f72d485698d04102b6073eed2cae70082a0e0abe9cce1455278ca74bfa09843d

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 770KB
Sample260827-tmdb9axfqa
SHA256 f72d485698d04102b6073eed2cae70082a0e0abe9cce1455278ca74bfa09843d
MD5 64b0ff82b7aa3a079c49edcad7f221d7
SHA1 5c659832fba1c66ee7360ffc803e9c6ee544867c
SHA512 91e26f4ededaf5d38b0ac6a306e4ee79980258a4b6281240fc771d848394cfae124dcc39a88834e786e3888ba6ca44d35cb2f3951743da43b9a5eb1f83955952
SSDEEP 24576:Ru6dK36S5zT7TJdlXbKL8fHz0/LPRRPUoIyke9b:R0qSZTfJz+gf4/LPRxBke1
TLSH
T1D0F41271B1D0D0B2E27B8475C599CEB186793C394E60449F3BE839BA0E733E5921876E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3368	alg.exe
1148	GameInputSvc.exe
4664	GameInputSvc.exe
4588	elevation_service.exe
6088	elevation_service.exe
3736	maintenanceservice.exe
3216	msdtc.exe
2616	OSE.EXE
4568	PerceptionSimulationService.exe
2180	perfhost.exe
1060	ReFsDedupSvc.exe
2756	locator.exe
3432	SensorDataService.exe
1228	snmptrap.exe
2560	ssh-agent.exe
3632	TieringEngineService.exe
3040	AgentService.exe
2908	vds.exe
1608	vssvc.exe
4328	wbengine.exe
2240	WmiApSrv.exe
2864	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\12ee268238bf42.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	GameInputSvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c983d89d3e36dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001313ada03e36dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036abe49e3e36dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4664	GameInputSvc.exe
4664	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4644	2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeTcbPrivilege	1148	GameInputSvc.exe
Token: SeBackupPrivilege	1060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3632	TieringEngineService.exe
Token: SeManageVolumePrivilege	3632	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3040	AgentService.exe
Token: SeBackupPrivilege	1608	vssvc.exe
Token: SeRestorePrivilege	1608	vssvc.exe
Token: SeAuditPrivilege	1608	vssvc.exe
Token: SeBackupPrivilege	4328	wbengine.exe
Token: SeRestorePrivilege	4328	wbengine.exe
Token: SeSecurityPrivilege	4328	wbengine.exe
Token: 33	2864	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2864	SearchIndexer.exe
Token: SeDebugPrivilege	3368	alg.exe
Token: SeDebugPrivilege	3368	alg.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 4664	1148	GameInputSvc.exe	90
PID 2864 wrote to memory of 2036	2864	SearchIndexer.exe	111
PID 2864 wrote to memory of 4124	2864	SearchIndexer.exe	113
PID 2864 wrote to memory of 2872	2864	SearchIndexer.exe	114
PID 2864 wrote to memory of 1472	2864	SearchIndexer.exe	115
PID 2864 wrote to memory of 1760	2864	SearchIndexer.exe	116
PID 2864 wrote to memory of 3612	2864	SearchIndexer.exe	117
PID 2864 wrote to memory of 5688	2864	SearchIndexer.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_64b0ff82b7aa3a079c49edcad7f221d7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3368

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6088

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3736

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3216

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2616

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4568

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2180

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1060

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2756

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3432

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1228

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2560

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3632

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3040

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2908

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2240

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2036
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2892 2884 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2872
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2912 2876 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2912 2876 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2892 2884 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b2901cf5d6ee15184008be887d6d00f8276beec1f7fa6c8057c58c0b31a9a8ec
MD5 daff4baeb482ac162759c9df0baf0342
SHA1 98c2fa0682f1e0159df01fdfa653f17187a8365f
SHA512 81f4babac4da4218c8f9949290392cb831ebe078f1c2ddf7eda6f24257874245d8a4eb48bb09d6a99e582a59659fd840192e9ccbb2a6e3857c529b79f5225c52
SSDEEP 49152:mb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnaJz+gf4/LPRxBke1:Y3q6gjBJJqgQ/LPRke1
TLSH
T1F7D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 b80810c9dba5ffc1ac0bd4f30b4fbed9faf2be5f866bb0fd38a0fdb04bb3d0ab
MD5 86f547d71074181dc31a67c9fee99311
SHA1 9c78cc70da6c06f70509e4a5d5309c2f3ca678ba
SHA512 472d29fb5e57ed7022b3a3bc9a56b9a69e1debacd487bc90ee114e0c529802f94ee34ac6e0416638535024cf2bee73b203023d00d863e2aa15e94e097753e0f4
SSDEEP 24576:GXYa1tczAb5JdlXbKL8fHz0/LPRRPUoIyke9b:gtcq5Jz+gf4/LPRxBke1
TLSH
T1B305F12967E044F9ED6BC17DC9628522E73278654760EBDB03E0896A0F333D86E3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 c332dd51ea426487a923d8ba954973b3071bcb744a6d5288ad8757960c15cdf5
MD5 12c6c00119b133a3f1524237ed5db06a
SHA1 30186c574b573f2265d4b876653038c11acf0bb8
SHA512 a39c642396830d721ded40417b563261e95126aec5238eb0af8e667b78c35e17e2491e85014c146f0bdb4d0132ce833380178e09424f9bd8fb54c067ee4f2940
SSDEEP 24576:203eDIW0hmxOrM9JdlXbKL8fHz0/LPRRPUoIyke9b:2JIW0AooJz+gf4/LPRxBke1
TLSH
T1CA45AE26F6748371D073C0B9C5D2A69AEA7130855B308ACB4286D77C3E677E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 349fc8d3d78ee496c79416f432c41c509dcc1f7be3d3866a0a2398d336dace13
MD5 046d2e550b615f6b42ab021e0deafe8f
SHA1 fb88fc07e35cc74aae319e99ad3c53097091f189
SHA512 6c6b4b4f18cd34f2746a9d50d355061f7f66d9e8a431680589180c93100a8fc06fd971e783114a6bd94ed3e7804144ed4b3dbf07a8a16b912192f2d07aaa6221
SSDEEP 24576:WZP/ezSC6vUyD/aqgrvW/6q8wyu1JdlXbKL8fHz0/LPRRPUoIyke9b:O/ezSC6vUzPvuHjyiJz+gf4/LPRxBke1
TLSH
T1C3755D25F5788323D0B2D0BAC5D66A9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 7e4e9bda0dabe581925d8a93e71fe82f3d45fd1c7308f5fc81344dbde50610aa
MD5 caa564e3dad07a53dec0857016b5b744
SHA1 9717707629897866208099dae101d9bb6cfe5f5d
SHA512 d82232e2f21fec10e3c6ee3467ce7c75912331c8535a0b519da6b8b35a76d84beb2389e9ac8fa79a150e6b8e1de48e0b6837f470db89a049225a81cd3040a83f
SSDEEP 24576:oAbxPcH8ov/l+d5eJdlXbKL8fHz0/LPRRPUoIyke9b:oACH8oXl+HeJz+gf4/LPRxBke1
TLSH
T130559E66F5B4C331D073C0BAC5D2AA9AEE3234414B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 4f127c74da44ceef47ac3c56b8f89ffd0e6dc0658f786d973a9959ab27b2a3a7
MD5 0f2b961480105ae78ee8677525068190
SHA1 d8a7fc866c1f281c19623014e87a37776a0b1cf5
SHA512 fc6e0fc8123796fb999c41f3d26e8d6c1659ed511b254951778f43fbdc746be0918795973a2e95c890c6425caf728a03993879571c742ca1000d2e9e9acf6ed3
SSDEEP 12288:+wA1JorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:+wA1JdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T104D423BA9AF1D0F1F3AEC0B9E64F09B3D32824348F441EE9565018EE087676EF554725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 3f5023b9b1a3a7a2c89548fb2663ce3fdc1ee6c821ec678c887a498faf1f1e81
MD5 9b41e1851716ba7817167275239f40cd
SHA1 17f13d5fddf34c734edd940f6225317a30c6dae1
SHA512 9b84f3db9005015582d4123b2fa656302f7bdbf6f2ac7c4a82654bdf14214dfc422f74bb250987b9a4cc2dd394c4f2ee657a904aeec95e7c70926ca7726688be
SSDEEP 12288:heBNUbTVO86UtJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrf:hJIUtJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T1C115DF3BEE38FCE2C27E8CB996518640D77274304F61A3CBD164824E8E236E55E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 55a11e5e46ac25cc35356d2fc107c19f39f3bf0d72576a2ec1eb4f7880d36a40
MD5 b7553b58e51a35dbc3d20450250a8c15
SHA1 5957d7fe2524c62f050c217ba4f35fd48c98ee22
SHA512 647aa3836534eac1f554f186c184c4e7ccde16ffbbc4a54bac62a8dff3cf7ccbb707af33ebdb7dee17db96c14d19920c6e772e25c07c1810bd2aa49c2de0a305
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJI9DN5JrNRV3THw:5QvGAdlCEL8c/IRN/5CSJqgQ/LPRke1
TLSH
T13A367C656BF880F5E0A7E178C97A85B2F7B678120D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 591741655f7cbd7ecedda07cfaf7c4408503c9fdc7701dc619f781a9ae66ce29
MD5 14f80fd94548b52a68070e23e88ade4b
SHA1 072a989976263f65d2318378fabbae9fba6890b7
SHA512 c288804557dd7da6be599238a83794082d93e588d5798ecb3f203fc2c7edabc14bb83d6371490a4848dfab038d23d297780eb5797ac8534e9125e60c389c6b94
SSDEEP 24576:CmewsAjeJdlXbKL8fHz0/LPRRPUoIyke9b:pljeJz+gf4/LPRxBke1
TLSH
T13815E031FEB4E032D3BF0DB65B26C726542C79204F511AC3E3A88D9E59702D26776B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e3bcb6774d0bbf0fad6782aa784dd27ed61ec5db73950e75cb71e11a98181dcc
MD5 5f4c101d4f86ee0526aed30fe4b1c0c6
SHA1 52a995fbce838670019eeea2ddf3649689a5bbb7
SHA512 bed84c848848e123bc6fce3bcf8389587cc1584ee346c4141404cca55ba5b97ebc6fa057250cd4231c02f206d2c0299c2b919d12e670e89f4029640dbe6d06aa
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrJdPlbuJH1/Ll:DUEtQevvqc2W1cpV2Xrz21/Ll
TLSH
T1BC474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d87928a6c4c5d0b4a1c325012e7c39d923739c7b44e3e52acb1521f2f370fffc
MD5 6e29021a79f55e146709d245bafcfaad
SHA1 bca93dd2727b8bdd3fc9648045108d33f7ce28f0
SHA512 a1472a733b723f0576c10db6053b2ac8ed388b754783302588f8c3dcd06a91fdd02d09257ca9f4b79620f0b8d13845a5d77cd7fba4edbc485a8af0849c65d725
SSDEEP 49152:xibRquA/m2yL5zMfFiV+XenmE3/zDJz+gf4/LPRxBke1:+oq1VjnmEJqgQ/LPRke1
TLSH
T142D58D1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 47bfff100d48ea0ab70d6ef2e39b5cf8df3636e06769e921b2245b379cdcc4a4
MD5 fbc58a30e9e343351bd9169ceed99888
SHA1 21e5d0a6eb3b2451f432ef20b732b73976124b63
SHA512 c8b9b885dc73283da661cd34eb1c8893fa51cd654b0d9b26a97109debf4c5b88c1e10a74482fd8ef4cf015ce4282091b6118e5ab67226b9e691b83f54dc0b347
SSDEEP 24576:bAhGLvUFoiwtA5l7S53RJdlXbKL8fHz0/LPRRPUoIyke9b:bAMAFoiq5BJz+gf4/LPRxBke1
TLSH
T15245AD81EBF951D4F5B3AAB899B68571EA76BCA55E30C24F2160C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 828KB
SHA256 8062d203042c77a2ca598015c0811140bf5462ba861c1a8c818a48b2dd4c5e6c
MD5 dbd16b453688053d757ed7daf05ac00e
SHA1 7728730e20a63ea09fefd61e73821b91b34e0f68
SHA512 02650b740fc9fde176c3567abb96258fc29d590996df8b890f2c5b876ff68d032554858d50b02e006620ecb69b4c91fc1a9ad0a91336fde254710a26b8386e04
SSDEEP 24576:LwuROWBJdlXbKL8fHz0/LPRRPUoIyke9b:LwGOKJz+gf4/LPRxBke1
TLSH
T10E05F15A76E448F9E5A78139C6478532F7B2B8212B20DB2F1760C65B5F33361BD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 a9907173028af52ed430be9f6ac8300b0dab18eb9cffa9e24ae58b56360f4d4b
MD5 34587bbf2d1b6c7eb5d8f1e232c26ac2
SHA1 d4390665320cbbb7805e27e9bd7ff454232c0ede
SHA512 ddef21b336e19dba505a3a5fde4cf0e23e14804dde3231e383b0465de37795bc88f0e688d2d6cae0b7fd79840785d1f69c3d9ca82ef680bd8a9cccd88714bd8e
SSDEEP 12288:b9c1I45JorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:ZcuKJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T104E402AA27F0A0F5E2ABC17DD9960962D33534314B7447DF166005AA1F33BDAAE38731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2982ea9db0f7bc82702b5ff2a4aa3c56f575339435855fb6084511fcff184213
MD5 165d2728576d4fe24dc5d648dfdfbcde
SHA1 9dc8f8cc6c288cd41d084bb642a345c45abf789f
SHA512 b90bcd28c9b0b75ef6ca112b9df98fc6cc4d7bc6c9423bc476f53c5014d5272a62f7ab2fd3e6cd8214ff8f84997b53f9e01a8d95749e2b33be9d13976e0f850f
SSDEEP 98304:rQRQyi36YOcP8Lvw2gAf+PN3+JqgQ/LPRke1:aQyiKa+X+PNL/Ll
TLSH
T16D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 25ddc044b876dc451d88ccc8f19c9b7d45d692b682b2b7a21769a09052c53406
MD5 78692e1c63348e579e3c8ce087a2fc65
SHA1 f19b470db20a3ac173cd17fff10e2433519a2ff0
SHA512 c2e4f6364320ce9d3cd8a4ec255f0951873e05dab6fe2d00572c1652090a729a2c6974f6d3ad9f565bfc88a799ebdefbd930fc94e8810fc5ab22877876f75a95
SSDEEP 98304:rQRQyi36YOcP8Lvw2gAf+PN3VJqgQ/LPRke1:aQyiKa+X+PNk/Ll
TLSH
T1D8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7d97ca4c0b74c536c87da9538d89ce0b2f42e7d8fae86b0fa821a8ad9179bca3
MD5 fa39c94f00894064dabcdaa0f85492c7
SHA1 3d1654f5c58c13efc520552ddbbd43aff7ce2ae8
SHA512 9919bf4f61d2b8c70971ebb1e1ac19bc158eb5e7acd5439727bf81a52b9b6d218837fc130a48e8e3a8981b104727e61c97ad99dcc7b7a7149a99c880acd52b1b
SSDEEP 49152:G68Qg55nhMeWu7PNU3/xJz+gf4/LPRxBke1:kthbRc/xJqgQ/LPRke1
TLSH
T1C0B55933B2F200A9C44DE1769F4A873196D17C758FE0E7DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 52f13e8d69f5206512c21a6ba3d277c5ec14ec76a379386155d7c4c2cdaaf4b2
MD5 4d23573a08260afe85c5da2f8133fe0e
SHA1 47234657d827bc41bed611b53fabffa2d20c1275
SHA512 5a0af2b5a49cfc865718b2bd72ed6f43534507afc82223a8dfbe2b1b7155c21325edab639b636fc8477953812de620e3a0df318247eea2298fa80bbcda727321
SSDEEP 98304:9y5112gYy5azzVv569nLKnhZYJqgQ/LPRke1:gLIHAWhH/Ll
TLSH
T175167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 33f3e5a020195d708088429415118be5622d1bf4c31a0ea67ff8be2542faacad
MD5 9533fd55871a65cc270096faf935eb84
SHA1 7f4c900c892f5c7ed173245ca6eb4c4ca57bd588
SHA512 9e484ad8005a04fa8552ab2c441f7ca4d528d9a03964149f22670c17b0ebe969120784c9633d5f6f52c52d20052f0d037b0c99eb464dc0ad5bc5ee9560bbe58f
SSDEEP 49152:wB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gluJz+gf4/LPRxBke1:qu6JmTxd2duJqgQ/LPRke1
TLSH
T1F1D59D13F1D901E8D06ED478974A9233FA62BC590B34B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 17f7ee2b84847ea70174b70f3f78cc80564995f42536548c888ccd51e7ee714b
MD5 cf4078429c55390c91c535c6205fb20f
SHA1 413bf9d269fbb6fca7b2af3db209138882ff7ea0
SHA512 8d42b1dd2521a540661ddb8ac5f8fedd02250a3dc39d6e7663b5db8ae4465f7463ddb1cf796d46ab10e96750b06c1efa06d03f4ce21f1fd908ef345626b9aea3
SSDEEP 49152:g1hpsNoJpF1A6UU44CwH7R4xQJz+gf4/LPRxBke1:gmifPbR9JqgQ/LPRke1
TLSH
T122B5BE13F2D940E8D06EC17887569632EA62BC450B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 57b93d6201cbd1d98a4735418f280551bcb6f7500c507433942e05acd6fe90fb
MD5 ad6d24b8d34c7caec3dadf63d02b984b
SHA1 72ab89d0f36ed9c2c7fcceb40022daa7bd01abb3
SHA512 4bd2081e47e1912efa1fea456565bfea30ea29bcba3312f0ea8441088e186cc08f9bc448b38c6546adfe22f9559208b980199cbb0bc514030b3fd451066fcfa8
SSDEEP 49152:qSuZQIY0Be2K6RVtOnks6NMHqRJz+gf4/LPRxBke1:05dKoi61RJqgQ/LPRke1
TLSH
T1E5C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 96da87ca79180e597e2f03f141a6f2addfff225e035aba22a530531f607d5fa9
MD5 79d10be11ec96549a94c8ef21dc71129
SHA1 4e499a325fc48715afa4e6a95970401eca235e9e
SHA512 73308879f06252d06ce9fe28ce7abfce39effed071b165a732030232fb53b09aa55a1caee374435bbffafd119995cc9e2cfdff457cdf785b037ba91a4683e96e
SSDEEP 49152:qhtSn8EApI0figTgiDn0AP5wdJz+gf4/LPRxBke1:LX2iyph4JqgQ/LPRke1
TLSH
T17FA5BF13F2D940E8D05ED178C7468632EA62BC150B34BAEF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 68fef465ca24c56d8600d47382277a1ca832c09fa5f859365f55c45eee3ca385
MD5 fd128b70cddabaf85357e499e5198bbe
SHA1 4c0ad59483052dc46bc14c15d1e4b212e48c1f36
SHA512 ed36987785a4a3bc178b2aad29d79c3b7a9182ccb74442c4ff73401e6022e308fc65da7df945e051749be717a3cff3ac7798e604b529faebf61ce58488d52994
SSDEEP 12288:MDqJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:MGJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T194D423AE9AF1D1F1F25DC0BAD60B09F3D22C24348F541EF9665014AB097676EBA48738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 34f17fa6b29c031ef9ff4187ba401e8210d1be818de3384e088201f60770d7e7
MD5 55fc7cdf00f0bbb4cb2ea0aa69fbf095
SHA1 f0f458f8a76f2eed01c25d6c9b33268542b9d03a
SHA512 57230df0fec7609bca8676dd3f23ca7e0bca1fb19fc7a79bab50fe1bab182e9d1d7492eb7e8be3b1039762392c02032f73e91da5762c3164a7f8c38831df2182
SSDEEP 12288:KpqJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:KYJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T133D423AE9AF1D1F1F25DC0B9D60B09F3D32C24358F541EF9665014AB097276EBA48B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 e9458741c2e01584af1d64c914c21efd92c19e3f04de28c7c24d7a3ffec4e6ad
MD5 881ef979859988802da017eaf009a59a
SHA1 5c5084ae0b6552088cbcfde17309580c3bb36eef
SHA512 5b225e911dd44a89621a9bb0f7a50481d4056ed1fd68dc7adf4de335fa3772b2865ba6e1c375ec9eed74d4e1841eb2ff4eeaf5fb41298d9c3461144823fd59b5
SSDEEP 12288:ECJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:ECJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T1C0D423BEA9F1D1F1F25DC4BAD60B09F3D22C20358F541EF9665004AE097676EB648738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 622KB
SHA256 c120e40d1bedd8da27809718d6948f9a5a044fa3913c232ccd6790751f267b87
MD5 b1ceb01a314ab7a5547052eb5e732c3a
SHA1 c2d9c5f1bb40138d9d4976dac801afa424a28bc4
SHA512 54643513cb38026fe678faa331093bedef390f558ee3de7c1fc807b8d9d6011b64a31015e6dc4ffb8a4b1d207f75661980ca9022a5ee33a8522e0841c72728b3
SSDEEP 12288:5l6JorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:eJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T180D4126A6AF5D0F1E2AAC0B9D60B05B3D33834748F245FEF6B50089E0D72769B914B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 2a3bac1f79788c4ea2d15768b60735e59c88b0c696c05d650b7acf3809fd15ab
MD5 034a6c409f683cd8b21e341f836b00bb
SHA1 9f462ad8d5dc925bc54169f9302667f8eebe5046
SHA512 d8655e660d73c45f518696d20eaf54544c81c619a44fc66ca5946e255eafa8aef69a8cdf93242e33609a4abf8ee5ed2e007b0f84ad1b472929e4d5cd8578cc2a
SSDEEP 12288:TwJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:TwJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T1E4D423AEA9F2D1F1F25DC0BAD60B09F3D22C20358F541EF9665004AE197676EBA44738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 fcf182004b7971e85041dc6102845709602a7d85e5042939e64b233a83d90c7b
MD5 9192bf9cba3bd97c974f83105beb5e8e
SHA1 1cc8598f4c2fe28bc33849e6804a158791d96b55
SHA512 08056c764e91163ea2f468f4fdaf79bb2e9f7bd5005c83d4f88a8147d8ec3a8604f817f4f1bd4cd0f48a1405cf58051a43fc22343edadac6017e8249a0a845e8
SSDEEP 12288:Q9JorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:Q9JdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T18ED423BEA9F1D1F1F26DC0BAD60B09F3D22C24348F541EF9665004AB197276EBA44738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 dcd6fc3eb446fcec3ae1b46824247c500a20675fe735695ccd2686bbbcf0eb26
MD5 23b5569ff2956082e7ad5cf5aa114177
SHA1 36997d4e8630f24f70b19fc414484e50c43fc2b1
SHA512 961dfb6082e76d7416d543191700f0793de0b3f2698fd00da3a0d3b89ed88c45b4556f3179d70c8eaf4a2967f0a30f6d18724e1d949c81990c4f0203b1f8234e
SSDEEP 12288:bFJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:bFJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T195D4237E9AF2D1F1F26DC0B9D60B09F3D22C24348F541EF9665004AB197676EBA44738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 863KB
SHA256 6c4bd43f459acd14444cfcded05a8c848310e85327396c330ad42cc019a84490
MD5 3717423020c6c92c8bd0b44500d65a22
SHA1 34ee864ec8692c02346444c6fb0c61bfc244c164
SHA512 ca18d37fe03387614a463f63c7a9511de4e19d512fdd1ba277741c14ee848fc798934fb3d16c67a4546badeaebe59839d96a29b8664666b0e73ce97aa89bf5f8
SSDEEP 24576:HZMmzF9SeJJdlXbKL8fHz0/LPRRPUoIyke9b:HZMmzXNJz+gf4/LPRxBke1
TLSH
T1901501A9B3A054F4EC67C13EC9164962D2B27C390B60CA5F13A4366B1F333616D2DF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 90a176d67fb4bd050ed5411a7ca82036ef077e932e7b1aba81abc0c61e9bfc62
MD5 5b7d46d3005a870c35d7fffe1e828e8d
SHA1 ffd707ed4b4fb54945081c2793ee145ebe0822d9
SHA512 693f2afd4c759a4d07ed0e16735c137cdda8ebde415b63a7e15bfe18ca2f11f7fbe88c30394ebfcbd09989cdb9f23cd61912b0da9141370a303f2a27197f19bd
SSDEEP 12288:eDJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:eDJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T1E5D423BE99F1D1F1F25DC0BAD60B09F3D22C24358F541EF9665004AE197276EBA48738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 84224f2718f5cdce90f7b3ce135cc5b36995294f87d81c7350889212c36a7e87
MD5 24c6384172eba0f2c611623dc6ab1d24
SHA1 f20c7da5c2b2d47111395446b475ae569ac4ebb9
SHA512 39036d8d9cce04de24df25c7b145f3013e5f14904daafa0383fae1b06f14dd61d4b32c32ced675a1eee35aad9ddd6420ecd0248ace066d6a2f1a854ad75a8f37
SSDEEP 12288:AtJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:AtJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T199D423BEA9F1D1F1F26DC0B9D60B09F3D22C24358F541EF9665004AE197276EBA48738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 0fb960b772261a80a68cd9da475d2359e3f314bc4ed6d68a704b0d451ecab840
MD5 6d95e3898959a30b3a1613d53d4a90b7
SHA1 f76634ae6f54ce1aa76105338fef330ddd0fc6a3
SHA512 074563c3b7ed96fab4d08f5a06641fdf7781cac2b015334d46f771d1a2784991b2a091abe88adcc933936dd8047be04d8ac6b1ed3dc1247224b451e65dc16a2f
SSDEEP 24576:Kvwvtk9RX6wkyAIwJdlXbKL8fHz0/LPRRPUoIyke9b:7MnYIwJz+gf4/LPRxBke1
TLSH
T14935D029EBD844E1E1B7D17CD9A74606F2B178690B31C6CF129553AE0E33ED4AE39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.6MB
SHA256 6a83dcff533aa7401a4d2bf203a7085798096ad3c7444292fe26c3bed83515ba
MD5 a8387819bc594352c094b1a677f4b3f1
SHA1 da156ceed966c770e8ec92dec3d7861c269f5284
SHA512 36dbf9c6d7fce938c971f9a6504a0098b2a211e7b6a3e452a6a3ad359926bc6feed18dbc6a7cc05e9938d921c3c8a52ee0a6fab80a906da2539d598d1f129e45
SSDEEP 49152:+Yk4Npsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0iJz+gf4/LPRxt:xySzPqJqgQ/LPRke1
TLSH
T1AD066C96A1A841D5C1B9C1B98B0BCC17FB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 105ce7dbd11189857d3479cd20bb7a20b9ba7aa38b4b271dc28640b2c9176bb6
MD5 1f6a53a65ee1ffda8cb20377e0ee60e0
SHA1 344b6f68dfed8686a21d669cad847c23a3c26f48
SHA512 305582dce9506b85a8d298459eed33c651e07cb230354f48ee10571b66383e95f250903f09d6a428e4630e156430140199ab34d268684c1cc0a5d832375db948
SSDEEP 24576:6F7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYmJdlXbKL8fHz0/LPRRPUoIyke9b:6F7JUQjXirIhCnDHUPfF/IJz+gf4/LPt
TLSH
T18665AE1EA3EC01E5E1BAC27885154A6AEA71742D5F31CACF1270427D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 a68e8d09c1ac419ba9b9d564da16b1683b2512449647df6e063473844b15d2bb
MD5 ad14577b310f843abdbd80ab94ae2441
SHA1 98c62346e2c738fef15f319515d5759de31fea9f
SHA512 978aaad4c302eeeae15c01b7bc71e2f3db6acb95727587f38ff23f3c21a9fad28cad11901da508baa1e47480c62246934091496cddb629cba842fed6d384f919
SSDEEP 12288:qTsfcdcJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:dcuJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T131F4015AD2A481E4D16E9179C7060AA1F3373C348BE097CA63D0F47E0F76694ADE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 eaf5af78a5d71f58f73f4cdf0c655b11668de947888e4a008eb162bc2bce5c1e
MD5 646854667f92a7d66f07dc872fd899f6
SHA1 d7fd87d45c68708e459917d90fcd0d15120da570
SHA512 6bb2314925fde3da40296c276fee6215930a312ce9018231f5b427c6ddd70e7eaa64e73760dfdddaa8f9dcb989710c159351a02ce2d21ace94eea4ff30cc4a14
SSDEEP 12288:KI7kJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:fkJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T1A3D4227A97F5D1F1F2BDC0B9D50F0572E32C30348F445AEBA64014AE187279ABE64B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cbda395f298fad68a0aa77ccb4e215c04718cc02c6a475e50e2630ab189f72a6
MD5 b11e3979849537acc1c0846261ef42c0
SHA1 4d62b8b4c50efa2160877aa45600a4112daff7ff
SHA512 74c0f4d494a6eea663406fd382b3ed95944b04fb03fe04ed78af5f0fea6904732c10053c6cc8107fd93d4572a9edae8f3b6caa59f680f2a4a31ba17280a223c1
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYkJdlXbKL8fHz0/LPRRPUoIyke9b:Qgb4mBIBhGFHJz+gf4/LPRxBke1
TLSH
T13D65AF1E22E802F5E0F9D2B8DDAA4417D6B278160731D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 76c5e3eb094d1517c83cebab8fba6034c183b237876eccd126a59db1a7d12af2
MD5 7619e4fdd5b4ccb0a606904b4e334072
SHA1 1b11a07dbcbc1d97b296a013befb3c1f814d8545
SHA512 5b4eda0993c4de70849734102459ebdd6f3203d165360c1c18d3c0796960116628f4f9272657796fe1e5ca1692502f8ec2514f3b3b929572fb309ad556670ac9
SSDEEP 12288:PXGaJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:/GaJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T1F4E4127E65F1E0F0D27DC1B9D51A09B3F23430708F142AFF599054BA4A667E9B638E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 166a4de32ced6d1a5a26cdf0ec6c4aa6afcb6edd3f38b7f0d0f8eb640c2b8ab4
MD5 d58b411d971358b05a9f2e35d8912adc
SHA1 5f91f686fb1c4440275dc796596049fdc8f32534
SHA512 6867386cf3c87c0eb92f95477a04e07ce6e04cd4fc2fcc8bebe51d6a5c20f407624f77cc5104fd2bff18efdbf0326387a4dce3c752f91c2f25c9043b726c8565
SSDEEP 12288:dWJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:dWJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T113D423AA96F1D1F1F2ADC0B9D60B09B2D31820348F541FEB655014AB09767EEFA74B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 5e3bca3864b2ec13c72d3fd415c28c5bb5f706c285d640e93f80ab7bf64b81c4
MD5 2a592e62fd9d6a65a906768ac42e38cc
SHA1 2a8da280573857cd1f348b1f0c54e0aadbb693ef
SHA512 9019202b9330f90d8377e8e831921daf3521d163f277d6687a602be64575c2ba061aec54664729c87ac25ec0af962ca8b061a584b7ac57145a8587a55b4b650c
SSDEEP 24576:5P58W8FjJqH1Mzria7/mbJdlXbKL8fHz0/LPRRPUoIyke9b:1+BFVqVra7/YJz+gf4/LPRxBke1
TLSH
T1EF35F16566E101F0D07BD038CA4646B3F6B1B4250364EFEF07A88A561F23BE55B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 9c70796132334d89ef2ef14cdaebdd4cb09a3d7aa88f21cf1962dfcf45483229
MD5 2f99148613ce0971ab5b2a1b9ceb63e9
SHA1 b0c6723c98f11b413165f2c783c8b57f061d44a3
SHA512 a5c2b6095c381af0510b0aef25d0e4b93bad73095dbc28df4dda2e383d03e9a66374e3758c83c81956cb1a548e86656275dce94c0c72587362fb19c7ac57059a
SSDEEP 24576:PPUr+NQAJdlXbKL8fHz0/LPRRPUoIyke9b:PJQAJz+gf4/LPRxBke1
TLSH
T12005E12F66F818E5E67AE07DC9464629E3717472071196DF02E0817E0E63EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 9296cfa2c1b312bc05141f68ea9602113fb3903f1c6c59bd3a6b9820d5d87c38
MD5 db246370c876107e67e9f3617f30232b
SHA1 13a757363cb0823e0330e9042d9a61d5c2ae364a
SHA512 34f83f6bf5b6b6b3a196471b5065bb61ca10cc2d6afc4726c40709813c3858ad541ac7618ae578036eed8bf48ff30aaa7ce2c2d00504c400e75928e781458b35
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjpJz+gf4/LPRxBke1:FG05lO43bsJqgQ/LPRke1
TLSH
T181D5CF6E62FC11F5D1BBC17CDA864A0BEBB23425032556CF02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 62ac73e54ee924f055e2ea8169a49ece1d7bd59279ddd1a3e81a21be8de2ac6f
MD5 f643ca1a38b3671353953d2ae5690422
SHA1 400fd84fd7ca0e34b97dcff6dda6e8dba5e53e6b
SHA512 dc9153147eff289f73b9a47a7bfe96e24f2f32d45058c96d7c9a42146d6e04ff92595988ef409a2d335150f3782016a2395bf931439a602fcd6c23378996ffa3
SSDEEP 24576:Tda5POZ3dpbWVM50JicR2hG0lasx2+47eidnVJdlXbKL8fHz0/LPRRPUoIyke9b:xa5POZ3wJt2pasx2+mPJz+gf4/LPRxBf
TLSH
T1F865BF5EA6F801D5E1B9D17DC5834A1AF5B1342153319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 53a97c3df7617dad7912fa23607e446daefdabe979e0226969d82ad425cb082e
MD5 471332eb4361ca5818d01f05dff458b1
SHA1 41d5f29e9c8079b96ec3d16b9a98709312ae5764
SHA512 68c22907cbfe51cd034ff1af4648f07891824fd9aaccd6c5fccd8dc687ad886d4ce28d7dcb67489ddf3185096f3fc7aae0279cfa6df5910d8588d90c05763dfd
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7Fk+JdlXbKL8fHz0/LPRRPUoIyke9b:tNc/zEOVHF1Jz+gf4/LPRxBke1
TLSH
T1FC858C2623E901E4F1BBE1BE89679546FA71786557308ACF0291811F1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 d65c3545f22c196f17ba53cee96c23cec1fc483d3884e81b036030229a2da483
MD5 62f24058d7f0690996b9677b49c3acec
SHA1 70ac85e28a16f51f912e2982b8510bec07b1b57e
SHA512 cd155fc65a4b49b8c3461f59a65ec9ebabe19cbbdb1e0accfe68bf0bd38224bfdcf07c94cfdc057e2ef9e6bc0ed8a8601ae482eef2cdc9ff0f57f3d18b5d40d0
SSDEEP 24576:7JnJPbzB4S9JdlXbKL8fHz0/LPRRPUoIyke9b:7JnJv6S9Jz+gf4/LPRxBke1
TLSH
T10515CF3DD2A810E4E4B7C2B4811A1A66FE31347C2F2569DB59B4D4353F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e7f3952d820a634e51543f2026025ba1ea1a1f5df43f2469b608154903cbdcd1
MD5 c3596bb9a8f557208db967820c576a2c
SHA1 fed4d15330ca12ebf1dc86ca81f133c864113fa3
SHA512 a3ddf0bfb73a0087876c0f35ab9b65347ff71b58be0e78eef5241caffa6c07c799e65bf2085627f9f28a6e58c9ced1e8700e008bcea8ed3d29f77daeb17ad4ab
SSDEEP 49152:0CLHGeeV5ijCmlDWDkOJz+gf4/LPRxBke1:PIJqgQ/LPRke1
TLSH
T1ECA56B05A7EB4184F8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 51b7792504d4ceb1b5995447828a9b152c45fb680d968af774a18903c517ea33
MD5 5cb21ee8e802544605f63e186a440222
SHA1 0b230d728e2ba674fde34c15b418dc67e1f17f78
SHA512 2472826876c8df9accddfcc2f337427d38ab31ab5743cd8c7c86dc5195823e08f01ffff65b631bb9aedb525ba7b9d76a63fbb0c74415554924828e59283321e9
SSDEEP 12288:P1Hck6j5ZI7KJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgA:L6DIOJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T192F4F16D63B650F5E16BC07EC6830562D2B270708B511AEF4A9484BE4EA3FDCB938F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 4cd7def5ba56e669c774aeb501ca3fa8fa99799701d0e73c025daf7a713933a6
MD5 8507749e609d13fd39225c6d885d5a29
SHA1 db7be81b7cb852b53ac79c4e207725df5d9d9939
SHA512 8e3bc580a50cb465c45f7a870c830fc6c1f00a841656d8a0fa307b0d7cb36ac61e3bcc894019d7c734289e0351f73991f96d4cd1f0b501fd5595d68e595a11dd
SSDEEP 12288:NG6kyuJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:0tyuJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T15CF4125963F0E0E0E6B9C178DA1701B2D73878308F105BEF6690A57E1E367E9B934B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 9d133ab661953370a589747481bab9e3057194a609078da737b049157a380659
MD5 33522a25734412a9949356e12318143a
SHA1 96e19bf0222401266c160cf2c8e0f0842f1428d0
SHA512 fa7e6909970b7c42c8d47d8783996e11eb3e9e3d990f7f3a657b9df78f1558260f83cdb3cba76232064d9b584dd96ab651d6e7cc554ab318523f8c1d49bd7c75
SSDEEP 12288:yqtJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:TtJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T1EED423BD96F1E1F1E269C4B9D10B09B3D22830344F541EFF659054BA0A767EABA34F24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 6d598921f69a7c2b946fb98ab246402741f0f27fc4a4f1bd5524276fe600d3aa
MD5 04e71c7dcc698305696ff531880fd42b
SHA1 57aceda345bcdd550f7e3edf1f53e9c290d5e107
SHA512 9e923f469929bd66638fc827cb357d63554ead2d37d447924157fa43e8fd1b68a08cf3030ef34ed37ea228c1467604e83b62bd37a9fdca3841734bb5b3f6f218
SSDEEP 24576:XegILoTfaidZMJdlXbKL8fHz0/LPRRPUoIyke9b:OgHTrZMJz+gf4/LPRxBke1
TLSH
T132559D1D67FA05DAE2B2D279D8221493D633B4315772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 17893cad6ef34e469a436339e37183c1af6c7abfde72df9ef964e9c898e4d158
MD5 093a7925106144289e8117d96645bba9
SHA1 3de552e8c7ab10781be534763e10254aa520808c
SHA512 922da3aaa538687e9b37df5c6e0d464924f48c1298a3763e34d0d240e250c880807bf5a55f0ac7d599159075a374a12827c1d70a6d32525687698f8a7298ffe8
SSDEEP 24576:yrcmRkBJdlXbKL8fHz0/LPRRPUoIyke9b:UcmROJz+gf4/LPRxBke1
TLSH
T1C305F05EB6BA40F1E1BBC17CC9460562E27370305B1167DF42A0867E4E67AEDBE38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 14837825bfa24c8918ba7889da7f42fc1021193e90c7e54b419df1fce50f4da7
MD5 678ae55aef1e1b6b7814674f4170df68
SHA1 f3a9218ec7c26474978e4aaa3f67bab254e79d97
SHA512 0b61955cc93cee767864353980b3b5302650bcbbcb9b96a9b4b208f8b973c846e2bf0232b717fd02fe1d685b1d3dbe4a4143b6cd745b61ccd1d07c7ee6675af4
SSDEEP 49152:JDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3ZJz+gf4/LPRxBke1:a3Upow8sBAJqgQ/LPRke1
TLSH
T1F2A58C3DA2E810A8D9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2241a66c5a41a474b892f09d0cb9047dd544b5480d621d012d22aba1abfc5303
MD5 00e803ef5f1fd5b2afe9e5d3451f7807
SHA1 99a074ddf1bc2c1bebf87f7d5025b0213b400284
SHA512 e69f64c172584ad8cbf3f4c1e5ec34fccff4209d494f6c4da79c56937190054e3b171ad0b1d24d2bd0fc34d29de8d654aef15f9b8e3e9bd1cf74d75b099c7534
SSDEEP 24576:DTkNvNnaFeYhJNtmZBmZJdlXbKL8fHz0/LPRRPUoIyke9b:DTMwBtOmZJz+gf4/LPRxBke1
TLSH
T19A55AF6EAAF846E4D1FEC6B5CD238522E6727461073253CB5290C13F0E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 988KB
SHA256 18285e2513f0c6bf8d23695f011b3a588fcc99b3499e9d1273c116ec54af196a
MD5 9fa5079ac88358b7ee5497c5d7027438
SHA1 a138fca17f3e9de91bc586817305785a120cb58d
SHA512 30a8c4755acdc925be70247f90feb78d4e41509899d699abb4be65844c0ed25ef5119ca59a06a9a3d5192f2a60251c950d65eedf8982f7a36c6859b3cb444ed6
SSDEEP 24576:uD3FHshBIYQgA+JdlXbKL8fHz0/LPRRPUoIyke9b:uDVHeBIAA+Jz+gf4/LPRxBke1
TLSH
T1ED25E17EEAA800E4E57AC1BCD6534A16E37134B907215ADB12D081BA1F6BFE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 441310a32e6d4a95aff79331b33255cbdaf0a67a5c7ca492ad4a6f6ab00de5d0
MD5 a44543a4413dccba570c6458e483291d
SHA1 9c6e26e6af98072b07d9a5d3ebc6e36193c4b46f
SHA512 e408b8299a57a0325e0d5b4381b4d41a2eef58477c7ab5494c1913264b0f90ad436231af4f690ffb56ab8ae5f0499b171c1af5d7568411814662f558c7090b69
SSDEEP 12288:MyS6b3IkxjbBzYJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigD:66UqjpYJdlXbKL8fHz0/LPRRPUoIyke1
TLSH
T1D1F4126E56F0A0F0E17AC178E9164172C23478310B645AFF76D495BF4A32BD9A93AF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-205-0x00007FF6E7BD0000-0x00007FF6E8313000-memory.dmp

Download

memory/1060-281-0x000001D8FBAC0000-0x000001D8FBB26000-memory.dmp

Download

memory/1060-118-0x000001D8FBAC0000-0x000001D8FBB26000-memory.dmp

Download

memory/1060-117-0x000001D8FBAC0000-0x000001D8FBB26000-memory.dmp

Download

memory/1060-282-0x00007FF6E7BD0000-0x00007FF6E8313000-memory.dmp

Download

memory/1060-116-0x00007FF6E7BD0000-0x00007FF6E8313000-memory.dmp

Download

memory/1148-113-0x00007FF794AE0000-0x00007FF794BA8000-memory.dmp

Download

memory/1148-28-0x000001E6FE2D0000-0x000001E6FE336000-memory.dmp

Download

memory/1148-29-0x000001E6FE2D0000-0x000001E6FE336000-memory.dmp

Download

memory/1148-26-0x00007FF794AE0000-0x00007FF794BA8000-memory.dmp

Download

memory/1148-27-0x000001E6FE2D0000-0x000001E6FE336000-memory.dmp

Download

memory/1228-145-0x00007FF773B40000-0x00007FF773BF3000-memory.dmp

Download

memory/1228-143-0x00000239FAE10000-0x00000239FAE76000-memory.dmp

Download

memory/1228-234-0x00007FF773B40000-0x00007FF773BF3000-memory.dmp

Download

memory/1228-144-0x00000239FAE10000-0x00000239FAE76000-memory.dmp

Download

memory/1608-248-0x00007FF64E270000-0x00007FF64E740000-memory.dmp

Download

memory/1608-192-0x000001D5C6F00000-0x000001D5C6F66000-memory.dmp

Download

memory/1608-193-0x000001D5C6F00000-0x000001D5C6F66000-memory.dmp

Download

memory/1608-191-0x00007FF64E270000-0x00007FF64E740000-memory.dmp

Download

memory/2180-109-0x0000000000900000-0x0000000000969000-memory.dmp

Download

memory/2180-104-0x0000000000900000-0x0000000000969000-memory.dmp

Download

memory/2180-103-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2180-190-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2240-211-0x000001F949BC0000-0x000001F949C26000-memory.dmp

Download

memory/2240-210-0x00007FF694240000-0x00007FF69436E000-memory.dmp

Download

memory/2240-212-0x000001F949BC0000-0x000001F949C26000-memory.dmp

Download

memory/2240-271-0x00007FF694240000-0x00007FF69436E000-memory.dmp

Download

memory/2560-240-0x00007FF7C5800000-0x00007FF7C5AA3000-memory.dmp

Download

memory/2560-155-0x000002D9DBD70000-0x000002D9DBDD6000-memory.dmp

Download

memory/2560-154-0x000002D9DBD70000-0x000002D9DBDD6000-memory.dmp

Download

memory/2560-153-0x00007FF7C5800000-0x00007FF7C5AA3000-memory.dmp

Download

memory/2616-85-0x00000246C4AE0000-0x00000246C4BE2000-memory.dmp

Download

memory/2616-86-0x00000246C4CC0000-0x00000246C4D26000-memory.dmp

Download

memory/2616-87-0x00000246C4CC0000-0x00000246C4D26000-memory.dmp

Download

memory/2756-209-0x00007FF74E490000-0x00007FF74E53D000-memory.dmp

Download

memory/2756-125-0x000001D16DC90000-0x000001D16DCF6000-memory.dmp

Download

memory/2756-127-0x000001D16DC90000-0x000001D16DCF6000-memory.dmp

Download

memory/2756-126-0x00007FF74E490000-0x00007FF74E53D000-memory.dmp

Download

memory/2864-219-0x0000024B67B10000-0x0000024B67B76000-memory.dmp

Download

memory/2864-272-0x00007FF6D6EB0000-0x00007FF6D71EE000-memory.dmp

Download

memory/2864-222-0x00007FF6D6EB0000-0x00007FF6D71EE000-memory.dmp

Download

memory/2864-221-0x0000024B67B10000-0x0000024B67B76000-memory.dmp

Download

memory/2908-184-0x0000026BFB1C0000-0x0000026BFB226000-memory.dmp

Download

memory/2908-182-0x00007FF6E04A0000-0x00007FF6E072A000-memory.dmp

Download

memory/2908-247-0x00007FF6E04A0000-0x00007FF6E072A000-memory.dmp

Download

memory/2908-183-0x0000026BFB1C0000-0x0000026BFB226000-memory.dmp

Download

memory/3040-172-0x000002070C7F0000-0x000002070C856000-memory.dmp

Download

memory/3040-176-0x000002070C7F0000-0x000002070C856000-memory.dmp

Download

memory/3040-178-0x00007FF7F75B0000-0x00007FF7F78D0000-memory.dmp

Download

memory/3040-171-0x000002070C7F0000-0x000002070C856000-memory.dmp

Download

memory/3040-170-0x00007FF7F75B0000-0x00007FF7F78D0000-memory.dmp

Download

memory/3216-169-0x00007FF650C80000-0x00007FF650D99000-memory.dmp

Download

memory/3216-73-0x00007FF650C80000-0x00007FF650D99000-memory.dmp

Download

memory/3216-74-0x0000026E543F0000-0x0000026E54456000-memory.dmp

Download

memory/3216-75-0x0000026E543F0000-0x0000026E54456000-memory.dmp

Download

memory/3368-93-0x00007FF787A10000-0x00007FF787B32000-memory.dmp

Download

memory/3368-17-0x000001A6368C0000-0x000001A636926000-memory.dmp

Download

memory/3368-18-0x000001A6368C0000-0x000001A636926000-memory.dmp

Download

memory/3368-15-0x00007FF787A10000-0x00007FF787B32000-memory.dmp

Download

memory/3368-16-0x000001A6368C0000-0x000001A636926000-memory.dmp

Download

memory/3432-136-0x0000023BF6EB0000-0x0000023BF6F16000-memory.dmp

Download

memory/3432-244-0x00007FF69F840000-0x00007FF69FC56000-memory.dmp

Download

memory/3432-220-0x00007FF69F840000-0x00007FF69FC56000-memory.dmp

Download

memory/3432-135-0x00007FF69F840000-0x00007FF69FC56000-memory.dmp

Download

memory/3432-134-0x0000023BF6EB0000-0x0000023BF6F16000-memory.dmp

Download

memory/3432-242-0x0000023BF6EB0000-0x0000023BF6F16000-memory.dmp

Download

memory/3632-163-0x000001EBFF900000-0x000001EBFF966000-memory.dmp

Download

memory/3632-241-0x00007FF77B4E0000-0x00007FF77B674000-memory.dmp

Download

memory/3632-161-0x00007FF77B4E0000-0x00007FF77B674000-memory.dmp

Download

memory/3632-162-0x000001EBFF900000-0x000001EBFF966000-memory.dmp

Download

memory/3736-61-0x00007FF774DA0000-0x00007FF774F08000-memory.dmp

Download

memory/3736-62-0x000001B5B7380000-0x000001B5B73E6000-memory.dmp

Download

memory/3736-63-0x000001B5B7380000-0x000001B5B73E6000-memory.dmp

Download

memory/3736-68-0x000001B5B7380000-0x000001B5B73E6000-memory.dmp

Download

memory/3736-70-0x00007FF774DA0000-0x00007FF774F08000-memory.dmp

Download

memory/4328-199-0x00007FF7868A0000-0x00007FF786DA6000-memory.dmp

Download

memory/4328-201-0x000001D285940000-0x000001D2859A6000-memory.dmp

Download

memory/4328-270-0x00007FF7868A0000-0x00007FF786DA6000-memory.dmp

Download

memory/4328-200-0x000001D285940000-0x000001D2859A6000-memory.dmp

Download

memory/4568-97-0x000002D8B3B90000-0x000002D8B3BF6000-memory.dmp

Download

memory/4568-94-0x00007FF70A4E0000-0x00007FF70A629000-memory.dmp

Download

memory/4568-181-0x00007FF70A4E0000-0x00007FF70A629000-memory.dmp

Download

memory/4568-96-0x000002D8B3B90000-0x000002D8B3BF6000-memory.dmp

Download

memory/4588-47-0x0000025200EF0000-0x0000025200F56000-memory.dmp

Download

memory/4588-45-0x0000025200C90000-0x0000025200D92000-memory.dmp

Download

memory/4588-46-0x0000025200EF0000-0x0000025200F56000-memory.dmp

Download

memory/4644-253-0x0000000000320000-0x000000000044C000-memory.dmp

Download

memory/4644-8-0x0000000002470000-0x00000000024D9000-memory.dmp

Download

memory/4644-44-0x0000000000320000-0x000000000044C000-memory.dmp

Download

memory/4644-1-0x0000000002470000-0x00000000024D9000-memory.dmp

Download

memory/4644-0-0x0000000000320000-0x000000000044C000-memory.dmp

Download

memory/4644-6-0x0000000002470000-0x00000000024D9000-memory.dmp

Download

memory/4664-38-0x000001C376200000-0x000001C376266000-memory.dmp

Download

memory/4664-37-0x000001C376200000-0x000001C376266000-memory.dmp

Download

memory/4664-36-0x000001C376200000-0x000001C376266000-memory.dmp

Download

memory/4664-35-0x00007FF794AE0000-0x00007FF794BA8000-memory.dmp

Download

memory/4664-124-0x00007FF794AE0000-0x00007FF794BA8000-memory.dmp

Download

memory/6088-55-0x000001C0BEA70000-0x000001C0BEAD6000-memory.dmp

Download

memory/6088-53-0x000001C0BE840000-0x000001C0BE942000-memory.dmp

Download

memory/6088-54-0x000001C0BEA70000-0x000001C0BEAD6000-memory.dmp

Download