb39e55a6f23ec9331
SSDEEP 12288:N9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:N9yxknw4FYnshx8OfVe247
TLSH
T18A65237CBBDE95E2F50D10734B7172666609B5A5EA72811BCB7DB00EF1F0CA0A01E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 4493128cdebc9d453fc28dbbd34d92fb786b25a46b6969e1a2d2209ef6677049
MD5 4b116886418a0eccf3a36104ad4c2931
SHA1 e406b6ac619877911e863da3ea9cc3c4c5a69f0f
SHA512 f05372f192415e552737030266eb0c9717753fa76086598bc86d09fb53d7a8b458aa3c3cbd51c75cd130909a35a7a14ac6ab1596131409422eb463e6c31a0326
SSDEEP 12288:OyPz5L8K+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:TzyKyxknw4FYnshx8OfVe247
TLSH
T1A875125B73E530F5D12A4236C9621612F372B872473086AF87A4537A6E739E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 35e3e853cde72cd650cd169965fca68d54648016fe6aaa02347ad0f9d12b8a4a
MD5 c37f82d2fd88dea11e3f7ba42ff4c76f
SHA1 2c14e31c26ba22ebf40e5077ba9d8b5121dab62b
SHA512 d55a974d3e73b6d0286da496585b39270433b324d87c8f2e68d7b47e644a7c3549b260521c1e88b9c76e88e0ba40c5241b99449a0b1c811722c6eccb8746a179
SSDEEP 12288:kp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:kpyxknw4FYnshx8OfVe247
TLSH
T13765237CBBDEA5D2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 56864a943acc383226667a2955c1163bb810282aaf279e0fd007d6a59a2c8b18
MD5 ed1b891a9099923c653bb692c2a5d78a
SHA1 3c2a411e622c35f53e6fd4f3f35493704d712bf4
SHA512 dfd2a14e4fff996a84141107d761440213cb78539c415558dbe97a90302fe3e7bf34e54bfb50ae0234775f3fcec75993e696ddc43bcc75a1a1e4968adb567b31
SSDEEP 12288:bp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:bpyxknw4FYnshx8OfVe247
TLSH
T14465237CBBDEA4E2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 11902954b4fec39b229ab40fc0fc0d9b7f20bbee8dcaca0cf019846008d06ae8
MD5 224a3e60e6b8c2b9e64a459bc65d6cc4
SHA1 f33d4c651ae236668500d0f9eb9a22d8581c7b2e
SHA512 a346d1fa076621d52df87132c1a19bbadae1d1aa3151681db6516e8528b5458188ed0e18ddb88e12b02d812f6d5a7e0d167fadc9617908f0f117bf01586fe92f
SSDEEP 12288:+yPz5L8K+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jzyKyxknw4FYnshx8OfVe247
TLSH
T17075125B73E530F5D12A4236C9621612F372B872473086AF87A4537A6E739E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 e5b609fe09df241e1cafbd5f2f6dbf2b63fab3292cc9f0eb9328a506e2255e4b
MD5 b363dfabc03d72d1f05106cb9096fc19
SHA1 ce6413ba214bf102e4ffc4d462bff08ab8ac78f3
SHA512 a0e5dd3bcb49d0b38c18bab9983cedec1f1551fbf4c114dfab0e8821e5a61beef1dc2d46d5c05d29344b0def4056d214c183152f5f2eaae6a538dd255f209537
SSDEEP 24576:hTGaLl3z0zDEyxknw4FYnshx8OfVe247:hTFLljCx4x8EVep
TLSH
T1F37502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 4ae39f201f2452cc097dd880b0ecce609c36af2e8df1d4b9bdf9e397331e3a87
MD5 cd2e2bda91d6c19709d94044b2c0a463
SHA1 c54d794b2cf610038c7e5d8f380418010b4c00aa
SHA512 4b77e019f50cc68c47866f113b40f944ffa16340935a01ca39d848c42ca33f3786c4052bb812ba3bf9bfd7dcdb058cc0204a3f585ef073e1bf2b6396cca8fa34
SSDEEP 24576:y3nd9CHKy7GZgyxknw4FYnshx8OfVe247:Und9CHKyatx4x8EVep
TLSH
T1E195DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 c021b2cce849ac5afae7dd466374778fd6e6a951a7d60af908e97becb73fe29c
MD5 95d25ba717858ff326ab549c01ce2aec
SHA1 a8a976445afc81ca191877f713a981a9d0941864
SHA512 07a5c5f7a53b780b1200c567015fa373078765028f381fe6a536d5d57dc56ec66389260e4bf07714960538d7d3765f493a21cc2d721332795b459a3b68fda8eb
SSDEEP 12288:kU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:kUyxknw4FYnshx8OfVe247
TLSH
T1ED65237CBBDE95D2F50D11734B7173626609B5A6EA71811BCB6DB00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 0066d52fb0504045e100d8df99cc3a2e8375b002fb4188fe875c76edb1e22a53
MD5 2a456ab9edfa6175674a4807590dc7f7
SHA1 c1c761a9a83c90f91ad520b0caeb639f47f42719
SHA512 6a6b428d1d6cbe7efc2ebfc584fa16ebc21ef892ebc627bf0fccb1493a54d17a278b9725c6c91203b7dd7a4befdc697792dec452f95dd5ae68c6c256c695a822
SSDEEP 12288:vq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vqyxknw4FYnshx8OfVe247
TLSH
T1AC65237CBBDA95E2F50D11734B7163627609B5A5EA71821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 c32118fd69d743112390b096faa842804cc302bf754684a430354cd6892c8559
MD5 f167dfb2917b4de8418bb61d65b3ee20
SHA1 b7e614f0d9d3601e5d4cf2c149cd0b2f595abfbc
SHA512 f4feab146a8d16fa6ca1a6d9e61731f2b32beb62c56e698f73b388e023383a8f8db9d2469089691aa870884887016d06c23f4eb13bd5051729433f523dddf105
SSDEEP 12288:bv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:bvyxknw4FYnshx8OfVe247
TLSH
T13E65237CBBDE95D2F50D11734B7173626609B5A5EAB2811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 f6a9938ce7148a8c62102ec55348d9db09086d9e36719d2c9d04d4ce142400f2
MD5 be8cbea76c6fc791f22ed74cf3d26b00
SHA1 51550122c82fac166d4b958e796c52c0cf1e4766
SHA512 68a9b9eaf4ea0c37beefd9a73b639df8e07351c7fcf3de781f2ac6ed1633f9617b50b9ce457e4fd203cb97d59a5eab9f6dda5a0fcafabf7a265c98c99641b00c
SSDEEP 12288:op+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:opyxknw4FYnshx8OfVe247
TLSH
T19065237CBBDE95D2F50D11734B7173626609B5A6EA72811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 bc0ffad70c6e69e93f34f45efac7beb4298ceccdbd0fcd1fca6e2fe135139b06
MD5 4f319bfffe0dfe2dfc85ab0b91d7b3dd
SHA1 4cc2ee20cbbfced16de47b50e5ae14d963cdeeb5
SHA512 11db528e54bb5e1fce8401018627b06a9822b2e79fa6ead0d47dd259d1ed26ea3c181ed8a8eccbe684b6edafda69db0d2a098388f50bcd230ff20e0fe801ffeb
SSDEEP 12288:mU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mUyxknw4FYnshx8OfVe247
TLSH
T16765237CBBDE95D2E50D11734B7173626609B5A6EA71811BCB7DB00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 1ead77e581cdd2207c9409004873cab78cb8dc5f0d81ff9f617c94e6c04ef6be
MD5 2c7385496690ab7451b2804d73599ae2
SHA1 ac07f70e8d8afc8a05f7ba7ed0e77a97aa2abe07
SHA512 13881817867effe505c3b545498fb4ab7f71432283bb94fb05096afe4eb6643877601e4eeede834084366de1106dc23387bbf5e45cc6f10455e66b1eedb7f6b9
SSDEEP 12288:YB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:YByxknw4FYnshx8OfVe247
TLSH
T16265237CBBDE95D2E50D11734B7163626609B5E5EAB2821BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 bce18816d6636b5c018426327fed75ed9825cd841cd74ac6f95d1d51a08fe38e
MD5 91504fe7641eb1ede86593474ace5435
SHA1 f2722571341ce16408ff4fe912fc42279ffb9579
SHA512 d67a8b270311bd4ca7445702c00ca00d7b5aef3e3b838b8cd07e9a34c94aa7a9a8f78ef6daa6b4edf124399d9775b4091efc37cc9864ebab50bc9d8ad4987b9e
SSDEEP 12288:9D+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9Dyxknw4FYnshx8OfVe247
TLSH
T12E65237CBBDE95D2E50D11734B7263627609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 d551bb3566433c805943e2b029812ee89abbd8a170ef69172977b336e5ab04f6
MD5 c9b7e1133502d49f25282b59a3688075
SHA1 764c76cd5d4403d7f55c8d97abece4d601d476a6
SHA512 3f5a302db8f9902f0a7051131f4015b5ed11b1c8271c122a5aaa1429a1ab924d7eaae782d59413b11469584bf23be2565e20e4a3bdef690b24688b00edb5c471
SSDEEP 24576:4fwvJk9RX6wkyAILyxknw4FYnshx8OfVe247:hMnYIux4x8EVep
TLSH
T10B95CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d1f95135f58a011b9b4470f36afe485692cdafcb428be4e2605ac915e79df685
MD5 47ecd21b5e62591f4760b4358e3af4a3
SHA1 87a308d779b3b5c6399afdb891cdc6a14b3dc02a
SHA512 de17dba3d45ecbf97d191bd3f9ef1a4cc511f48e2133c9f4cd5901e2299304dccd18c953cad2deb2044ea93676346e646a5d073609e682151537bcce180250c5
SSDEEP 49152:WYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Fx4x8EVep:IySzPdix8EVy
TLSH
T1D6066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c6ddfb965f671b64f99afce87baea20983de0108859eab675b2082b45965f57f
MD5 11b771d3665256f19df5fb78637e5083
SHA1 095d58fe3d1a02dbfd8642d7313ec663a9c55180
SHA512 70979225dc42491c5309c7423b504c95b3d58932039fb8735ac08f141e715ef761a0bf632ed5f9e69ae4ec013976cf582e15ea476ec5e510132f9b9637e202e4
SSDEEP 24576:W47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYkyxknw4FYnshx8OfVe247:W47JUQj1irIhCnDHUPfF/Vx4x8EVep
TLSH
T1B465AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 b9dcde532c683671de4e25a9a3cd266dc398b8b2a458679fd9816a5a997fded7
MD5 df3739912e5d7543174b22943ea56480
SHA1 5165f9759be867be08acbc2f80a59b55ec86b574
SHA512 225321d83bc8914ee6c86d9afac455a4c44ca2f1d22f7f7e963ead00b8b9e6022f305355bf2da68768b40188cac244608d607eca162b00d80935f8dfa628debe
SSDEEP 12288:y+sf5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:i5yxknw4FYnshx8OfVe247
TLSH
T19A75F028E29802E4D06E2276CB625641B3237C6597F1D3CB97D0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 31b736ac22e9b7e9cfe112b3e043173b8c6e044e010770dc62ace09342d55b12
MD5 a09d8696e823fc1669ae34898526d3c8
SHA1 5c395ddc194d2a560b29163b3af1c201c3c7ebe9
SHA512 99b07579a65e5d51e18bf580df6c4acedad3520810c376fc9bdfe9f804d5182ef1324082a2bce99b3002bb80c44db27ae36a519b48265f46455eb27714642218
SSDEEP 12288:gvFO+xU3fAey1m+Xi4NdLEc+XzYY5PtaAJ5H1M5H:gvACUPyTNdLEc+XzhPtaATVM
TLSH
T18D352800766AD75FC6AD40325E32C2CCAB707D41EE059B0772C8872FD57666DBAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 7e14a40cce2965fbb226b1ca09d71f7443c92edbce8bf2d065dac120a9b1fd24
MD5 32b8c001dbb77cf9c62b90997741e842
SHA1 ae90d7531c20a592e0f71571d0dea826a3b86c93
SHA512 415515858b98dcd61736b2cd5cce8cd71915d4afd9627be3fbe5af3c487f186950ccff6f44e63e652f8fa05c035e85df5ad8e9c536d9e4b42371e66c314a7bb1
SSDEEP 6144:b29D6FcCkRTAn1gZPu2atKX2drW7fKQ0vySrkcxS26tMxu26tMxO0g3h+qY7xdS7:b2oHUsLR7DvySr3jFJ7kPyxZgyg
TLSH
T15C65D8416537A38FD1FB6032072A5B4CAB64EC16B7056F26A3C8453ED86A725B0FC3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 837d58cbde0b0c70a63d726926254411fbfdb13a77560af8fe2eea8a4e0a6ca4
MD5 7dfbe1a8a8f10b0c3e0da93271183456
SHA1 a454f0df1c2139f715ec9a81bd31bc4f48b3a993
SHA512 9ce95b8f4ac84b2799835d96a68456ab261041c6f7f96d368e035809fe69f6bf3efc9a22737549d1ebb048954761f4c42f6aa0bb2b584e646f84327a73af2c38
SSDEEP 12288:H47n+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4nyxknw4FYnshx8OfVe247
TLSH
T11565237CA7DEA992F86D11730676A231360AB5B49B70C1DBD728B14EE0B0CD0D93E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 51138941906a42656bdfc9b0ad4a562ea16bc91a09ee4fbb8a12eb0ab0b05eb6
MD5 b3e25dd1d897c856d28e6716448a8e93
SHA1 c386324cf78b8415a445127a3c8aa63c2defda32
SHA512 1b74e34bd7e053f05f6b6b1f0f5a0b398a3a42b5a8f3795c307494822dcf59794e2035720d63c4393f4b869b85f2af477328186be3dc144ebe819893006691ea
SSDEEP 24576:oG88u8FpJqH1Kzria7/mUyxknw4FYnshx8OfVe247:L7ZFPqVVa7/Ux4x8EVep
TLSH
T10A95F16977E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b67adcb1c5b9e6e7ed3ae5799b56fae8f0f61b20de3c0522a96f298e180f93c5
MD5 322cf570e367b6ccb605c7e930f2e7a3
SHA1 676845beb125ee39a75e8235f22a5f5e22c9046f
SHA512 9614c6898c29fd5f480f7494f44ba3be0154f72c06a2fa46e51579b7dc159ea1a93758f9970522f86f34f58ae558cca7a14ab654aed7fcfbb8aa06378ac33844
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjrx4x8EVep:dG05lO43bWix8EVy
TLSH
T1FCD5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 92aacd9d92eb72f230a68c1642dc2e438de2ed3edad907369ec156b5cd3d494e
MD5 ea00b07a65e9711271a179ac90941bb3
SHA1 9b480160b272e031ec7decf3c87f4dede9c889e9
SHA512 5713ffc0f39d54c4df9aeb651a456984126fadefe79930a8bda879e36e9909a38e5e4fff7e87191fb6bd2355efc6c0239d04018abe57f49a1407e47f288e2d8b
SSDEEP 24576:efa5POZ3dpFWVM50JicR2hG0lasx2+47eidnqyxknw4FYnshx8OfVe247:Ga5POZ3+Jt2pasx2+mjx4x8EVep
TLSH
T19365AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1b40febc0964da4c57f9cd2efb992bec6dcb0422b1da5dc22274756f090e073c
MD5 2ab4b5ddc3b88e4094cb00b8df46b4a6
SHA1 cff7e6b75ee7c2765b570f504d9c8d76355798f5
SHA512 d667f1df0a447bad299c947ca8c7d022ac442c731a4d032e91c2172a05280df2ecee1a15c7df845ae3a05c51c6c4da8818e53e9e78d3b63bb18265bbcee8dc1b
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7Fksyxknw4FYnshx8OfVe247:eNc/zEOVHF0x4x8EVep
TLSH
T133857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 1.4MB
SHA256 1cea50d459b4f23073af67b263f49e335bd2e9bbdccf9aabab2d8da3a78121f4
MD5 63e6f2fa075510a0c18f986f33c0478e
SHA1 81c12f593eb4f5a9ceeba21306f198456f417075
SHA512 65d7e792bd7f3bbdede20d2559d754c4d694195d398539282c8e30b1ed24b51af60af44f299ad18343f7ec415e4252f6f7d169ea22d7e980a1e7bcaf8d4ee3a8
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYpyxknw4FYnshx8OfVe247:Hgb4mBIBhGF/x4x8EVep
TLSH
T17765AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4d3db6e77593e28574a773d4b5e0f5fd0abecb5ff687987d68c402a595a2b34e
MD5 7b044912aaa68f67fe87b0b9375bc29f
SHA1 0fa25c1ad2bb4fd2035783716c91f1ba0e25fb41
SHA512 0ad552b11290c21b613ba99632a23714efde000e889b04b9732dabd7a1d3b7d3820649068009fe57876c88666acc2401da15d1a429abae34fabd16e00cca42bf
SSDEEP 24576:e8kNvNnaFeYhJNtmZBmWyxknw4FYnshx8OfVe247:e8MwBtOmJx4x8EVep
TLSH
T18A55AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 a5b60193022330a2754a02673aebaf88f40808c230d7bf80f6eb357ddec8b714
MD5 67e42c82ba2e15d5c76a523abeeb3f30
SHA1 659b2491a6810b7be137cf7ad5556f8a21c6edfb
SHA512 5a872a8abf890d68317ee0938232d4ca6a8756f78010e135e50332bb9feceed94879c30595f014421eb9286063c9b7eb9f8a783455bea252bd6536331ce61c60
SSDEEP 12288:HHvUrBFrEjwaQY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:HPUr+NQYyxknw4FYnshx8OfVe247
TLSH
T11175F12E22ED18E5E67AA17D89928319F771B4621711D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 e4d64b3dbf91275182acb68c9edee77c45418e181c5cb1bec504e8c754f2ce54
MD5 459d25d8465b949b5525c0d33c303a42
SHA1 95647b5e781a3da13f0618c5f1fb60bfff0210bd
SHA512 3c449af42107d571e68f5e43faeff7c980e040c0ce83406c64c55060c22ac8e427dc6490cd726b103efc0117e78045762372f32b09c37bd86f57b2a0b3fe950d
SSDEEP 24576:DD3FHshBIYQgAjyxknw4FYnshx8OfVe247:DDVHeBIAAmx4x8EVep
TLSH
T13785E17DE79C04E4E57AC1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1284-102-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1284-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1284-108-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1284-327-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1284-326-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1856-317-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/1856-67-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1856-73-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1856-65-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/3308-300-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/3308-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3308-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3308-54-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/4300-1-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/4300-8-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/4300-0-0x0000000000400000-0x000000000056D000-memory.dmp

Download

memory/4300-77-0x0000000000400000-0x000000000056D000-memory.dmp

Download

memory/4300-6-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/4336-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4336-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4336-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4336-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4336-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4620-20-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4620-21-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4620-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4620-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4620-15-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4788-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4788-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4788-331-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4788-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4808-330-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4808-115-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4808-121-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4808-113-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4888-52-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4888-38-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4888-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4888-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4888-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4888-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5048-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5048-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5048-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5048-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5048-342-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5048-344-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5108-136-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5108-134-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5108-128-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5108-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5108-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5660-79-0x00000000009D0000-0x0000000000A36000-memory.dmp

Download

memory/5660-328-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5660-78-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5660-84-0x00000000009D0000-0x0000000000A36000-memory.dmp

Download