acd8633954ff9cd1809be9f3e4978e088eadf82e399f8dbb2b18e47f6b7ce9d0

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 1.4MB
Sample261102-3m3ftaxwds
SHA256 acd8633954ff9cd1809be9f3e4978e088eadf82e399f8dbb2b18e47f6b7ce9d0
MD5 c19e174f6f9865839b5309d4f3b50ec9
SHA1 7cbbe756a585d517fe081bc3c3fdd561246fe094
SHA512 3342710f1f998000377d27ceab0f897de28dea846edcafb50fd36b740b0cc4827ef6c869865f9abe59235da725e2b98cd6ee498e1231208577ae7a94dbdb5b0d
SSDEEP 12288:dtg6UsICvgzdXSpE4TxvqfJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:du6Asg9SptTgPdCN/j2GLl3iFSE33b9
TLSH
T1C4651270B1C0E072E16B017546F8CF701A35BDBDA970444F67E93ABA1F767E0812A69B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5040	elevation_service.exe
5780	elevation_service.exe
4524	maintenanceservice.exe
3876	OSE.EXE
4532	PerceptionSimulationService.exe
3016	perfhost.exe
404	ReFsDedupSvc.exe
2644	SensorDataService.exe
3080	ssh-agent.exe
4444	AgentService.exe
1576	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\efd7d09a612dd39a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005212a957236bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018727c56236bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030daa956236bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d424157236bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7c7e598236bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077499757236bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003eeedf98236bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000bc439b57236bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5780	elevation_service.exe
5780	elevation_service.exe
5780	elevation_service.exe
5780	elevation_service.exe
5780	elevation_service.exe
5780	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5384	2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeBackupPrivilege	404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	404	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4444	AgentService.exe
Token: 33	1576	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1576	SearchIndexer.exe
Token: SeDebugPrivilege	5040	elevation_service.exe
Token: SeDebugPrivilege	5780	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 928	1576	SearchIndexer.exe	100
PID 1576 wrote to memory of 776	1576	SearchIndexer.exe	101
PID 1576 wrote to memory of 3112	1576	SearchIndexer.exe	102
PID 1576 wrote to memory of 4108	1576	SearchIndexer.exe	103
PID 1576 wrote to memory of 3164	1576	SearchIndexer.exe	107
PID 1576 wrote to memory of 4940	1576	SearchIndexer.exe	108
PID 1576 wrote to memory of 5556	1576	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_c19e174f6f9865839b5309d4f3b50ec9_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5780

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4524

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3876

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4532

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3016

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:404

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2644

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3080

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:928
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4940
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f64111cf9a3da18ffdb9c87ffa0c0812d458603bdcc9db55eaf7abf987881a71
MD5 9c7bb38b142030b124a4e8c49bae9a04
SHA1 43b36fbdf310571e39e33e4472110e1f98e18632
SHA512 075f21d7224762f880db69dcf3f4d301105cc799dea8e23ef2cbc3180d2c175f080eb26faee222af25e10cd1025c5f5479660af2912d7b10bc709f2bd821e493
SSDEEP 49152:Zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn5N/j2U4FH:v3q6sjBaj2jF
TLSH
T129D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 b5447e974290b08bc4fcb2826697b7c49b6674af287bba98b474adb7d133aff8
MD5 0785474ae8ee49f09b71dac78abdf451
SHA1 34d0baa351390e70cf85ab690e54b149c8ae1738
SHA512 7d5336811636c421a416d0a5f81cb1e3da5a109594d06a4320df628f8ef4891d6f33213f6e2f9918b8360c847a7b9c15969a6e5d538cf56c3c8bede4fed6c525
SSDEEP 12288:31XLsswWkxy2lRq2czAoyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:lXYfDtczAhdCN/j2GLl3iFSE33b9
TLSH
T128650228B7E049F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ed449b71e1401596767057808f9dd461c282099e3e3deb544ca1502f2d199145
MD5 073771cf3641778407f4c21288b31e7f
SHA1 bb4811721d39a051c158cb3d166d11905a6119a3
SHA512 2149318edfdfc3a2af3088bca30200808593da9e803a3ef159cad12134fda0b3322897c045dba5cda84091cc8d80d387feec12d08f272bce4fac3041b8b70528
SSDEEP 24576:q0Le5ji0hmxxrM+dCN/j2GLl3iFSE33b9:qPji0AjgN/j2U4FH
TLSH
T186859E26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0f4b5cae3d7b5b093d5573d82e0991825b75a267bc6e940a816d8575b628012b
MD5 3f14c674bb48b2c9d1e54e998d808c92
SHA1 e629f90ab5890cd783f7b41bfc755066a1e3ce3a
SHA512 ae52bd7a6d3134cd6568b2adcf129b8b3c04862b1c5a7a653343f26e96efcb1b39e2a6e8621b501aadb0b209fb4193ab5956d73ef2466838c29185cedee18513
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWn6q8wyusdCN/j2GLl3iFSE33b9:u/ezSC6vUzPveHjysN/j2U4FH
TLSH
T197755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9c5574953ebad93987f40b7574fc7ca34a3096fa8fc7c161dbb456cc224ef086
MD5 81812699f78f42d0eab08cad063ce98e
SHA1 8fe556f77d95463c0a898017ded0257ad494d381
SHA512 fd9721b40a07fc6a797faff06ceb83ba5d5a1ea16062c1b6df1f1dbe48863aecfaaef3d910ebc7868bf4e770ea294caeec9d810a1e23a43b0568bb5c412a97e1
SSDEEP 24576:YVbqPb88hv/l+YVdCN/j2GLl3iFSE33b9:YVO88hXl+vN/j2U4FH
TLSH
T144559E66F5748331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 49f52b67e3a58b18ee57c401d8cee46f5a1b34bf9eeaa1e2044da5d6024a61ee
MD5 cfdedd36838cf6552fe30b17e8d8dc35
SHA1 45c5fa09a473333195321090a2d06b23ebade0d8
SHA512 e2742b4a3f4c075e0755bcde0ece807f7dc27afc844443db2f565baf1ab4cb676359e3a5810f8b8a3cf08cfe7efd296bb7c29cff28574ca1d8bd5c9b9e8e792f
SSDEEP 12288:YLjyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:YLSdCN/j2GLl3iFSE33b9
TLSH
T13C452360DAA5F565F26F837D03ADAE656200FEE8E525884785813BEF513CFE8C032063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3d785acc2d81564323b94122dc6b26adcbdb873ace342610931deb8ddd8de918
MD5 c7e25b71e89cc7033724196e506d2063
SHA1 a526806bc12f653b1a30585fc11ceb13e75c30a6
SHA512 e9fc4f6c5f75efbd59657884c5c3f35f8521bc8027ec4459248065cd34904f1a52b1dd493e87844027937b504fcda1e6e7364652caa38c93515fcda3ca42dea7
SSDEEP 12288:ueBNUbTVO86UsyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:uJIU9dCN/j2GLl3iFSE33b9
TLSH
T18F65CF3BEE28FCE2C27E8DB85791C600976278708B6293CBD165834EDE235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bfc769fb9c6f7f7c3ae74a3b1bbcd322e1b980f5e2c7f13196841d973619ce27
MD5 a83afb8c35ddb5bed78144f357fa5f37
SHA1 411eba7ec6d36a4b7301495aed23aff83a0cb73c
SHA512 3060db42b4ecbf3a56d7f2310ff7616d499b1116dd76f37c46369c6025ae2de293a6c9e1bf6ce9acc4d89d7440b50962e499aca9fb04f3189085cf2d73eac1d8
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THT:zQvGAdlCEL8c/DRNw5C5j2jF
TLSH
T134267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 22c3fda8293ef0102f40ff69fc09d529b9b9981c07ba85bad19fa42df66b59a9
MD5 ade4c3fa09f90c68bc0a44416960969e
SHA1 3c8eee928eff69b491542fdf36d9a85825ae798b
SHA512 6175a322d22f5b4187b7d372acca146ca3b26592bbd4d7400585a1a661c7542e6dfcb40c18274630b2dd0d33f64d8c8c4e3d52b3a4c953d27f237815e5a794b9
SSDEEP 12288:KAwSfxL/2Dc3RDLLmt0LDQewsAjeyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33ba:f0ewsAjzdCN/j2GLl3iFSE33b9
TLSH
T12175E031FE74E036C2BF0DB61B36D716142CBA608B6119C3E3E84E9E59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 39338045fac6aa254caa994097dd19c6482954c629b01659380482783b4b8e02
MD5 0693ece1d5b64badf6c75ffbfbc012ff
SHA1 bedc0641e0323bb5040696570d885f249a6192e1
SHA512 d4bc96afc40a3933e092ed6bb27a367acf95aa7ca00228c20ece95c2c0c39d4aa6c1a380bff7a642e1ade6099db1c27dfe571b19cfc41afef5a8868d5612d579
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHU8F:EUEtQevvqc2W1cpV2tI32U
TLSH
T18F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 469f6af7aa4535c0ba65e1c782dc5a18d37cffded012a26174ec95ce429b0bef
MD5 603b40258cccb6849eb12af1ef1cb184
SHA1 2f23892164ac369d7050890c5d7b7c2b4a4e6859
SHA512 7324451a421d71cb99397095da4db82d4e3a557d2185ad2775eb69fd5652966bce8f89f09d3d8eb495fdd8cd900a5524a6b61f0ad7c3169182261c4c55fb0efb
SSDEEP 49152:WCbRquA/m2yL5zTfFiV+XenmE3/zQN/j2U4FH:boquVjnm9j2jF
TLSH
T1B7D58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ade6016969a3f1336cbf96aca21c85670f1484e3cd1d68bc50b9dae724ad9887
MD5 cd62f4f18e8e967781675dcdd0b41680
SHA1 2579f20de73245664bca63e39e3785c40241309a
SHA512 803e8fcc90a38e1d6b861b261aa65493d11b362c20861fa0b00b9a758a920bc6fbe7d7eda575384dd71bdcce1cb04fb83cbf577cbf755e8ade35c29619cea8b0
SSDEEP 24576:CAhGL3IFoiwtA5l7S53odCN/j2GLl3iFSE33b9:CAMUFoiq5DN/j2U4FH
TLSH
T1B535AD80EBF955D4F5B3AAB899B69571EA72BCA95E31C20F1150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8441ff71f32d5a893846631387abecd58eb8967c584024cdea8befd77e706a58
MD5 a60669d40104b289fa30ac0835731bc8
SHA1 9c14e30e104e2c42e7b8cd28168ed21333f6e95b
SHA512 000566cfc8466269a92332f654be5ec760387495926085bbfbbccaf2f5dc139e98522481b30282521a095047e3121a138cff79c959abbb00948107999e453eef
SSDEEP 12288:lmw5HEjsChNVBFgl0WDm+ChyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Awu4OW/dCN/j2GLl3iFSE33b9
TLSH
T12165F14577E41CF9E56782388697C536F7B2BC512A21CB0F07A0C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 481b31a86ea7e40b5dac20cd7ea040b236f5ec02ba9204ccddd6db4620a99e48
MD5 2c6c521baaa2e265b431dfe14455d714
SHA1 7324a2c1e18457f4b7a6d8735b19c5ce2c1ddef3
SHA512 d4f42988db6b027b1190e1170b2a3972f2351650b1b291604e56c0b1f25dc0d55fbb17cb66b16fb027d66e2903eaab52c3030e84199ed992e2d83d2b9f82357d
SSDEEP 12288:heZ1IyOyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:0ZuGdCN/j2GLl3iFSE33b9
TLSH
T1C955125937E471F9E1A7823C8AE59A05D321B8A5A73243CF025047EA2F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8f57a405637d04cd6e85a98096a50565bb8cc1ff5c8e0757960d1fd2cda1644c
MD5 baec3ee3b85538f634ece666a4dea8d0
SHA1 68ea2863c76ccecbac87f1842d1ab48d72ea356f
SHA512 3343cd3efd229f9a5fa658f33ee5f2f36f1891e01b59aaf69d33d72f90a3bdcdf9b1921eb213d6bccd597a50c968fec3c81ace392ad5880a7a5049d98d5bd4e2
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U/:EQRQyi36YOcPbLvw2gAf+PN3mj2jF
TLSH
T116667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8345cb408589714ac8bd3357a74b9f68fd4b92d20da3094744860e8b1ce614e1
MD5 facd59702007c3466aa63cc7e587756f
SHA1 5517d17810b1caa59d59445bf27f14ca8e58e1a4
SHA512 6eab584b525eb7107549b5c31a2f44f5b5c45e1859bda697955b076398af7904c68228f8e96e3e3e43c9aa506e3f25270930f85820ddad931b9f4eccdebc7caf
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U/:lQRQyi36YOcPbLvw2gAf+PN3mj2jF
TLSH
T1C0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3d5295344bdbe688ef4ac3adca1171b08c9d257715c1d5cc132ad22f3ea25b32
MD5 dfadec439e69c9d4ab4208630ec2f98c
SHA1 e444b8a3ed6ebd61d2253c8a5f6b4675e24d491d
SHA512 37d32fc96aece3eb0de3d7a362404470d7544974e7c883abed666c4165333990e9b91731a997edd25417b9b5a2cb69dd1f26a19c2a410ad997088ebf5383234d
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL02dCN/j2GLl3iFS+:C68Qg55nhceWu7PNU3/gN/j2U4FH
TLSH
T12CB54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f36ccdc7e7ec65c760874c1ee559246a9fb6cc2e0491e45d4bc5dc89bc0aab2d
MD5 181d822ac2764dc58fe5e9bad88906e6
SHA1 fa055eda0bbc6441abd44937230c23a3a4fa5951
SHA512 b458c0a8e4caae1b253472110278bd0574c9972ec5448913683ee04a16e731f17c5eb2614bebea70d1e4e01b996bd393443cd49caae85f461ec37295263ceb53
SSDEEP 49152:o3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99B:Fy5112gYy5azzVvt69nLKnhZ7j2jF
TLSH
T144168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c65d64364edf40597c3ac5f92c5f9f9be7d39f8c0c3a88c2ee51141898c99659
MD5 6535abe1268a854d9a91964c01d5a9c5
SHA1 0223ebd34504f51c832e7a4db76d01fb9edee4a3
SHA512 4123b21b4ec30fe32d04a86c6f333e6ff23356eb5f074d80cda6f6118ece51076c20c444a3324a66ca3eabb75bb1ea2be8e7f53305566e62184ee43423d1df3f
SSDEEP 49152:NB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glmN/j2U4FH:Tu6Jmdxd2dej2jF
TLSH
T15DD59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 be276a8083bfba78ade03bb68f14b22d01b630aac7c21e20313d70ced194cbed
MD5 ed6b63d79023e16f60008a2289ef249c
SHA1 0f0b04358d2609519a2016fa98649430dd72b06e
SHA512 4bd4b1fc24bb83d31fa33e5debd49231ceb4710ecb2ef3bf228b5f4c6f405809e302a73007ea5670a036c4ab9fdf9b04ff4537cfe4a9a6642f8e5cb9f1b5d746
SSDEEP 49152:z1hpsNoJpF1A63U44CwH7R4xyN/j2U4FH:zmifPWR9j2jF
TLSH
T1F4B5BD13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4826bb5465e06cda4b0f49d35e361e0593b315415d9aa16d84f2f8018fbd79ea
MD5 0963c823c5f9c0ea28f60690633362c7
SHA1 bb4ce7cb2c4f925f73c5488ae0bec1bdb486bfeb
SHA512 4b134464debac5967f2bae215ffa5029341507e487ec8355ba3a08afa10994ac375de6a0e6d60796aad06ad16f10e3e89fd206b0fb54c1548b10927df0d2850a
SSDEEP 49152:2SuZQIY0Be2KcRVtOnks6NMHqJN/j2U4FH:Y5dKii61Hj2jF
TLSH
T169C5BF13F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 453241fca4258a19617d029d206bb471b6fd497f3d47521a364f0eaa58d51272
MD5 92814e1d7994e3ffd90c5b49c25966a5
SHA1 3989f0743ce3f3ffd22434bf5be0c24cf45bb4ac
SHA512 b4467e031457201c9568ea06ba5c41f4c871decafc82af5ed2a082785c79efd545aebf928f4f3df67209260c03aa80bc5407937d73e73c96a4b9c1d13d071511
SSDEEP 49152:NhtSn8EApI0fig3giDn0AP5w2N/j2U4FH:cX2imphBj2jF
TLSH
T14895BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e0a2eb020c938ce36baeca769e8cd771ee02a952902b8dbfe264e323f427e7dd
MD5 69e0ce53b9c76e9c74c1c29b7182cfed
SHA1 f42862d7617d084d418d609629c163300522d4e5
SHA512 71f070cad908b9cbd9ccb10d0848083f9aeb17c999fd40a4776b1bffe6be712145d385a1d826e15b7dd81387a590dd698bd7864297a808da3e478e1d3d6b4491
SSDEEP 12288:7ryJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:76dCN/j2GLl3iFSE33b9
TLSH
T1DB452364E9E6F669F15BC37D43A9DB555200FEECF6264447868116EB237CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5a91ce43636b36be1060ae147bfdc1880c38dcbd6eac69bba20c8578ed86618a
MD5 19735876045fcedab513153ea2d694cd
SHA1 0c79615d89d745dd3c9900a8806f39d2e00c09dd
SHA512 8a17ce9ca84ad74c3f730e2f931ac44ec2eb7c455f46dbe862a703f625d83f657edc569d99c46e4e6f7bd95b069a87e29ff79fb7a22ae9abc66f1c7742086d62
SSDEEP 12288:zKyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:z3dCN/j2GLl3iFSE33b9
TLSH
T196452364E9E5F669F11AC37D43A99B555200FEECF6224447868116EB637CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ece1e6cac8487da914a8628e7a2e3e1bc75217b3b16f738f79b26b702266346d
MD5 efba25ad6ddbef9146b51209c9de2f29
SHA1 e910fb71ca01bf80e65fa86067d85ef7220947e1
SHA512 5339307f186647486e533086f7318826adc4b0c19e297510affe587b54e09b51237d3654d1e97338f29a8605bee702c4d2b77caf8e9be3b0ed9d1f11670c574a
SSDEEP 12288:9UyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:9FdCN/j2GLl3iFSE33b9
TLSH
T1D9452364E9E6F659F15EC37D43A99B555200FEECF626448786C116EB237CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 667e10f68cc95287a48a4b0b22cc8dd2d396573abaed04c69e445910a243a949
MD5 b33278268f51af6e0137f98a710940e2
SHA1 aa9cf79205e17ebeb51a78e1febd549c361fab9d
SHA512 6bcf3fbd6a2fd342ffbbf0f65c033747fa925d00cd71e8ac47d2065016e1c4362079617093e7590856bd504a5682391cf8800d87ef149c1e3afb960f91b979a4
SSDEEP 12288:TVlyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:udCN/j2GLl3iFSE33b9
TLSH
T1C0452364ABF5A1D5E06BC37C83B5DA11E310FDE8E732858F86401AEF1B74BE89431562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 003ff36218d403b1f71fdb34df8e3eb03a61251fd558e99fef19a1d2488fc1bd
MD5 7ae270b4c1bd99c2de90de754266e3f1
SHA1 f5308686cbcb1e7113bd160cad1e890c1f9d8513
SHA512 912edd7a214ab051720597d9620de1f6ce4a331b5b0d663a488ad26ee994fe8b57f2ab46e93d734b199f12f79fb382f7c44d25ca07bde7ff10aa77af816f1dff
SSDEEP 12288:69yJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:6gdCN/j2GLl3iFSE33b9
TLSH
T13B452364E9E6F659F15EC37D43A99B555200FEECF6264487868116EB237CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6ddb3219d1f6b93ff80d6f314ce8d096a86c87fd27c24db429fcece430d54f93
MD5 62022b17511c09153f97a21d50faea5b
SHA1 6ddaf34be43f4e44c8e2c14696f75950ca9a443c
SHA512 9924fb3a6117e8fbc3dc9432f6de6b63f38df90076f5935b0f5b67ee1797ca15660c020caece8dcb5315eb41fc42e28a2dda1e3a88770f86168dc0107dc5c5f3
SSDEEP 12288:sGyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:sbdCN/j2GLl3iFSE33b9
TLSH
T1B4452364E9E5F669F15EC37D43A99B555200FEECF6264487868116EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 04c9dded052155eafc76747e2996994a30352db291258d57569ae43298e858c1
MD5 a0c4411df99ab07c98964a46bebc11f9
SHA1 edb8edf6a99180e6dfd0a9fb488372f5b652063a
SHA512 d8b0271dc41e9799fb727d35d2a08802fa567daa07dc70d39fed7f8f46f8da348df2afe456d475a3549f884a07c681b1df0bbd3d5025e826f0d319cc9d791def
SSDEEP 12288:cCyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:cvdCN/j2GLl3iFSE33b9
TLSH
T1BF452364E9E5F669F15EC37D03A89B555200FEECF6264447868156EB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 fcda7ff60b10f32b2b3f78edffee1095adc299d109ff868f51a237741384f2e3
MD5 217be8302ccd0d7974e602a02fcdbea8
SHA1 70f9df7eb37432e65a8c1dec13e87289cb04c409
SHA512 15a41a9bf4afdf7596219c125255fda44d440f69a896f85717fc582da0360cca579146610c9b4f55cd31070abb5e5fb8136ccd37794c36bbf23427ce3677483f
SSDEEP 12288:niZwbVzzFEoS2cPvyqyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:iZMRzFVSOXdCN/j2GLl3iFSE33b9
TLSH
T1EC6502A4B39058F8EC67823EC9658906D2B1BC594770C60F03E4366B5F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f7313f8b39fe2c53c7bae7d642df8bd07f1022ffa88caedf50e25230e642d500
MD5 b38062adfa5c00793f5e34086bef0b53
SHA1 727ff3d55eaaa98f6c3f0ccf994a106680160630
SHA512 2518a5835234356ac7d57d9e82afa2d51b57e5730ee42f103553316ccbd0b922a1da6afc2f6a399c03e11e613b39fce86bc8798e7bc81906e68ab0ede0137416
SSDEEP 12288:jPyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:jWdCN/j2GLl3iFSE33b9
TLSH
T109452364E9E5F669F15EC37D43A9DB555200FEECF6224487868516EB237CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 2e33b81dfad0c208a14a2ecd514bf37e4b21475eea9ff75e6a06e0a129dc4772
MD5 5095acd93212d27da0d99d475b38cc51
SHA1 53ebbd456989a7b344448b3b196bb39355c81fba
SHA512 088c8ff97af7c41a0006082836f15b7e7728f16a6ce7bc744fe1cdfa8e626a090c95999596e41b0717039d13dc6584678e1990dae10f692ef41607a874cc0ddd
SSDEEP 12288:PTyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PidCN/j2GLl3iFSE33b9
TLSH
T171452364E9E5F669F11EC37D43A99B555200FEECF626448786811AEB237CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 504e062da13451e9fda43f34623ad858494d3fc481776af132e16935004d1330
MD5 869573e61c6a91e6e6deb746c0b86fb8
SHA1 12a20f8e7faabe25a719c7d29a949b1e4ce293b7
SHA512 7006e77aaa2d03b68571486da06f1f3e15ddbfa7fa1b0b78f49dc4925d06d088b08dbd3fe9e19f69887d815280625244ee59c621cccdfa270313738c1109702e
SSDEEP 12288:0yPz5L8OyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:tzyDdCN/j2GLl3iFSE33b9
TLSH
T1B3550257B7A130F9D17B823889A55A01F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4d77f6fb20126ff311c59cc824c374acfbdba951d08f2a72566f84f892a7d14e
MD5 2ff126f65c270afe143d64c97e8d101f
SHA1 0ffbe093250c8eccae718eb2ac328c9e99818549
SHA512 8b7081dec97a37aebc3e08d5d41a7897079e91fab57434b78c8ba59072937cc1e0f68550bdbd6d5c2cb1a7b79acbe135eec00ee8938db41c2bca9cfcf4f37d95
SSDEEP 12288:sPyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:sWdCN/j2GLl3iFSE33b9
TLSH
T1BF452364E9E5F659F15EC37D43A99B555200FEECF622448786811AEB237CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2588e873c5df89369a6146b7f5543a14381cfeaba7981305cc58db3f55263fb7
MD5 1b46885ee286e071228d5c3bab72afab
SHA1 f29292a15fac9ecaf33cdd199d335d3bba65369f
SHA512 12fad6e65c49adb23418b8e375c85ccaf85b4485705450d435022edc0ab4aead04100be43179035932e943e01e5d40743ba5a5696ec70fed98713ab6d6a444d6
SSDEEP 12288:bPyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:bWdCN/j2GLl3iFSE33b9
TLSH
T10A452364E9E5F669F15EC37D43A99B555200FEECF6224487868116EB237CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 62f0205121206deeeab951375dfd6106e6f37e33d52fb86d6f93ca0386a1626e
MD5 c4e382e1d028c5416709417054247d84
SHA1 aca6f039d34118f3e6361f375297f23e0d85cc6c
SHA512 e41e39b3b1b46a97d03e6dbf80bd2fbcc568c8a8f4d57fd413bfb81c4a0a54c621fd4a27c6fcb0bc269de59b68196eafd12451125582ff2004544b041e8beb5f
SSDEEP 12288:EyPz5L8OyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:dzyDdCN/j2GLl3iFSE33b9
TLSH
T179550217B7A130F9D17B823889A55A01F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 a400fc456b19243d1ffba1b8f95b82b9d09755887efebd324ea24cb20c417d9b
MD5 ca669c9d07a1e21fc926935287cf6861
SHA1 161cd32c6ebaf6a7684ae543cccf7ba5a73ce70c
SHA512 b5027731fdef1ca7dc7f5dd9a7cb329295a1e508e8197fe5c8b8705bfa96fb0f2f9a8b17d3f4363f9aa355e16ed881d58b56e5fc253ced6be7dfd0dcf815d51c
SSDEEP 12288:pCd9CWYoaLHF3z0z04PDvhkyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:0TDaLl3z0zD1dCN/j2GLl3iFSE33b9
TLSH
T1496502A4B39058F8EC67823EC9658916D2B1BC594770C60F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ac78728bf610a36863e5b8cfa097e5ffe86b8b2883bcde6992044bba09133390
MD5 f09fcae2ba02f7c05021272e45b2053b
SHA1 37591e57fdb69d03dc256d865e4846fa9827e04e
SHA512 6cdf2d386c4bfcdce110047ed3b8842d30183c5d1cb411fc7771c2a3e728ff67ce72cfe7b7147f6c67b00008869b010579a572d98c476b6f171ecb9a657d261a
SSDEEP 12288:Vi4e7KRdTfgwCHKy7GLbbdIvZyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9Yvp:V3vd9CHKy7GZJdCN/j2GLl3iFSE33b9
TLSH
T17A75CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 81135f0c8581d2ac5f57738d1593004ecc8cd29b9c6076759955bde560a90bb3
MD5 c7c76767a5d11a0d90162dbab27fb05c
SHA1 7e36a7611b6608a3b8569e6d79159dac6eb0ab3b
SHA512 d41cbff1bf8784b2ed395b24ba161fc994819aef253cf806f86c25140b4c436adf54d907d0eeac320e12037ef15953577ac7e3efc9ded6ed1a292fd53a9ef738
SSDEEP 12288:l0yJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:lldCN/j2GLl3iFSE33b9
TLSH
T16F452364E9E6F659F15EC37D43A99B555200FEECF6264487868116EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 67703b8168d4ebb989a3ed21a695ea9d1bc5f8d78642d968183b9c67c5ed21a7
MD5 6f4e6dac18c7cd1e1c0901c8466716cd
SHA1 bbbda2f031b1eb817777c187afe9a9d7fd907e83
SHA512 5b58d4a2b17095cb7e0c5679c2e1fcf2de2ec6e4ad0153911435c164c8beff0882393fe84f24418d27e4eab72a137742e792da3e54fec21e24950240928796a7
SSDEEP 12288:euyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ejdCN/j2GLl3iFSE33b9
TLSH
T15F452364E9E5F669F16EC3BD43A99B555200FEECF626444786811AEB137CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b96b15ad1587fc4a54b1166096f7c6e2d164c4a60536d865c186cb0ef602d0ed
MD5 586c85400a26af4e17a13fa19f753b88
SHA1 0fbcfebb3e9180260be048811211ea154c814fe8
SHA512 aa82c6a30725ff11f11dc8cbd2bdb28c5135b301f46ee8a6389029c7251687da4eb664e75567c7681494ecf33291d5f8d66a0c88482b3db6175bfde8327fb11f
SSDEEP 12288:MZyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:MkdCN/j2GLl3iFSE33b9
TLSH
T12E452364E9E5F669F15EC37D43A99B555600FEECF622444786811AEB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a5588d7fedb773d3b24555b8ab824a6892a038b0fd8d694bc9d74a235ded1f17
MD5 188ca7463cd912d710cac7af758bd74f
SHA1 421843cecbe9a763343096046b1f09d2a2ace5e3
SHA512 2fd0eb30cb0f853dc9a7122fb4d89cb057a01e04b3d156aba6586483c32b9a344d99cf3507af79bf97741fd969e60671cace0d1fc5653bd14716768f19fc88e7
SSDEEP 12288:wPyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:wWdCN/j2GLl3iFSE33b9
TLSH
T18B452364E9E5F669F15EC37D43A99B555200FEECF6224487868516EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e941dfb3e3711d8664a683be1591901d92b4ae02b0032f68a1e254e46d2a543c
MD5 c930e0aeff5a2210fab21d988f47517e
SHA1 fc90b663251fe0c8244151e4f310fdb85639c8cf
SHA512 642aa1e120c14f52d4020ac5499260eeaceb5d8d378a4b6a9b8e36b957d47a6a9f1a02403ad5674d5d743123bcdc77a9d09d4bdbde3a3935034dc2ab491e16ac
SSDEEP 12288:m0yJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mldCN/j2GLl3iFSE33b9
TLSH
T1E4452364E9E6F669F15EC37D43A99B555200FEECF626444786C116EB237CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 11e68b54cc57cd82a7f06c8c938d17be93b314de1bb2a2aa83f96e6b3bf0d021
MD5 cec9e2d76f0fa167aa022bec1a61f318
SHA1 47e0333978d57b8c780458f014626c88d078f0ab
SHA512 2c59c7d04f19506995298847a1f58d75c06a92ff2dbd8e38172b6c955b0fefa5004808a583077b42b8903e04db20751d5b9a7a85b257462a31d8cfe54a229d27
SSDEEP 12288:qnyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:qudCN/j2GLl3iFSE33b9
TLSH
T1A2452364EDE5F669F15AC37D43A99B515600FEECF626444786811AEB237CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e67bda76d198e9397847ca0501740c59bf8175ddbf0d5e3bdfadf191b4d2e27a
MD5 ca5258679879911f58fc0575ace3e1d3
SHA1 1d9973eb05e593849b7b2205ee45d7d159332b19
SHA512 3b069a09171f8fce445a38e9b0e4133f35ae1f589f47ae20d199b8cdecb26c113a51c211429c22e90a2c769d886d17718698849d2e4859973834413719abd72f
SSDEEP 12288:Z9yJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ZgdCN/j2GLl3iFSE33b9
TLSH
T1EC452364E9E6F669F15EC37D43A99B555200FEECF626444786C116EB237CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 6cdcbc18907d8cb135fbbec2228ac7c86181da1a684905c3605dc5751cfd0c5e
MD5 6e809bd3a24b886aae53e7b3b76169b3
SHA1 ed1ae4f08827699394aae65e894cc958216dffa1
SHA512 31353235162497f7ad31532eb8bb0da83daf12b04bb58061f39419ac12ee0267f8529d8a5386522f9e8012615489e2bb4abfa697ecae920f71d92ce1e22625bf
SSDEEP 12288:2cyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:2NdCN/j2GLl3iFSE33b9
TLSH
T1FE452364E9E5F669F15EC3BD43A99B515600FEECF626444786811AEB237CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 5d8308e535d15209667e32ca4ec16be789b3ccfbd2b025f186995479b6aace54
MD5 ea938f7489bb5644134c207eedceaa90
SHA1 bce64075bd010061e89c02e0d1e1f3e408a79266
SHA512 690ca630dc6d88c53f29b6b6dbc654a08ec15e3b22ba6a8fd72a30c3a9947aa156cdd0fe793ac49571ab2e8f40d8290689f3f642b3e9f00b812b0e09930620b5
SSDEEP 24576:OfwvUk9RX6wkyAIydCN/j2GLl3iFSE33b9:WMnYI1N/j2U4FH
TLSH
T10B85D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c1a932c2b554f86ad5fd4e0f9857b04e30b72b59be6d00f6ea3b39b07ea051bd
MD5 09989c3c1a89ae3b895b2c4699a9a467
SHA1 18edeb18e463e141d7b8daad34b54693efb75e33
SHA512 a41da866e3c8da0017624ff61aae837793f7ef3db0cd26796ff38247896c7216fe61ffd1ea351a1f3642dda7ddcf9294001c4db90ddad6e1a85388b2b8d99566
SSDEEP 49152:cYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WN/j2U4FH:bySzPGj2jF
TLSH
T1D9067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8bb73150368264f2c8029890c3271afa511fa4430780b68edecf5b2d5e633e55
MD5 a118432f956ccfc691ad123986823b6f
SHA1 73e5fd3b678d9ec9de4cf711f7c670646bed9780
SHA512 591d70e763b5e2f239c4451a4361b080b85dd52f92e31a3a6f6ffbe909b63f4ded7d7d8ff45e4c2c3d39cb470ae1c2e513fb935b15986d1f37ac07d6eaafc718
SSDEEP 24576:o47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYndCN/j2GLl3iFSE33b9:o47JUQjTirIhCnDHUPfF/mN/j2U4FH
TLSH
T12D65AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a202a1d4cb48fee3ca3b38eb4643e9fc987ae468e55910f4e67b747eb2b589f4
MD5 b823ba49c7bfa517faeffd1925a86da2
SHA1 f37de046740ac741263441444f328f9d5e97420e
SHA512 52f1955bdf9530d9077b7c3a6b0450673d42b242529232c6407cbfe5527904618e3b6e0e02a5ed1137f82d6b08dc2e344bc9ff30297865d3cda64da4d55b00aa
SSDEEP 12288:AbsffyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nGdCN/j2GLl3iFSE33b9
TLSH
T1F7550119D29852E8D06E9279C7558A41B323BCA493E1C3CB43C0F5BE1F39AD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 9bee0c6b96a1825b7a8297903aac3875409d8a0a3f82809f441683d2adfd9c9f
MD5 58b5fb96b192d4ea3228683f73bde29c
SHA1 07e75d3b499812a895a3888c8eca0930f88c491a
SHA512 a4f8db53b5640097fbae903b189b45a57a920c9e526f906cc33aefbb3c33cf880b43c2141e2629ee327d0a9e2d8b4a7538179e19fe83cf96716e14819d9d77f3
SSDEEP 12288:yoDhN5UU3fyfJyN4jPmLNuMTLQn2QGTUDrM09qa0YZt:yiaUPEPENuMfQ2QWUDrM+qa0YZ
TLSH
T167452801762ACB4FC66940321E73D6CCAB707C42EE45AF0773C9873F9576658BAB2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 2c3c090d3d7b8bb5b33bb1a767080574f675f341db83b974bc40caa5a0b6e7b9
MD5 4b48a6998fe80500756ebb484fa86082
SHA1 6ae7c33563e96b29225a26267cade5518a188192
SHA512 b1eb7000d34a2307b807df2c8fcaf7a16463fceb10972875110e668d7f54a2db93a07604a9e6a2a46d3596054ebeea1efff4b76a145b84319d424de1efd13ad2
SSDEEP 6144:thEGhGSz77r6O6L4/04/YS/1UetCeMRkiLJkbBBPFlOgCm0yUOuDQa2DVvnWtMxK:ththd+LI0IYqCLraFFWRjcpef
TLSH
T1D965F941A537A78FC1B72032072A5B8C77B8EC07B6456F16B3C9453ED86A716A0BD3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d805e3aab9fbc49d2600ed5768fc01046069a44fc17920d7c7cd1be3c1919709
MD5 3a9c1e305edd18561873d0eeac627f2b
SHA1 2086a22e1ce4fa292b67084ca89d2db56a002619
SHA512 4df2b4149957b997e75a8223b8520d882365413fe855d5832ae790ac58c7596d8daf6723b38e43d54e29d261ab845912a71c4836522d15d47a9568b6a5164ed0
SSDEEP 12288:h073yJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CedCN/j2GLl3iFSE33b9
TLSH
T16F452361DBE9FA55F07E837802ADDA256200FEF8DB2184C7C54117EB6278FD88932563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6870dadac790285a5ac93bfa81ac79393a67c181d17fbf838e3ebf59cfe15167
MD5 316137fa7fa762205c792c1d9b7bd095
SHA1 404d8084c6afd18af030e4d3cbd3635b72750015
SHA512 38f1efe14a048c52e3a0c989628e17f1d7542d5fe84a27f7d03d4bb3c5525a9ac34f454bbdfd253c331236560a73d79512c61f4185174e21a61ed0fee41e9df9
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYsdCN/j2GLl3iFSE33b9:Kgb4mBIBhGFUN/j2U4FH
TLSH
T1A765AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 22ff2617dff2f9ae2de5d8dafbafe3ff6ba6aee3c35efc0eb1d3bd513a91c976
MD5 4284081a8b5ee676b0f047a7e3bf9e37
SHA1 877fd2e0109925a0c50657a8882696c5c394f80b
SHA512 cdef60f78ef05ca9d336433cfbbf733babd86968f335eeb2d0302a7644479b10f0f9419765fe5c758d456998b39639b30b3aad9056fde1dc92195ead970c899c
SSDEEP 24576:BG88u8FpJqH1bzria7/mXdCN/j2GLl3iFSE33b9:E7ZFPqVea7/vN/j2U4FH
TLSH
T15385F16577E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 aafb7d493bdfc0fa518f967704bcf2df6b08b2eadb40f525e885026339bab090
MD5 685d191fed155409bd39e4c7cbb3d303
SHA1 2e8025dffe7e6094dd57eb197edcf14eab928067
SHA512 9e3335e412cf6422bbe6140542b5c4e2dec22fe0a76a15a80692ecffcdbb04db094ed767885c1a87db117ad90ea4b62cbf23d93e4440a1db886fae3c35f47bec
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4N/j2U4FH:TG05lO43bDj2jF
TLSH
T113D5C06A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6779d4d9ffca77bfdb632d4ed9c6dd9a252604d2350a67a8eb3a28e8ddce63f9
MD5 f0bf469cbe24c5f5bd27aee686a3e9fa
SHA1 af7d4a624b5f7138e52bf52bc8046171059409ef
SHA512 bc13f71f9f1bd96dba46f1669c06b2ce3206e02eedecba22e902215d97307829c8230ec805dbc3ffecf75e79581d6ebca2f3cca63568eb6e060ed4f16eade3f2
SSDEEP 24576:Sfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnBdCN/j2GLl3iFSE33b9:6a5POZ3BJt2pasx2+mgN/j2U4FH
TLSH
T1FB65BF5EA6FC01D5D1B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5b05d4de4b656c6cb6c999f5ee4c7a29b35b57ffa9b0f4f0003157dbd1153661
MD5 14dd143b6131718c81d06d67e048171b
SHA1 9c8b475c56f51269b41f591db00c3de3b627c1cb
SHA512 d1b9696fafda7f9eab1ee63a01f0bb283b5a8f414048e022bf7137bddfd2842989ccd1f000aeb76b6e971606e06b195c48590809e4d72ff578368a1a528b9489
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkfdCN/j2GLl3iFSE33b9:TNc/zEOVHFPN/j2U4FH
TLSH
T151857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 af89898d4074a198b801dff1ec394dace2f12c7ef5beca9e00a1949bcbc63717
MD5 effa8f6f0985a5a9abed896de67d1939
SHA1 4c5d3130f19476b1972656cfedfb431e5aa9d3d0
SHA512 795b7ea41d6b7c9bb192d21073bf99cd44cff6e71b909b8fd3744acf46d88fd5189b440a583ff043b45cf4d714e2be5275c9fe4f165bbdc6a1baf97c30b080ad
SSDEEP 24576:1TkNvNnaFeYhJNtmZBmNdCN/j2GLl3iFSE33b9:1TMwBtOmiN/j2U4FH
TLSH
T12355AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e15bc821340812f2ce84c423551b30b899964f209afd480f0b61f5f8c033dd02
MD5 f821bb5dcfbcb506f1491c0333648e26
SHA1 ff1fe690582fb238e5dc125a6ebe51c99c83e585
SHA512 22e1e94de6c74f28a806485960438b41319619cef64870f156fc57104c1e1cfb5781d95851c3dc358075a6fbce46c805b7056bb731a7e380562f9aaa68568be5
SSDEEP 12288:oHvUrBFrEjwaQ2yJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:oPUr+NQrdCN/j2GLl3iFSE33b9
TLSH
T1D365F12E66EC18E5E67AD17D86868719F731B8615312D2CF02D0817E4F27EE8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 757e564b27fa14d496a495d73056e8e2715ebab0eaf3f07795637f19dd9b63b6
MD5 1fac8e45dd46b0c55bc6cf5d6f22e2af
SHA1 7d1ae58274fbcb5f6df6cf75741fea94672f85b1
SHA512 9362eba027ae84f75dcf52210b77b1f9b9a8b7aecb7ae213a88efa4f987856d46fcc7a558ba198b1d4c92efa64aa085898e85b47ce0dd6505264c2de8ab97481
SSDEEP 24576:YD3FHshBIYQgAadCN/j2GLl3iFSE33b9:YDVHeBIAA9N/j2U4FH
TLSH
T1B475E17DE69C04E4E57BC2BCC6638A06E77178AC432255CB02D481BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-372-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/404-370-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/404-84-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/404-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/404-78-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/404-300-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1576-134-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1576-140-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1576-133-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1576-306-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2644-98-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2644-301-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2644-303-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2644-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2644-91-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2644-92-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3016-75-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3016-285-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3080-106-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/3080-105-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3080-112-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/3080-302-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3876-57-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3876-58-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3876-51-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3876-240-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4108-369-0x0000025148400000-0x000002514868B000-memory.dmp

Download

memory/4108-389-0x0000025148400000-0x000002514868B000-memory.dmp

Download

memory/4444-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4444-117-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4444-129-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4444-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4444-123-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4524-49-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4524-36-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4524-47-0x00000000023B0000-0x0000000002410000-memory.dmp

Download

memory/4524-43-0x00000000023B0000-0x0000000002410000-memory.dmp

Download

memory/4524-37-0x00000000023B0000-0x0000000002410000-memory.dmp

Download

memory/4532-62-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4532-64-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4532-70-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4532-269-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5040-14-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/5040-20-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/5040-90-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5040-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5384-7-0x00000000022C0000-0x0000000002327000-memory.dmp

Download

memory/5384-74-0x0000000000400000-0x0000000000600000-memory.dmp

Download

memory/5384-0-0x0000000000400000-0x0000000000600000-memory.dmp

Download

memory/5384-314-0x0000000000400000-0x0000000000600000-memory.dmp

Download

memory/5384-1-0x00000000022C0000-0x0000000002327000-memory.dmp

Download

memory/5384-6-0x00000000022C0000-0x0000000002327000-memory.dmp

Download

memory/5780-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5780-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5780-116-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5780-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download