3475cbe5d042318dfe94975f605d01f83d7cd3bc14e9646caaef6a2193d24b17

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 770KB
Sample260925-vypp4awxc1
SHA256 3475cbe5d042318dfe94975f605d01f83d7cd3bc14e9646caaef6a2193d24b17
MD5 f1d3c4856344cf3bc0f449e4d62d8aec
SHA1 f48e28a1e450bdd203c4607e62fb0d209249fa64
SHA512 6b61768be35638e0a5a5d3a2c508d030fc2be04fe51887309efe274ca569325c0a817d4a57a6717aca3bb38bff68f9067c7d63faf42dd0344ebd16b32df1551e
SSDEEP 24576:3u6UD39SGST7IJ8QaYEE3jnI9GU5xPLFf9Af:3aNSjTxQaYtjY/njFfa
TLSH
T127F4123671C0D072E5771432C6F1CEA15AB97C7A6971808F2BE8397A5F323E1413979A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2400	alg.exe
4560	GameInputSvc.exe
1900	GameInputSvc.exe
4984	elevation_service.exe
4064	elevation_service.exe
3288	maintenanceservice.exe
1416	msdtc.exe
1456	OSE.EXE
1220	PerceptionSimulationService.exe
4396	perfhost.exe
2680	ReFsDedupSvc.exe
2740	locator.exe
4112	SensorDataService.exe
5840	snmptrap.exe
5888	ssh-agent.exe
6012	TieringEngineService.exe
1392	AgentService.exe
4644	vds.exe
464	vssvc.exe
5504	wbengine.exe
5716	WmiApSrv.exe
1152	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
	\??\F:\	alg.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7890c756b68fd3f0.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	GameInputSvc.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f83c3ac8124ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005784d6c5124ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012aff9ff124ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061740f00134ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000854301c6124ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1900	GameInputSvc.exe
1900	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2584	2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeTcbPrivilege	4560	GameInputSvc.exe
Token: SeBackupPrivilege	2680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6012	TieringEngineService.exe
Token: SeManageVolumePrivilege	6012	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1392	AgentService.exe
Token: SeBackupPrivilege	464	vssvc.exe
Token: SeRestorePrivilege	464	vssvc.exe
Token: SeAuditPrivilege	464	vssvc.exe
Token: SeBackupPrivilege	5504	wbengine.exe
Token: SeRestorePrivilege	5504	wbengine.exe
Token: SeSecurityPrivilege	5504	wbengine.exe
Token: 33	1152	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1152	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1152	SearchIndexer.exe
Token: SeDebugPrivilege	2400	alg.exe
Token: SeDebugPrivilege	2400	alg.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 1900	4560	GameInputSvc.exe	90
PID 1152 wrote to memory of 2948	1152	SearchIndexer.exe	111
PID 1152 wrote to memory of 2380	1152	SearchIndexer.exe	113
PID 1152 wrote to memory of 3724	1152	SearchIndexer.exe	114
PID 1152 wrote to memory of 4696	1152	SearchIndexer.exe	115
PID 1152 wrote to memory of 824	1152	SearchIndexer.exe	118
PID 1152 wrote to memory of 908	1152	SearchIndexer.exe	119
PID 1152 wrote to memory of 4300	1152	SearchIndexer.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_f1d3c4856344cf3bc0f449e4d62d8aec_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2584

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4064

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3288

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1416

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1456

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1220

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4396

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2740

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4112

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5840

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5888

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6012

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1392

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4644

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5504

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5716

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2948
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2380
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2936 2952 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2980 2964 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2936 2952 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2980 2964 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 38d7264fec2e259cc4d84a243b3db769f061c903b4adf4baf1dc3c1ed406ca0d
MD5 209f606567dd23adadf5bb0177cefaee
SHA1 5237ccd2b1d71e3ea1f1a997029e7c64b318c563
SHA512 974a7382a36ed3014a357ef29e69a8315431522d3502a5071d2bc7d9555949098e0fc6372275cd2167f36433d48b2055ff6b0249f3278d5f7098c8b433c4746f
SSDEEP 49152:JOp632BuPkFKRrdE6oh7stBhuXjfS4LWxn2QaYtjY/njFfa:L3q6gjBtQaYdY7
TLSH
T1B9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 85c4a65796ca89ff0def384dad1c7d7ed60643537b4a82fcdedb322e0dde1235
MD5 e28a021be0925adf08b4bec56895311b
SHA1 4fbbded563d016ece2a2ebca40c6d51b67ef330e
SHA512 97ae23f5bf54a31b9b192698b0ea19e94d8cd018e2839587bee04815beff0a5b63edc168d0fac357063aee25a13f0bff5551be922cb6b8ea88047abe193dd8c1
SSDEEP 24576:RXYTDFczA3J8QaYEE3jnI9GU5xPLFf9Af:cFc3QaYtjY/njFfa
TLSH
T1F805012D67E409F9ECA7413DC9A28506E773BC914760E78B03E4893A5F233985D3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7567a4a14b09835b72dae715e4b4259759dab5dfb8c3dad7a4ee3c1c5c40ba7b
MD5 094f11744b69c5a016ca3b9cb034d271
SHA1 a4e6f6b38eac9dfd8c9d1a07e5b1287248b05b33
SHA512 41b84495de5ce7f97c45b435bef661b46a5e3405fb91f83d41a58720d8d2b4696dd465b6b49245afbb1c0fcd0b58168053b6fb3c29a2a8430df8fddc61dc522e
SSDEEP 24576:p0De43Z04qxOrMNJ8QaYEE3jnI9GU5xPLFf9Af:pe3Z0zoJQaYtjY/njFfa
TLSH
T19D459E26F6748335D073C0B9C5D2A68EE97130865B308ACB4296D77C7F27AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6c772fa83291c382e1d34e2ebb464e9b457c15f4b53968e668752f556db3626a
MD5 42069c2a38b9b74b89f1bfd435b6f051
SHA1 db4fe52adf2c723c1e5fbb1623d0b5ae44e44746
SHA512 1d16ffc883a4a40ae3ef79dba317b0889f00c5221b93931a0f272a01feb457686837511edc195c4f38190207aa80cf77326126ab201b55eb8b0b7245b9a85ba6
SSDEEP 24576:tdb/ezSC6vUyD/aqgrvW/6q8wyuBJ8QaYEE3jnI9GU5xPLFf9Af:H/ezSC6vUzPvuHjyzQaYtjY/njFfa
TLSH
T19B755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 b520ea5a8c0cd0b3d798ada967e230b204149d5f351e883920b6551559f4a304
MD5 9383fd77ad47f3267e93ba919974244e
SHA1 df7ca771062731ca777d21db096a91e44f2aa7c4
SHA512 c0d2fe9471c6ce6ef336e495713c00ee18ba764276f94fb13416db2edc1890eefdddf917e6046fd7a8cf81f6e9abbf387832190c88eaba718a9c66dc102af567
SSDEEP 24576:zabHPSLCHv/l+dV8J8QaYEE3jnI9GU5xPLFf9Af:zamLCHXl+FQaYtjY/njFfa
TLSH
T123559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 5b266ad12ecc3b3b31dcf80c5db0ad9023a6c4dc73ea45ff87aaa616f155285e
MD5 42ccbabaa432dd9123c46f2e85c8f6b5
SHA1 bd649e885d75cab73d950800b8d857dccdc88434
SHA512 300611fee6d4f44e9480f99c840a42aca3d3a9df3f1c0bc464093f26580f2ecf1bf6faf15fb8e31177fd61996fb36f4265c76ac078288a22754167a487226710
SSDEEP 12288:AdKBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:AdKJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T12AD4232F0698B275F6F11836F6E159CE72B07C427953CBC74FE0686EA72456580723B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 ef7a9dad2645cc3aa5c5843925133604d8dee44b10fb7250e1502ae16f7ffeb2
MD5 e3197e745629ecb6d22c19581e4450a8
SHA1 060243b86a64812c908357bf6020815ea31346ae
SHA512 d29d6043dc196023526dd8643e2bdc7c16841ca40d1daf8f7f5f858e6eb6ef782c4b924f4888b8eba30c1d720cf6935ce73654e6cd6472963355ea68656f4ece
SSDEEP 12288:XeBNUbTVO86U4Bvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5t:XJIU4J8QaYEE3jnI9GU5xPLFf9Af
TLSH
T11915DF3BAE28FCE2C27A4CB99B918640E77278704F6293CBD174820EDE135E14D76D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 00ed40ce787b2bdbca7d6b32fc655c76decf920f86045f5c83d8800457d26a18
MD5 aedd72b3784c2153734b695a551a5232
SHA1 45daab0e28159880a060586f15636bc276f9be24
SHA512 59fcb6157d25e26d69720b232bfac6fedec8cb0769c2de6ec053950242763c0adb99e57fa1329078f005be7cf30cc64db901075f1f6a22cae54156aa897047dc
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3TH:jQvGAdlCEL8c/9RNw5CCQaYdY7
TLSH
T15A367C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 53045e974f1fcd41154b64436a5b595632ae955d07178e290320368b43206768
MD5 af888889c6af346cc8885e298a2a0ea4
SHA1 226813a4a3b73e703e1f75c45febb5c1541b58f4
SHA512 9f8aeef0f973cda633f54a7f8dc026d3d284abc03cb385ce269147bf7043fb635993b2db1dae49a12b7f220b2f814b0602582e7712ba946e30dbeab73cbfbe0c
SSDEEP 12288:HrwSfxL/2Dc3bDLLmt0LDQewsAjCBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxR6:LmewsAjCJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T16915E031FE74E036D6BB0DB65B72C70A647C79604B521AC3E3E84D9E59202D22376B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5a09c8bb4cee28f2800818fd5f33f9830a62e257d99d4d9aae5a372c4add5510
MD5 b693e45e1cec5882725bfd5bef9bac6b
SHA1 10bfae3b6649b6852b39e394eb85c9435d43d3b9
SHA512 bc39c3f66a63e3d5bae7315115e339729f4fcf7653f785f148bcffd3abe8f30e2d918b2236f822b422d4c6f1f1760e654638097342629940746c7b2fcad35c44
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHbY:lUEtQevvqc2W1cpV2XF32b
TLSH
T17B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 35eb743bf55f8ef1c3785362552a0778e7c53df8899a7e184dd3b03134468600
MD5 2683f7c25da13e6d3d965f4430262180
SHA1 7e21d15f23b7cfa2bf8716d079ce82254d921631
SHA512 3b68953e715d1d6a50a3e1dd3431f605f58aa3594aa7a029b5f95ace4833203543a4b93ad5665cafd963ddb910b19b8b3302a8ae0467aba8a1b55a590f9bb524
SSDEEP 49152:1lbRquA/m2yL5zMfFiV+XenmE3/z1QaYtjY/njFfa:voq1VjnmSQaYdY7
TLSH
T1C5D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bfe1675b45c0fa4baafdb6060d26811559ad718430999460247464ceeb834ff9
MD5 dc2a7b0eed7097f3e8f6205029c7765a
SHA1 e42bcaf9bcb93ce8c0eaee1880d08f271201c6bf
SHA512 c90610680903b9ba0a03ba61397c27c95a41d2700559a557ba26de45a100bddcedc92cef79f7ad1019e956d2559f9c356028709b132edd91aa851adace0cbe8c
SSDEEP 24576:RAhGLvrFoiwtA5l7S536J8QaYEE3jnI9GU5xPLFf9Af:RAMPFoiq53QaYtjY/njFfa
TLSH
T13A45AD81E7F955D4F5F3AA78A9B68171EA76BCA65E31C20F1260C11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 7db45315e93be7cbd899a50912e3db82223e735d78d964a8f7d6f6a7bf017d53
MD5 0e6dbca85cc8ba7a28c0fe14eeb9ef10
SHA1 18f93bb22398ff529d662129442df38d6038d760
SHA512 f20d035890a68c4bbcda9d68f7f7406d42c3f16747d44602c22612f45f5dae329f8d9c00ca2e19793e8e7000add4ca8ccd5c2739438f5e690f8a9c363ec06ab4
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CqBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1Bs:uwuuOWtJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T13C05F14A36E41CF9E9A75539C693C536F7F2BC022A21C71F07A0C65B6F272616D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 59e00b0ddf5600fd17e74b1f44120caacd61aecdd386f5b25499481748762143
MD5 6d7c01048badba7d80c6f56888966ae0
SHA1 60daf25820e5a448e48ae86b66c7741dc0361386
SHA512 78a4eeb7cd3aa932687e88761b2eaebbc6a2f9dd14f545bbd4a6adbf5df73a83715713f810aad63a4e96b801a49bc1a5d149a5e2c19cce5d87a97ccd3d8a50e9
SSDEEP 12288:qHB1Il6Bvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:yBusJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T12CE4125E23E871F9F1E31539D9E15A49E3B17852373283CF0AA0456A6F22AD64C36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c79c1c8c05986ecc0a218089904b415c3598889c2c8f8789bed48881c9e77cd0
MD5 8ca4fc212ff2184d5b34e59b71f05481
SHA1 a4c33c847fda99ba5827f6b5c60f5b56a0ff6478
SHA512 0fea7e9df671264496ce479cae2db89bba79222c7875064514d5669ee89c5f5c2d23f3daf9ebdc203f0ffdc273ef3f8687b7848822bd6b9699d734e587c49c60
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U:bQRQyi36YOcP8Lvw2gAf+PN3nQaYdY7
TLSH
T1BF667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bfe5e97ab65c27996e684fe1e1f426f67af591eb3d6f2133d3c0d2a257d115c8
MD5 cedc30a89f9909d8ccaf9a39dd3e2b7a
SHA1 41d53cedaadfa07dfa27a984e8475c34732dd890
SHA512 9ca462f90c6a3d3ef395f8ce5f999fc4e89729ae774eb2a4b1f5fdeb53f8c4fceeb0e215a1ec0ce2521bc014877cca5680c088e8a59f29d5c6b322a0487821be
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U2:bQRQyi36YOcP8Lvw2gAf+PN3hQaYdY7
TLSH
T100667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e053c5ac252b7e08159581d0b0699cdc2d7099f41739777e657cfbf78b40528d
MD5 30edf2d58a0b2ce024e3f414d9962287
SHA1 59d3ecaf925ef8bccae7a3d949b00bed49225e8b
SHA512 a2a03ab4e29919afe6951bf96c5b1fa25416da42cf3c210847780f0746e36780d453374700711cd1d43a70b45d7a33a19696b881524aa7181744971256eb4603
SSDEEP 49152:j68Qg55nhMeWu7PNU3/RQaYtjY/njFfa:dthbRc/RQaYdY7
TLSH
T187B55A33B2F600A9D44DE1769F46872196E17C718FE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3b9957886eaa25185e01ad61c72c6cbfb8f9d37cab7b774713ef01cc262ad4bc
MD5 b8783a99bd19d9891f0be012e363e807
SHA1 d1e550f592451b8b80bf8c7ebe0ca96e24194006
SHA512 7a314999dc7c3148a96230a74e36f5c4e9fdfd18af5762cebfd2ca49b0a44e6e0a9880e00fec52f109e998cf64d8f2dd5ec8c54285a6c1290666a0ab5d7368e0
SSDEEP 49152:T3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99q:Gy5112gYy5azzVv569nLKnhZAQaYdY7
TLSH
T10E168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 39d8ed5541c4cf2056e439a6ffa8a6c60a08ad4d0b1cd726ddb1c4ffe1499c55
MD5 ec4f48378a08fc3096fe276d0397e276
SHA1 e2f9b5e3fb7aa81948de2207ae359c7b2b93c243
SHA512 b1dd96549c45d9e6c2ebe5ef055f725293b8dc720df9b2e21c08d60b6de5865845c6571fe4e4dd143f22e21b9e93da6580d61633cc980223315dc59fca416991
SSDEEP 49152:BY+taZ3usBWOBr4tEGp0bqx0z+n217aau1glWQaYtjY/njFfa:iu6JmTxd2dWQaYdY7
TLSH
T1B9D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a3a9701902b40271bee8f00aa21308879caf52cba22191d3daacde44a26a191d
MD5 4feb97c73f170678f602b26ea94f464b
SHA1 7669fd16d8e27e61fcf7953000cf038917886082
SHA512 5091b131d68b1418989686fd7f590dcbdf7a16e6f75e45060d73cbe99bc893f7af3cf02a3ac9b3ef3351e05fb853e592a580c37ef3807c43ac1360bde46d9461
SSDEEP 49152:F1hpsNoJpF1A6UU44CwH7R4xLQaYtjY/njFfa:FmifPbRCQaYdY7
TLSH
T192B5BE13F2D801E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 161fc6b1b3f138da10babdbc9e52e6c8788306698c500d47c491a1451b4fc2b0
MD5 25878788aaa4dce2ff77ecdbb14c9cf3
SHA1 a748fb778e1e5baeaf13e654b5732d3f821050c0
SHA512 d717691ab5651a32db04bb1a4a1bc4121d3f117920d359622059a3a7c930d12b3056d8e19d45b82dcb932d6c450743fde1c549b1e4cfa89ac30c73447e002e2c
SSDEEP 49152:VSuZQIY0Be2K6RVtOnks6NMHqlQaYtjY/njFfa:75dKoi61lQaYdY7
TLSH
T195C5BE03F2E941E8E0BED67487669236EA72BC464B34A6DF064072591E37FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2f305bb2f9300134e834ba625866512c0f46fb46a3d58df845234292ffe5d20c
MD5 bb48840802ea56d7ce48994c5e20958c
SHA1 998acca78bfdd4b414e0e76f05263b8211e4a3a3
SHA512 5af8138589d7927234a23df82ee46b8d26e3e5a438b9f4acc01b38edc370650dc837452df3a9a987f4e85aef1eadcc74cd0f698169fe8fa5bc26ffe28bfd610c
SSDEEP 49152:GFISn8EApI0figTgiDn0AP5wRiQaYtjY/njFfa:uX2iyphkiQaYdY7
TLSH
T1CFA5BF13F2D901E8D05ED178C7568632E962BC160B35AAEF0A90B7561F3BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 93f437f3452c7c8615cb3070d72db8e7c7edfe6165ee1f0bfe4d05cf9d0cc263
MD5 7c4962c294fefd8e2c45342f14088af2
SHA1 4cbd6b044ddeb4d1b5933077581c6c3a232d3eb6
SHA512 7f0619033c8555254344c091032529efe9a970cb55931476b3aacf07ecd9a108d7ca72b63c88ad8ffeea5e7f2c615d91e1f39135a81fb3160a90964ceae818b5
SSDEEP 12288:L30mBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:LjJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T1B6D4232F19D8A776F5F12876E2E25A8EB2B47C87BA53C7C78FD4442AB30452500727B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 8181b1d74d66b775db97b1bf29bdb7265be876486faa2f99bef620348913f692
MD5 90773d1f4d1ac47c0277e155c2f65012
SHA1 85ec2f7ba2329a4aac5397bbe2f139096f78767e
SHA512 3c37b21c122282e4b598c7a0c4106ce64ee9c1f61ef55281b31810cf7bcaec22a03fc048b5e731650622891fa6375ce976adb5de9253b758d9d2da8615062dca
SSDEEP 12288:tj70mBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:tjfJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T1CFD4232F1998A775F5F12836E6E259CEB2B47C877A53C7C78FE4442AB30452500727B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 70f2abefe57429990c6cc3350cf9dece8e7ce79be6d6579aeed839f81a4472f2
MD5 a5f285f0ed8d6e381cc78249b1b85db5
SHA1 534494cec79309ad9145054cfd2e615216f16453
SHA512 3629d3ac8d4a009bcd285daa79c1567572a48ef39a4196b317dda987ae975c8507038735881394f1597c0b9b17db94ed1dadb8e216bf38b271021b79d6cee76f
SSDEEP 12288:zRBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:zRJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T1B3D4232F1998A775F5F12872E6E25ACEB2B47C87BA53C7C68FD5442AB30452900327B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 e9255008637e7f9fa41543d143a3b3b225df13e5a8a9e2d750a275d4f8f3249b
MD5 436a75d37d8f285ccc34ef178e942829
SHA1 51839bbd0f86ad9b4b8d7f83533221cd630db6df
SHA512 58c659113ae9a0a6a080ea8b6655d68869c78f4fb953fe85830534a61d505d8531b0b0b7b8cd37a3eb641bf7d3bc0296b327736b715f1fac0279c71465773856
SSDEEP 12288:4lmBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:jJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T1E7D4232F16E852F5F8F22535D6E2558EF2B47C96BA23C7CF8F90042E6B202545431BB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 296d19eb5c5e353ab27632d0790a94062702307aa5f6e0d7b415114ae729f5a7
MD5 fb47f8d237a55e983ab914a7b8afd28d
SHA1 5c36098bc6e96d5104b567a5d4f9c7981406a430
SHA512 8ba3dec9fcc626ef6663f9429cdaeb43a9615b5ae2e51723465ea8a6b963db86e48f34953ef12b1b819ef399b25f79dfac482fe9afb2d66382b06667eac648ce
SSDEEP 12288:iDBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:iDJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T13FD4232F1998A7B5F5F12832E6E25ACEB2B47C877A53C7C78FE4442AA30456500727F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 39ad22c2bfbfebc583045596581dd10569ab6808e210a47e8c689817056d6350
MD5 e755a05dcce76a48c9d585478400aa10
SHA1 544b3ae88f2324e35b222fc2d473095e4b7d806d
SHA512 a6e2586260692eb1d6e46b00616e512fa18a7fadb4bce9360410f7b5ee9d42e8230590898d747b2b2521022eac5b279bcfd0900d9a80a503abe8f2d4a5da5c93
SSDEEP 12288:ZvBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:ZvJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T195D4232F1A98A775F5F12832E6E25ACEB2B47C877A53C7C78FE4442AB30456500727B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 4f7d4e92cd561ff8958bd6404363f547d548332b88399adc9e035838e2b7d8fd
MD5 0a8b4a849d0c1252edd3b729fff2263a
SHA1 65b664c59c989993038c76eea5f541aefdbcbaa3
SHA512 364091682d2543041c955d31813e6824857af5421ea6475f52c01de72bbfd577d0a4ffe816261d3ee45f4ebf96ff18ad5b1ec147e1d994fed72aec2c8f5fa2f8
SSDEEP 12288:cfBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:cfJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T1E7D4232F1A98A775F5F11876E7E25A8EB2A47C87BA53C7C68FE4442AB30452500327B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 09ef1f8d42c6fb620eb212172c505f2c9d71c6cde716e3c1a0c9508f154ac0b9
MD5 87bcc18e909b0193e453669e494811b8
SHA1 85ba66d292c98872e4f28cd19cb34d1f296f6d00
SHA512 cc6a424fa34db7adca48d6b2f7e36bb2ea0a1b4e62e1085380b21ecdf40313b1588316d6657143bf0a595b187c2bd99d12781799df5988c2eca48256c196b42d
SSDEEP 24576:RZMGzIVSdtJ8QaYEE3jnI9GU5xPLFf9Af:RZMGzexQaYtjY/njFfa
TLSH
T1471502A9739019F4ECB7413EC961894AE2B27C5A1A70C65F07E4362B5F333611C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 6b924da3d72dc8f628512d377fb81bbaf9d92c5f79922a3cee01a480d04a90ff
MD5 cd9450495510df38de2b2c330db2a889
SHA1 115fa3ffe851f17c2e5f270d44f02c99b6af5be8
SHA512 82fce1b937e8120a0fd6daf2b8d1d3fec8103107219156d98f55091d12749033cc8966b52e74ce185ef7cd7a905af06e31d2e0fea107247f03885eed0a023eee
SSDEEP 12288:3ZBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:3ZJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T1F3D4232F1698A775F5F12876E2E25ACEB2B47C877A53C7C68FD4442EB70452A00727B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 c83c4ad7236880b7962df9492e5bd60c0fb6329b5b7f2c8e3c5bde1cd06bf59b
MD5 77ec09e02c0794bb1f64bf32a36b44f3
SHA1 e1619fb0b6a3d6d9d887ec7cb3593f1e5e0b03da
SHA512 1b9d1c0d4aad045b4a57f655d20409b5b6ab4cb1b71528fae57a18fb0bff6e1d6c4e85256c422d6e783a98ab6667814a320831bbcf9691c8ef2d8e7455a1c8fa
SSDEEP 12288:9HBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:9HJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T1F1D4232F1AD8A7B5F5F12876E3E25A8EB2B47C87B953C7C68F94442EB30452500727B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.1MB
SHA256 82a9d7256ce3f5a34d1d7b115915acf2e4f8b4b2f940b0ccdb04978327c038be
MD5 154172aee6e5ba91892fe041fdb17da0
SHA1 084b4b829ac6734225d8d93f68f3b43567e2f81e
SHA512 f0487de3bb7c5d4e2dc3d61e07ec13290b5cd977f226cdd6554a8c23219b26a49fca968a3c1df658d84e626ec23879bf3dc7cd2aa92d37aa2d03ef51ed231e34
SSDEEP 24576:igwvtk9RX6wkyAIDJ8QaYEE3jnI9GU5xPLFf9Af:GMnYIGQaYtjY/njFfa
TLSH
T15635DF2AEBDC44E5E1B7913C99B3460AF2B178591B31C6CF029A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.6MB
SHA256 08097b2c935fd828fd7043b71feebb4b78f3df8adbdecb630f89036209666aca
MD5 a6b1f36b81f58c93832ef4fa28d079ee
SHA1 5a156c018bd1f19bef9e082b6d7b33bf05d9b4c4
SHA512 f8bcd2b14ed9f6cf4cfe910c029500acfae7f46b48d1fb3f54eb42bbf17588f048d86b8fbb9497833d7f07aabe88ed6099186aea09c7850801d98e987946aa0b
SSDEEP 49152:7YlrNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0bQaYtjY/njFfa:+ySzPDQaYdY7
TLSH
T16E066C96A1A801D5C1B9C1B98B17CC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 89a18072a57a04a920915fc0a9e87b6c1608156d5584b5b1893039ffe5b63aa5
MD5 4e0442b239fd16bbec1ed95f2b0d6b05
SHA1 04d90eaf423829fd28de5555f7b7240005bdf96f
SHA512 6bc3f034aaec4cef19eb828e59a67bd857312a634567df4497c12977a5ca932e45ed92f3f68a1007f9337fe202ca43714f597d78051ddc0a1c63fb5ce9e44e58
SSDEEP 24576:SC7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYIJ8QaYEE3jnI9GU5xPLFf9Af:SC7JUQjXirIhCnDHUPfF/vQaYtjY/njU
TLSH
T1AB65AE1EA3EC01E5E1BA927885554A5AEA71782E1F31CACF1270437D6F23ED44F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 86005f4aad676f2480534d282b2062d7ad408272f2a1075d015b7c8f4c11e357
MD5 8f33d5271d4ef3c96a03ed6b930efb2c
SHA1 b9348ca2b72860508ed46be4da2dc24114ce4fcc
SHA512 9cf5a425d19c7b7bc3a4ee2fb5f4e3b415622feacae8c0e9acfb3bdfadb723163361b151a90844508190764e7bd9dd160ab9878b7f08c646e939fd3a9a9bbee8
SSDEEP 12288:hdXf+Bvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:L+J8QaYEE3jnI9GU5xPLFf9Af
TLSH
T19BF4F11AD29812E8E0AE2135C7924A49B3737C6697E2C3CB47D0F43E1F356905DEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 909cead85d4d40255b32f206163191b484477d81dc5cbc9a8eb9047d11ecbb1b
MD5 6ee7ad6d48a95ad9cc92e25e07c4b242
SHA1 c6d7b1dee9d0faaed00133a2405aa4e544953063
SHA512 6a804368085fdf59e776fc3c10aab67bc22333480afcb542a40eb8fd420f3afa144fc168bee806a1b814f10cf7d465da0aa8e26b4613b91d7c4f6ef393adeeda
SSDEEP 12288:sT7uBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:6uJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T1EED4233F07DCAA75F8F52831E2E2854D72787C967F12C6C78F90546EB320A9548727A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d76be87df035006d8a43ad40281e7210d47662e81d3f18ed5439daca7ec9a18f
MD5 fd5570d9536c4a559b28324e5ad5cbfb
SHA1 d8bc7ef42ecc6fca5e58066bf0e464f454973e0a
SHA512 ec04f77e26afe46f0f547881bb500e8be3aa7ba2b4168e924c469cbce2a02a69dbcaea3f0b4b24d429211bf56b8b6de077d83b921d1bb39eb6515559fffb1643
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bYOJ8QaYEE3jnI9GU5xPLFf9Af:vgb4mBIBhGFYQaYtjY/njFfa
TLSH
T10F659E1E22EC02F5E0F5E2B8DDA64417D6B278161732D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 0a27307ee125a44df01a85d7fd2a368ec3230a08f209d741ef3e5d5f9681f86f
MD5 f6f7384ca030b5815bb79d6ec5efa5e8
SHA1 ef6df1ee183e78d9a12c5be38618b363c6afc965
SHA512 b932a380863d0b23bf5b73d4b5e56b44833026f3eb2ea8a98ff92904152448f3da17ce9a8e2b0978682755d83630b968c7cd6662533cb7924637ea89f001e800
SSDEEP 12288:8AGyBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:JGyJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T151E4233F25E972B8E8B51639D5B2558FB5B03CA17B1286EF4EE0D03ADB145E01136FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 8585e0a33fd321b9e1663845dde6d2dc2ea92401626203f1005126d6e6bff12a
MD5 cd5ffdaeae4c11a1ea6ba026dc49f40f
SHA1 64cd3e11a407c714a07abcae873f633f628043bf
SHA512 c67ee0edd4b36db23f558fcba77c8aab6deabc144d6e19e169467c11970bd11e4a8dd473fdf342ecd47e354b50370abee9e89346eb2aae3a488873d9b69c8ef6
SSDEEP 12288:04Bvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:04J8QaYEE3jnI9GU5xPLFf9Af
TLSH
T1E1D4232F0698A7B5F5F12836E2E2598E72A47C927B53C7C38FE0502EE3145E604727B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b733ecba962aeb48a0f438d5dbbda2ea1271eea4e7352efe0fe0f432a87acbac
MD5 8a9ce2b3d2ef5892d388a95f1671db8d
SHA1 9fc205ce8fd855b351239794ff3c7cdf5bc85583
SHA512 79abb0905c803862a1c7d09bf68ff44f8552d5c7b0339855ec5c34b6ad7125b0154fd6bdef73c44c1f0a9e37ad76f47dee965b5e019ce7af7187f52cd489055c
SSDEEP 24576:8ci8u8FpJqH1bNria7/meJ8QaYEE3jnI9GU5xPLFf9Af:FRZFPqVwa7/UQaYtjY/njFfa
TLSH
T1D535F16567E002F0E477D138CA824657F6B1B8251361EFDF0BA88A551F23AE50B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 c18538636ee7b32ab0b84dc5ec374fc040e6821408e7c60d34f551c7e7687113
MD5 50e63adf061e8571e8e4564cf622b7a3
SHA1 289084510126486a1a9f42e9929ebfd90c2e61af
SHA512 d09e4b6010ea9977f888192b6286b3228e3b71aa8114ba2bb2e50cff0347221593ec051bb9a3a0b027768ac988ee21e2c26c07342c0aa15478a07d190e978f67
SSDEEP 12288:PHvUrBFrEjwaQPBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoIf:PPUr+NQPJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T1FC05E12F26EC18E5F676A17DC592460DF77178621712D2CF06E0817E5F27AE86C3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 3b22cc8a0412b6765d947f055c4f5c68027d806317ebb00289a090c28a31b78b
MD5 f075e82885d8329b61b3396f342cb577
SHA1 85387301416a0b54a027c6499ba70af85b5b9320
SHA512 05a850b6e20b2950fbb35b5cecc1ecf644e37b362a91cb142ae1d422c14cb599bb9a18d8321e3b34bc5ed6076eec809766fe3641024ed828258572c151be63be
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbQaYtjY/njFfa:DG05lO43beQaYdY7
TLSH
T112D5CF6E62EC11F9D0BBD17CDAC64A0BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 81cc2221c41d7faaa6ddcbdde4c4d9bc6d85c5082e3d18239708198f2db7e91f
MD5 56c8d58ba4a357ef6fca7c126a4cd856
SHA1 b15a3a116282f5acfa2c83fd46957e4e2ae69236
SHA512 97cb2d1ca37f7420976b24c1d8f65025a5057954654993e4e391817fc0317e8b3977c0a9eaca478519f1cc66978dbfe97e11cf5f296c4ff3146a166e87c3e388
SSDEEP 24576:S4a5POZ3dpbWVM50JicR2hG0lasx2+47eidnjFJ8QaYEE3jnI9GU5xPLFf9Af:Ba5POZ3wJt2pasx2+mFIQaYtjY/njFfa
TLSH
T15465BF5EA6FC01D5E5B9D17DC583460AF5B1342653329BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4b04fbc3072d63c2e9f4574e8bffacbc953053e619063538b077edffbd21b02f
MD5 887279ab2cfe3818bff51a16109e0c22
SHA1 f4591d6f95bda30b9b5ed53fd29e2c518ff72e0b
SHA512 a29851b4926fc48bbddf7ef8a4ac49109cce5c02d8c6805b90decdf2b9fbf76abf181dbbf4f0321cf44baf30e5770125d18db92a5a4517b3cfdc8ddb79d48d65
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FklJ8QaYEE3jnI9GU5xPLFf9Af:NNc/zEOVHFrQaYtjY/njFfa
TLSH
T17F857B2A22E901E4F5BBE1BE89779546FA717865133086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 434299d5a48703a77613805e07e608790bacedc764d50db8396c7c1b42774649
MD5 42fdd128f1fc07393f64fbba42b6b43a
SHA1 351a9850135427ebeaa219f608e3f317d0fb6345
SHA512 b793ce02f9ce0484f5443d40696f66096d57577c34e659179a16d04a5ad9c007a3cf1db5174b88da0cbb22761079b33a4d516166cafa7bbb5b94c02c1285bcfe
SSDEEP 24576:KJnJPbzB4S7J8QaYEE3jnI9GU5xPLFf9Af:KJnJv6SuQaYtjY/njFfa
TLSH
T1EC15D03DD2A810E8E4B7C2B481561B5AFF71386D2F2269C719B4D4353F12EE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 346da4b72662a519f689fdb0455cdb9476234564283f9e424aeceab90fc95df2
MD5 c5d567fff26c5ba2cddd6ede23a4d3ea
SHA1 134a5258cd8d1dfe8b10dfeee6ec3bcbdc9af085
SHA512 8deaf6ff6310eabaafd5ced9ec4cdbd6f080c10ba5f7c745dc86208e17e1a4f6c7e835137862d9d3a409e3e12787c8bb66b1f313fc5ad025a96b48bf20a9b365
SSDEEP 24576:+CLHGL0MoeVtFumTijCmlKQWDkHJ8QaYEE3jnI9GU5xPLFf9Af:+CLHGeeV5ijCmlDWDkCQaYtjY/njFfa
TLSH
T1EEA56B05A7EB5184F8F3CAF5CA2294169A327C549B34F7DF4E80C96A2E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 1935bb2f859fb00b7f93f04f7dbddaf145f9136da978a0a3ee18066bff309cdd
MD5 4f9c1f45a64cc3655e675cb1001f1cbb
SHA1 34c28a6dfe688f76ebcd41b68174c5caa897e580
SHA512 19b3c30b6ac8212861c735dc67b45616e59fdc1e972a00b1e5aa4d5bb7a1e6f438b8ee5452e945e63c025006f3818562d0ee8250e672c6014960e23775cdf4a7
SSDEEP 12288:KFHck6j5ZI7PBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5Co:66DIjJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T17A05F11D23BA11F5E0B7903EC6830546E2B2B4A197125ACF4BD4C47E9F63ED8B839E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 a64d4c145f068699d81aa3ad2e8582fc3ae93ff85d04cd2ad1a4cce55914e7b7
MD5 8596a6840fd292b11a8f2b7519a7ab16
SHA1 f4a2619d8496611b8029f7f3115f6be28b84062c
SHA512 52076db98f5e6d14a0b047b847e2a184363896187c0f7be607142b1857d36b4d8fa3be52ae20c35b6d1735c3d923a27cbd2c2d01b7342fbd76c3b26756c06e9f
SSDEEP 12288:qG6kyfBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:jtyfJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T1F0F4221A13D861E4F9F51538DAB38189AA74BC216B22C3CF4AD0E63F6F357D46831B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 99d59176a3e80789fe0f8f4ed71171acd5a5fcd393b69272062a439af774ba6c
MD5 b480ac55b34f4bf8abb8bf5879237756
SHA1 33a65b3a7ec8c033f55a4bba05cdf6d2bc7878b8
SHA512 77348eeb668daecc58f1447a81eff5d9a3f7d852a94668a0b21dab4e3fb3d6e1c9276b1e02950899ce2863caba0e0e91a2191575424dc5fa11da8ab7d3a05880
SSDEEP 12288:n7UBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:7UJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T1C6D4233F169876B5F8B12935E2A25A8EB2B47C623B13C7DB4FD0843AE7145D50432FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 771cdc0de5ed1dc3ca02001d55995edc6876b02021e0762fa89dc48ce28b2a14
MD5 be935b1c63e5d06063407d04b115831d
SHA1 8cd9e87f6c9ae9335720fa14bec8747289cd828c
SHA512 09613f21abf9e9d7dd21cc4ed06e4549b711ba31fe2cf2c5f8123dfcbf0904a9e1ef4c831edaa0d958709ae92154e3c0d72df596005444fb4855c790a9fef91c
SSDEEP 24576:nCgW7oTfaidZ0J8QaYEE3jnI9GU5xPLFf9Af:CgVTrZpQaYtjY/njFfa
TLSH
T19C559D1D67EA05DAE2B2D639D9721483D633B4315772C6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 6eb3984c97bafa4757f83755f6f3a38bff0ded0829ae75120b8985fb60d48fed
MD5 3ffb4a45aa0f61736bc5a39753df2555
SHA1 d5830fd6be9f6db2050ec621aaa2cd7810c38854
SHA512 a2020a52251659163b4e02c2d13bbecce7f3ff0159b75d3baa87494124a45c3b6c96fd1e0b53b2dc6f3b2ff9abc3184ef22150b84edc4456ddd34f1fa86d4e55
SSDEEP 12288:WpJcm8CN/Bvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoI5CPda:WrcmR/J8QaYEE3jnI9GU5xPLFf9Af
TLSH
T1C305F11EB2AE00F5E1B7813CC982464AF6B37431271297CF06A0C77E9A17AE97D35B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 783c192268bdd2dd20caa70905301ef5caf7056d876a630b1c1f7bd7daddab8b
MD5 110aac0d03c3f6294aac104ab528bdb6
SHA1 39c7a084c3aab73cf00c2e258128b4c1e1931abc
SHA512 190f159738158e152087068d12e72e0ba2d8cac52b3d98fded953d421195ca87ceff694c82dcc1b1da01e16e88b40612a174c8958fc98f4979c23d85b9c588b2
SSDEEP 49152:NDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3kQaYtjY/njFfa:u3Upow8sBxQaYdY7
TLSH
T1F1A59D3DA2E800A8D9AAC379C54213A6EA71782E3F3055DB0174C178BF1BDF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d02c3d233f6e4834983b87aac6c53d39218bcece086eb892a02f2885aec68688
MD5 d8b4aa9a2d4709b9f48ab09482edf938
SHA1 22a6b0f883ca3fb2393caca76b328fdb6a0d158f
SHA512 8970d1bf53a35edd023624b7a6bbdc829c3725166a17979e07e4b7dba9f2dd02c2df817c83af099b8fab97e8f83d6230513fde31e59cdfbdd116941ab388b5fa
SSDEEP 24576:ATkNvNnaFeYhJNtmZBmC5J8QaYEE3jnI9GU5xPLFf9Af:ATMwBtOmC0QaYtjY/njFfa
TLSH
T1A555AF2EA6B846E4E1FAC6B5CD238516F6727861173293CB4390C13F4E279D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 992KB
SHA256 aea65a61a0afa6e783b5f4031cc5b29a671fe6780c0bb22e7fb0fa41ce411a71
MD5 938771e71dd9229780dd9f2d75fe666f
SHA1 8f8b08cf876fb510e542b63fb6ec2ef06d08fc5f
SHA512 b013aff500185acd0d313bd1e9ccbdedc9016a85c1996b7f7a7ff175b9b2c9e3989e7c67ad2a5ac05c3b6102d90f5f8714f9e2f3791c14b0c127765b6aab3b56
SSDEEP 24576:SD3FHshBIYQgAjJ8QaYEE3jnI9GU5xPLFf9Af:SDVHeBIAAmQaYtjY/njFfa
TLSH
T15025E13EE69C04E4E57BD17CD6A38A06E77138A9032256CB06D4C1BA5F1BEE42D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 772KB
SHA256 edbf5f396196c585bdac3f9723ba9cace63ff7d827363cf885899e16b8dcbfe7
MD5 70cbb683c1cd0622d2e916cca5dff19d
SHA1 16e7e1e81a1111ff57dd6ce37e8c305044f282d3
SHA512 7f133ca68781405d996bf9745c917adc32df595107150c2c73b9fe45f52e69aa5ee957a20ae610b7c0cbc5c438516e81b88dfd005475283f6d8cade869438cc4
SSDEEP 12288:UWD6b3IkxjbBzzBvj80lVNQw/yxyEEuGjsUoTla69+FbULlxRmLc1BfFf6EPSoIf:P6UqjpzJ8QaYEE3jnI9GU5xPLFf9Af
TLSH
T123F4122F16D464F9F4B51134EAA2811E91B0BC722772C6EF6AD4953F8B31AD4843BF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-197-0x00007FF71ED20000-0x00007FF71F1F1000-memory.dmp

Download

memory/464-191-0x000001F918530000-0x000001F918596000-memory.dmp

Download

memory/464-192-0x000001F918530000-0x000001F918596000-memory.dmp

Download

memory/464-266-0x00007FF71ED20000-0x00007FF71F1F1000-memory.dmp

Download

memory/1152-222-0x0000025414CD0000-0x0000025414D36000-memory.dmp

Download

memory/1152-224-0x00007FF6CAB80000-0x00007FF6CAEBF000-memory.dmp

Download

memory/1152-223-0x0000025414CD0000-0x0000025414D36000-memory.dmp

Download

memory/1152-269-0x00007FF6CAB80000-0x00007FF6CAEBF000-memory.dmp

Download

memory/1220-170-0x00007FF72ACF0000-0x00007FF72AE3A000-memory.dmp

Download

memory/1220-97-0x000001A5C69C0000-0x000001A5C6A26000-memory.dmp

Download

memory/1220-96-0x000001A5C69C0000-0x000001A5C6A26000-memory.dmp

Download

memory/1220-94-0x00007FF72ACF0000-0x00007FF72AE3A000-memory.dmp

Download

memory/1392-171-0x00007FF79C440000-0x00007FF79C761000-memory.dmp

Download

memory/1392-179-0x00007FF79C440000-0x00007FF79C761000-memory.dmp

Download

memory/1392-177-0x0000020C1C0D0000-0x0000020C1C136000-memory.dmp

Download

memory/1392-172-0x0000020C1C0D0000-0x0000020C1C136000-memory.dmp

Download

memory/1392-173-0x0000020C1C0D0000-0x0000020C1C136000-memory.dmp

Download

memory/1416-74-0x00007FF76FB90000-0x00007FF76FCAA000-memory.dmp

Download

memory/1416-75-0x000002BF48B50000-0x000002BF48BB6000-memory.dmp

Download

memory/1416-76-0x000002BF48B50000-0x000002BF48BB6000-memory.dmp

Download

memory/1416-161-0x00007FF76FB90000-0x00007FF76FCAA000-memory.dmp

Download

memory/1456-88-0x0000016736C60000-0x0000016736CC6000-memory.dmp

Download

memory/1456-87-0x0000016736C60000-0x0000016736CC6000-memory.dmp

Download

memory/1456-86-0x0000016736D20000-0x0000016736E50000-memory.dmp

Download

memory/1900-36-0x0000018068390000-0x00000180683F6000-memory.dmp

Download

memory/1900-35-0x00007FF6E86E0000-0x00007FF6E87A9000-memory.dmp

Download

memory/1900-37-0x0000018068390000-0x00000180683F6000-memory.dmp

Download

memory/1900-116-0x00007FF6E86E0000-0x00007FF6E87A9000-memory.dmp

Download

memory/1900-38-0x0000018068390000-0x00000180683F6000-memory.dmp

Download

memory/2400-18-0x000001F7407A0000-0x000001F740806000-memory.dmp

Download

memory/2400-16-0x000001F7407A0000-0x000001F740806000-memory.dmp

Download

memory/2400-15-0x00007FF69B530000-0x00007FF69B653000-memory.dmp

Download

memory/2400-17-0x000001F7407A0000-0x000001F740806000-memory.dmp

Download

memory/2400-73-0x00007FF69B530000-0x00007FF69B653000-memory.dmp

Download

memory/2584-0-0x0000000000820000-0x000000000094C000-memory.dmp

Download

memory/2584-42-0x0000000000820000-0x000000000094C000-memory.dmp

Download

memory/2584-7-0x0000000002320000-0x0000000002389000-memory.dmp

Download

memory/2584-248-0x0000000000820000-0x000000000094C000-memory.dmp

Download

memory/2584-6-0x0000000002320000-0x0000000002389000-memory.dmp

Download

memory/2584-1-0x0000000002320000-0x0000000002389000-memory.dmp

Download

memory/2680-119-0x0000014254BD0000-0x0000014254C36000-memory.dmp

Download

memory/2680-118-0x00007FF720200000-0x00007FF720944000-memory.dmp

Download

memory/2680-196-0x00007FF720200000-0x00007FF720944000-memory.dmp

Download

memory/2680-279-0x00007FF720200000-0x00007FF720944000-memory.dmp

Download

memory/2680-278-0x0000014254BD0000-0x0000014254C36000-memory.dmp

Download

memory/2680-117-0x0000014254BD0000-0x0000014254C36000-memory.dmp

Download

memory/2740-127-0x000002675B620000-0x000002675B686000-memory.dmp

Download

memory/2740-126-0x000002675B620000-0x000002675B686000-memory.dmp

Download

memory/2740-125-0x00007FF78B550000-0x00007FF78B5FE000-memory.dmp

Download

memory/2740-198-0x00007FF78B550000-0x00007FF78B5FE000-memory.dmp

Download

memory/3288-71-0x00007FF7C4A40000-0x00007FF7C4BA8000-memory.dmp

Download

memory/3288-61-0x00007FF7C4A40000-0x00007FF7C4BA8000-memory.dmp

Download

memory/3288-70-0x0000017DB09C0000-0x0000017DB0A26000-memory.dmp

Download

memory/3288-63-0x0000017DB09C0000-0x0000017DB0A26000-memory.dmp

Download

memory/3288-62-0x0000017DB09C0000-0x0000017DB0A26000-memory.dmp

Download

memory/4064-53-0x00000284AB530000-0x00000284AB660000-memory.dmp

Download

memory/4064-54-0x00000284AB780000-0x00000284AB7E6000-memory.dmp

Download

memory/4064-55-0x00000284AB780000-0x00000284AB7E6000-memory.dmp

Download

memory/4112-241-0x0000025D73F50000-0x0000025D73FB6000-memory.dmp

Download

memory/4112-243-0x00007FF7F7EB0000-0x00007FF7F82C7000-memory.dmp

Download

memory/4112-207-0x00007FF7F7EB0000-0x00007FF7F82C7000-memory.dmp

Download

memory/4112-134-0x00007FF7F7EB0000-0x00007FF7F82C7000-memory.dmp

Download

memory/4112-135-0x0000025D73F50000-0x0000025D73FB6000-memory.dmp

Download

memory/4112-136-0x0000025D73F50000-0x0000025D73FB6000-memory.dmp

Download

memory/4396-104-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4396-105-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/4396-110-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/4396-182-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4560-26-0x00007FF6E86E0000-0x00007FF6E87A9000-memory.dmp

Download

memory/4560-27-0x00000227E9050000-0x00000227E90B6000-memory.dmp

Download

memory/4560-103-0x00007FF6E86E0000-0x00007FF6E87A9000-memory.dmp

Download

memory/4560-28-0x00000227E9050000-0x00000227E90B6000-memory.dmp

Download

memory/4560-29-0x00000227E9050000-0x00000227E90B6000-memory.dmp

Download

memory/4644-185-0x000001FA20AD0000-0x000001FA20B36000-memory.dmp

Download

memory/4644-265-0x00007FF781A80000-0x00007FF781D0B000-memory.dmp

Download

memory/4644-183-0x00007FF781A80000-0x00007FF781D0B000-memory.dmp

Download

memory/4644-184-0x000001FA20AD0000-0x000001FA20B36000-memory.dmp

Download

memory/4984-47-0x000002333EF10000-0x000002333EF76000-memory.dmp

Download

memory/4984-45-0x000002333ED10000-0x000002333EE40000-memory.dmp

Download

memory/4984-46-0x000002333EF10000-0x000002333EF76000-memory.dmp

Download

memory/5504-267-0x00007FF6EDAE0000-0x00007FF6EDFE7000-memory.dmp

Download

memory/5504-203-0x000001E616130000-0x000001E616196000-memory.dmp

Download

memory/5504-201-0x00007FF6EDAE0000-0x00007FF6EDFE7000-memory.dmp

Download

memory/5504-202-0x000001E616130000-0x000001E616196000-memory.dmp

Download

memory/5716-214-0x0000016529250000-0x00000165292B6000-memory.dmp

Download

memory/5716-213-0x0000016529250000-0x00000165292B6000-memory.dmp

Download

memory/5716-212-0x00007FF717660000-0x00007FF71778F000-memory.dmp

Download

memory/5716-268-0x00007FF717660000-0x00007FF71778F000-memory.dmp

Download

memory/5840-211-0x00007FF7D8330000-0x00007FF7D83E4000-memory.dmp

Download

memory/5840-145-0x000002A04B770000-0x000002A04B7D6000-memory.dmp

Download

memory/5840-143-0x00007FF7D8330000-0x00007FF7D83E4000-memory.dmp

Download

memory/5840-146-0x000002A04B770000-0x000002A04B7D6000-memory.dmp

Download

memory/5888-154-0x0000024F45EF0000-0x0000024F45F56000-memory.dmp

Download

memory/5888-221-0x00007FF759C40000-0x00007FF759EE3000-memory.dmp

Download

memory/5888-152-0x00007FF759C40000-0x00007FF759EE3000-memory.dmp

Download

memory/5888-155-0x0000024F45EF0000-0x0000024F45F56000-memory.dmp

Download

memory/6012-163-0x000001A7526B0000-0x000001A752716000-memory.dmp

Download

memory/6012-162-0x00007FF677250000-0x00007FF6773E5000-memory.dmp

Download

memory/6012-164-0x000001A7526B0000-0x000001A752716000-memory.dmp

Download

memory/6012-238-0x00007FF677250000-0x00007FF6773E5000-memory.dmp

Download