stealc | c6a6621cb07e44b76c69fefd3915e0c1d64a6cd7ce477ace8785e81ad2ce7cf5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.4MB
Sample260930-evnevswend
SHA256 c6a6621cb07e44b76c69fefd3915e0c1d64a6cd7ce477ace8785e81ad2ce7cf5
MD5 250ed25aef383a40f7526f42d2d25723
SHA1 cf53e973837233210535894e6597c5426a3cea3d
SHA512 ab96a9f433204428993223f66c79817e63643722bd1d76c5f03d91197ecdf848765424ee58f2fc2187ddaf90456dccd5ea4d78f78caba4642779ef356e8f4e2b
SSDEEP 12288:dibwAEUmeF66je6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:4DF66je6nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1406501353AE0D073E273207108D2D7B56BBEA9B19F61978B7B80177D5F343918A2934A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral1/memory/2676-82-0x0000000000400000-0x000000000056E000-memory.dmp	family_stealc_v3

Executes dropped EXE 22 IoCs

pid	Process
2156	alg.exe
5288	DiagnosticsHub.StandardCollector.Service.exe
2076	fxssvc.exe
5684	elevation_service.exe
2368	elevation_service.exe
3844	maintenanceservice.exe
3988	msdtc.exe
5832	OSE.EXE
3904	PerceptionSimulationService.exe
1752	perfhost.exe
1020	locator.exe
2084	SensorDataService.exe
1200	snmptrap.exe
956	spectrum.exe
664	ssh-agent.exe
3732	TieringEngineService.exe
4556	AgentService.exe
6052	vds.exe
1420	vssvc.exe
4388	wbengine.exe
860	WmiApSrv.exe
5500	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\16a09968227ba850.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107609\java.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107609\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf0dc46f9250dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072d0c86f9250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f94ec6f9250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000028ca63709250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032e4fd719250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004484ba6f9250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7a9e06f9250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d712e719250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f423b709250dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef10866f9250dd01	SearchProtocolHost.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3484	regedit.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5288	DiagnosticsHub.StandardCollector.Service.exe
5288	DiagnosticsHub.StandardCollector.Service.exe
5288	DiagnosticsHub.StandardCollector.Service.exe
5288	DiagnosticsHub.StandardCollector.Service.exe
5288	DiagnosticsHub.StandardCollector.Service.exe
5288	DiagnosticsHub.StandardCollector.Service.exe
5288	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeAuditPrivilege	2076	fxssvc.exe
Token: SeRestorePrivilege	3732	TieringEngineService.exe
Token: SeManageVolumePrivilege	3732	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4556	AgentService.exe
Token: SeBackupPrivilege	1420	vssvc.exe
Token: SeRestorePrivilege	1420	vssvc.exe
Token: SeAuditPrivilege	1420	vssvc.exe
Token: SeBackupPrivilege	4388	wbengine.exe
Token: SeRestorePrivilege	4388	wbengine.exe
Token: SeSecurityPrivilege	4388	wbengine.exe
Token: 33	5500	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5500	SearchIndexer.exe
Token: SeDebugPrivilege	2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	5288	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 3484	2676	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	87
PID 5500 wrote to memory of 1580	5500	SearchIndexer.exe	115
PID 5500 wrote to memory of 6020	5500	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\regedit.exe
  C:\Windows\regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\config.reg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:3484

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2156

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5288

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4056

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2368

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3844

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3988

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5832

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3904

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1752

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1020

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2084

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1200

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:956

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:664

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5864

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4556

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:6052

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:860

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5500
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1580
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0cf896051b2923e357f99b0e02e8265f2d69dbdb7c6733266545b296a622f98a
MD5 17db3d8fb3558de2f28c3f8315aea964
SHA1 46cf82e8d5ca2b22773e54c65b471edf7124b008
SHA512 c31b7488f286bd2a466825352b84b1eb4d9bae124294611bc170494bc42d58fc5311cbce2d43b16cee017be9e3fe6367d8976210ed07e917faad102508f0b365
SSDEEP 49152:Tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxndQ/lFTjN4:x3q6HjB1Lm
TLSH
T11AD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ccb1b04b0a2d54e13584b7ec96be423bb080f46d42a5f24a0f2056a9fe36b7ed
MD5 a08cb86e7d263b9eec55f2553bee0079
SHA1 48545b12b57f998473b1debad5c3e46fdc8f76c0
SHA512 ae7cbb980c8394d158a9f03793bcbbe19e537763cefbe463afa4f666f9deacc436ec1cdabf750e08dcb73b0ffdab8880cd3a5d3f3cbc0d30f597976088a70a79
SSDEEP 12288:T1XLsswWkxy2lRq2czA+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:JXYfDtczA+nQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1B965F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 6f13b96ea1af9c21705a7d31e1a77681521247c3fc9df22a19ad86aea8925458
MD5 5af6ad528a5b829bcc324f18760b212a
SHA1 78392ea47fda591799cebc2401a8b7fc20c4d8b3
SHA512 d634198c81f4bb6237e5b5d8c482010afeaeec209df90e3294655fd8454f8aa2b41c93bf84c55de8fc818c7d0087903ffccb2a1ac807c4f91a1a18e8fddd86fa
SSDEEP 24576:30Le5ji0hmxLrMFnQ/tbw/2Mkjy6Fr7g0oO:3Pji0AlAQ/lFTjN4
TLSH
T17A859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 89c07df8b48a0780da3f8e4c765a8063c5acc961b7fc5fa0927275d6a8f21ddc
MD5 645835e7e9c0cc2bd223eb71321e0e63
SHA1 9ccd93a06ac6bf4d1f21b0f2b97914ba0d45f826
SHA512 811f06f3b5445f54c88baea541690947d00ab6745a954006d35931e237bca82db5b347a2fca7c1155d0e90c471924c0f76c378cb97c75371000e86d026fe55f2
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyujnQ/tbw/2Mkjy6Fr7g0ol:W/ezSC6vUzPvxHjyEQ/lFTjN4
TLSH
T1CA755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8366ddbd63a366af2b3c3a07bb9312c3aec209b45506d50e7c503ae91e312787
MD5 bb6475089ec9933c1189eb99fbaa6703
SHA1 3b66f0afb89b8a5db72abcc0fddcf9cc5d4223cf
SHA512 641339ff221223b341247911318ed3d46aa9486c5572f62f4f60c13350f55708f12774ac6b17b952cafef924361bf822008a6865cdcc127f819426b942a3c288
SSDEEP 24576:WVbqPb88hv/l+6qnQ/tbw/2Mkjy6Fr7g0oO:WVO88hXl+JQ/lFTjN4
TLSH
T156559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 202c53839abb09cf71877979ddba74f5860e5305de74a671685e741a114d6efc
MD5 60d7d24e8de531baebb5783ba81ad277
SHA1 219bf731b6356e32b1394f92ea98adff4c94576e
SHA512 233326f45b5bb7416e6c2583a7c16732bac5e8d8a13817b1b8c17d7391315bed422897f8c71474b296b67989a9c06c373f9be79e684c66b4e5cdc05fadb62d8c
SSDEEP 12288:IzRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:IzhnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T16D5523696A24F897FF2B06B15CC284826B3B0EC1BFD4A74E7744362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 87674b16cc85bf0b480c6430db7b2e8a049e58bf09c8449e9a06cf31ebb647e6
MD5 49ccc4bdedbd384883aff82dca55f3e1
SHA1 afe3a5a86513e3c10d360748babc253f7cce7be3
SHA512 c20679d6916cf45df17b368d361b90a4d665d903d87705f591dc699d7c5a81af006fa50b9bd1212959279238d6bbe8dabe45a69f342774abc3d98e2314a82821
SSDEEP 12288:5eBNUbTVO86USGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:5JIUSnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1A575CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1392b1e89dd0d2d41835d1d2c07a918c7acd75cd605f98e140de778b98ab6848
MD5 19b9bd2397668c5103674a313ea09354
SHA1 e6f52219e62464c9f8946bd2dd81ad22923fe79e
SHA512 ebacafe50b32c3a82645e264a7cb7c6ce6ac583a4ed36809bdf377a8b17974f1c1c2f86d0b6cd70e03effb47a82b1b9bdce152c6a09f38a265ce82ef977a4bd3
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:kQvGAdlCEL8c/yRNw5C4Lm
TLSH
T1F5267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 285a8fbba8c8098a506a57cf888682e3ceb77b5706ac3dfa27a1eec186a56fc2
MD5 ebd1ddc865401eba168d93a7fda57cb3
SHA1 c568f5d0d2bb4a7337406b08056af67e171fb341
SHA512 c1c38e4cdb7826668e1fa9f4bcd22825631f5747d1635845db8f2ec9d6b7efd97b5eebe50fc0ca6e82299295f383dc14da88b933a0b86cc5cb3c3eb401acc0c3
SSDEEP 12288:zAwSfxL/2Dc39DLLmt0LDQewsAjQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgh:sQewsAjwnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T18F75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b987b865f148f88bd2c29cc954b1e3f8317d2dcf25a478e83e2dbb01481611bd
MD5 2878d09d3f8bc2deac2f25fdfb6d35d8
SHA1 0a944f0d8d3ad623977696e307e16ec4f8a9e8de
SHA512 bd0e032c3131fe4fc368417aed7b2012f7ee09e5616ad3bfe080081970433788c57931222f455a269ed85c201a02cb350bf18ccb71f145ee72ae23e59977aed2
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHLL:JUEtQevvqc2W1cpV2EI32
TLSH
T17B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fc36cc1b68ff3c661e83052713974f573e0d30a71eaba04e528099ac06240245
MD5 10175db094075744028ac88387960d8e
SHA1 556dc8b61b0a35d01cd79adf3b4aa9fd446a7ab1
SHA512 f36dd22e42ec674d48accf396749487b798343422a9f79e801504232b6adc8ef3933ca4c0c358e908c9c6b44206612db24150aef7ac23d4c6915bf878d8cd1d6
SSDEEP 49152:oCbRquA/m2yL5zQfFiV+XenmE3/zQQ/lFTjN4:BoqtVjnmcLm
TLSH
T121D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 17c86943a07e0127153adb05adb0211c917546d8cbed1af44379f93bdf137b90
MD5 a5885add96ed018dc0bad50267e2356c
SHA1 e4d3985a081ef75773a3f52007b5e7a26fbf6e08
SHA512 d515234069fc3d7476c0f7a36fea9e90d2578ae6efef2dbf377e0d2d55c14873abb420d3c667267b8d38ae6e806e323abad805d7acee749d66f1de3a2529966d
SSDEEP 24576:hAhGLJIFoiwtA5l7S53XnQ/tbw/2Mkjy6Fr7g0on:hAMyFoiq5nQ/lFTjN4
TLSH
T16C35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ab4872c027cd18a263153a21c16299b9f9803d83e91c2651f36a3fd284c6d563
MD5 b05e0ecc5ea115e82dfb9c315d8b6cc7
SHA1 290e3708f35e903979491546db7ee269f719dce7
SHA512 c1132654f8d6a79953be65e0b86795763cf6a9c1aa2324b4d471a147a1e099cf7cf3431537a97ed0714ffd2863ec893876c3258b0438750fa1d032ddc6d755bb
SSDEEP 12288:3mw5HEjsChN2BFgl0WDm+CTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMU:WwuHOWknQ/tbw/2Mkjy6Fr7g0ol
TLSH
T11665F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c8b4e760e553980c7a60df88242073449f113d0762b19afad10d9d7274d868d9
MD5 f8ae734610f217909e1cdd207f4c0498
SHA1 29a918048d799a2522f8f649d519ee11ea35839d
SHA512 c62721b49d87886321214fb24b3420f21f3eb5b8236dc5e169de48236bf0644556811530de74b8788ef97df3b78c357583a502b90a5bbc8d0cd2044ba45a4601
SSDEEP 12288:nXZ1IyAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:XZuNnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1B655126933A4B0FAE6670278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b1be92b87bee48edebcd3dfabaee6de5c4b80c3ed394b1cecd1de273812c9f7f
MD5 bfff591f4c4e7dfc333e2cc6854685bb
SHA1 a3ff25b1246a3d9cc32b674aa129118d5ab433e3
SHA512 9d6e57176e284f67c99e60c0b5ff69f11548cf375b5d8461f7ac3d07735bb012a116299c73e1c2ec46d28312f9437c3ff13b5251a35a908510f26f080bab33a8
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:GQRQyi36YOcPQLvw2gAf+PN3xLm
TLSH
T15B666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5b126187429b459d89bec280902079e51b48da3deb122ed6a612ffbe04023aeb
MD5 313f3b9c6ed03938bd025874f3c7e9ce
SHA1 af0e1f3d2b3cffbf03fb45fd89c04d660ddb46e7
SHA512 f480eb2059230de3754fbe885bb549aad9b67089579e2c4ca740b3bad8d3baeed47e204f2479ded006c32b3a2e014df95bb979f4e24620eaabd3a4e9b5f84717
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:0QRQyi36YOcPQLvw2gAf+PN3xLm
TLSH
T130666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 35339af35c521285965c1215e7f9c95bfd109ca01c2f56fb5031965ac43be737
MD5 567cc3c2e2ec061a068d2ddb9da430b7
SHA1 468187850224c90329f5a3f0b7e93d9d886f197c
SHA512 9d79a505713fa76e48295a98e6e9a10b46b8432852f0c972861c428f899316137938acf195f04d0b0529a189a8433cc0d80ee5e3a44689ddde290d5f5493b58b
SSDEEP 24576:GwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0dnQ/tbw/2Mkjy6T:Q68Qg55nhheWu7PNU3/AQ/lFTjN4
TLSH
T14BB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 68d829da2adff954787f6a3874e0e99cbc3203ebe97350d91cd04838475d9cbc
MD5 9d728dd71a375917167c2feb07cd5718
SHA1 e6a5e590da83220233c3c67ce49457d04493f8a6
SHA512 cb34246ef46861317811868ae5e306d6405f0bf2112b01b96fe5eac7a52f117c0dd9f32514df58783ecda45ac719df2fb0fc5b2e6b8a7f7bc1e09ec12c83ab1c
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99W:Xy5112gYy5azzVvL69nLKnhZGLm
TLSH
T11B167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d750903463994922785f9e8a81179a75329af4e3e33af245ec0645046d06aed3
MD5 29cdcc74619a8c5e2146a3e87b7b1443
SHA1 af7ae2b46402227ae46ec505ca19c7afb003b7cf
SHA512 1c438e91d51913290f7386ccb5552c15a444cbce02eb517731b06b5c1e390e40dde6a261d3131e8c3b999ba446739c7502303a7cef68c1badef7a06dc9febcd1
SSDEEP 49152:0B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glOQ/lFTjN4:uu6JmVxd2dpLm
TLSH
T177D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ce3b51c1a040c068c74cc2a6142760944feefa963d95c620391f9e81fd53f6f4
MD5 5d15853e070fcbdef512d3218446d8be
SHA1 9ce7eadb59d7db114eeb9da64969b6c451dc9341
SHA512 5450cc6fcf9458c56a2b0d38e94a8c4dc4c9bf482fe8f5f431a40158d581f8231c59eb01b1c376ef8ac88708f0d306f075ea54bff29b1cf47f21447448c3d2d7
SSDEEP 49152:o1hpsNoJpF1A6UU44CwH7R4xyQ/lFTjN4:omifPbRcLm
TLSH
T13CB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 05fb2e40914ed7dcf5ee32e75d28bbfcb9b911dfc2e728c8d89033352a305b85
MD5 8e042be8debd1305173f51ee23cb8e22
SHA1 19a426484c7e36439e2ade53bb434d47dbf355df
SHA512 2347e8841981e239068438cb9c890536e7b63b2b449d7ec638237875cf7f977c6a1d8e304b9f7873149c70e140a7c07a7116d394086835a8040d44817c8fafdd
SSDEEP 49152:8SuZQIY0Be2KRRVtOnks6NMHqNQ/lFTjN4:+5dKTi61CLm
TLSH
T10EC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 26ca3c946657c03591562cce4795a823802b4562d32485d751bebf5ad3da87ea
MD5 3d02053d0d92b2071ad751adc027687a
SHA1 40e0283991055ca5d32c8abc033bba2faa77839a
SHA512 03f0a02f91c063595a96b69eeffaaabbd6fa31c46cc47645578d6cd242404e852c80b5ae5c7c26a2ab196d7c0db5ac9305630c7d83b73be6e2a6dbc0cab9d614
SSDEEP 49152:IhtSn8EApI0figngiDn0AP5w+Q/lFTjN4:ZX2iyphALm
TLSH
T12295BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e870abbfafeac2ecb5540fd93b19a393450abbf51b3e8ea19d5261711e7eea4f
MD5 9ce943df4ce7cf6b2d63244d97e898cc
SHA1 6c6cfd63a83192c9db5faa9718fcedf5de7b3347
SHA512 5e18521d4015e7310eb4df92655a17fda69d4529f125750eeb40b981da00d2fae5b3b1e6ff289dc78dbe523cfd8593df8ef982f8776738c22189f18c2b71f83f
SSDEEP 12288:A5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:AJnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1385523697964F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ec8cae0d59923cc60ed66bc6d28211a8149f958d92456df6a98edeedbba9a079
MD5 08684c26f1ec1747a1d7092f979b42ac
SHA1 c0d1e5373229b601e0f2174a8acb1a8f51343899
SHA512 49f44cd059abac57a7f6307fc73073976d403a85295dfb98150eeb44b257c77204f61f950afe4289e548659786536b1a3ff2bd9baeba630257df621991cce3f4
SSDEEP 12288:b8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:b8nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1BC5523697964F98BFB1706F14C828186A73B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 facb486839dabbbd9b1df16b5b4faa41dc5e0493a46c5f7e2f4fa167465fdace
MD5 fc2792e8123126c7fafb37c3701a2e12
SHA1 7c12b108f02a3ed92c9217f1579a13e6564bd2aa
SHA512 3d802355843a53edb45bd88a2a2bafdacc5e5b27b0ee99feb73e3ca161d2f4a675a5ad0822e2d6326af0fb6c96800af32e9083521026ac5e93d7e0a04e2cf4de
SSDEEP 12288:q6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:q6nQ/tbw/2Mkjy6Fr7g0od
TLSH
T1FF5523697965F98BFB1706F148838182AB3B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 cbe23456b365f8e821add419ea8981650667d807ee587692dfea8bd19996482f
MD5 209d2af083e338508104dd9c17115f7d
SHA1 7f5600a9e8ea20044218f5179a2df30dd30bb930
SHA512 7fd692243797f13187896647ab6f0eca4aa6315bda9b7b1ae66d13b064b37b7366c749af1dcd89847b80ca4f791b11f0934eabb0cc2bf5d063f1b3e87918f6ff
SSDEEP 12288:MVXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:unQ/tbw/2Mkjy6Fr7g0o+
TLSH
T11C5523693A69F4C7FD2742B4CC928142E77B3DC6BBA1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ed6b010ae01dcf9e49fe03b4f515bb8301b08d53fad0f7b9c7b2ded1948454a0
MD5 97bbceaa87cd7e8680ebb086b27bf2d9
SHA1 53b28966e9b5cb7274013b4e887f4d10b19d2734
SHA512 b6fba95702038f9052215c03a778a3eafb2e11ff70c9d547eff79f209d3143b033d884466e84d39b696d5f633c8b3f515c7c1298dc9a3401133136a64abc8a4e
SSDEEP 12288:jPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:jvnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1E15523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f06a92b3e732f55b49977a139b4d537e318cc336ae3a2324ed2edc9b05ffc8ff
MD5 a9f33c22ee2ea39e34c3a050b60ecf8b
SHA1 0d33556d23959eda514512b41689c43ccb9f42b8
SHA512 ceb9f098f18d0f61c1fcc51c496b3c6bd3a6fb51ad24c26809f9fdf4e942bb5cb462d2f8953cc28431ea978d062c596d48a9ce9508c8c244745315dcc1cccaff
SSDEEP 12288:RYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:RYnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1A35523697964F98BFB1B06F14C828186A73F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 fb488125dc52d9eea0d7104f4db608024ff6f641b57d9cb85c42db4f3000a579
MD5 d414de113387c543b19b4f91efbf1aa3
SHA1 a97821ab5a45174002221c7632a5b082b07a0d09
SHA512 fb7cc90429db34cbc822828d70344265a7fdb34bdcbd2225559e61aea465bb91cc35c8ddb7e8468b8b3e05e90c4220a5cb367f17eb6a10c651fcd2f31acffe15
SSDEEP 12288:XUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:X0nQ/tbw/2Mkjy6Fr7g0og
TLSH
T1965523697964F98BFB1B06F14C8281829B3F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 1d8c408a9dfc5501802ce81c2b95eb73f01cadc06e201bb1af12a1b4a94ac059
MD5 b74391d0e53da20854fb70f4333154fc
SHA1 2e3245a82a6679e5f71244ce32387c0a6b5d2cf1
SHA512 626d1100c25c29e80e53b81965d93f2c69dfec662ffa2b1f5017691681df7460f7e772ca280d5ea47a5b8667d3b7994eb6a4dc5e52e4c7401682baba13b0b576
SSDEEP 12288:3iZwbDzzFEoS2cPvycGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:yZM3zFVSOcnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1087501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 efba9c6afc331c80e8399be63be3259f81a93e5b6be290cb9e0f1fd837dcf4c6
MD5 5712b952aa1729f769e085f4cc997235
SHA1 309ba9eb6e6f195275fb82b92c25db027bd32fe6
SHA512 415efb5924818834597508e195ff02781cd43e521c97221c816a1a7ef429c7564e6bbdaef84d37d404419ae589501c8688412c783fe0a7aa83e2fe76aa77fd3f
SSDEEP 12288:6dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:69nQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1515523697964F88BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8248e13a645adb23287825dabd07a57ea38c71a147a9fff1093aba30826e9f62
MD5 1f7db9c0ac1f264f9cdd2b12dba93404
SHA1 e344aaf2f0f59c5d6a41be54e2cf7ceef3e8f4cb
SHA512 452d624241523c289342998e3f33b4abb6b18912686f28cd57bfbdf00f0225817de9df306419819698be62a725a4a7af42a90283eba30fce81282225a990fa49
SSDEEP 12288:bBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:bRnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1CD5523697964F98BFB1706F1488281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 2fe36edcc45f845646726f65ea46f65e3bf626aea97c34be334b62553a8ac7d0
MD5 9eb17405add31f8349a1c64ad871b06f
SHA1 ebdd3c0d5865eeebd0b91e4fad76c209e86df153
SHA512 b4b74d5c559f2f9051249e74cd072445f16cba46d6ecc0eb8c5ba047a3f2e63b9e60e5152f133ba6bc29c506c11aee10672195da7e461aef33afb69b38b25422
SSDEEP 12288:5yPz5L8AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:4zygnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1AF65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7beb879556c75548947d818892f3ce254359309dd037bb14a56c830c266a322f
MD5 71304ce17e8810d3e1d89e3c4966ab8a
SHA1 4d1b974f267c76f787de7c0280801f957fd6457b
SHA512 a7e3a4fdcde9cb3f5ad5a6061ffe3259ba5ef476f92e72a6c632339f85a6ef26264bafe3bb0f9450df4570d4ebb756c8a55e24da4f8400bca652897adc0408bb
SSDEEP 12288:LdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:L9nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1925523697964F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 58d23591d8ebd0fe43470b109f741c4441b773219e4901a8e4fef2e71b5002fb
MD5 2cf939f25977de780388c316cd50dcd6
SHA1 cb5a0b93fe5744c54c8db63de2f2586d024b0c79
SHA512 730cf053ef5fb3e38e8ab44fbfa42073a48c50483d26ab90d2a1039def82b7df04f1cdc3a4c4cd788c11ba54ffc5ea2c9b7825c4700bd40e1d27e55292fe0a5d
SSDEEP 12288:bdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:b9nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T13B5523697964F88BFB1706F5488281869B3F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a1d6418e211204db8891301eb0ab5e4a5a73c254ab6eebdc8e581e02d51a7bb6
MD5 9ed13c04e1271122c1e97821e4429460
SHA1 2298362d94edb0f2430e4311fc6b26aceec8ee97
SHA512 b703b88f84fa7c6208d575a56bd07b0cc648c3e7665bbe56af753bb2907a53fd45cd141cb4f9f865dacb146d638d508111daf8033f3918001333384f34362ba0
SSDEEP 12288:xyPz5L8AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:gzygnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T14665021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 f624e8dce95bc13359210fb91a6cdb860c1cd9d6efebda88c866f58da222a9d1
MD5 06875e1c729a3def9a23644aaa43a8a4
SHA1 2e05587405fb0bbbf1497042f3bdedf43b4b0c9f
SHA512 89fae1011914f78decd3771c51dd5aced3d38635ad0418e4e9c67d88e042ecd55d6b4c05f9a7a1e82742594e81b67487d4e17ac5f2b499b61b02a07a0e40f610
SSDEEP 24576:qcP4mcvIjkGOxhKP2l71nNKbrh/8KBVnQ/tbw/2Mkjy6Fr7g0oG:1P4m4IpOO67W8KTQ/lFTjN4
TLSH
T12965AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 866cf25f1fe35f621f893a08beceabe6b7ef5b63f9e5480c64c63c35fc589401
MD5 0d71eb7d05f4f0d42824d5c3be507831
SHA1 674fc7af155af4f0bd71e5909a6b6c3830c9d8d2
SHA512 a695cc2e40951e69b39748240f33839ee86b6d4635ce512e33724a790070272a8c9c8d1c212d3909d9877045716df6944bf26f5d37a8a9ba7b931ca5749a5b4a
SSDEEP 12288:RssftGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:5NnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1E265F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0b956274a33c1dad15a30850cc3063b49c2d4590ca0075d509a8a2af346a3c6b
MD5 a038748fcca4faf0636a05166b35b0fb
SHA1 2615d24cc8a97ee62dd25d06759079bfc6e4b9fc
SHA512 c6bf4f534d434f103924f4bbebdeb061eade22d5fd532fa618696434eb801415832c1a7b8f66244672af8a5dee9e30095d9ea8b5fc70b7c5723068eb1403cb5a
SSDEEP 12288:JNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:JtnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1D15523696768F94BFA3B06B05882C151673F0EC5BF90D38FBB08222D957C3D41EAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0d67f6f322bef4ab0cd05886b398c9ea1d5d40888d4ca61b8e1efe434a2d327c
MD5 cf646bdef9aed5e12cd9dd3e9eec38ba
SHA1 cc08fcba9962fda60eddd6b7b4673ea9f20d02da
SHA512 8ea7d3f3e07ed0e34be71fa467bcae30dd5de0ac45e4ede3ff9d2322a9735a3d777fb9f054eddba64880ec728b662edbfc82eb328e91e8b954da637504a08190
SSDEEP 49152:Ua0h2GEkuAe73q3pp46zwwQvQ/lFTjN4:Ua0hNYG4JwLLm
TLSH
T1E9859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 980c1cb9d06154a32802dba609f14ad923afedef60d4afa7ac635517515bd80b
MD5 3752532cd80fbd73367b95077450609f
SHA1 4f1ae9197f3361993a0deb392f219f95a21da0d6
SHA512 e4539d36626560718ab770f39cfe5a544bde63f30ba50917552cd76b16626d541e0f81c62c9bd2447d8250714a83e597238b54ff2e292611d4298cfe9644e837
SSDEEP 12288:7hbHjfXMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:7hbHjPMnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1A355027D26AC30DAF63692BD88928546D7327C552B11A3DF2381423D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 97f11658e5c40e7433b8696e144f8f07d0798ad41910ed790e77b05740036c7a
MD5 27f99080cb075a6ddedb17a327ce1c72
SHA1 2755c104e7a790226cd88b019363b6baa0534072
SHA512 042580c82cd5aa2a621f2e0b5b73d40ff092ac296d683eb61e53e5b8efe0103b093d7ae234521813860d61a6283f8075495d627a4643a41c9799468329fef758
SSDEEP 24576:e3YgnJcRTk4yti+R5dBR/knQ/tbw/2Mkjy6Fr7g0oG:eIgnaTk46pBR/kQ/lFTjN4
TLSH
T16645BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 99fd27ecc4dde4f234c50608e9b5a4e964027026fdbb635ec59946533276ab6c
MD5 ad297df71253dfdd4284bf579bd3747f
SHA1 e1fc6ccea49a7a690aac7cc14899999e233a934a
SHA512 fec5721344eedcc1dd68e37e9e14fd299d4815f7b85be4a33b34253a73ddff7577dcb2f2f57daef6d47a9aba7f4d210b679b8a507fa6851faf79b05e93164d43
SSDEEP 12288:axGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:aBnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1505523687614F98BFA2B06F54C838546673B0EC17FA1A3CF7B482129967D3D41AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 41e44e0ee5919407ddc34848ba57d910e1a20be1ff1d82f30fe5ce099fe3f7d5
MD5 1f7e7bdec12925678412bdb4ac18b096
SHA1 124b1595a33113580314bd19acf07303db6abcc5
SHA512 12751c4705e86a8c20441da8f7ab10a64e79bc15d7919f05857683fe89e6ca223d276fcb52d7c18882df6f03aeffb30bc098da71b7009b8d6d56df001ef9ce68
SSDEEP 12288:LOb4A4LWOsvAYFT+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:UwL3UT+nQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1E275F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 77f4473191d295520ad74e855f3d39b648bc5e3feb5317212a11df7698830d39
MD5 333de98327d4f904fa7cb2e5ef63091e
SHA1 04e8969f136d5fc67cc42ec332b5351d31ed94bf
SHA512 7990443b5e5594d2c8ee05c0ff4173599786782d2217f9911ef2a389c19535bbde09eee115556ed3b1cc750e0bcd3ef3292fbc29b2d03975fa1d580b454feeba
SSDEEP 12288:HpFtCOyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:0OynQ/tbw/2Mkjy6Fr7g0oo
TLSH
T12C55022D36EC60E6E53A527D89838249D37278921B6253DF0780817E5F77BF81C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6feb44348073b27e1eaf94227996f06fd63764024da393ab1dd81bec392c655a
MD5 98bbc7b8e431417214b7d7a71eaa6282
SHA1 e83ba33640829ead476226ee722c893ebee22e67
SHA512 0cc6ebaa1630a062547785f0448ff58d472f1cc8d557c83941b715b98d82ecad136600ec012e44193812db84963f233355f958c9e43716494ad6ae39723d70ef
SSDEEP 24576:y7NM9YqZqmWMUkPjZM48Mv6bEhs9nQ/tbw/2Mkjy6Fr7g0o7:y7cBWMpPjN8DbEhsQ/lFTjN4
TLSH
T1D1659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f4f3255dfa4230d2fb0d92fd2e869cdf3921942dac0a2d064756feb0265c3375
MD5 818c15223e9370d93c5be9581deea4e5
SHA1 1c5c667f8a5f950f63ebd4762f0c5314aa549a31
SHA512 d6b7f106abbc98c5c7df4553722fd7f6ad21416ce443b9840c395d3dc287f7d65a89abc4f1ce4fad91a278219930b8fcaa718b8effbafa2e8211c3c85ead1d15
SSDEEP 24576:0W6BApg2YuyuNDYTabvcdvNYf8km1bnQ/tbw/2Mkjy6Fr7g0on:0F2YuHNETovAvNYf8kmdQ/lFTjN4
TLSH
T1B3857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 62bab57b10d9fdee184e409a505b7266f412bb0a37d58349c5845d134a713add
MD5 4d927a2d9cb4b434afeedf45ba205159
SHA1 4cbbb2ef29a387f3f4194ee404ce94b6571b4de4
SHA512 5f80c47aefed471d9f177a84c5ed482ec29e8282f72ae6c8067abbbff06b09fcfdcc9aff0b4c9eebad3b1b283d38b2e5b95bc35abd7d66337772e3590a7501f9
SSDEEP 24576:lAFs06+Omlf3NXEbToGnQ/tbw/2Mkjy6Fr7g0oF:qFs060lVXuPQ/lFTjN4
TLSH
T12065AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 9c2cee3a40f1c274181d13448b5599e60dddb4c21556bb2326567c5fe9dc965b
MD5 b6731911e3a3e80dd424c55235ffb83d
SHA1 065ac00b7adb6d44563b375519d04e6797b8c791
SHA512 53e22c194d7a7b80fc2ccf7bb8d3efd3b152aeade5366a8fc406da7ecf5668347d62205437d57d2e350c89de19a7dd6f555a93365be9d53b00c3ac18738ba6da
SSDEEP 12288:TCJnJ5D3Vkrqzx9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:uJnJ5D3WaPnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T15275D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5e211530cfe611c2ca08aadb612d6482c3861a9b394fbebaeb4195fbcc8f8fd7
MD5 305cc8a27eb18d5dfcf91abc467be45b
SHA1 10e0fa731304e65110f1fd20cd26107df7ff9dbb
SHA512 149de8025d802db48266200c01418150a272f9c77b88a8acddf83cd40506d94a15ff033ae247861d0dac0021da149efda8b6ebe0f0fc04c6d88ccf39d383db14
SSDEEP 24576:bEPghm6/7IIXdwcXrif7qQncjlP65i3VuknQ/tbw/2Mkjy6Fr7g0or:cg06DIKdwc+eQnSt65aVJQ/lFTjN4
TLSH
T1D4955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 5326d7cbedc957ff91331e6a711dfd3ef4eb4fe55836c197a0412c84cb525072
MD5 166c769d4dc4c097f03990aaf0229f22
SHA1 59f3bc40ec72bb6c116a850e09164b65cc15d5de
SHA512 d8bcd5a582fa138d32637d3170f153df85b8c531f3482d364955be2408e3b5a03bfab52f49ac887c9a31dd74f88390f9cf3fd1c18cad7ea8f2949419268e02eb
SSDEEP 12288:yEP3RSTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:xSDnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T13E55126D37ACB0EAE52A517D84918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 1af4e50e9d2c137d0f0aa25ee3ddf3bd5285e67fe1cc06b4512dcb7241edf55f
MD5 ff8d084b15d7736a4972e193964324a5
SHA1 64ae1bbb1180ba6208ba5c466c051f792e226909
SHA512 0156161882ae95b623370f4051b44fc21bb6842aa1fb0c9f9eabcb0b22c1c82cb97101bcd4e2cead8978984a498b895a44c312add1977ce5ac804fc527a7541f
SSDEEP 12288:Mjky8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:MIy8nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T16F6512186398F4CAFA7A06788DA381919B367C506F2193DF6280F23E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 89fc4596233f877aa9ed169f1bf50b15de932cb6f3d45116367cf4635d7279ce
MD5 d6b8458424c1d70af7a4b712b4b58634
SHA1 d3a0c258b0028c4eb4c2bc6488eed9f0eeb88503
SHA512 357643578cb4894d8ccb67db6e8899aaf088b3af43a3a3a857d538019e523c235123908b8d30baa7909f87c7ba9f9613ca58a97911e814997c37ce7b72e362bc
SSDEEP 12288:a0iGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:1inQ/tbw/2Mkjy6Fr7g0o7
TLSH
T18455236C2665F88BFE2706F448928542973B09D17F9163EF36886239CB7D3D416F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 cd7e4f4000e6ed62a1a07dc5f99e11cc8195f5e528a9fcd95625df48654d8f2e
MD5 e656b5ec621631ffb00323007942a9eb
SHA1 f809c516c3a6c48e4862c517d6afda3abbc6a12b
SHA512 8eabdaa38cb9c7a889f81901c84af36209889ff7635321938cf093b41f7f4db6ba098a72cd960e44a39feb830a338e37a35c305b02d07b9e4df970b8550efef5
SSDEEP 24576:bQ9MxZKdcz9dw3lnQ/tbw/2Mkjy6Fr7g0op:bVKZlQ/lFTjN4
TLSH
T131558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 f467cf77b88b3b5f3cfa90664abd0bde7abcc92bb81becc685a8f38b7540965f
MD5 ecd06825f076bab51a76196b5f45980d
SHA1 df9730ce3acc48d70ac9124a7a536c66f5efbce2
SHA512 e376e6003219565928380aff94e747f00788c7f879ca229e1cc4bfec569c7ab79083425ea7a9d83141966ed2fc49a26369f8adf139d31a0db9f1a704abc89ede
SSDEEP 12288:DyoKo20Rple9pQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:DyocSApwnQ/tbw/2Mkjy6Fr7g0of
TLSH
T18065E01FBB6990A2E136813C88818745E773B4706B6263CB6691C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2e6b0e5e932736d85ca5b52470be27c06c1ec2a91b30c2cf3ca7416f67d42da3
MD5 0c81cbd9e0917525e0b525a644c09c5c
SHA1 2cf250e36a4672c43080779cfb63a0142c6af3cc
SHA512 6d92f77c2ad2d448444834959433d0fcf7eceaa8a739b28cfccdd82ceb79b2592d647a1c3b225d65328df73020ef6a0dcd1024a80f972d880916edf60a57b8a1
SSDEEP 49152:EWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKwQ/lFTjN4:u0zuNIZLm
TLSH
T1C1A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 74f3c1721226ba437cf7e42e877204fc06f458eba2e0c5087e6cd064a918dbb6
MD5 8153acad2e10e3110a5e0b002d48d04a
SHA1 64f189dd650ce16d784d081bd0ec442889861169
SHA512 044e2e9ff95149191cba4d459aa84b0fd18269aca58a36002d65f6a9ec6a7e6e7f5661b4fc2a879f2d6d92ef0ead0c21febef4b1c4edc9f7e0afd6f3cf2ce065
SSDEEP 24576:n1QT7EcpfxR+N5AWAz3ooiYtjMqbDnQ/tbw/2Mkjy6Fr7g0oI:aTDxR+N5YzTfjMSQ/lFTjN4
TLSH
T1A955B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 42fb9f4adf46d5546626b6ce775c4670dead07e7b529faa05798f6e518817912
MD5 5371f0db0970dde7735643c6d769c163
SHA1 3672689ceb8a3ae4708dba2ae0f5ee86d0805147
SHA512 fda6864499478af8b91f966be521f05b4d518c2aa9c126aac217a667e71e994c2bf25c98459d4287fb7313d584eca90dcbdc01079a9c317330a4120d0bcdb4bc
SSDEEP 24576:XTMdOz0FFS+1mSL3nQ/tbw/2Mkjy6Fr7g0ow:l0K+1mSL3Q/lFTjN4
TLSH
T1D075E17E636D14E5E53BC27D9A438906E67334A20321A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 795f456d60d55e4a13966b0d0fd75b29714fa1867d7ec1f8d747e604f670edaf
MD5 ae1fd2efdd59275ed7bbab4fc547acc9
SHA1 df3348917c1436b766dd29fa215277a8c2f70e69
SHA512 a11333935f19be3a716e7e5844a7fd03ff080e10834271605e7ecb1581d46edfc50241c85e9a904d0ff7925ad076b5bcc846c55219edfd7b4c38260d6c43da94
SSDEEP 12288:14T+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:I+nQ/tbw/2Mkjy6Fr7g0ou
TLSH
T18455122D23E8B4DAF93752B48962414697327CA2276167FF36C4C23E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/664-130-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/664-140-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/664-359-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/664-136-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/860-164-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/860-367-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/956-123-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/956-338-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/956-117-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/956-126-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1020-163-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1020-108-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1200-114-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/1200-308-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/1420-156-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1420-365-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1752-159-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1752-105-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1752-96-0x0000000000620000-0x0000000000686000-memory.dmp

Download

memory/1752-101-0x0000000000620000-0x0000000000686000-memory.dmp

Download

memory/2076-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2076-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2084-361-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2084-167-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2084-111-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2156-104-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2156-12-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2368-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2368-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2368-139-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2368-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2676-0-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/2676-82-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/2676-8-0x00000000022C0000-0x0000000002326000-memory.dmp

Download

memory/2676-2-0x00000000022C0000-0x0000000002326000-memory.dmp

Download

memory/3732-360-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3732-143-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3844-54-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/3844-60-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/3844-65-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/3844-67-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3844-63-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3904-155-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/3904-85-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3904-94-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/3904-91-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3988-69-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3988-145-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4388-366-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4388-160-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4556-148-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4556-146-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5288-25-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/5288-16-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5288-22-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5500-368-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5500-362-0x000000000D210000-0x000000000D218000-memory.dmp

Download

memory/5500-168-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5500-214-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/5500-198-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/5500-290-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/5684-37-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5684-125-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5684-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5684-31-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5832-151-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5832-83-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5832-79-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/5832-73-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/6020-394-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-378-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-404-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-409-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-410-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-380-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-379-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-377-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-376-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-375-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-374-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-373-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-372-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-371-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-407-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-408-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-384-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-405-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-403-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-381-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-388-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-406-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-389-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-393-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-382-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-395-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-396-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-397-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-386-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-398-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-399-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-400-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-402-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-401-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-390-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-391-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-392-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-387-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-383-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6020-385-0x000001BBA9CA0000-0x000001BBA9CB0000-memory.dmp

Download

memory/6052-152-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/6052-364-0x0000000140000000-0x0000000140147000-memory.dmp

Download