dd3c9a37320e85f0e0b884be147a137eb9bab5b7f0542843d1537b03d786b218

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 1.4MB
Sample261110-2ry4hsdw91
SHA256 dd3c9a37320e85f0e0b884be147a137eb9bab5b7f0542843d1537b03d786b218
MD5 35d73d32e6cddeb9fe52903c1b5d7844
SHA1 1db4871494061795d73d996f638be8a69ed380c8
SHA512 b2595b46d8a79ab62410afd2602b4699e80a2d1f9cca8e79b59b9ff2eccb8459796ade2076f1c7affd5319e777471f20f1f69d7decc740792427c384abffb5d0
SSDEEP 24576:Au6Usg9SpgT7aSnnrFb4PM4MYgLxEVyGLV:AlySqTZj4MYPVyGLV
TLSH
T10D65027271C0D0F2CA6B147181B9CAA05A3A7C7AA9B0900F3BD8797A2F733D1456975B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3616	alg.exe
2924	DiagnosticsHub.StandardCollector.Service.exe
2052	fxssvc.exe
1144	elevation_service.exe
3520	elevation_service.exe
4484	maintenanceservice.exe
3340	msdtc.exe
3052	OSE.EXE
2732	PerceptionSimulationService.exe
1268	perfhost.exe
3792	locator.exe
2472	SensorDataService.exe
1832	snmptrap.exe
1320	spectrum.exe
2660	ssh-agent.exe
4264	TieringEngineService.exe
1300	AgentService.exe
4340	vds.exe
2664	vssvc.exe
2032	wbengine.exe
4312	WmiApSrv.exe
4232	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6d3cf99a250d612b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b00fbcc6571dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9bc13cc6571dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000000941cc6571dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000cd207cc6571dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3be7bcd6571dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000848842cd6571dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
2924	DiagnosticsHub.StandardCollector.Service.exe
2924	DiagnosticsHub.StandardCollector.Service.exe
2924	DiagnosticsHub.StandardCollector.Service.exe
2924	DiagnosticsHub.StandardCollector.Service.exe
2924	DiagnosticsHub.StandardCollector.Service.exe
2924	DiagnosticsHub.StandardCollector.Service.exe
2924	DiagnosticsHub.StandardCollector.Service.exe
1144	elevation_service.exe
1144	elevation_service.exe
1144	elevation_service.exe
1144	elevation_service.exe
1144	elevation_service.exe
1144	elevation_service.exe
1144	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeAuditPrivilege	2052	fxssvc.exe
Token: SeRestorePrivilege	4264	TieringEngineService.exe
Token: SeManageVolumePrivilege	4264	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1300	AgentService.exe
Token: SeBackupPrivilege	2664	vssvc.exe
Token: SeRestorePrivilege	2664	vssvc.exe
Token: SeAuditPrivilege	2664	vssvc.exe
Token: SeBackupPrivilege	2032	wbengine.exe
Token: SeRestorePrivilege	2032	wbengine.exe
Token: SeSecurityPrivilege	2032	wbengine.exe
Token: 33	4232	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4232	SearchIndexer.exe
Token: SeDebugPrivilege	3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeDebugPrivilege	3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeDebugPrivilege	3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeDebugPrivilege	3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeDebugPrivilege	3192	2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeDebugPrivilege	2924	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1144	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 2220	4232	SearchIndexer.exe	109
PID 4232 wrote to memory of 4688	4232	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_35d73d32e6cddeb9fe52903c1b5d7844_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3616

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1800

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3520

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4484

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3340

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3052

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2732

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1268

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3792

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2472

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1832

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1320

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2660

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3344

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4340

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4312

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2220
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0bc6f73492bd7679e8d5a3c8e42c9b42b49ace627baa1da67d73f995bf061c0d
MD5 5efa28e8eec018792047e2ad8e098976
SHA1 c051b6f6de73c76d716f298ed56d1bf4d7311134
SHA512 6e6951218679b55f08f1d2e3e366438d6786f89b7d55643fc01fcdd6e95ebe23c80eb0c8c10298c074dfb20e2a608878365c6960484a7cc3543ec9b75eafae80
SSDEEP 49152:Db+632BuPkFKRrdE6ohmstBhuXjfS4LWxngj4MYPVyGLR:h3q6HjB6VN
TLSH
T167D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 eb2e51c1341cbce472d2c7a0db11cbbedd484948c9e85505ca973b7ca668e54b
MD5 f538d26b8856275320481c28eb4775f6
SHA1 9d82080926de3276eb7eec23a3399a208f0fd8aa
SHA512 181a3d4f8da2fe239cb7f322018eee2ad97598ccd19e4ec13b777f7cf08ab0f99226b449f2b4da5f0878ad59bf5e6c0257fe690f0ff77e8a41844468e7423981
SSDEEP 12288:f1XLsswWkxy2lRq2czA934XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9C:dXYfDtczA6SnnrFb4PM4MYgLxEVyGLE
TLSH
T1FB65F12977E408F9DD6B8278C9A28545E633B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 adfa91be7b68c1a187bfac00d7b9ad8af7d854c7406c35a70dcf42181a9a33b9
MD5 0382b48488ead91646e9ca6a2f551d32
SHA1 3a20b9dd58233089fff179471ca773cebfcc0617
SHA512 ed86b31d7b62feb5611385302ae3d639a6571aa918e983567c2ef2d153937f35d74b1a94cb403b62c0643d84a0ecaa45d6727f350f862b38a8b160bc5511659a
SSDEEP 24576:Q0Le5ji0hmxirMvSnnrFb4PM4MYgLxEVyGL9:QPji0AcLj4MYPVyGL9
TLSH
T1A8859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d675eb73df8aec37721f7bd01baf8075284c3e7edfe0bea8a24d7783d84381ee
MD5 1fc45e0ea5dcd82cc456728786e95e1e
SHA1 d9227d38ec90e9186eef3365ee807daa22329e3f
SHA512 24b7e5785bdd4056dff2611796f2d0e3d3c1b78f91db91ac146aba3c721f953eac0ff8770df906969a21f7e81fc98d28928b53d511ca9f209ce8dbb05f7c197f
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWE6q8wyuxSnnrFb4PM4MYgLxEVyGLM:m/ezSC6vUzPvxHjyfj4MYPVyGLM
TLSH
T15F755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 02d11afbde82f01385adfa625b3d3fc32e7e3a1ae9949d639dd948943643acb2
MD5 f47036c19669a3cc429c418ee1c1e47e
SHA1 9a41681e680d9becc1475f40de8474372cb9037c
SHA512 8e569e6a03b0d51ee2fba82275cd4268128086cf7ddb61381f735e053bb9eec58c0c1dd6f3fce60768d9c8e4af97b195b7110044df96e9068347ba08c6f64c34
SSDEEP 24576:ZVbqPb88hv/l+62SnnrFb4PM4MYgLxEVyGL9:ZVO88hXl+sj4MYPVyGL9
TLSH
T19C559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 221e102ddc47cedd11a998361ca170230cbdb2d28dc82603517e0182c1e0319f
MD5 0d5ff99eeb37893fda56730d3440d383
SHA1 2f8eb80c80a72f9afbe501f1292ca5f328d2cbc9
SHA512 287c059054a6e18ef55713a7ce74c1c19843b4e2133fcb66b24e2ce978ba9c50628438edeb2fe1bb6c31b4731f4f2a03346ea7e7b789fc46431921c6e27662b2
SSDEEP 12288:URo34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilf:UR7SnnrFb4PM4MYgLxEVyGL1
TLSH
T1A34523A75BDC10EACFAE15B0D1B96AC8E2157C61F875B10B6750785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 15992a6a887c70bd69b0a58a335581f41c61ec7a8211aeca983535e8d947c1cd
MD5 033dea002504c6d6cfa21a737eef16d0
SHA1 e864c22248b762db8a8ca9eb43841a58ebef2b12
SHA512 f2491b515685d0bdb7e72272c6cbd554b8bc067423fb43edc207ac17f07ee74065dfcd0ed0237869d1e0d28dee4c191c5f477dffbef89c9f586f5252d5f72551
SSDEEP 12288:ZeBNUbTVO86U534XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:ZJIU+SnnrFb4PM4MYgLxEVyGL8
TLSH
T12465DF3BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8357d492e2e6ecb41caff77d33d982502c1bcbb15e127dfd0790e9ea2681821f
MD5 3f08f8eba58467020e549e0814e080cc
SHA1 06fb9e642d8a96e6966bac259dc9466f7d83704b
SHA512 3481797458a48a5e5d12c5a5606e00edbb556bc733d14bdca308e42fbe1698a655dcd11e66fc74225dc8cfb15629a7def45e0aad5867c6f4306926bf1749dc7d
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THG:aQvGAdlCEL8c/yRNw5C7VH
TLSH
T1F7267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4ba95326918d2a73170d0487e6c0728f3ae6b61fc3a79ded4cdddb347c70bde9
MD5 39db0e91a8207480c89ff9b529ac1e41
SHA1 45946eb8813f2773b1a64b3ee2345b82f35be2dd
SHA512 9dd66c87e1622c465fa815a0bf59b4459c3286354fcf098e79f5c3f686c612420534dc714dc6c6b2367470b81621dad0c1b36e70c46871118ca5a814e67c1fa8
SSDEEP 12288:VAwSfxL/2Dc34DLLmt0LDQewsAjH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAB:2dewsAjISnnrFb4PM4MYgLxEVyGLu
TLSH
T15275E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1fba283602cd09bd8fa623d86f927956c53414c89659f1d113a2a2a5c4b50db0
MD5 97faac3b4ef177326325b51705e0bfc5
SHA1 ff6d942fa578c83d2de3f34ce6e61baee900781b
SHA512 56c071bf6575074e97c9d827759b10896f16e23e78f5d4b2b8cc4ccb682bc349760d2326e729092ffeabb765135a33f5223852418e1f839a53e6989574c34345
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:vUEtQevvqc2W1cpV2EI32
TLSH
T1D8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5925972ba4cb0ab5c69000a19654a4c5655048cb953b41009e45629b885e31ce
MD5 29703d4c8ce91596d7a4b9c7dd471caf
SHA1 5d24127339e46695fbeaf78e2fe12cdbe8f86741
SHA512 302100c9fda62e7d982077bcbcca5e77c500779d65e3fa4366805627078b0e74e234de0973fff7491265e41feeff14d83602fcf151bbdefc1d88ac8d31c4b4fb
SSDEEP 49152:wCbRquA/m2yL5zQfFiV+XenmE3/z7j4MYPVyGLg:ZoqtVjnmfV8
TLSH
T14AD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a8586cabe308ddba71942beb76e399db087216f6e18c962c192650739b085800
MD5 f782c25d31495df3f1e8cc21a735d573
SHA1 55801f188030981e7f0901e5d76ace6e552d252f
SHA512 85a2c57184e35c04eadd5cebf82bea62b5423feefb5110b8ca2f195edfa7c6900f4b2380bdb59c1a752de13e1a66f940dfe19c59834ca566bb3760993ae03d3e
SSDEEP 24576:hAhGLJIFoiwtA5l7S53lSnnrFb4PM4MYgLxEVyGLT:hAMyFoiq5uj4MYPVyGLT
TLSH
T1E135AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2a5a2016a335b2908d2c3aa9b9fdc9fb796cc5bde8c384a44b4efcdbe380f9f6
MD5 1b2816a7a058c3e83ebe14a2a7fa5b33
SHA1 28bc3d0512760cf864d507baa4e32c91387fc6a1
SHA512 dc1f2f8f5dd297a15506f3dfdf9d12941876f71bb760087c3df26c2cc546abdd7b4a33a72e2cac394e3105204903ef05ae111f589e84b2101c7c1bfcbb65aba3
SSDEEP 12288:9mw5HEjsChNVBFgl0WDm+CC34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqM:4wuoOWMSnnrFb4PM4MYgLxEVyGLm
TLSH
T14065F14637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 21835e798b646efe83344c9638c393e18e615ac7a24666bc8666bc5a40264297
MD5 35fae6cb3e6e09fe415e730f580c0123
SHA1 0191fab96a8e0ee1531cc6159d92edebaaeb6ae1
SHA512 139add25f6fbb7e8c5f910dd930e266282a2f629ce069a0521d75d6ef991b9aea82c0183c750b7f4ad9d58ce9d679f504e2049785c01bdf88948095a756432bd
SSDEEP 12288:6BZ1IyX34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilW:0Zu3SnnrFb4PM4MYgLxEVyGLs
TLSH
T10B5512AA37E820FAC6AB4274C4F55688E3327862B77293CF1650655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2d4540ce194fd609ba98c66bfa7300204451453bee3621dfa17c45f01e9b8f1d
MD5 a2a09b6307f61f654484622982bb5d58
SHA1 c2253a0508a7141b67b083bd6049600323f9de61
SHA512 faa19221a92ac53a5a8d176997c1c3ae17516643e63f8aa8b178f52234e0a41f891c6d47005f6ccc16efe4271f3e77d982162132ddc1b367a24c9b424b7aab07
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U9:bQRQyi36YOcPQLvw2gAf+PN3mVY
TLSH
T170667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d61ee68700c5fcaf69f7e7d4d6a5c6d4c9b4f829bda225c5a293628f40e03132
MD5 791cf46ee4b576f48010b59fda122d92
SHA1 66b99070a62870ff5ae051e4e4a47fd7b6948da6
SHA512 4c16430f5246b08e5a4db6b162d968065b4852f1120e5d2acc9050857b3c3a4e46d9e964fdf0a62b1fdd7802b976ba3dac91fe99723daf805d67693315991336
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ul:4QRQyi36YOcPQLvw2gAf+PN3mVk
TLSH
T197667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0924520a48b00a19cf1b567250e24b827215a297fe6fb843f20e68ad086abe27
MD5 33d0c3496e02b63bceb4675bea349989
SHA1 743b512569acdfeecb60de61e30b3ccb19e189fd
SHA512 322cfaae6d82771b52745d6a4b7ab9dd56adc09af881e613791a13ab5ba0cf40820e85c0055760ac293713d46144ba539ea7cb499c25e6901c460d1a284ea128
SSDEEP 24576:0wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0nSnnrFb4PM4MYgw:668Qg55nhheWu7PNU3/Lj4MYPVyGL3
TLSH
T1BBB54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 77d7c8f37ddbd2be0ec96dcde5dea4316211bd32bbbd7b774fba5de401d03fce
MD5 bc6bb21622060d68d42ec3ff0c82ab47
SHA1 0b81daeb822bee4c51e0ea3572101bf342918143
SHA512 f579c4fce14516538f4782f49d177ec1fb09a5fa3b44b78d36329aa24795c1d87bbae7213c488723e4309382844ccb7285c6e4a8ab9308e4b38b06096f4e0537
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk994:Ty5112gYy5azzVvL69nLKnhZBVH
TLSH
T1F1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9e3bb6df6f34d0fa3f9ba4e61e499d0c01f8a31b72aaa2d65575070e200d0e2d
MD5 27d97a18bddca2d0d982e2dbaaa1a380
SHA1 c117b3143ccbd8970f7932f43ab13bc1bd0ae7df
SHA512 3b2c5ab87d8cd0b42a5172b2756aa560c048c59baaba5d3d31f28345a366e80cd21146cd2ddd882d92d8af4f1a12c0b619b2607dbe3e062e068fd34cd6d59d38
SSDEEP 49152:AB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gllj4MYPVyGLK:au6JmVxd2d+VW
TLSH
T1B1D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b9ee1f4bbf3851c6df37a7804310281ea8a8d79a2650ccd7c80423ffafa1c9ad
MD5 ff5ac590763b4996afb3bee56373a2e1
SHA1 5bb2d7f43169a5b9268d278a2c1efb4fa91c4263
SHA512 9be5ba29f9700941b7754b398376a09f19db510f3bb7ff128dd424b4d126e208c42400c6fc0f84dbf4ed36fddf548693ace8e0ad3e59cfd7a38b596b90f9b697
SSDEEP 49152:I1hpsNoJpF1A6UU44CwH7R4x5j4MYPVyGLo:ImifPbRfVs
TLSH
T1C6B5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 12ddcf327a266e561dbf5aff009ab1dd29bbff21e0db6e93774a3276c175a133
MD5 5a61158d7c1bb3afc74fe6d0b3bfe05e
SHA1 f9f13dbc7c20673c2ab1c0bb2ba273c25d208be3
SHA512 5d010ddc92ed9dc7d934378dba1cf518df633feb1cef1b66d1f8087de6d0142cbe48f4ab7b64166b7d53c1709ff578b7429a6304d6aceddabb54223fedd066b9
SSDEEP 49152:6SuZQIY0Be2KRRVtOnks6NMHqwj4MYPVyGLP:k5dKTi61tVz
TLSH
T19EC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 96b6a13ee6439d0e4b34d01370efafa6a52e8e053153d35e07d47b34275b8c43
MD5 14fb752fe02aaa7526e63244c6a6b9c2
SHA1 22b7b1a559396a34ea8ca0d2fa88369f3b905878
SHA512 76ad95937c662ba5a594c7f42cece99bb2732e911ab68d3f1f968716ce0ec95c08182320811881c9f7e64eb3f0c6686fbfa3c1588701bb4a408e421e0a21d994
SSDEEP 49152:ehtSn8EApI0figngiDn0AP5w1j4MYPVyGLJ:/X2iyphjVl
TLSH
T1B295BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 18001e20b90c8675ff74c02317db5155171020fee09e49c3d076764e8a66d8d4
MD5 00a2956e181b12934c9a483f61026af2
SHA1 17643fd720ba66b97c42f1f2d83e0b49f5847d0b
SHA512 b88fee17054d7f23ea8e7830c4cbf0b63f99302b91eb96d7b34f8d494c591829d61fa9d22b9cfd1025fa39dd02b4ee658b649a31185cf3e980847727d9889f36
SSDEEP 12288:/Q34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilQ:/jSnnrFb4PM4MYgLxEVyGLO
TLSH
T1334523A62EDC10EECF5D56F0C1A966C8E2097C62F976B20F7B4574173B3B20D5892722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c3cc3dd53bc203ae3592fecdf92fc062158ad788ab1e642521d97525e0f9b75a
MD5 a1116f6393deff44cc5e89e9eaec271e
SHA1 b7c74b1959514f7b91c569dee03f346f16473439
SHA512 2a190125524fae123300556291c412811dc6c23948895609c5b18c6907f28bd8d56607248537b8ac59c127b2d42d7bf9293913beb6d07e77c69ada9218240ab0
SSDEEP 12288:OL34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il4:OESnnrFb4PM4MYgLxEVyGL2
TLSH
T1B44523A62EDC10EECF5D56F0C1A966C8E2097C63F976B20F7B4474073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 888594233052c414ca6b5c4170072b7bce77dfc70b1f1c963f38d60d7cc72c03
MD5 2da997f2bce171f5aede288643326e3f
SHA1 2b6945240a8a07a48aeacde13d2c1703661fae45
SHA512 b509f027fc39b981586c87f0809fc6a974bff8bdb76c0b52529bfe2c6d0cd6eca1d02507069b9700f5a5e3d4b6251887c0275eddb241702426ef14206d76d25c
SSDEEP 12288:xh34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ile:xmSnnrFb4PM4MYgLxEVyGLQ
TLSH
T1E54523A62EDD10EFCF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B20D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 09488ca738b8ce74752dae96c23db4dd3b9db54e2664e90dae85f7efb99460dd
MD5 aac740217a799bbf8c35592544a36605
SHA1 57f6eb2ac13031e47854da74aaae4748b94363f0
SHA512 1a88c049fcb51076dd46541d8ebf39f9c76d3f53430084baface4525d7128f1e762a5bc9a20f9d078db457d88706a7347f15cfabf786242c130cacdb2f357b73
SSDEEP 12288:xVO34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilK:xSnnrFb4PM4MYgLxEVyGLg
TLSH
T1DE4523662BDD10EACE6A96B0C1B556C8E2257C62FA72B35F6740381B3F373489C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 07d210e05430a7ae437fd1345bb1257432607975e9d21a3bb6c2c3db574bdbd6
MD5 05ddedf50111433e1ce1e653756ad0fc
SHA1 e21da6a2f2e1c947e26c39f0c1acab2a1c9d107b
SHA512 381a7bee17c2197f0d8a8780b125c67ff69f07e9e4d3db22ab6c13cfde1b8d4d18fd7e077e2365b0dafce4d7b4ac7edca11ff908ade8b23a1bc52526a2332fe3
SSDEEP 12288:OG34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ild:O9SnnrFb4PM4MYgLxEVyGLP
TLSH
T1AC4523A62EDC10EECF5D16F0C1A666C8E2097C63F976B20F7B4574163B3B20D9891762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ac613de3e24b9ce6976ce72a1d8cc72caf4247e00aec0d64b83eb89ede764da7
MD5 8f6190931dc52ae1255811a774eca099
SHA1 9e8306a771fac40dc76c61a997c5bf7cd0df640e
SHA512 1e38ef3ac4911ecaa237a03692dd0088600e4d730519a16c898190be707dfe569329e6d850abba30b30afe67499aa497f00f21c9e1aba59fa309a17c493c9c2e
SSDEEP 12288:cP34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilD:cQSnnrFb4PM4MYgLxEVyGLR
TLSH
T1354523A62EDC10EFCF6D56B0C1A566C8E2097C63F976B20F7B4474073B3B20D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 39b9b868c069e481ce1e672e479316a7e868c037372064043e3de7db98a1bb06
MD5 c751658265b0c4c90a4aecbe58b51797
SHA1 efa909704fb49782c66be593950cefb3f700f2a2
SHA512 43ae59802419949e6e0345b676b3c8005114d93ab8a96502559011a2ead2d0c4395d3f6cf58404a9a41e6e9bf63b094fe8a343307ba0135a96cb05d5386af1ff
SSDEEP 12288:nj34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilm:n8SnnrFb4PM4MYgLxEVyGL8
TLSH
T1C54523A62EDC10EFCF5D16F0C1A566C8E2097C62F976B20F7B4574173B3B20DA891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 459d33c4ef53b027384659fbc01841ddc8f7b866705222946ebaec837092d28e
MD5 dc9c3fa115d28f04b531c150d0c3e57e
SHA1 606460b478ef0938a11d26fd4002fe153a4aad75
SHA512 67b77eebc628b54091dbac97782d037ec48700bab19d002730324752a89a4aa221bcd967fb124746688ffed144737c43734a2b2c6a222ecc5cb71b7ffa78d619
SSDEEP 12288:fiZwb6zzFEoS2cPvyr34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2U:6ZMSzFVSOkSnnrFb4PM4MYgLxEVyGLh
TLSH
T14C6502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 514f1fa8391cdf565865615b1bce168fd92b50e6e1bf39382579fe5c13b9819f
MD5 65f51f250f5eaa60b699041dcdc3cc79
SHA1 dd6b7e1ad2a1e30f2694991f9ca00ae5153ad963
SHA512 6be83dbe71f8861c78923f88034a381027fa2a59f0e817f1355f0b9c315271237bcb4d66682abc97ad7226b5bdc2af2a058dd9120195c14dc844abd1288d9b51
SSDEEP 12288:9834XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilx:9HSnnrFb4PM4MYgLxEVyGLD
TLSH
T1FD4523A62EDC10EECF5D16F0C1A967C8E2097C63F976B20F7B4574063B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 cecdeb43e720da478c3cd1f468fdd443cf1329907313baa8e8c3bbb43f7390db
MD5 47f1a93da2ab63b9a3ccd9b0ad81ead3
SHA1 25bebd1a05d586374e2811baa3112e2be4e4e9c0
SHA512 eeaa379c86f9d9ea4fc31165119c2c49a2f830b91c9de50aa4cd6e30f4b601357f78472de42032ee449580688b92be10847b38909a039e48bc0409a832c1ff80
SSDEEP 12288:P434XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il3:PLSnnrFb4PM4MYgLxEVyGL1
TLSH
T1FD4523A62EDC10EECF6D16F0C1A566C8E2097C63F976B20F7B4574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 6ab72c071eb8da10b186c780382c44e8c07529b732198477cc682609d82b22f5
MD5 adcca27aa19fd820e994b7b62e561901
SHA1 0f51f3a41acfad08a6678cde742f03642d0215c5
SHA512 4b88aa1783e4185f194116818b7362a2b7876134d39cc0faf5487eb907a870cbbc8eeb3afbf0304dc8e2af05ebfc5772e0278a5289aa2261b574607150fa3e7c
SSDEEP 12288:hyPz5L8X34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilU:wzyYSnnrFb4PM4MYgLxEVyGLa
TLSH
T16555025737A530FDC67A8274C4A21A45F336B8329B309A9F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 939cc05c0df486b8d370a44d9fbfde7cf0981e3d00d015198fd4920affce93cf
MD5 baa5de81d5bc2b3604bdb96f1e98d491
SHA1 deb40ec801ddfc98efb8df3b44718d3266308446
SHA512 d10f9e3dc009c0d2cd78410529333bbd880bfa6498ae9df3535ccddb4995b365b646033b835ebf5e4e481f3c8f9f38f5ea5a7163f2bfaeb0efa829ea260f0281
SSDEEP 12288:t834XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il/:tHSnnrFb4PM4MYgLxEVyGLJ
TLSH
T1DF4523A62EDC10EECF5D16F0C1A567C8E2097C63F976B20FBB4574163B3B60D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 66f1a3cc12db8726a1d4112f0faf7b456ec0ee5abc9d87f5f049618655c23cfc
MD5 40aca52fb9e5e5d15675ffe9a3581a8e
SHA1 0d5e9252ea98a6b4a9eafe19069e5c0b022ec956
SHA512 28ca3e7e0498d75784005e8f09503341f5e44a54228637758dcbd0b6328db3522763161e96ea6719f6f67270d7a05206f3b314fd0d329ffdf8d119fd799c7083
SSDEEP 12288:s834XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilaP:sHSnnrFb4PM4MYgLxEVyGLe
TLSH
T1834523A63EDC10EECF6D16F0C1A566C8E2097C63F976B20F7B4574063B3B60D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7f60980732cc7596b3bf7b1312bb15c6d53044f8e7740c8983d3a469ebaf7663
MD5 7ec1f539dfbca4e3d1c191411b645845
SHA1 bf90bb09e12c7b7afcb880dda3f61cec8e26b4b5
SHA512 0abf286c68a6c0e423fb67928efb203094a99469126f5c726a475cc743225ac56ac4f4edf8885c48fb24ea13e615eb7f211a91bf54213b711d376e0e2eca53a6
SSDEEP 12288:+yPz5L8X34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilA:jzyYSnnrFb4PM4MYgLxEVyGLm
TLSH
T10855025737A530FDC67A8274C4A21A45F336B8329B309A9F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 f87612d89a205da464fe83f0d8bec0253d3fe16fa2c54505a1e96f36193ace49
MD5 18d8af59667c2c2a9f293760de30bfae
SHA1 5213899d39f9529482e09725ddd0d56a0f195fdb
SHA512 1b73695ddb6c9f160ef390d448326fd5818afe50cf61406eb8065879d3271cd838c0e7e0ed12a4cb5cef229c64ec0c1a68d183adbb8331c0a59117eccb1822db
SSDEEP 24576:5cP4mcvIjkGOxhKP2l71nNKbrh/8KBfSnnrFb4PM4MYgLxEVyGLe:OP4m4IpOO67W8K6j4MYPVyGLe
TLSH
T13065AE2DABDC0096D0BB917485658A49FAB1742A2F3286CF1160A33D3F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3a49f93d70b9e48d30080fbfe5a347e2802b3dee9dfab871250e198a68c97ced
MD5 40d020d4254490581368e437acd20325
SHA1 bfbd296dd091185a830eff14bb779ca5f6247475
SHA512 b91f2e3154066231bbca599ec5a912c071e4607dcd7f80bd16164e6622184615d1e9416cc2cc4173b49ecce9183e76e79af3ac80e12c14ca9dbb36700668002d
SSDEEP 12288:ANsfs34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il0:h3SnnrFb4PM4MYgLxEVyGLm
TLSH
T1C655F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5a5806712765600a6de336d42f7291a1639d19a3fda2e5248dcfb52362228d28
MD5 c86c680d28af9aa296a8b0089d293018
SHA1 c0be3c6115fb583ad88ed98fb55ae68111f4dc20
SHA512 cea56b347385166d742d12f3d8edf7e407c50eb97c5a0ab2f05f828018ab2d1e3f7bcbe3335d538c331a011b2ec36fcbc7791957f8834538619beb2d555ac976
SSDEEP 12288:fM34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:fXSnnrFb4PM4MYgLxEVyGLZ
TLSH
T1BF4523666BDC14EFCFBD16B081A596D8B20A7831FE71F10FB740741A3A3A6499CA1713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 61832ec4cee297320d567000d4457fbc5aa3888aa72a379f8119e2a915a8de57
MD5 90db36754c007fe1e4935001477e90d0
SHA1 cf8b138813d0f3bee0f6bd6521bef2ca9fac8468
SHA512 4862ce7d0e570e74e2a4d9db17b6c08e780328c3660bf9d5d674dd555c0b2b766759594c3c942d750be6376cefc8a9162e62a55d6e02494190a1f6d0312a42f9
SSDEEP 49152:Ia0h2GEkuAe73q3pp46zwwQWj4MYPVyGLR:Ia0hNYG4JwAVV
TLSH
T10485AF1E67EC82B5D0BAD278C9A6814BE6B2B4221B3156CF1151853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 a8ecacdbf3e207809d9d5283d5e8e8bc743a4d6a517537638c1bc3743c82f837
MD5 2693838df4bbe9e36225868d3263d3ca
SHA1 c2bf0aed5c34a8373da74a25c7180a0fc8ca64e7
SHA512 a951445b3d40c27e0ac4c5d1fc50128585e43fdd146f29bbdc02ef6e999b3411c81eb22e131eb57b84a0f9591866f407fd3f119eeab64b1b2a97a8510d6cdccb
SSDEEP 12288:JhbHjfX734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilN:JhbHjP0SnnrFb4PM4MYgLxEVyGL7
TLSH
T1FD55127E27EC20D9E675A1B8C1964649D331BC226721A3DF23C1917E2F3BAC85C35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a41236af26f7d672c7697430fe5a934beeb7f176392d4ab9f70efe606be71176
MD5 a555c95051060ab88340f5f1622ce5df
SHA1 7b0d8fb76fc295d181a50fcd61146315e0236f6e
SHA512 0242fcd0fbeb4f06e4c0458caf513d4eee9dc22fdc4c9697d2d87087c9145205201bd5083fbb4015a0f65d71080f9f31afbf3ba54eff42b5bd743ded0ac1d3bb
SSDEEP 24576:o3YgnJcRTk4yti+R5dBR/MSnnrFb4PM4MYgLxEVyGLX:oIgnaTk46pBR//j4MYPVyGLX
TLSH
T1B945BF2EF2B910F9C8AAD236854147B5FB71782D1F2096CB0170C538AF1AED85E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 3ff8506eb07449641976693df8660dc4e5a8cb227d8242efe6ec774472a309d0
MD5 561566f13809685b525690b21ab2a8d2
SHA1 fb3c70aecd544f47bed489de75e5b9388593ff08
SHA512 f356912e2ba66223a7e85f4e1e15b84ce8d0f3fdbb6c76a82bab5f91022a4c0e6e80bd61723703014f14912a62f3be854ccdc24bc6c385dd63d695d93815f652
SSDEEP 12288:4I34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il1:4bSnnrFb4PM4MYgLxEVyGLv
TLSH
T1F44523A62BDC10EECF6D56F0C1A656C8E2057922FB72728B764474173B3B68D9CB1312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 1a80f117337b72d9052c3172efac3ba062a20530cc9a2dfef6b09ec76daa0f70
MD5 03cc6cbd9f455b94362581c9a4b855f3
SHA1 d1a794abbc005200f918d5b4b947ae2e9f7e0f83
SHA512 1f4ac0a7c790842fa58f8a0f875a689b9f423584da319b43d9157ccac3a0707fcfd420590f74524f20a81b1cc7b503ce6b380b5a55cfcbdb0327acd693d9d8d5
SSDEEP 12288:sOb9A4LWOsvAYFT934XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:RpL3UT6SnnrFb4PM4MYgLxEVyGLu
TLSH
T1F8750155F7E800F9DD7B8138C5A28A16E272B85D1764E3DF03A84A662F233E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 d3838972819a89303fa9986b8ccecefb9103b9926cf77d16efc84b4507140c55
MD5 a4eddb1b811683e087c7b19b469a78f5
SHA1 ec9555505b4124081df6d746eb37155c9cd0218f
SHA512 d8e075fea1483208b813ed524b4302e44f0915ae28cc351252d6cbccb4346e92a95cd3875a67f905e9ebe778c9b6f50bac0ae22763dd7e3ed190100f601a4a33
SSDEEP 12288:3pFtpOZ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:bOeSnnrFb4PM4MYgLxEVyGLo
TLSH
T1BC55026A37EC10E9D579A178C592434CD331B8625B2263DF06D0907E2F77BE86C36B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3cdc25c8622b2c0c3ddfe4be0123dfec0e703366034cd0bcb2ff01f86ec580eb
MD5 f766f8cb5ac10dd61255e0ca30f387c4
SHA1 b78385fb7d6383bb8abec93ed007c1ff0b0e3aee
SHA512 8a57b0e11855d0ad093cbc3ba03b54a314581e75f187cbfb19306f7dcd9c2ab173ae89965a3f0f298e69b3225541efa05f16d3dd8fcec3d84f4685983fc2996a
SSDEEP 24576:o7NM9YqZqmWMUkPjZM48Mv6bEhsHSnnrFb4PM4MYgLxEVyGLU:o7cBWMpPjN8DbEhHj4MYPVyGLU
TLSH
T11E659E2E6BEC81E5D576D13DC9A28245F2B2B4611B318ACF1252833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 209ddfd6f0381464cd021a4453c0988801e292418a80400f76c3d0d5a3e2581a
MD5 e41fc36ca4caae31b5595d09229b0a05
SHA1 e891a010215ca483b0711c35ff0154f8083df284
SHA512 c34cde2e0ef3b19a64daf2c72dcb8227f0cbddfe64be9abd5db32cd6dd1ad464c42af21b760c17741073f42c65092942bd870efa24e94d59ecf66a92714f4620
SSDEEP 24576:zW6BApg2YuyuNDYTabvcdvNYf8km1JSnnrFb4PM4MYgLxEVyGLt:zF2YuHNETovAvNYf8kmgj4MYPVyGLt
TLSH
T17F857E6927ED80E4E0BBD27D45B6D286FAB2B8511B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 375edf8eda34663a2742df1936624b0678151e9c124109117949093bc90ec4e3
MD5 8dc4149e7b5bfdb953875958dda207dd
SHA1 51af2db8983505da83aa59a7589d282ad01fd30c
SHA512 68d01dc0162b3255a40b83e69db09a01b03776c4631e194a704811a0749aa62e88b8ca21d769a9b56ec19d9b1cee4495899717e1068a240e6fca470bf394dd08
SSDEEP 24576:zAFs06+Omlf3NXEbToCSnnrFb4PM4MYgLxEVyGLO:8Fs060lVXu2j4MYPVyGLO
TLSH
T1EA65AF2F66EC00D5D07ED17D8997C91AF2B1746307256ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 401948a09488e2ca8dba978fb382cd17235720286b26ad73598adffe49921c5f
MD5 d2fbd35aa4767aeaad6696d6dc7f4fe8
SHA1 10fef4e6a68451234d1e0d5eae01ff3f10a8256d
SHA512 6d5365578aa1e86210dbfb6503d8bf105ebff236e4c27f4216f2a188b1130a401295d39a9bd3db4c4af0197f4e4c2dada56e46d37445475c41809ca69255a73d
SSDEEP 12288:VCJnJ5D3VkrDzxc34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilV:MJnJ5D3WXdSnnrFb4PM4MYgLxEVyGL3
TLSH
T1FA75D02DD2A810E9D4B7C2B4819A1795FF72383D2F226ACB28B4D5353F12ED09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 401bcac416c6c4075435907c54da4c84e232d4e62a62b565c177aeb853ed888e
MD5 d2703c05ea3e8a02deb59346221bfcd8
SHA1 631b469431582393989e775310b8d46f3e054696
SHA512 e1298f9a7ce73e71fe940c00de6f4feec1fdc5fda53d2e7f118f1e2de9b490ff36b43106570e906120673b793ca7397fc0cd2da19271522d287d4d8ed4926a25
SSDEEP 24576:uEPghm6/7IIXdwcXrif7qQncjlP65i3VuMSnnrFb4PM4MYgLxEVyGL2:pg06DIKdwc+eQnSt65aVsj4MYPVyGL2
TLSH
T16C956C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 bdcb422eb759b405a5be058c52c78c5f5d35e25ae84e55f6de9af1d0c6094828
MD5 66fa41cf4cef1a096701148cba353555
SHA1 ac92282896374877e7238a0516fea594e8df62d9
SHA512 5210d0a33a1532e4143f0c1aa751e7962369b2e937cadde6274dc2cba17b36119e70f682d03b5261d016992751810d7eb39884c2cd4e890cebdc829fb4d80bbc
SSDEEP 12288:CEP3RnC34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:BnRSnnrFb4PM4MYgLxEVyGL3
TLSH
T1A755126E2BDC20E9C52A9178C1A18688D332F071BB6273EF1691D13E1F37AD95D39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 97215bc87f97f701f9ae1aedf03af1270082df98ae4bb5b0e3064fc7838e40fc
MD5 a117ebc535292d751f661c6049ed6727
SHA1 42649f4e4eff6819855b07a44ccf37c74c1e2bd4
SHA512 9d56b4a865ba8ceea8a6c375b0d5fd7f41464757430824ad45017c41c82923417f8f7edbe762d5a1d7e7ba17deb6b35a7c0951ae8ea9c966c87468d5727a7e02
SSDEEP 12288:qjkyL34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:qIyESnnrFb4PM4MYgLxEVyGL8
TLSH
T1AA55125527D860D9DAB90674C5B682D49A35BC21AF21A3DF6280F53E3F377C8AC31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 e3f06352a4789faca7e6e1780c1032912317c3ebc0e405b17ffe2f25078908d9
MD5 75375af3c95bdf2ee2aba1fe1eb8b872
SHA1 9356dbe8426ad512d7d0b705fc90bdc09bead4ad
SHA512 716bd987c92297349a7aeef1f8e823705b7b636af2983db6d5d3500f77d71f385f36fcdb99413ff830fa15735527ec5765b39c516bd9246a23bc20b55bc5fd26
SSDEEP 12288:8yp34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilv:puSnnrFb4PM4MYgLxEVyGLF
TLSH
T11D45236A2BDC20EECF6916B0C1755BC8E2157831FB71719F76C0B4363B3B68958B1A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8e566165f146bba33333ba4ae98844e183ee5b15d83727c7d9d297c001856db3
MD5 c8003c94bf214048fdcf2d8fc2a20f74
SHA1 d145f26ecf5a1c4a9645bcb043a499f3ca8d502b
SHA512 b420bac0a42f2ac22b66394167c911447e419e81f5a76704dc695c31e06c554ff0099d3ef8643f7d45264e5487ad04678cd35f3b2a8211338c561033d10818d7
SSDEEP 24576:wQ9MxZKdcz9dw3PSnnrFb4PM4MYgLxEVyGLM:wVKZoj4MYPVyGLM
TLSH
T1A2557B2DABE905DAE177D27594A250C3A633B4311B31D6CF2448D03D4E7AEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 ae88f5f32c7dc20d03584fc2a7fd15779ae4ba80674a96d88c6a5dec327b4193
MD5 70cadb25a271009861d7dc5cda6824e1
SHA1 82c983925b2246c62c09d014b1f0692ecf071000
SHA512 2d3dbfe522ce0dec42921995f9f40eeb851d3f86a90e052b6ec82db5dbe16d656879596056135388295cb3334c23f61735b6106387740cc049f6be5efe06c7a4
SSDEEP 12288:dyoKo2JRple9pH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilO:dyocDApISnnrFb4PM4MYgLxEVyGLo
TLSH
T1BD65E01F7BAD40E2D176813889858785E773B0306B6263CB6691C33E5F27AE9BD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a61bfe61e38b0de30093b673dc2a516c3b6d7f05b96335575d467b7822799d2b
MD5 618ca1c975dc5ce6d4e0dd4de79d17b0
SHA1 9e31578daf9064457a4612c554e619722aa4b492
SHA512 aa50387f6d336fe800d73a293f29b2c9b878558b45f832546094682ab1fbde4ad89b90d39cd0cbbda8ea54fbfd2d87ca6a1579daff4ab4f460ebcfb379eabaa6
SSDEEP 49152:vWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKbj4MYPVyGLp:X0zuNIuV1
TLSH
T1B2A57B3DA2EC00A9D9AAC375C14513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 52c82a7f107f3537dddb49e14633267bafbb615d7484207d98b08ce5f8509dfa
MD5 a808d3ebdfa7de04597d70c4451e21be
SHA1 81aba132958a08dd543de909835b66b2c6e512cc
SHA512 46c4d784f1f3bd75d78508523b784b047b4af01dae568207c7926685a8b4a87d555af08f2e9ac96792162f37c141d4bad4199df4f85cf4fcb4bc21e121b9438b
SSDEEP 24576:11QT7EcpfxR+N5AWAz3ooiYtjMqbRSnnrFb4PM4MYgLxEVyGLv:wTDxR+N5YzTfjMZj4MYPVyGLv
TLSH
T1E955B02EA7F815E9D1BE85788A23C506FA727821133193CF42A0C17E1F6B5D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 b789629f37d4828b4afa0dc6743e58e7a36276c353bda59e0ef5a4a575b6ad64
MD5 c53357765df9ac26820d4070e59bf641
SHA1 1984c99052f25ebef8cc82322048642fa8aca346
SHA512 015bff8d008707879359c492d0b58f1103fc574e0ea2e5d151179ae3aa9c042ecb01f66028c492d433da998e47b52f6bf3c95e3f49a6b1cddf4af4d6defbad52
SSDEEP 24576:KTMdOz0FFS+imSLFSnnrFb4PM4MYgLxEVyGLS:G0K+imSLej4MYPVyGLS
TLSH
T11475E17E67AD14E9E57BC27CD6538906E67234620322B6DB0690C07A3F6BFD47939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 67616ee668d584fd3a79425661685d22ade51d8f6214b2521396b1216c21800e
MD5 2b9ce08789eb440eec26f2300b5812b4
SHA1 54a41700ebe398b84dc008db31f10ec3ddf26595
SHA512 e3fe34e2d72d627fbaf1e390f2f76b230fc1b6d1ee48ff1c83569914452afe0d2ce21e22bef793c374d524800726dce4d41be0250bbd0068f5c3cb977b0a8542
SSDEEP 12288:n4K934XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il2:76SnnrFb4PM4MYgLxEVyGLk
TLSH
T11555126D27EC30E9D9765270C6764289D220B832B72572FF36D0E47A2F376C89875B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1144-34-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1144-130-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1144-40-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1144-33-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1268-100-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/1268-105-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/1268-164-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1268-109-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1300-151-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1300-153-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1320-128-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1320-122-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1320-131-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1320-262-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1832-120-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1832-260-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2032-398-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2032-165-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2052-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2052-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2472-353-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2472-116-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2472-172-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2660-145-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2660-135-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2660-141-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2660-311-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2664-365-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2664-160-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2732-92-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2732-95-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2732-159-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2732-86-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2924-16-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2924-112-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/2924-18-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/2924-24-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2924-23-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3052-74-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3052-84-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3052-156-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3052-80-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3192-0-0x0000000000400000-0x0000000000600000-memory.dmp

Download

memory/3192-83-0x0000000000400000-0x0000000000600000-memory.dmp

Download

memory/3192-459-0x0000000000400000-0x0000000000600000-memory.dmp

Download

memory/3192-8-0x0000000002120000-0x0000000002187000-memory.dmp

Download

memory/3192-1-0x0000000002120000-0x0000000002187000-memory.dmp

Download

memory/3340-70-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3340-150-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3520-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3520-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3520-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3520-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3616-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3616-108-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3792-168-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3792-113-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4232-206-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4232-173-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4232-448-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4232-245-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4232-190-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4264-148-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4264-333-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4312-169-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4312-447-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4340-157-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4340-363-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4484-68-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4484-65-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4484-61-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4484-55-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4484-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4688-387-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-372-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-402-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-390-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-391-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-392-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-393-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-394-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-397-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-395-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-396-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-385-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-386-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-388-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-383-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-379-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-381-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-380-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-377-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-378-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-375-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-401-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-369-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-370-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-371-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-368-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-367-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-366-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-403-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-404-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-405-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-406-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-407-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-399-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-400-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-389-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-374-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-373-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-376-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-382-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download

memory/4688-384-0x000001C938F20000-0x000001C938F30000-memory.dmp

Download