3c3cfb85a3fc5bec086020972e40f39971713b13e335cf278febdcf9db99da53

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 1.7MB
Sample261102-p1ttyah16w
SHA256 3c3cfb85a3fc5bec086020972e40f39971713b13e335cf278febdcf9db99da53
MD5 a4f77e40565dbbf11aea14ce21934fdc
SHA1 1656bc822cc7553d8ed40764a5b3c167a338b020
SHA512 9c7202854aaa9e5d359a4eeee71bfd333dc09183b2571567eb2e730262d0fbdfa7197fa11df84cce2c9ea3146fa8549a7e213668c98149d2fb97191e5323d321
SSDEEP 24576:eu6S339SSgT78fhOB95Dr47iJ0nQZo2vI3:ecNSFT4hOlciSexvI
TLSH
T1FD851260B2C0D0B2E27745B18AEACF61897A3C7958A0044F6BD8767D5F723E1826D35F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2104	elevation_service.exe
4956	elevation_service.exe
2664	maintenanceservice.exe
1076	OSE.EXE
1268	PerceptionSimulationService.exe
4432	perfhost.exe
5272	ReFsDedupSvc.exe
4892	SensorDataService.exe
2372	ssh-agent.exe
5728	AgentService.exe
468	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2f989a34b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f672eab8c86add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fbd3779c86add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e80c0b8c86add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000224db0b8c86add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b87f2bb9c86add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc4b9a78c86add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2104	elevation_service.exe
2104	elevation_service.exe
2104	elevation_service.exe
2104	elevation_service.exe
2104	elevation_service.exe
2104	elevation_service.exe
2104	elevation_service.exe
4956	elevation_service.exe
4956	elevation_service.exe
4956	elevation_service.exe
4956	elevation_service.exe
4956	elevation_service.exe
4956	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4484	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeAssignPrimaryTokenPrivilege	5728	AgentService.exe
Token: SeBackupPrivilege	5272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5272	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5272	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5272	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5272	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5272	ReFsDedupSvc.exe
Token: 33	468	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeDebugPrivilege	2104	elevation_service.exe
Token: SeDebugPrivilege	4956	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 992	468	SearchIndexer.exe	99
PID 468 wrote to memory of 2324	468	SearchIndexer.exe	100
PID 468 wrote to memory of 4620	468	SearchIndexer.exe	101
PID 468 wrote to memory of 3408	468	SearchIndexer.exe	102
PID 468 wrote to memory of 3232	468	SearchIndexer.exe	106
PID 468 wrote to memory of 3860	468	SearchIndexer.exe	107
PID 468 wrote to memory of 2460	468	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2664

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1076

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1268

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4432

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5272

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4892

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2372

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5728

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:992
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4620
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3232
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 84f976385d5e648f21f9629ac13df5e4d0b8e65c407f6fd33291c6f398a59ccc
MD5 eca77e19c52a4fd67f78042a15efa07a
SHA1 f0452e3ff3f0ef75463761d343bbbb09cce26be9
SHA512 30c3052800e09a0f54dd51291648e8307ef840d31ecf89ea5a90ea89b312657942b386a691a247ac16e227632748e97756fc277240109b4a9b87338d322b4d16
SSDEEP 49152:Nb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnQhOlciSexvI:T3q6sjBt8rSex
TLSH
T17DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 b34b960a3c05755ebfd1ec1d38662be3eaa451ebb16125dbab10cbb86923f9e3
MD5 4968f661273ff5ae1ce8602e464fd4c3
SHA1 8592af11e4011e16885110256c4f468cd3ca1ed9
SHA512 28627dd171b536c137263687495aa643ce645d35c2dbb8708322bf989f2587c58c03fa42386e344375ad6edc10b51bebc360be54164d99d27e37b609fdb39679
SSDEEP 12288:d1XLsswWkxy2lRq2czAdXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:TXYfDtczAlfhOB95Dr47iJ0nQZo2vI3
TLSH
T1EA85F12877D409F9ED67827CCDA28502DA337C9547A0E78B03A096395F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 a79c9b24c3f9b11e0a346f498e4b6045d451f3f61738f76252e811d96926e1e1
MD5 d554d04d88d99695d138e51f789d8909
SHA1 64efebf191b78c9fc1e2084c14618d221ef22eb2
SHA512 5afb8f3d489398bca241aa0ccf24f15fac98b0b5565dc85e339db2ec4bb3ce00d7cd300f271e3b162b3b9bdd2a2d286dfc17da69fda43f4e7fa8d2712b693def
SSDEEP 24576:u0Le5ji0hmxxrMYfhOB95Dr47iJ0nQZo2vI3:uPji0Aj/hOlciSexvI
TLSH
T1F2A5AE15F6788731D073C0B9C5D2A68AED72308657308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e6544d53acaef93ece8e8d0a1017f4be5b9c232d584c611a238d6c9e83da5dee
MD5 ec545642680da240da6d1aa0272b6f43
SHA1 461d920f11a6f14354af0c9634a6bd67b152b16d
SHA512 5afa938c5de0819f3a750895b1564484818deca82fe2dcd78bcc4597490b4764dd737b6a823329419bbcec38a7f69ba68d5d730c2ab25e208e2274fd33afae22
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWn6q8wyuWfhOB95Dr47iJ0nQZo2vI3:i/ezSC6vUzPveHjybhOlciSexvI
TLSH
T1C0755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 652ee3d2f6912f020e313dce06dd68a554b55ec4d17a386512b36b8c5eb3379f
MD5 fc4957df5ca3b33dc63f7aae9047dd8d
SHA1 cca628607f81c1f7669855d9785e8d53e0241a21
SHA512 8a9128958a25135b2842ac2f0ca4d2c80c446fa71910c15ad6704b45502ad45cf26a56debb109568af9972b42b2d5097e4bf243f187f6b92d893bbdfb5e972fd
SSDEEP 24576:rVbqPb88hv/l+YZfhOB95Dr47iJ0nQZo2vI3:rVO88hXl+KhOlciSexvI
TLSH
T1AF559E65F5B48331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C3E676D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 f51f0635c6931b5734982af58a90bd5a0a76a824083dad90013511329d6b4492
MD5 4630eabff8b1fda7a41a2a98c4d02aa5
SHA1 a5f27620b52fdda54ed36d0b2b9c80951987c8de
SHA512 2180004b0eb6e35c4b4644f3b31729a77e74179ca3de08defc5cbfcb16b95c306c7cafef74c40904c603d8ff4c095c7d8f4f77bd3770cfec78b4bba4faef954b
SSDEEP 12288:uLuXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:uL8fhOB95Dr47iJ0nQZo2vI3
TLSH
T1337523889FCC6DA6F3B7C7B97F9B8B02C8593DA494C10E539D00B26DE935455C2AA027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 c13a6483c5da75abaecd2fe2f8373144ed91afc7d5ca790f9caa217f028b86fe
MD5 b71c8ed4edee41667f0df831aa737dca
SHA1 eb84550ddca64debaaa7e1848aebe4e2cc5bb452
SHA512 d072b5d755bfac6d13a1ecacbee99138f1af9b7a0bb3ae832a2f5bcfb6fa80cdb15e22780e508c5dd36ce9fc45b6baccfdd441d455565c1e923de31e65e4f6d2
SSDEEP 12288:neBNUbTVO86URXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:nJIUxfhOB95Dr47iJ0nQZo2vI3
TLSH
T1FD85CF6BEE28FCE2C27A8DB85B918700D77278704B5193CBD164C20EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c68f8682e212e9496fa1a178e6a34c91a3dbf1386a43d8cd87c52eb7ced82124
MD5 a8f6d7dbee09719349e5a3c60c8c0f3d
SHA1 871faeeba35caf9a39ddb33d5887ba061b48f86d
SHA512 6bde88971d1746ef788e9221fb376f1b9e95eedcc66343202b06beef677966407ed1fd2d8f297e6bd188c5cff98d1c3117cf6c3236fc1bb644a884c08226bddd
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THn:9QvGAdlCEL8c/DRNw5CC8rSex
TLSH
T18A266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 345fd60b55603a82b3ab015fa334569e97bfcf950be2e7e8dd6c731c751c4346
MD5 3fde1b3c2c4d0ac6eb271b0cb4672ad8
SHA1 ef92a57192c343f3bc9a8b0c42d547be4eac8720
SHA512 2d975950872a18ea7c0dfc927e84a637f67bbc46254d8557697b3d4882964de3aaddecfdee0eebebfb3da2c6a81db3b8f4923b8986a88d51e7517a9249a9f139
SSDEEP 12288:LAwSfxL/2Dc3RDLLmt0LDQewsAjnXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9k:00ewsAjXfhOB95Dr47iJ0nQZo2vI3
TLSH
T18295E030FEB4E436C3BB0DB61B36C706587D7D604B911AC3E3A89A9D99301D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0cd397296c0068eb72fc89f1843e92de631d1e006dc6f02b2b5ec75510752f02
MD5 4c318ab54ad729d299fde7db7970b4dd
SHA1 4107bd9a780d0351d82b9f423b2f88f7b5ec751c
SHA512 1343560bb6a365d0c4da230a9e9a50f81f83e085e550da0ef685a398be28c933a5877818123416dcef117c771b2a14499fda7ce70c06ac2ea85beb12b99573f3
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHcek:6UEtQevvqc2W1cpV2tI32Fk
TLSH
T114474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9e075767f8c30d45ca4ec5dc7c9f924ed222c37f2ad23c458af11daab913d69b
MD5 396cc5136e0b8b86de6557a14f1e0bcc
SHA1 b9b88333423655a3f84cf46da377737c0b36e08c
SHA512 ac4bdbcfbc77cc38562f5c6e6bf9dc40289cbb0e46bf6997d7a0846070a122317f3fd7a4e8f70dcbde35a07598abd7f1448773f7d3d5feb3c26604b6ca1a984d
SSDEEP 49152:lCbRquA/m2yL5zLfFiV+XenmE3/zvhOlciSexvI:yoq2Vjnme8rSex
TLSH
T1B8D58E0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8f17df588066a57ff2d0d253c2beed560539bd02b2160c164a143254c4938184
MD5 c8df8faf3a71c0b0a4874e0403edfb04
SHA1 017cad106d18d8693c98d982697cf7b58e6066d7
SHA512 acde00dfe200655d5f1500cf8813721e570c6d4ac66ee721a14edce5918c2eb9eb88079f0a510976362086ca0e567a33ebdf317de8c9a04efcdee372114fc325
SSDEEP 24576:GAhGL3IFoiwtA5l7S53SfhOB95Dr47iJ0nQZo2vI3:GAMUFoiq5uhOlciSexvI
TLSH
T10F359D80EBF955D4F5B3AAB899B68171EA76BCA95E31C20F2150D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 66fb31527a143805c434e67b2682bdceff51a28c5c0fb4b7133e79467594cb7b
MD5 37813a1c54384a321d700d619287bdf4
SHA1 a736b01d95ee8c25d0416e6318f1dd46e99a56b8
SHA512 038d6321511d9d964a15e358ffcac44ceb187dc8e069f9562d6be440f633c8dc04c8bb60052a65b9600e4e15f18d00252f2432b0c1791d7a06b59c2b165f33ba
SSDEEP 12288:qmw5HEjsChNVBFgl0WDm+CYXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvi:jwu4OWzfhOB95Dr47iJ0nQZo2vI3
TLSH
T13F85F14577E81CF9E6B782388A97C532E7B27C112A21CB1F1760C65B6F33261AD2D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 7931640e48ff54f20b9f25970b97d4cd38cc22a8f5d2835b66bab4422440d5bc
MD5 78a25d9e0e9b5899b0154eaef0407ca2
SHA1 eb39bbff91f28ce398885593fd1aac7f65684859
SHA512 a4dd657bbc461e7b27e61618175bdc6d715088f492a873fd018a30319bc540d22196616fa71a83a697b310f8a01eb0bf960eca1dfb5294a4d1f54d14988bb9f5
SSDEEP 12288:JeZ1Iy3XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:sZuQfhOB95Dr47iJ0nQZo2vI3
TLSH
T17A75128927D825F6E2B3827C9EE64A02C7763CA5537143CF5A10826D6F339D59E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c799fb7e0b0a82f8b6ec33607cfe2ccd00d6a59f99dfd2f6ff5aa383ff0ff4a0
MD5 c5443f8be5e986cc912acd2d23a07799
SHA1 cd475559ee17ea0eceed34387891ee04240710bd
SHA512 9bf38d585f95f7d651fccbfb52f15223d6743e2ada9531f1714c5416889d46e25090af20db68a86db70eb1b67f2439f21a2edcd54c642679c5f2d264d1f39130
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ur:AQRQyi36YOcPbLvw2gAf+PN3B8rSex
TLSH
T17F667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6602ed83d2bf0144a3c4319ee40d3d6e7ed74a41f80669240d33fde1eecc8f36
MD5 25fbbecbc2be2fbe013f469bfe7e460d
SHA1 24b3c939d0bd954832207d3ce845df1fa77f6640
SHA512 246b479b748e88f8872b6030805fa7c8b57dcc7b2ca79aafdb640744d50042abb02e70a946cd5fef001dc708f7cf5ce9bc93c9ea900ff3359db063c9b37549bb
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ur:4QRQyi36YOcPbLvw2gAf+PN3B8rSex
TLSH
T198667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 aa2151c38c720b43175ec290e02e94c5324802bf1c4f903b1a45969cec23b89e
MD5 84f7f5192a6cbf3213dae330dfe58e3e
SHA1 7fc13b76381613d9dc47fbcf64e37c27229b2c77
SHA512 28059cf8b92752a08d15f0e63434b8dcbd86441e7524c1e3428614436ccae50db2578ac4ad4c3a128656212e1cffbdff96c82024064ff6d1dcd58a15dcc76101
SSDEEP 24576:7wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0AfhOB95Dr47iJ03:z68Qg55nhceWu7PNU3//hOlciSexvI
TLSH
T153B55A33B2F600A9C45DE1769F4A872196D17C758FE0E3DB8501721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 eb43f1f93a58db8308d0a4f2c28263e8b80c16e9aa543ab42d2c6f491ad2364f
MD5 8d99cf04dff6498baedd2193ed37d05b
SHA1 9c3148d9e9141461e638cff6f8a4d6978ea403ff
SHA512 fb1abcf02494f00d2cc872cee13ac9de2f7250bd99ef35a29621731942e50ecb4e3c322e2643c53802dae6ccd6ac4605dbd70e853c7dab5c4bae25e5ecf5ad58
SSDEEP 49152:l3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99R:Ey5112gYy5azzVvt69nLKnhZ88rSex
TLSH
T1B2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 87a6a40b4a034366508f809ee8bd5aadfffa627bd756e603f2c43a1f3798fc79
MD5 1d0df7c5863f60b71907e62643cf7043
SHA1 052f921168122aeb915e3f46c7efb3787e87ca6d
SHA512 1434b1e4096d3163e5931d0a9dfb169b136d18e405fc228df28bf9495679ddd231b890d544846f3797f72a94afc106ba81b3684bd05b9280757a9f412d5a1147
SSDEEP 49152:9B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glJhOlciSexvI:ju6Jmdxd2dJ8rSex
TLSH
T163D5AD13F1DA01E8D06ED478974A9233E962BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e60ab7ef3eccfe5087ff4104071feb683fba948d62ff0154fb21637e7d310727
MD5 899c7bfaab115277cbc8e6453ddef6d9
SHA1 60b7b14df243692ccb30c616d89d64d66c1ab174
SHA512 2274aaa02eb86512ac78c108b4416f3548faaeaa423c167aa7cc15d0ce651fe7a732cade7016f15a24c524778b9a9cc4ca702e4f31fb96dbb3a86971b0a413f9
SSDEEP 49152:u1hpsNoJpF1A63U44CwH7R4xFhOlciSexvI:umifPWRe8rSex
TLSH
T139B5BE13F2D801E8D06ED17887569232EA62BC450B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b292da4fe9786fca0359266bd1f086252927602e83f78af61358fddecf815a72
MD5 c1f1deafee079fb1f8fd89312f095037
SHA1 46488016708fd1ed36d7ca7e56e263e5be7803f3
SHA512 e0143e752fbd835147705fbf1841db11faac8bf98bb4cc63641b2761f3d0224b7aab46676f6514acd31aa7bb40d308b190177c720813346435c23cd82dccdc43
SSDEEP 49152:WSuZQIY0Be2KcRVtOnks6NMHqghOlciSexvI:45dKii61g8rSex
TLSH
T118C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 dd32c08b5002ad587505f14ccd79d0cd59f9f532971bab68c24c9faa59047df7
MD5 7d6b456b35898da4022f5e911d1e8ab9
SHA1 58dda5ac72a3d3cb08ea57a9b14f8b6750c96da6
SHA512 77d22c5e69b6bf115445ced24f9176eeea727718deedc07abdb66d2e89cf56524eef73810da79575b457cd0a7263aa408a992ff66e692b65836f55f78ef238e6
SSDEEP 49152:yhtSn8EApI0fig3giDn0AP5wZhOlciSexvI:zX2impha8rSex
TLSH
T18B95BE13F2D901E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 b67778642e3653ccdb8bd9a75e1ed389f90d1428916fdd74d9d0f1acd02d6d2b
MD5 7e24e795a1032a6c8215edd75025d6bc
SHA1 7a88a698095f8f3a18c30cf1019509071797cb25
SHA512 e1278e7f2af8dc3191f63edefb12d1f1527a0e58fa42ca6f168a27635e4e851f34f5291cb99573375c60438172eb5f2f3e2ec4e6c70ea69199781f8721bb1bae
SSDEEP 12288:UWXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:UUfhOB95Dr47iJ0nQZo2vI3
TLSH
T118752388AECD5DA7F373C7F96F9B4B03C85D3D98A4C10653AE00A12DF63585582AE057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 8dd1352c0a4a51065535c10924f7328f3c8c84a6872a3dabdc3bdde371427f09
MD5 67aada1c32bf01df7430546959825cd6
SHA1 68a45917a1ebdd715439028dc077af9f570bd45c
SHA512 9dd51269ae39969c75dfab76e1def860a81637be85b8c229ad1e1248ea687a1ab0df83da970bc69a0a204144daebd19d4cdfd7cc5ca36c96530c08a7a0c7976a
SSDEEP 12288:XDXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:X7fhOB95Dr47iJ0nQZo2vI3
TLSH
T1C57523886ECD5DA7F373C7F96F9B8B02C85D3D99A4C10653AE00E12DF63585582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 3aaa9713cc571fc858d75207fa17fd7362bf22a7f74cba32aa43bd7cc0383912
MD5 7caa51c5479bd188223a0f2913e88629
SHA1 4981c79dd476797d00b3403ba2fe4cdfe5ccfb7e
SHA512 1f25135c935ed128c929e397f5cb3f988d9a2dd36af31f246ba9a24c8178cba90dc86cf021aa6385d9935af07f978375cba10109c4798bd99b2b3ceaa01b5537
SSDEEP 12288:qZXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:qJfhOB95Dr47iJ0nQZo2vI3
TLSH
T1147523886ECD5DA7F3B7C7F96F9B4B02C85D3DD8A4C10A53AD00A12CF53585982AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 97f8fbea8c4575b9cd53165ccd2eec50ebf11ecab9d1146e9e716a15007d561f
MD5 46cbf1d8412e6ef3afeeba483b7ac3a4
SHA1 e66966a8fea27856c65b1075261361fce4cba93d
SHA512 b0a7b83f830a8bc83643fd9c57abe2168fe00f9fd0c7459bd76b4628cd3fea946082bf8cfc980fa41ca1f203f02ebcb6bfeabc674655bf591bdd0d2b24523120
SSDEEP 12288:lV8XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:SfhOB95Dr47iJ0nQZo2vI3
TLSH
T1937523446FDC19D2F3B3C7B8DFAB8702C5793CE4A6610B9B9E00512DAE316948279627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 e35afb89b67ebc9bbc3361c894f3cd314f4c6efde0f1074f677abdc3625ae16b
MD5 d887da8458483f52c5bdac764720c08a
SHA1 d5da38b73cf250dde22666b8c83ac6c6712b99de
SHA512 687253501ea6f7d4c62e3bb971f72dc503fc3199f0642335d40c9fc332edb619dc172b7ad585d8ed115d23a65675a5a8d1b4caf20f5fbc1422b7af0895db873b
SSDEEP 12288:DUXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:D6fhOB95Dr47iJ0nQZo2vI3
TLSH
T1E0752388AECD5DA7F377C7F96F9B4B02C85D3DD8A4C10A53AD00A12CF93585582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 d3b78a2574c818e3a7bbc0bae663aca0a5ba0b261d179617e713a861c0179c8a
MD5 6bd2ef1bbd526005be3014853570d332
SHA1 cc2932883d340f0204cde946dcb745acdd47787f
SHA512 a291b1dae5ac90feb565a9b4bf13a86ec8e55d90206294ec576815cce826477a61038ac6ece0f096a8b90ef941465d6bb1a078941da6e110979776f9098f94e9
SSDEEP 12288:pvXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:pvfhOB95Dr47iJ0nQZo2vI3
TLSH
T1AD7523886ECC5DA7F377C7F96F9B8B02C85D3D98A4C10653AE00E12DF63585582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 c270dbf7c15b5b05fe740b296ec739a683e0bf208d80774d7104362386897784
MD5 b386db8aaec0dac620d72ad17da3f478
SHA1 3b942bf29f39e936fb02afbb8c8e86b83cd2a98c
SHA512 2f3f02433367fff98826c5456c503b39c78c2f04363512266a93301b94a4786e73527003c00cd95753734839347fcb13f3d87fb0ffbc5c2ad1eef68281a3bafa
SSDEEP 12288:abXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:ajfhOB95Dr47iJ0nQZo2vI3
TLSH
T1AD752388AECD5DA7F377C7F96F9B8B02C85D3D98A4C10A53AE00E12DF635455826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 c93f604f60195e5a0776526eecb269fb1fa67bd9e5c3cb5dcdef159ba180e4fd
MD5 e9d20956dbbf5978f94e7a9597a53888
SHA1 c7e82d9608d07e5c5deea21cef012914a75e1238
SHA512 ee194e78f80b3b5d3b0cd363ab4868003987bd32078edbd80281ab0dd02d038467cc7fdf2f9873f039e6ce5b55734eb6bf0b3e6374d231858ada171dd1c9ba85
SSDEEP 12288:piZwbVzzFEoS2cPvyjXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:sZMRzFVSObfhOB95Dr47iJ0nQZo2vI3
TLSH
T12A850294B3941CF9ED73827ECD568906D6B23C5907A0C61F17A4322A5F333A14D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 dc70338d8602eb7f440b7820f1ba99aa8769288c068ddbb8a7308437cd826b5f
MD5 b0c1aff1d9a4806b9dfc12fc6d277972
SHA1 54c264e0b7ed6ee7e996b529553e756c9c7d1b61
SHA512 e781b4ccb05aeea8bff54b4d1f0dcf01cca7149bddc4673d19f9aeda34414fac5eecba12a1031289d4b96942ebed844b31be1f7555e65a2867acf12574ee55be
SSDEEP 12288:7aXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:7gfhOB95Dr47iJ0nQZo2vI3
TLSH
T1D5752388AECD5DA7F373C7F96F9B8B02C85D3DD8A4C10A53AD00A12DF635855826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 9231beb20358f03f86835d6d561fb5ff87704c0f21d52912314efbdbb951fc91
MD5 da1c770c87839488e0493448147dddb6
SHA1 578c77647f5e8f59a5e55f68f1f7b65fab6e5d55
SHA512 d22f3217ee9e79ce512152581c4433c638ae37c544b26ab2bba70d0a4c6fac63fb005cc5a064fa999d4ada5941f5c6b26af6e50daa7200d98a7a222759ad1267
SSDEEP 12288:K+XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:KMfhOB95Dr47iJ0nQZo2vI3
TLSH
T1387523886ECD5DA7F373C7F96F9B8B02C85D3E99A4C10653AE00E12DF63545582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 d95e8471366ed52c654db25f076057f68a14b224c62ba05ccff5a976344b2080
MD5 a58f10329a4f6fee1c02b55bce5c3ce0
SHA1 7651c426e9af1daa13b6cbaada9434b9219b4e0d
SHA512 f31f8fb6a4ccdc81453b355e1686f366ac0a7b08208656fe96ee5bf16624dcd0403c5fc95a99fec66d42f705229e54457a1d64cd7411dd57369cfd9007c088be
SSDEEP 12288:hyPz5L83XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:wzynfhOB95Dr47iJ0nQZo2vI3
TLSH
T18685024777A530F9E27782788DA30A02E7763C7547608AAF5750437A6F336909E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 724752c1ddea167958d177c073424fd479c8367979e1e0916d7acac68cfeca0a
MD5 390cf3e6b940fb896a63947c1d2c5e67
SHA1 f81829252f001b99970be4fa44acf430d7ae9a94
SHA512 58b0eac7a98856871a4778faf8b7e6faf7c8d167a4f55d35fd19692ab67afed3776c6957d0dbf71a9debb7826af65af4a3733cce340b73209074d37145090db1
SSDEEP 12288:GaXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:GgfhOB95Dr47iJ0nQZo2vI3
TLSH
T1DD752388AECC5DA7F373C7F96F9B4B02C85D3DD8A4C10A53AD00A12CF635859826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 5a9250c21c51b93831800ff4a6544258697cef067c1ff562a66c781635c8a3dd
MD5 47ca4d71268cdbcf3e0bf0e87dc56eed
SHA1 1d85101257590f91c1211ce11c78b71f59268b72
SHA512 1fd48714822ee3d75658dd0442b509b050ed97bf2c1f5a3ade043e28ee97cf978a71f55b81b8a62a4a9f607aeadb6341551b231f11d45b5b33c5965bddb20376
SSDEEP 12288:laXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:lgfhOB95Dr47iJ0nQZo2vI3
TLSH
T1867523886ECC5DA7F377C7F96F9B4B02C85D3DD9A4C10A53AD00A12CFA35859826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 bf522b55b43fbb5a82c169896bf942bbe9eb133bed7c0a7ccfa38c4c628d75a9
MD5 7d6c6202c3c2c8009332423b04c7734e
SHA1 24b1e13f577c41cdc64523f91d6f0354db9e178a
SHA512 657ca21f7bbfd8a93c4a8863b7e8bcbfca3e993345572ff0103d909f2fa07c1f563517d81f0828f6556819bf51ec954d5bb4e63a1a049c651449ee9d440be7e2
SSDEEP 12288:myPz5L83XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:bzynfhOB95Dr47iJ0nQZo2vI3
TLSH
T15C85024777A530F9E27782788DA30A02E7763C7547608AAF5750437A6F336909E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 1b296818d1e2470ece0b6e5e3ff6e935b8b3afc9125ea79fcb0c13e5435e6c19
MD5 53039f72606aaeafb182d589cdd3c061
SHA1 3815ce77ecb1571cd7b78b1f572a5d9b72f39559
SHA512 1cd320a5c5c64a44a78c6e1b70201371f5ac3479d4ccd38fcb1ef421d032b1c71be853e869a710f94eb087bb1a93d7a70bdc3262a32fd4fc01a8824e23231111
SSDEEP 24576:/TDaLl3z0zD5fhOB95Dr47iJ0nQZo2vI3:/TuLljyhOlciSexvI
TLSH
T1A1850294B3901CF9ED77827ECD568902C5B23C5907A0C61F07A4366A5F333A15D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 f6b44de104b1efba25ee08c9d3779d9df9a798d999f016fa8e12f77325379c17
MD5 6b0523746470a17b645c5df24f8aeae4
SHA1 914603f3614a72223624f0db38562eead837d836
SHA512 f0800056ecacdfafdc7d99bbb644f9914f46d1a6fac0302b1665b77a855b3e54fb1d67d1a360465f09e5a273c39717cb2ea6a6699ed6cbd4bf72ed6e4541038b
SSDEEP 24576:r3vd9CHKy7GZdfhOB95Dr47iJ0nQZo2vI3:Lvd9CHKyanhOlciSexvI
TLSH
T15695CF90F3E814E9F1B7CA358D764502CA767C995B61CE8F03A4661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 b31ff04c3466f03a46bda3eaf75882b599d4c179f12a42346245dcc6ecefd543
MD5 e78099b76b4f8c85b806917bff8cebbd
SHA1 634ae8d3b83d5f29f5c085b7320541085dea2173
SHA512 9c9279accc0e34325ca939fb73b76c8b01383ebd8821b5bd6c15c859632ae71a455675591887a043fef4b582d28ca281b2ff440790bb02ac1636c15fc205c1cc
SSDEEP 12288:b5XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:bpfhOB95Dr47iJ0nQZo2vI3
TLSH
T18F752388AECD5DA7F377C7F96F9B4B02C85D3DD8A4C10A53AD00A12CF635855826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 c41060cb141a70d64b6a99231161521398c2bc3831217b921970e70a237032cf
MD5 d83b98c19ecaef9450ef872f261eeeaa
SHA1 ad09e9dcdbb7d9e1fa8e514df3f5cb0fc202b169
SHA512 d0b63b63ff1744a645f699825e0b51e22b3e1842f219dfae68efd12636c107b381266b8ab4809ba0eb700bbb831794fa6e0d37c6877ecb50dd6adb7ad036cb11
SSDEEP 12288:9XXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:9HfhOB95Dr47iJ0nQZo2vI3
TLSH
T1D87523886EDC5DE7F377C7F96F9B8B02C85D3D98A4C10A53AE00A12DF635855826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 beef45cd16e24aec80be14728285132e83dd93061cdcf1d370e33b5080ef4129
MD5 c2c4024e217d1359f97a6b3a6e88e1fe
SHA1 a944ff97bca3d85203df6d5f9fe5bc8c2f80396c
SHA512 0be31bb353e81f44da64adb6be93caccd5dcea684762e8623b22fbafc15325a076b091e3441434d9146b8557840f42ab638384e208b1681cc5d3dfd20eb6c921
SSDEEP 12288:HQXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:HefhOB95Dr47iJ0nQZo2vI3
TLSH
T1747523886ECD5DA7F373C7F96F9B4B02C85D3DD9A4C10A53AD00A12CF935859826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 cb9401d2e7df8db3bdc82cfb3136d769ff1614ac08a86fbbb4bc883daf06bee6
MD5 cae9add97ddb635266cca5b6aa59a131
SHA1 9023372d8a0c304ec38bfeeefbdd6e922ae00f2f
SHA512 7d06ce0de55707ccec765ddd696cf21e624e2114fdca7309cfb40d03e3219467b492f8f71e65ee6b4f17e5196a006420bc1a8e3c348f3df66f3c156721324e62
SSDEEP 12288:zaXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:zgfhOB95Dr47iJ0nQZo2vI3
TLSH
T13A752388AECD5DA7F373C7F96F9B4B02C85D3DD9A4C10A53AD00A12CF935859826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 8251a28b1cb0f8d6797e220b2c9ad48e2443e7ab66a4f54e040159e3cea6b91a
MD5 474a87b9de72e379c4cbd4bc9a534d65
SHA1 93b3d76afda231b14c8f52bebdd6362bd4c21153
SHA512 0b44f37c618c503f1120198a9d9ea766cba413ad4d4fc8d7940884c6de1790530659ab5711455c24bb37ae47aa9d3273804931dedaee2839ce4f4e1d04eb9a2a
SSDEEP 12288:r5XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:rpfhOB95Dr47iJ0nQZo2vI3
TLSH
T1F6752388AECD5DA7F373C7F96F9B4B02C85D3D99A4C10A53AD00A12CF93585582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 e69edcd1670889d765e8e3d95e63ebca029a253475ca4a4a5055c39a695dd465
MD5 8414b4dcfbaf616881c9ecc23050bff7
SHA1 7344a878b688d18b5f0f5ce9b786ede72d324de5
SHA512 e55b5200a155114fd743980bc42cafbd06e91ae8f360cb1ca5eaeef5365bad216643f21df462013e4cf9d12aab335e33a12a9e4f33f591dfcb286804a8d9ef58
SSDEEP 12288:uSXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:uIfhOB95Dr47iJ0nQZo2vI3
TLSH
T1847523886ECD5DA7F377C7F96F9B4B02C85D3DD8A4C20653AE00A22DF635459826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 fadba18b110cf7d38a3f85b71b41f8e951abb698760c5506c049ccf48223b235
MD5 619d2f2a8111ff8cedf58dc714dc9f40
SHA1 15a62aabc408274cf8a20fae512547acade24ea9
SHA512 130e76069dc8bd4583f1e2e84d11d2f585c081682fedf221ea5978dfe71a4bb9800ebe6e303058be45df4f3d71dba5acbb553adc0d1862564d75655d3d2fe415
SSDEEP 12288:WUXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:W6fhOB95Dr47iJ0nQZo2vI3
TLSH
T1FD752388AECD5DA7F373C7F96F9B4B02C85D3D99A4C10A53AD00A12CF93585582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 c2bce122a6e3d2815cd2379277bb8140ad1c6ae6b7f1c0aab548b09e3a215a6d
MD5 ab349dfd50794c1c3ed09771f4c6bdb6
SHA1 0190255ad7b96ced5db8691144f6e9bca11ca416
SHA512 f2767e16ad7e51e83dba8fc6efff258880a5554c1b651bba9c993c9a63181133b533ea49b76bb3415529ef8c6f2de485ea46d6c45fed59d8e1ef02477966ff88
SSDEEP 12288:ThXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:TBfhOB95Dr47iJ0nQZo2vI3
TLSH
T1207523886ECD5DA7F377C7F96F9B8B02C85D3DD8A4C20653AE00A22DF635455826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 5d626a8404b5d0e9aea2e788cb4f2bb889254cafe745f1cbd7a33750fa76c00b
MD5 4783eacb8fda93cfe1baefcf96ae2e0e
SHA1 7f5986a4f3957a99994136ebeb59af3bcc0c82e0
SHA512 f4cc0cfe5bf22e18642c5e4f812d3ac378ef3023271b22fb9e5aaa4477ddcb81aa35bba89c8dd4a03d6b8d46aeb906c9b7a9defc43889e28dda497aa38165310
SSDEEP 24576:EfwvUk9RX6wkyAIcfhOB95Dr47iJ0nQZo2vI3:AMnYIchOlciSexvI
TLSH
T14A95CF29EBDC08E5E1B7923C9DA7460AF6B178681B31C6CF0259536D0E33ED45E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a13e60025c3f55ab70f2852ae46da225ba9cd0fb37118185581271ca5103e065
MD5 739cfde38367c543704b9f09d0c6a95b
SHA1 2f2731c01bc38469bb8be3578b3ae28895d7f010
SHA512 7040afba12d3bd5dc877c32a348609a3f9dea2926962844be49f46745d0255bc05d94b3f5a6b5f60a32fc335330c803156bce509411e149f60e215e7ac85df47
SSDEEP 49152:WYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05hOlciSexvI:1ySzPh8rSex
TLSH
T1E0067C96A1A801D5C1B9C1B98F1BCC1BFA7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8c8afc887b5c4c52e84226471b4963cd9604e9b7d4eb81557073eb64f28df201
MD5 897f4b5a9525c67b9ffaf236373efaa5
SHA1 3388d885ad82c073c5a1aa3e58cae0c907e8251d
SHA512 d4d07f863cc5be014f3525da20eb6d618d303bb5e46d0e90b2dac7cb87a21922727d6a956e33c1bc5338ed01198511034ab71f5a42389c8fc86516ffcf6112a3
SSDEEP 24576:F47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYrfhOB95Dr47iJ0nQZo2vI3:F47JUQjTirIhCnDHUPfF/JhOlciSexvI
TLSH
T1AE65AE1DA3EC01E5E1BAD27889154A1AEA71782D5B31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 d2af9c862f132ecd551e2e7deba33f3d340b1cc0034fddc16dd7f83c38e4a7e2
MD5 d0b33dbe84ff2f9f97ff72173acc7a65
SHA1 59b70777a60bbde37154b6c440f54a130ee15505
SHA512 b885504caf30732b506439c68580e96ee2265f1e4419cb33b86ac8492455ec4af17b0dec9aabe14605bdc2159f4b9c82022fb8ecf6c2e2631f05c76dbe6371d1
SSDEEP 12288:kbsfKXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:bQfhOB95Dr47iJ0nQZo2vI3
TLSH
T192750149D29802E9D16E92B9CB568A01F3373C6493E1D3CB57C0F53E1F366909EEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 ab9c92d9351b36d8f5a37676a0387334fd610f0a298e1865bf2754d95ba23543
MD5 b7eae4966f4b106c2a7ee795d71993d1
SHA1 2899c7efb3086e0c2e8e7e1b0a3e3ba00cfe7404
SHA512 c0ffbf07f12a81fddc37e4bc5955054674bb40b4286635ebc5cac1ed86f2e8628a59655a8386c488e1fbf87e4f8ef3df80f6e2ebd825f0d6c7414638ee476914
SSDEEP 12288:mKS8vz/n5Lw53hYskMpFf+neDzX/K26UpC:mKJbnVg3hYs9p0nMzX/76
TLSH
T17D3528017666CA8FC6A940325E33D1CCAB707D41EE44AF0773C9973FD576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 e1bc30bc3dab7a43a4952e8a5a9fc59153c1588cd8102dd54a81f651bcf41192
MD5 65803e95075f67576195e932a5ea2c05
SHA1 93ee711a6ebc96619d8960c4258be14870d9f459
SHA512 915956fc6c0e5fe6701bc3af2be98d0cd32612d6d67826e5fad933942b5e19091e747dd3f14a50634cba0b38753f2cc2486344f3c7e0973555444c370f9b2874
SSDEEP 6144:e08fFf08rlWlWS/qn/H2P20P6PR7CYght8E+BGyLo+caLtMxAmLtMxAb3gSQ74:e0Yh08r3P4d0R7CSnLo+cZ
TLSH
T1474508815437D6CFD1BB5032072A5B8CBBB4DC16B7096F26B389543AD82AB51A4F93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 6bce47de67f8732d9eae33094115d1d9fc440288318734e30b01b5ee8fe68b90
MD5 bd1d71d9edc3a052540f77777e081433
SHA1 6224c2b9b28668d9aa4b4aa1d9460255ff78b28e
SHA512 f7e7af52d16a74aa2e4e527773b70e188fc653eec190a3bfeca135e9623c2315e920130f219499be93aecb599f0313f0146e69b55639afd8e034cbee6f4c7c76
SSDEEP 12288:6F7CXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:24fhOB95Dr47iJ0nQZo2vI3
TLSH
T1E3752344ABCC5D97F3B6C7B46E9F8702C41E3DA89B8045D3E900A26CF5318C5CABA11B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 36a13a15fa96b45db7506bdfdd52a22c41fa5961244fe03ea97623c51066192c
MD5 8ce8c07a15d7670d0cab49d808223add
SHA1 0ebc8c4741e4237e4e52942257524d018e18f0a6
SHA512 c47532e941c3c5f968819fbf696e1a81a4eece1298d8ef3021d9899c89bcba5158e6580644feeee8bb6d1ad30fa7c624fabffea9d1872939eafb3d1caeb5cf03
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYWfhOB95Dr47iJ0nQZo2vI3:mgb4mBIBhGFDhOlciSexvI
TLSH
T12C65AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 def05744cf375975d0e5502f79aa59f9975e3311fad4a105ef70886ca408b06c
MD5 40ca774703c011bae7b858729998ff68
SHA1 3226b534d6fb9b6a5842a76941e794229c8fd7ba
SHA512 86f6c57d70eda07443bc15d4fde03e340afbca4774a6d82f1afdde79ee0ec9cce0c01152ab8ef12efdb4745301425f67ff31d7a27ebcd322c8bea893abbff63b
SSDEEP 24576:uG88u8FpJqH1bzria7/mbfhOB95Dr47iJ0nQZo2vI3:l7ZFPqVea7/KhOlciSexvI
TLSH
T1D1A5F16577E401F1D077D1388A864663F6B2B8250360EFDF0BA88B551F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ba10d1d4831852779cc2d02b8ba264a5260f4e35e81eeb70ad90971b3aa17e10
MD5 31ce22beef525a7f546472bef12d82b9
SHA1 13064b264979d205db00b84db75fd20c43522050
SHA512 64beb95126790c2a6837ee912b9d7303b69e707a469d6667b1ffecfc9daf5f612bcbdee10f7eddd23f290d87e12b3c07992747ab98f7bcfda7cd85d4a623e4f7
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXhOlciSexvI:hG05lO43b08rSex
TLSH
T1F1D5C06E62EC11F9D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 67d86c27a5ca08ac1a95b14817113b1e0fcd714f298e9b2b129a476b30a0be56
MD5 f0ec71f526b7b54fafbc135cac873914
SHA1 a21c757622e8338e9ded96d27208af81a53094e2
SHA512 0987f96e1b9019609878de7371cfaea0ec6c6a3e56d634800140e7068608d223d2d2ba7daccfcc45715be82bb703ad7fbe477768ca03b7c985cda31e13354c7b
SSDEEP 24576:Yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnFfhOB95Dr47iJ0nQZo2vI3:ga5POZ3BJt2pasx2+m/hOlciSexvI
TLSH
T1E465BF5DA7FC01D5E1B9D17DC583861AE5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1d77bbfba32fa0e413d160752f67a445eee7f6b7604b39a113f733e8d9d31b31
MD5 05bc3583d9e68aa6bc04534f7adb2894
SHA1 3dad0e27f545edd5786d552f5ee4fb8c2fe5795f
SHA512 c90ffa4cf1a8f6edf3d86befdb25ccb91b7f76c81f2eae86f5aff28694cee7534c38679bfbeb19b172602200cdda7a866785e0590a76a9f38d03ad68663b2d7a
SSDEEP 24576:CNcwHdjbyQ4nLC18lb/EOjowL7FkTfhOB95Dr47iJ0nQZo2vI3:CNc/zEOVHFqhOlciSexvI
TLSH
T12C857B5623E901E4F1BBE1BE89679646FA71786553308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b18bccd1b425d8ed110e4aaff3b033933d984d6f178ed6c8eee6d5fec596a04c
MD5 5f739fba73cbd43213622efb1c243869
SHA1 a074a97c3522261982d00ac610234523c12e2f93
SHA512 afd0c97df49b93c9fda9fa2728ad3093060358cd77b2a7a16c236258a4b4cc83b93a73da85933c5263e00707848a21ec3c803596435f55a7d476aff085fec84e
SSDEEP 24576:+TkNvNnaFeYhJNtmZBmBfhOB95Dr47iJ0nQZo2vI3:+TMwBtOm1hOlciSexvI
TLSH
T1F155AF6EBAF806E4D1FEC6B4CE238512E6727861073253CB5290C13E5E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 0aeddd6a47e8b99fbacc625f7223093345df0f523a75d9e213135cc87bc4dd60
MD5 0105d6d9bc8e75ba9af24bf01f09c78f
SHA1 2c1345ea39835004ef6a7675a93ff50d594ca37e
SHA512 5c2e24edd440e279b0111129a00baa605bd169463131dba06f7ba66c09c931035aa59c2a3c60950e3d675d715c1a044819fe855e97a787c4e7dd04e748313196
SSDEEP 12288:1HvUrBFrEjwaQ/XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:1PUr+NQ/fhOB95Dr47iJ0nQZo2vI3
TLSH
T11D85E11E26EC1CE5F676E17D8A868709E7717862131292CF0290817E5F37DE8AD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 85a22e3dee06426ade4eb5dc1cb51b075b45665de6ff3fc72a2daa2eef0f099f
MD5 8a9c6978d9fde5c5a108ec1f360b6aaf
SHA1 1c999a005ed5db09a00ed9e83e33bba77d138a33
SHA512 378c61bbf7dc955d09723e57fb3d1474a44e43b813c221838ad1b92d6472fca3001865a9167e1ba8cd48419086cf4aedb054948c847a9df1f0e338b38acb43d3
SSDEEP 24576:ZD3FHshBIYQgA0fhOB95Dr47iJ0nQZo2vI3:ZDVHeBIAAEhOlciSexvI
TLSH
T16495E17DEB9C04E4E57BC2BCDA538A06E67138A9032156CB0690C1B95F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/468-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/468-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/468-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1076-217-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/1076-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1076-54-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1076-53-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/1268-251-0x0000000140000000-0x00000001402AA000-memory.dmp

Download

memory/1268-64-0x0000000140000000-0x00000001402AA000-memory.dmp

Download

memory/1268-72-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1268-66-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2104-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2104-13-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2104-87-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2104-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2104-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2372-120-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2372-114-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2372-112-0x0000000140000000-0x000000014031D000-memory.dmp

Download

memory/2372-311-0x0000000140000000-0x000000014031D000-memory.dmp

Download

memory/2664-38-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/2664-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2664-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2664-51-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/2664-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3408-398-0x000001BCE0050000-0x000001BCE02DB000-memory.dmp

Download

memory/3408-378-0x000001BCE0050000-0x000001BCE02DB000-memory.dmp

Download

memory/4432-77-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/4432-83-0x00000000009B0000-0x0000000000A17000-memory.dmp

Download

memory/4432-78-0x00000000009B0000-0x0000000000A17000-memory.dmp

Download

memory/4432-278-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/4484-76-0x0000000000400000-0x00000000006A0000-memory.dmp

Download

memory/4484-319-0x0000000000400000-0x00000000006A0000-memory.dmp

Download

memory/4484-0-0x0000000000400000-0x00000000006A0000-memory.dmp

Download

memory/4484-7-0x0000000000AA0000-0x0000000000B07000-memory.dmp

Download

memory/4484-6-0x0000000000AA0000-0x0000000000B07000-memory.dmp

Download

memory/4484-1-0x0000000000AA0000-0x0000000000B07000-memory.dmp

Download

memory/4892-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4892-312-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4892-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4892-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4892-101-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4892-107-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4956-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4956-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4956-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4956-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5272-379-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5272-95-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5272-89-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5272-381-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5272-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5272-295-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5728-126-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5728-132-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5728-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5728-137-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5728-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download