38008836e75a6302e8a1a4ce966eeebd32504c115babcb8c22d581a22a545be2

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
Size 1.6MB
Sample261024-s8ea1avxew
SHA256 38008836e75a6302e8a1a4ce966eeebd32504c115babcb8c22d581a22a545be2
MD5 3e8bf2913931b22ede8ebaa9b98b6d14
SHA1 ac47fdad0ca3fc0d686d0a3715b6a201c6a14e86
SHA512 a722811835356e0593f76e83e1347f08cd2206ec58d23237e500328f82ff914e25ebed1ac6f366a29a30e78d2b8a0d1bb6d35dc8d6a50caaa7f4eb40793327b4
SSDEEP 49152:htCXoPqjQx79G1poWl9ddLD2/s8+tgauhwbR3P8wT8:htCXoPBx+b3LD2EPgaPJ
TLSH
T1D785F04C3165C07BCA930FF285E5CF231014FA813B27A52EA6952E997A31E964BF7137
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1352	elevation_service.exe
1048	elevation_service.exe
1984	maintenanceservice.exe
1832	perfhost.exe
2208	ReFsDedupSvc.exe
1028	ssh-agent.exe
3512	AgentService.exe
6064	SearchIndexer.exe
5920	OSE.EXE
2700	PerceptionSimulationService.exe
3428	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ca42ce2eb68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0001000000009323-259.dat	upx
behavioral2/files/0x00010000000093b2-260.dat	upx
behavioral2/files/0x000100000000994e-262.dat	upx
behavioral2/files/0x0001000000009cfa-265.dat	upx
behavioral2/files/0x0001000000009cd2-264.dat	upx
behavioral2/files/0x000100000000b972-290.dat	upx
behavioral2/memory/2700-293-0x0000000140000000-0x0000000140189000-memory.dmp	upx
behavioral2/files/0x0001000000009b8e-313.dat	upx
behavioral2/files/0x000100000000a04c-316.dat	upx
behavioral2/files/0x000100000000a2bd-343.dat	upx
behavioral2/files/0x0001000000009369-342.dat	upx
behavioral2/files/0x000100000000a1d0-341.dat	upx
behavioral2/files/0x000100000000a0ca-340.dat	upx
behavioral2/files/0x000100000000ba3b-339.dat	upx
behavioral2/memory/3428-320-0x0000000140000000-0x0000000140278000-memory.dmp	upx
behavioral2/files/0x0001000000006211-314.dat	upx
behavioral2/memory/3428-454-0x0000000140000000-0x0000000140278000-memory.dmp	upx
behavioral2/memory/2700-456-0x0000000140000000-0x0000000140189000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f5c5b20cf63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005cfe131fcf63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eade7a1ecf63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b46a110cf63dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f86e41ccf63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000008fc5e81ccf63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1710f49cf63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060f6091dcf63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1352	elevation_service.exe
1352	elevation_service.exe
1352	elevation_service.exe
1352	elevation_service.exe
1352	elevation_service.exe
1352	elevation_service.exe
1352	elevation_service.exe
5920	OSE.EXE
5920	OSE.EXE
5920	OSE.EXE
5920	OSE.EXE
5920	OSE.EXE
5920	OSE.EXE
5920	OSE.EXE
1048	elevation_service.exe
1048	elevation_service.exe
1048	elevation_service.exe
1048	elevation_service.exe
1048	elevation_service.exe
1048	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4324	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
Token: SeBackupPrivilege	2208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2208	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3512	AgentService.exe
Token: 33	6064	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6064	SearchIndexer.exe
Token: SeDebugPrivilege	1352	elevation_service.exe
Token: SeDebugPrivilege	5920	OSE.EXE
Token: SeDebugPrivilege	1048	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6064 wrote to memory of 5272	6064	SearchIndexer.exe	98
PID 6064 wrote to memory of 4400	6064	SearchIndexer.exe	101
PID 6064 wrote to memory of 5684	6064	SearchIndexer.exe	103
PID 6064 wrote to memory of 5384	6064	SearchIndexer.exe	104
PID 6064 wrote to memory of 252	6064	SearchIndexer.exe	108
PID 6064 wrote to memory of 3740	6064	SearchIndexer.exe	109
PID 6064 wrote to memory of 5996	6064	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1048

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1984

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1832

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1028

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3512

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5272
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2960 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5684
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5384
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2960 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5996

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5920

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2700

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 78f182b17074391f91a3cc6677d9ba3fad34786cbebc711f6ae70de14e10ff62
MD5 2538d21a32717ae2dbe354594084bbd0
SHA1 8813d8e67443c1de46637a8d26b475d53173ab8c
SHA512 0780781a1c5a84a641838cead407e5f6019184ba67a565dd6a6c62f3685aa8c586182a91f4b627fdbed157d0dab2dfbc0bb0be6ef9a06ad81541a4b874c01657
SSDEEP 49152:eb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnq+tgauhwbR3P8wT8:g3q6mjB8gaPJ
TLSH
T1E8D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 4a1dfd3ed765f00a7b8af6aa709d4ace8eee4c085e8f94a31136815708a6e3cb
MD5 e0a02310320b0bf52c1f3004b40c377f
SHA1 96e99c55d83b98d258f708e1d54d463da123e044
SHA512 adb2bd56acc72112f44246b95e9063d8a78c24c72ad5793d01fe94ffcd7b17886f2acd38ea747f110a96b5915884a8a2c6020998a85bc51a5108a69722bcd5b3
SSDEEP 24576:uXYfDtczAF+4ZAgayjhwbmY3MaReFeDvSP3b:ttcw+tgauhwbR3P8wT8
TLSH
T12F85F128B3D408F9DD67823CCDA28511E673BC9547A0E78B03E4AA654F736D84E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 fb1731c8942c42e961ea2301abac56f7a5c9374f4ac74125083b82f322280780
MD5 9585e510bfd4a8152de72581feb7ed3a
SHA1 54ed116365d3e37a06dff6007c8e95427a753074
SHA512 ae860af2673293419434f52a9c66a9adf4320c665721623b733fb36cc3434e0c4843099f794a07dd7c9e4b15f9108a8b90a880543abfb3e134dd34b26228c44e
SSDEEP 24576:T0Le5ji0hmxhrMC+4ZAgayjhwbmY3MaReFeDvSP3b:TPji0Azv+tgauhwbR3P8wT8
TLSH
T1EF95AE16F6788335D073C0B9C5D2A69AED7134821B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a99f127d6503c377a95f3569e3f48165cf7a04d565b4dfd2488648620ed6ed17
MD5 b8d0eedb24adcab6b672130ec67934cd
SHA1 def37af9cee714c6f8cf3654788dbf351c3f9900
SHA512 d9a51dc256132d5192175e68ac3222aa59a9dff833f6bf007f1b46142d1378a9c8cc00495aa69c229bcb3e39425360fc8e38948f5c6521237309c54cd7d405ef
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWj6q8wyuA+4ZAgayjhwbmY3MaReFeDvSP3b:q/ezSC6vUzPv+Hjy7+tgauhwbR3P8wT8
TLSH
T129756C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 90940980ccbb59715e220270285ae8f2df5d178146c8fc9b54a1f5491d6b5cd1
MD5 5f64bc8e7a3f5e36a2790961ccae0b72
SHA1 7d12fca3856b825ea7e40ee7ce1a38536ef06ab0
SHA512 b76e7b33e0f250301c416b78fb6ad7f6b2c038a2cebff87559a37323dc94aa49352995d02cd77dfe77e2370f62232fc8b11873cf88f928d0da984ad5d3e2d202
SSDEEP 24576:EVbqPb88hv/l+BZ+4ZAgayjhwbmY3MaReFeDvSP3b:EVO88hXl+P+tgauhwbR3P8wT8
TLSH
T148559E66F5748331D073C0BAC5D29A9AEE3234425B318ACB1246D76C2E77BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 458c278b85c862cae71a4fbcbdd0c7ac30205b590613d819b3ade303dc3f1dfa
MD5 5e62f67509e23e52c1e80621af8d7f3a
SHA1 3d1ce1f6a323a444db925c3e98836ba953783394
SHA512 b3905b248ba54dc1036f25ad6186ba001102df9a534b4c6395e838ef1b76f47118b1df1f0a540bac2ed2c4933d7e37f9991eef467d996f5e0b1ae0e14fea1f4b
SSDEEP 12288:iGveH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:iGG+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T185652381D34C98CACB7B0B348B7A0D606699AFC51E85A504E5C97BC9CCF0DADC6B2395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 9ae9a3a0d4217896bb183b11752e176b07681141a1a3735c1e9c9d5a58e7a75b
MD5 71dbe29d8760330d2e4562536333fe54
SHA1 86a87f95540cf3ae54a67a6a85422161c2a06a5d
SHA512 dd906f01a80884ae855f57f4b6204387f2e7a2ffc5092defe6a2d5064bfde29d8d40b13003aba6cc160f63e9c1f2715736546bba2cfce65206d76ca10ba6477a
SSDEEP 12288:8eBNUbTVO86UgeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bw:8JIUR+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T16C85CF7BEE28FCD2C27E4DB85B918600A76278704F52A3CBD165830EDE235E54E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6fe4e8e7429cd0972bc69db7c5a86ac965aa5703f25e538c02b9f08d3765d4cd
MD5 ccf253c8325abb6f7d7b0cfb7ba5aa8b
SHA1 edcc92034ce4068cb5c43d554a37c90fb0f05c79
SHA512 3ededbd47501330822d3c6d2c58e5db3fe233ffd50043b9f1c0bbc6a09fdd2ed0eb15acde808b9bd9aac289031793723ca890ce003f6c91821c9d339b54523fa
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THz:aQvGAdlCEL8c/WRNw5CDgaPJ
TLSH
T111266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 b135359121e3bb40e0556827f787f44105947b3937c0db8943922e61913b4947
MD5 36dac4bafcde050fd53b3aec884f6d05
SHA1 10d8e60e015cf4f5e15bf7637a7017b9e88030a8
SHA512 c8c86191b391562b3609ded4579b93a3d6018f49fb7dbf8f5582a2f434eb8d40cae1f8979303027414b1474698160eb4d3aed94aa0729d59f464a9b4472ba28d
SSDEEP 24576:xfewsAj/+4ZAgayjhwbmY3MaReFeDvSP3b:tlj/+tgauhwbR3P8wT8
TLSH
T1FD85E031FA74E436C27B0DB21B36C712146DBE604F511AC3E3E89E9E99706D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f34141c916afcee007d6008ec9f8e0d45cc869ebf3eb41ce1239ee1307598665
MD5 2dd5b5901162f923e01d3a4047e2067b
SHA1 0a5d6b505cc1f72cd28e9e420d6a99e29bc9595d
SHA512 7d96c464c06859ab90dd5b956711d28ada149611c37ddf093056389a564df9ef688cc957999242eaea09dfa7a981265cfa88075645d0f208cd649bc593468809
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHpax:6UEtQevvqc2W1cpV20I32C
TLSH
T101474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a988657ef2316e1357bf3610480dc41e9957327911c867fcd3604dc0c0c356ca
MD5 8cd8f8c236672e3723aaeb039f05edb5
SHA1 e8335bddcc421b420619ad1a8cc58f46ccd3a6f7
SHA512 8c3e0d5023d9640c2ca59a5c8af71fa58bd0e3077905eaa88fa632b745518234e10b592b3ce72babbf57a40ea177dfcdce23ed00bdd59c52a28710e8ad517661
SSDEEP 49152:vCbRquA/m2yL5zQfFiV+XenmE3/zf+tgauhwbR3P8wT8:ooqtVjnmfgaPJ
TLSH
T1D1D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c17b2ecc728ddde7ecec1199b9a6d7b4388c2904c7f93f7923ba9278a97d04ab
MD5 220d576715eb813dc38865eae1d3c008
SHA1 b50327f310811843e7c20a1b8fe15016d6b4896d
SHA512 3bd14cb4908596e56f953238b91a3e4debb5f16bca348bd9291730eb47d716b3f151fd083895d6f8ae5e0dc05116864fbed7cfc1279594045663e53acf7ca923
SSDEEP 24576:uAhGL6IFoiwtA5l7S53s+4ZAgayjhwbmY3MaReFeDvSP3b:uAM5Foiq5c+tgauhwbR3P8wT8
TLSH
T158359D80E7F955D4F5B3AA789AB68570EA76BCA65E31C20F2150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 5c1afcaa44f1b89132f4e445126f473fd85fffb28617510a9d14479146239200
MD5 0a79f8060873096fa2010369230f0d49
SHA1 338768791d745f2f2c1ba5fbc5b10242ead02864
SHA512 a307c034cd787ff1a13e1dd9006987ec5052cb747e98f3addc3a3d3d860a6ad95f474b8d3b3b673a219eb44a887329a61b3f7b7fe0f0a6649737d12d46e096b2
SSDEEP 12288:fyZ1IyaeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:aZu6+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1CF751285339860F9D1A70338CAF60A10E7B2BC922B7243CF9595679A5FB2ED54E35321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9ddef92c87b65480fc7e13d8009665c573b2d6a2243e98cda9f582a6029a404d
MD5 295ad339c3481b3dfc718bfaad5f463c
SHA1 0ab78595a9af3626a9114d04709ff1bc1ba41d87
SHA512 098efd8dc2d4326ce4887add1c07709bbd21d745036ce8fdabc043a388d6f6afd065a7f5019e8d683404ddc928de8e75c9bb771d23da8456de0631f709c3a52c
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UX:6QRQyi36YOcPDLvw2gAf+PN3wgaPJ
TLSH
T168667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6f85e94e9700843ed831ddc3502a1c841c5a02af6d86a2fe93a200c83900e05f
MD5 cd3fb43bf5e599b1589da1455dc8733c
SHA1 3d688912687946b19df291d86fcb87e5365286f7
SHA512 be2b824d5c753510d79e1ba7a712d81d3dd57ef8937b77c8980adf29df32487da3f3e4f5ab55913957888671e12c8b144616ec7692e8928d946fe20ca446d930
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UX:xQRQyi36YOcPDLvw2gAf+PN3wgaPJ
TLSH
T172667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9373db3ebf70d16f04cc18baacd6c9d4f53258fdf68b67b2e37f95fd025ab2b8
MD5 081cdd796df7256cdb4cc6ec4df33e33
SHA1 d64eaa2b7f72cf6146f8afc026be0b53c236bbba
SHA512 5ff6b100c09ab42e3122d01e448b27b1ee8b9599eae7fb3c16002d88e65ce4e888ea714b0f5e58ab2933d2076183cff8da41d0accd4d1a3c89b449ba0b339ec0
SSDEEP 49152:m68Qg55nhkeWu7PNU3/v+tgauhwbR3P8wT8:EthTRc/SgaPJ
TLSH
T12AB54933B2F60099C44DE1769F4A873196D27C758FE0E3DB8545720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 36854dc4914e5ad05f5447fd3a3e820a55be87d885026476623e7a4c0b860c45
MD5 cbc251cf0ac2eb0d2c8255fee6d1fd96
SHA1 281f73b49f725d8cbe99797603e76e95c9b3f36f
SHA512 d4adedbe787385342f4791a5892466ad76561694258d8910759c1fcd5b6c7c636b317fdba7ed2066eb847d1c0978869f35de4ee1eb2f488ca11b8ae994068aac
SSDEEP 49152:J3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99x:Yy5112gYy5azzVvU69nLKnhZJgaPJ
TLSH
T114167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 de27fa02102b1e8fb97520baf52f1920f0333bda7fbdf7c10d95313ade55481d
MD5 1a8c9287c233a5eef11680faeecdd50b
SHA1 5751e24da2424078bf5c35b193e4a99a5453dca6
SHA512 fb8088b45835776fded7aa8f1ecb7a1871cfe10e3a6f3c949e4520af3e17b65b55fa33e0158e97304d61e5b5308cbf6381481f9742308571a82a1db23e21150b
SSDEEP 49152:TB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl1+tgauhwbR3P8wT8:lu6JmIxd2dYgaPJ
TLSH
T148D59D13F1DA01E8D06ED578874A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 96f26d31393b383f108e268b5f57a05c13f08786d438d919dbf701b9b83bdaea
MD5 6f3fb6a19ac5cb5f873a670e6a3b31d0
SHA1 640efa30aa4962cc293bdbc1312bbe9954a28e2b
SHA512 8801159c566fac3b19cb4fa8e4be711a86fa0ecd157f19c3927b47958606e2076142223e685a008b5e294427703278b21f6cb662bfd7d7e22e2749234075ca61
SSDEEP 49152:l1hpsNoJpF1A67U44CwH7R4xx+tgauhwbR3P8wT8:lmifPqRfgaPJ
TLSH
T1AEB5BE13F2D800E8D06ED17887569632EA62BC460B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5846309a430c1fd3ff953cff0a80e330a248fadae771e2883cace60f37406069
MD5 adb0d346baf4478bb41b2bf7bcf88e59
SHA1 a34faa160ee7c2f0679796be4b6083ffb5f9dfb0
SHA512 0302b056bb0662ed25c69940e5b411979f69a43632915cfe25833a42771c6237643fda0fa9b0f261a7554e5468d186f7856d2653bc465f7f9527f1a7dd95e28c
SSDEEP 49152:mSuZQIY0Be2KkRVtOnks6NMHq6+tgauhwbR3P8wT8:o5dKqi61tgaPJ
TLSH
T1A1C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 03abc1ad9696b8cd653dd9d927af195f3cc7a1ec0fedcb6c81354935bbea2837
MD5 fadf687047c5249e7b9ca4f74feb9c81
SHA1 3c679e77d1926dde38e48f82ad363973296de15d
SHA512 6ca0304640b18f4160f2fec123d46c555d7e7c1dd0c9aeca3f1be01aefdf989fbc63f5d96f89191d2256934dbf96be7167b59dcfe5cf8f7c89ca2a5e939f0e67
SSDEEP 49152:WhtSn8EApI0figjgiDn0AP5wF+tgauhwbR3P8wT8:3X2iWph7gaPJ
TLSH
T18A95BE13F2D900E8D05ED178C7568632EA62BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 4622e2a7cf2f6c7c2fa4454644fa5f0c603d4441af1f560955400f4e047a2e87
MD5 9bee0d2a4fa7c6d4f3afdc4030e34536
SHA1 fe4a44df3758d8d7850b968e4fee809d6f9934fd
SHA512 c48cc9c4721276fa3e50a19af071b175e52d2f8150b309dab441d85371179cf3c93ff978ed85898736433ea0a11986a5eb1dbeee484b47f050b0f70e324a2526
SSDEEP 12288:XHeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:X++4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T11E652381D24C88CEC62B07758B6A0960A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 724d9fc75389d7644e5d1df8e248c18b56bfd43caa7ae2de7371148ca405b7a1
MD5 c94716a27f52576b89a3a1a9d347df3b
SHA1 90ccf76e5a5c2be2b94112376027decfaf7a750f
SHA512 fcfdc139b612f267c3dad0dfca9a58866f16ea0bccc03311b7c6b3aa894c55d26f7f9733150d8e419ba9157950b2a7e3267cf4d27d49207f4e40d3535bd8baa9
SSDEEP 12288:1+eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:1D+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T173652381E24C88CEC62B07758B6A0960A699AFC73E866144F9CD7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 eaaa8dff5165ee52f452179eaf673e4d93bb60fbffcff55f41e55226c1d15192
MD5 ebebc2fefc94d4791b35192e39492d84
SHA1 69ed9cb3d6ebad2e436d71744090725dd05e532f
SHA512 3c8fd03d2033430867c7ad75f2fb71978f2d3ace52c55669733dc8716efd638c61df0db83e1156a1ffe79b8e9f35929216d0e4b5161300bc53d5503eb9c2d3aa
SSDEEP 12288:Q4eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:QJ+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T187652380D24C88CEC56B07758B6A0A60A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 14810cf787febaf6b406c325e08133e42627dd2e96507289f518f6127073176d
MD5 8d49d2d9f69fba6439c7b37dfc1fa1ce
SHA1 606f77c84fc5fc15d7be73396ad0c297d28d97cc
SHA512 c55b88f9dc8a034958f958b91edf55bc1fecf282c08874290088c6504c9046aaf378846126d086f11e3b19079a6219c655afa15c693ac23447db948b380f2715
SSDEEP 12288:hVBeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:w+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T187652341A35C44CAC97B4734CB760520E3E9BED66F62624FEA853B854DF0FE88A70794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 68f3150d1a375213ecc99cc6baebfe6cb65ccca9ce7f61cb65117f522359f45a
MD5 9909db82585fa5d72a922a8b435f8c6e
SHA1 f59355cb1bbd4d68b940d4ac7ad20a52f6cec3a5
SHA512 fd60f4a075e24788c65eeef8bd047528607220d3b95d993955a7354016259d7e54372310b6e2ef2b8201a6ff2750dc2fab91487d071139ebf0abc26615ed4f3c
SSDEEP 12288:UpeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:U0+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T16C652381D24C88CEC52B07758B6A0960A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 6dcabd1d6a474cc91d492e1b6b354109979dff155b4130c2d2c4d802dfa2be40
MD5 defc310842e9996a07e8be545db25e19
SHA1 25373361c9476a07a11bd8aaae1831b63c1d05d3
SHA512 66ef3575d6058821aacb701a02a77f0d83522ba4ef122005f56c4a45ab861416dec08fa881c3226d4b4b23619f94232f61c0aa599fe27b9941ef7b9666de3e3b
SSDEEP 12288:6ieH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:6X+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T107652381D24C88CEC62B07758B6A0960A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 58e5435d91af99e209d47db9a17656e5e2c7ba93ce8dd11b47678ec62581dfb3
MD5 ca5a3ab800ac9dc84ef641164b14f7f0
SHA1 41a812b194c641fba005d30ddb351196b9326b00
SHA512 5bcb0dfc54ea32b8b4825d4e4be20aef65950a2bf3f14f1750fd54fe74208c780f9bdc9da9a66dc511be0da9ab8beb4d97b46923ac23b3eba760223317a3895f
SSDEEP 12288:rmeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:rL+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T173652381D24C88CEC62B07748B6A09606699BFD73E866144F9CE7785CDF0DBD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 8df25a96943e0d936e8d21745d885b4b004d0a7cc13dc0a2805f499b8c049438
MD5 d372eea45ea274d25d980480ad71bf53
SHA1 eb70bcb48602890c6951bf3918f1c810dccb45db
SHA512 34a8fe3965766c067713775637caa3c338148da95bfb69924ecc1ad60f0af62391eca509ba30e92b3c46213672a45f61f9752a6eada202e106a0ae394d5cc1e8
SSDEEP 24576:iZM3zFVSOj+4ZAgayjhwbmY3MaReFeDvSP3b:iZM3zfn+tgauhwbR3P8wT8
TLSH
T1DA850194B39418F8DC67423ECE264911D6B2BC5A0B60C60F53E837665F737A10D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 9374cec798d333762964ef55e6f874d2e47dec02a5e842e20add028c52c48df8
MD5 87608d442372a8e33ea965ecec348db5
SHA1 c27d5d11bd9187ad9a7e760ac75153e81008a90c
SHA512 8325b480f346e5cfc5e695aa580b683d3ddb9565baa3f2d5f1e48d5121f3fd7cf91087c231832c9929878a5e3e7cf182f3b9ec1adcd1ca9a7142186eb034587c
SSDEEP 12288:6zeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:6K+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T166652381D24C88CEC62B07758B6A0960A69DAFC73E866144F9CE7785CDF0DBD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 ea816ca080c1fea3b6361ab268bd569bf016958b484fade71467ad8cb02a7cf9
MD5 c79ae8d1496a740fd4b10f8e41399dc2
SHA1 fcdf5dd7e0364965565682dccd6188519efc9f28
SHA512 e106aa452b3eab3c1e9f498b7de4fe7e0dbbaaa33ad684b82b8e30d3febdab0182e0194f502ea3dead70316a39ddd65ccaefa1e3453cbe62650b60393255ebbc
SSDEEP 12288:XfeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:XW+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1F9652381E24C88CEC62B07758B6A0960669DAFC73E866144F9CE7785CDF0DBD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 b24f6d475dee9455c285f12263625a67e9105e0e49278c0d12f87d6331325700
MD5 c9aa696972a7c4e51a1f8d549b14e205
SHA1 78f63fbb923e1dcbe7527a1b75623c4cb82b1a6f
SHA512 2540e69a791396278eea342ab51aa00b2a2c2c2ff393d33517f36b51357a45150c16eb8c7b78f64ebbb208c9afc05f5119ca21e6a2ca3483c789a7fe9e46c897
SSDEEP 12288:/yPz5L8aeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:yzyP+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T17975124773A430FDC1374238CA620A11F776BC721B609A9F979417765E73AE48E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 27f7fd959356939361b6e599e03971062864e5306fccb3e4f7d867d67a6acff2
MD5 ef8b7ff53b79d4435849e3114d19febb
SHA1 2ac50f5dd2b776128dfd5e8af22a756126df37bd
SHA512 2a3ce7798b025c8f54c30290d2c547e2faa2cf8a989beed90931e77f43d10d6376159df3e205027a94d3bfcd0f440b3e10873126c74feb1b8395252a2e6d54fc
SSDEEP 12288:gzeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:gK+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T125652381D24C88CEC62B07758B6A0960A69DAFC73E866144F9CE7785CDF0DBD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 128f16a94fb2a330424029b8b29d72fb02b708329f975b376c3e3ac986d12e9d
MD5 d90f1ca52af5e352a305fb2525ee4afb
SHA1 64449aefb71fdceb3e40c3431a7f8aa801cbae81
SHA512 bbdcc375431e5ec07fc6faa38ee124782d869b0d258699398e2759a4186baedcae3c72c31bb7ae7000d250bf24dc52d66cfeade3a786db8e0130443566c2e481
SSDEEP 12288:DzeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:DK+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1FC652381E24C88CEC62B07758B6A09606699AFC73E866144F9CE7785CDF0DBD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 dc6d7bfdae20c3d84e45c170593cb87f0de2107f92478e1348c794ace41b62f4
MD5 1912ce41e523e78f20bb7d3689769702
SHA1 738c9164720be112140370865b9fe459f57aa0b5
SHA512 4f90dda2384be0d619f9eebc3d121e89a24ef6a1dc71ce0c6d2c8ebb2ea48ef69ea8925c7a05d486d3a29395669f4b272b6e7547fff761633ee785e4e28135aa
SSDEEP 49152:vMnYI5jQx79G1poWl9ddLD2/ss+tgauhwbR3P8wT8:EIx+b3LD2E/gaPJ
TLSH
T14B85F129EB8C44E5E2B7823C89B74606F6B17C591B71C6CF129A53AE0E33ED45E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 171a9ef57703c2f3e1ed111e576bf8d6c1fa03c6de26e15e7b4d59ae3299a34d
MD5 21500e3fbe67b2615ed7cdedd3e4647d
SHA1 9c99ceece0e9730718e3ead1223f5121ed0069b3
SHA512 84600c714c2bf267c12f663eee4bff9e9a2ed7617f89e0fe0f07eef7636c1f494081d89064ab3c1c0c0b45c3f4102994a28e46444092645d175564175eed3fda
SSDEEP 49152:fYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0l+tgauhwbR3PP:CySzPQgaPJ/x+b3LD2EK
TLSH
T13E269D56A16801D9C2B9C1B98F1BCC17FAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 33ccd73a2790a41a79adeae59c61629ad432c0b30ed1ac3c42c55a920ce52ecd
MD5 1b43240a13c5aa55f15e489cdd22662b
SHA1 476a8f2a3638e489e796914bb83d6f4319cd92d6
SHA512 de2e2c35e3fc58d0437d5bf99b2ba39d3088f6afe4f9dd8d612bfa8c62e348128aae40bd4a8befb9673aa631fb71dbdc7a6dc1f582bd8e2b2311e58dc4d27d75
SSDEEP 24576:a47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYz+4ZAgayjhwbmY3MaReFeDvSP3b:a47JUQjqirIhCnDHUPfF/1+tgauhwbRG
TLSH
T13F65AE1DA3EC01D5E1BA827885154A5AEA71782E1F31CACF22B0937D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 7da8e13d8eb51b8f27aa563052c72000bde53982d289840f97eec76ce2deefe8
MD5 b82f0a63aa19c14070442d5046b23c60
SHA1 c91e9d204c5f8fef8772f213aafc239319987175
SHA512 ff48d03b4dd032a1f6f26c33e282380199f07fd980a8adf6872821bad4b0aeb0e8d5679e34b047ab08c46b693b074f7035be23b8ce1b1a677670f2eb9ad3557d
SSDEEP 12288:5psfDeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:66+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1D775F149D29801D8C06E1279CB564A40B3777C6657E1D3CBA6C0F67E0FB1AD48EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 dea859127ba19b60679e0639307fa432c023fb41b585ac866cd5e05ad21961e6
MD5 4f66ad859d6a5bddfe30dd145e5daa0f
SHA1 1805d8303b67215eeeaad3f3e956589da6a586d6
SHA512 3a546896fd99d945fc3ac632fee36233e62d74bcf0a5285ffa353dce67412fbdf9ffb5bfb102fc969a8a88d5217d80d4f5cf091b7e36f923a20b1324a1be2701
SSDEEP 12288:7xc50am5cnJp+UGxCsjGZVDYSR7/i/T/ZX:7Q6cnW0ZVESR7/yT/F
TLSH
T1B93507117666CA4FC5A980321E32D5CCAB707D51EE04AF0773C9873FC576A58BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 0dde1352a7ffd2b259970818a834e65605c718056491a7d5a61694c8cfc0ee8a
MD5 cadb4fd90605b67bd9023015636b4737
SHA1 5e64a804b534c0440dda5e3ea1fba8668735b819
SHA512 10a54d6619bf150a57d286e1aa1f553212b87f9dd741ab83086b818aabe314ee0268c896fcc7e2cf8a4e83c4b1fb4e60fd474491cd1503873e8dade03e628af8
SSDEEP 6144:m9Y7raGpArmrc5rGhgCu5/oF1FTPuGd86+yUpDyPyZI1vzVUJhV9BM9ZAmItMxAK:GOO871IX0JuAJna6Kf6hn9ZR1J
TLSH
T1BA751A41A437A6CFC5BA603207269F8C7B78EC06B6056F26B3C90439D867B55B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 e423ac3f4c3205ba9295c2c4dadaff7cffb8a81084c8af2a8fed23fa4180db72
MD5 cb5e42b6fd5dc466cf9e03233e6d5506
SHA1 1b7783be1aedc2f12798d94a57b08b15683ca36b
SHA512 0af75d0a7a390b9c330d65459e36556fe8062238591d370e7172a842ea52a370e0dd5070b0b503477400d062fa66441e4d9a6e0f901ac719abbfadad4308bdd9
SSDEEP 12288:aM7reH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Xi+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T101652351D34C888AC97B07708B6E4930725EBF962F41A1C7F98977C58CB0DE88EB1399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c10206a39b527db86c805a086bb1443d83c83e830bf6dcfa275f6dc03729524a
MD5 2a40402f11d5ead51eb4e47a54f966f8
SHA1 f917315c5498dae6c18ea06333fa44e95e8aec93
SHA512 c5b977041795046875722f528f290add6ccb564cc92a5601ba01542806a29c2846d43fe32eb80c659fd9e65b71dbd5f45733c3123bf263d8f815c6ec753265f1
SSDEEP 24576:fgb6bmBIi49WNNFpg1rSvFv7bYA+4ZAgayjhwbmY3MaReFeDvSP3b:fgb4mBIBhGFz+tgauhwbR3P8wT8
TLSH
T13965AE1E22EC02F5E0FAD2B8CDAA4417D6B278161732D2DF1151426D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 f3bd84ddbe25df75882a87d3da90706520918f9afb0f700e1efffceb09b190cb
MD5 abf82aed0abaf0dbe961ab7958da304a
SHA1 08f31e01efdd8449a70349fc9161236a71f5e86c
SHA512 13377eaae2c546f0840eaa187f4c2ab3aef7e3ffe6c5dbd42bdf303ba815098f5321e7cd0f6e75f7550f0737b8cde797109ceeb4ef4201a2c6dc471e64adbe7b
SSDEEP 24576:/Ga68APIx79G1EGpkb9hYeu9Am8iioBvjVzi/NKK:/GfjQx79G1poWl9ddLD2/sK
TLSH
T1D905122C326A70BDCBF4C2768876402268753D41B3AC14FF5AFADAB657339D1227D944
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 088b96485fe5d8fedb17d0466c9ec0c1d3347330791010451d9b7347559e5faf
MD5 7dfa82c83bc42fb0a98977f4aa03b2a8
SHA1 1e9f022b504d6f271707d3d2f60383b20114e34b
SHA512 a42253eab8f142593b66bb3a83c13e743a0185acfa4ed0c033ccc429fd74f9f02bdd8f3a981b614291b9d2ed38491b6aa00298d07d1ada4b3fb34f997ed6abfa
SSDEEP 24576:gG88u8FpJqH1vzria7/mj+4ZAgayjhwbmY3MaReFeDvSP3b:z7ZFPqVya7/I+tgauhwbR3P8wT8
TLSH
T16B95F16573E401F1D47BD1388A864663F6B2B8250364EBDF06AC8B511F33AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f05fc6620a1823178609731971155227202bbe97eccf151bb513e0a03753cee1
MD5 043be5422aecf48f4700cf33e0df2350
SHA1 5ef45d7dba25ea04560fa15d4bd2ad281538201d
SHA512 88e21424eaac35dc1a78054b16c77a074b5bfe4d1a3c9bce1aa29f03e5ce26213fd8b91e7099a6e8416c84aec40af7ff937887d905adb18f001d6bcd2adf9c4f
SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjX+tgauhwbR3P8wT8:EG05lO43bhgaPJ
TLSH
T1B6D5C06A62EC11F9D1BBD17CCAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ead389779e6abc7b6b60ae9c8d77d83eb912f765be2f813a5b273ff4083d4c03
MD5 ed3f57f6b9bebfe2922e30b56e307fe4
SHA1 3c2eb49701b1166d89b5eaf41b91d8e15fb78eb9
SHA512 adadbd098859105282ed097e80568f6cf0d95eef662aef163e25c6779a592634336e54aff9747bb50c631184b957677f2da669b7beceaa1cb40e520e76377b7b
SSDEEP 24576:Vfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnl+4ZAgayjhwbmY3MaReFeDvSP3b:1a5POZ3lJt2pasx2+mv+tgauhwbR3P8z
TLSH
T19765AF5EA6FC00D5D579D17DC6834616F5B1382253329ACB122182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 2.4MB
SHA256 30ca130b0349513a4c083b6c6f9ac7624bdbfc2c9087faa06537bb4c0aced5fd
MD5 e7087be3751d0283448f97f15c520041
SHA1 32acb4f274c8b4c99572347952a44f090768270c
SHA512 0594362c46d0912a71377ccc1d2bc80b2f5b598f5c9117d790b6c453d437810f73b73f17163ddc3586acf0cb816ee2e8ab1e48b7f0ba8d76fb3059bcc1881302
SSDEEP 49152:3Nc/zEOVHF7jQx79G1poWl9ddLD2/ss+tgauhwbR3P8wT8:qIA6x+b3LD2E/gaPJ
TLSH
T196C5BE1A23E901E4E2FBE1BE89779546FA717865133486CF0292851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 7cbb50d66ec5f7996d4da85a5f216b494222370c0d9138df6363048d77ae0e45
MD5 5486fcb93f782d95ad44cc44de6cfbde
SHA1 ba0172df1a30c9b119dea43b098e2c3b505f126a
SHA512 efdb32a64b6d16f0304b6ca5ca28c8d6ae9216cfae10e92eb47f523068476314050cd64056dafafe77f3a9ee3dbb86418455b43b9b495cfae9ae078b8c24d8fb
SSDEEP 24576:2D3FHshBIYQgAe+4ZAgayjhwbmY3MaReFeDvSP3b:2DVHeBIAAe+tgauhwbR3P8wT8
TLSH
T12395E17DE65C04E4D57BC2BCCA634A02E77138A9032266CB12D491BA5F77EE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 d93a40949101dfc3b9f8da9b2a8177a0e0a863498808b05efa3c1dc1c5ee3b33
MD5 f7cbf6974de25df2cf8ece9c3b82b81e
SHA1 6319eac7a985195c51a1f61f99840024c2dec3b0
SHA512 a9efb0e1b3383d15881f412e4712543ebbc56ffffea46a82eb0ca139bd15ecac85bf9861b84b9ec5dd359d7538d2d8aab72c3dea461d2970a97756f0202012aa
SSDEEP 24576:m6DIr+68APIx79G1EGpkb9hYeu9Am8iioBvjVzi/NKK:m6DI3jQx79G1poWl9ddLD2/sK
TLSH
T1F725021C336A10BAD3E7C13E85B30011D5B2B96193A919DF07E9C5BA5F63EC9B93CA41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 e7cb9dd6c0ac5f313b4b1b2d5f3c687627eae60446e7a023d19fed2448cb18b4
MD5 adbb5e60cf22ca9650cef2f4fa5578ad
SHA1 c0541e691d1c7faacce1b74c2ab9a6a3a56cb502
SHA512 f43af2115fb1708b43794d828f5c9a8d29341a563046c35395e2f58cb345a68f96af04a6f0ed4ed3ef7be467432be2013db61f86ce820732ea91fdc3abf25c8e
SSDEEP 24576:9tyR68APIx79G1EGpkb9hYeu9Am8iioBvjVzi/NKK:9tzjQx79G1poWl9ddLD2/sK
TLSH
T18715120C335860B9EBF48279897341204D397C10B7B906EF66F6EA6F2B33AC16979745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 4cdc6244e5d58a7818978627eaa54dd89541b169bc6585377228ed33e3a8ae74
MD5 69356f3a4ef42f3f47981f8f6cc0cb4c
SHA1 b6a0d0d49bf2fd967e6269792c1d8d8a8e7d17f8
SHA512 ead2a30b3d863fbed91ecb8760653a1d98e019eecad8d6254b391a009dc6450789c6bb92b5eb503d4926f20d8666fd9a1f9b1eb16a754df42e7140f82991ed38
SSDEEP 24576:bL68APIx79G1EGpkb9hYeu9Am8iioBvjVzi/NKK:bujQx79G1poWl9ddLD2/sK
TLSH
T12F05231C331A717ECBD0C2B64476412148297E12B7FD08FB6AFBDAA757339C216B9648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 bf56a6a9d3c635ece5634177cd27233ce0799e2b4301e963fc067dea42a5aa57
MD5 57cffd160741724e3774249ea43cab1d
SHA1 1e575c62983e51639b273e7186ae205fdf6abbee
SHA512 8908f1fc56c887d02becb9ddaef3f6b1d2145dd7110e08c8dc34e5c64d48ccd687663e72ba5a1a76bdb9ac31c778e2944ae3d9d268dee07deaafe709fea7dc6a
SSDEEP 24576:mggILoTfaidZ068APIx79G1EGpkb9hYeu9Am8iioBvjVzi/NKK:7gHTrZhjQx79G1poWl9ddLD2/sK
TLSH
T1DB659C1D73EA05DAE2B2D279D8721493D633B431537286DF2498C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 dba7381920e0c9184e9af67240d10e323fa86552f2eecb9bc73dd98faee01ff7
MD5 0506235aae5caf54ade2f5f5a90eaa8f
SHA1 af2043ee87506ccc782cd11c13d8cca8216d4dee
SHA512 f1ff1f59a0663f569c18afa99a58e799eeab1d5d98cb7a134580b14497b550332f86f8cd300a6f9a3fa89f03f322afd1b870c25e8eb7191bedeade9d17ae34b7
SSDEEP 49152:4gb4mBIBhGFz+tgauhwbR3P8wT8UjQx79G1poWl9ddLD2/sK:4t7gaPJGx+b3LD2EK
TLSH
T199A5DF1E32EC02F5E1FAD2B88DAA4417D6B27C161732D2DF125142692F37EE88D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 e992453d35eb9a353f54846b53ad3c9620bdfe4c652658e8ab1afa4b1e84f881
MD5 4016336ee0c41622245c55129efa3283
SHA1 22377bcd608e81f6c613ac48b2828784dbb35616
SHA512 da2366ee73a86f717a19c123f3306f533c9a5c97c4dc38e6efd6e49901acb8cc78e8308052ca1157c678688e0f2c96f47642e5c335b65d6c43966bef8f0f4afe
SSDEEP 24576:8TkNvNnaFeYhJNtmZBm268APIx79G1EGpkb9hYeu9Am8iioBvjVzi/NKK:8TMwBtOm7jQx79G1poWl9ddLD2/sK
TLSH
T1FF75B02EB7B846E4D2FAC6B5CD238112EA727851173252CB5390C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 61e93313d5f229884731b7b4d1fa54ad13d09f24bd487fe625201ca59618cdea
MD5 2846b4d23db9585976e0446fe0f7ac7c
SHA1 e92200e9dbf1d42d1adc894b23e26a63db4da1a2
SHA512 5718184130ab38afb7f0736ed6f9cfd6d82220f73c34b62f123df02c5c21c792fb2a240a15076f21272ecd87e9fa843aa8888f0b9fc6dcd0d7d7b90f9185aeb5
SSDEEP 49152:cJQcjQx79G1poWl9ddLD2/ss+tgauhwbR3P8wT8:qyx+b3LD2E/gaPJ
TLSH
T16675121E329C18E9E7B6D27D8AA64215E671BC52135692CF02E1C27E4F73DE8AD3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 7f2947cdb12b024e661da6225d73c8354e62bc17fb683e5932d014bd07da9f91
MD5 00496a3c176ee1d2042f1e9d0dec9b67
SHA1 73eae0d0033d97ec9de82499610c2f77b7f75234
SHA512 c333120d1a4fef17606cf155c25a80ccbf70efd6c8191e1702014a6adbfc490a5ef2aae3de46b54ac4b77ef0ce77f11cce7dba0e0006a9da643e20891a376bb9
SSDEEP 49152:gDVHeBIAAe+tgauhwbR3P8wT8xjQx79G1poWl9ddLD2/sK:WgaPJvx+b3LD2EK
TLSH
T1BBC5022DE75C00E9D6BAC2BCCA738502E6713CA9036655CB12D5D2BA1F77EE42D39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 ff4cede0ddf65916efb42b0b136adaaafeea2de1e319343bb63e372ba3b24220
MD5 54559f00747b1604fc3a0233880ccc37
SHA1 4416c88cfd61741d4039d53943392765c1f2af4c
SHA512 6923f7bf6884acc915f37d63a65d64449e6827d7c87a15369a5206f3e17d1dde1c3775dc6c37aabe91bc34fe43c8893452531f25983f2ac15b14d2e55ee8e4c5
SSDEEP 24576:PJnJPbzB4SN68APIx79G1EGpkb9hYeu9Am8iioBvjVzi/NKK:PJnJv6SwjQx79G1poWl9ddLD2/sK
TLSH
T1CC35F13CE2A810E8D5F3C2B4816A1659FE31386D3B2569C719B9D5353F13ED0AA79F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca42ce2eb68fd3f0.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\ca42ce2eb68fd3f0.bin
Size 12KB
SHA256 3ddf0b905cd794def59b6395bf8acd1bb62036d7333087cfc2a8b4d82b485dbd
MD5 e425d8cc34fd636dd40a30be2226d681
SHA1 60f153587ba8c1145c619f4de9cf42bae75f2e91
SHA512 830737f63a041e55a22173c8806eb1a8dc6cfd7f46ce110b3a398f1fb5ffe935ad94efd9132cfdbddbc636f413451476653abafaea263deddfd3674d3fd47fac
SSDEEP 384:u4XqSBEKvtuhJNGqTOCPIb4T29fMfR+k+z:uIqD8tuhJIqd2Q25Mf0Rz
TLSH
T12542C0414737A745F265BCA13FAA5144DB481A795F1C71042EB18CEA4CC0ADBB3DA8BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 2b7331df2b36cb4531e8fd42ba8f1511f5450b6b84328c44a54202b93cc728b6
MD5 35eb5d68e1b055dc46269091e386bde7
SHA1 7940525b2e7a24b5c4019ad47c70a8182b67ef5b
SHA512 dc8006a0a45d8822da4694d6bbba1800b2380e76991df6852a236920088ea9963bca537be32792acbd41fb4b87a9d106dcab312545621be8f6d38742709e4f36
SSDEEP 24576:nj68APIx79G1EGpkb9hYeu9Am8iioBvjVzi/NKK:nGjQx79G1poWl9ddLD2/sK
TLSH
T1B305231C331EA17EDBD0C67684B6402548297E02B3FD19E766BFDAC726339C256BD248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 c9fe6cd5d8fe5c8135807c014a5b6276abbe5f17a99e6eb21cd6616db353b577
MD5 ce1d15539d74a0efab8134c1faa59f31
SHA1 a386e788cf311fb9fcdd691ef404db7251972c3d
SHA512 052940c899dda4e8b8841e2f22c366066de0976c9abf4b517fd386c814b0960a44f76a545bbf3b3039798655551ae3e8520e4d7da962e26305f063c0398cb9ff
SSDEEP 24576:l6Uqjpb68APIx79G1EGpkb9hYeu9Am8iioBvjVzi/NKK:l6U7jQx79G1poWl9ddLD2/sK
TLSH
T11F15121D338960BAE7F482748876812544757C2263BD19EF76EADABB4B339C1953EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 48d697cec83d995888c9dfc4d367ce6f04fb5da6f4c2933e9b0ebc7a83f61f6a
MD5 6e38387b0fb8c39b093ff69a0b1417fc
SHA1 776c7f64d414541954d20576c8213a2574e31287
SHA512 10ae27a54cea0f90fe6d8e275b4c1275367e08b2ea397fd9a39faae635bb02ca5202de1f3be6d918c21d0e9268666e8140b30ebd5dbfd03246a387b2176fc992
SSDEEP 49152:DwvOPjQx79G1poWl9ddLD2/ss+tgauhwbR3P8wT8:/cx+b3LD2E/gaPJ
TLSH
T12675120933981CFDDBA7823986778031E7B2BC023A699B1B57A4C79B5F336616D2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1028-135-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/1028-435-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/1028-128-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/1028-129-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/1048-50-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1048-41-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1048-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1048-242-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1352-35-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1352-37-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1352-155-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1352-28-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1352-29-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1832-87-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/1832-88-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/1832-93-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/1832-319-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/1984-85-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/1984-83-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1984-54-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/1984-64-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1984-70-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2208-461-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2208-110-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2208-104-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2208-103-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2208-459-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2208-409-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2700-295-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2700-309-0x0000000001390000-0x0000000001413000-memory.dmp

Download

memory/2700-456-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/2700-303-0x0000000001390000-0x0000000001413000-memory.dmp

Download

memory/2700-293-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/2700-301-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3428-329-0x00000000013C0000-0x0000000001443000-memory.dmp

Download

memory/3428-451-0x00000000013C0000-0x0000000001443000-memory.dmp

Download

memory/3428-454-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/3428-321-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3428-452-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3428-320-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/3428-327-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3428-335-0x00000000013C0000-0x0000000001443000-memory.dmp

Download

memory/3512-150-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3512-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3512-148-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3512-140-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3512-146-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4324-14-0x00000000031D0000-0x0000000003236000-memory.dmp

Download

memory/4324-8-0x00000000025D0000-0x0000000002655000-memory.dmp

Download

memory/4324-0-0x0000000000400000-0x00000000005A9000-memory.dmp

Download

memory/4324-21-0x00000000031D0000-0x0000000003236000-memory.dmp

Download

memory/4324-53-0x0000000000400000-0x00000000005A9000-memory.dmp

Download

memory/4324-261-0x0000000000400000-0x00000000005A9000-memory.dmp

Download

memory/4324-7-0x00000000025D0000-0x0000000002655000-memory.dmp

Download

memory/4324-2-0x00000000025D0000-0x0000000002655000-memory.dmp

Download

memory/4324-1-0x00000000023E0000-0x00000000024A2000-memory.dmp

Download

memory/5384-496-0x000001751E0E0000-0x000001751E760000-memory.dmp

Download

memory/5384-481-0x000001751E0E0000-0x000001751E760000-memory.dmp

Download

memory/5920-278-0x0000000001210000-0x0000000001270000-memory.dmp

Download

memory/5920-455-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/5920-284-0x0000000001210000-0x0000000001270000-memory.dmp

Download

memory/5920-277-0x0000000000910000-0x0000000000993000-memory.dmp

Download

memory/5920-271-0x0000000000910000-0x0000000000993000-memory.dmp

Download

memory/5920-270-0x0000000000A10000-0x0000000000BC9000-memory.dmp

Download

memory/5920-269-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/6064-163-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6064-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6064-159-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6064-449-0x0000000140000000-0x0000000140172000-memory.dmp

Download