aa8fa71a1263edc8c20398dfdd6aefa4c279c09eb8d52022840e9abe4e03639d

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_765a76931e14973af493c847f4d27ff8_elex_rhadamanthys_stealc_stop.exe
Size 1.3MB
Sample260604-tdcpcsaz3m
SHA256 aa8fa71a1263edc8c20398dfdd6aefa4c279c09eb8d52022840e9abe4e03639d
MD5 765a76931e14973af493c847f4d27ff8
SHA1 5c9fa0d61706b9d0a16a9603cc439cfb27006ba4
SHA512 5816a48294c2448763ce76862d6196219575f8134c0f98375e6256a753063eb694dd785f415463d8ad51068132a948357c91525b3e17e83508216008ff1e11f0
SSDEEP 12288:jCTKELRjzISXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3b:jC+ARgSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12555122176D0C03EE5B216388DB5F368A83B7C715A30D44B77A13AAFAE715D18B25723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1860	alg.exe
1804	elevation_service.exe
4624	elevation_service.exe
4240	maintenanceservice.exe
2120	OSE.EXE
2572	DiagnosticsHub.StandardCollector.Service.exe
3092	fxssvc.exe
1136	msdtc.exe
1248	PerceptionSimulationService.exe
1944	perfhost.exe
1932	locator.exe
4596	SensorDataService.exe
1600	snmptrap.exe
3804	spectrum.exe
3916	ssh-agent.exe
1692	TieringEngineService.exe
1424	AgentService.exe
1656	vds.exe
4308	vssvc.exe
1236	wbengine.exe
3488	WmiApSrv.exe
1252	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-04_765a76931e14973af493c847f4d27ff8_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e053c9301c6cb3b6.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173546\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_765a76931e14973af493c847f4d27ff8_elex_rhadamanthys_stealc_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001afe3fe23af4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf8749e23af4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000822747e23af4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ab796e13af4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1804	elevation_service.exe
1804	elevation_service.exe
1804	elevation_service.exe
1804	elevation_service.exe
1804	elevation_service.exe
1804	elevation_service.exe
1804	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4296	2026-06-04_765a76931e14973af493c847f4d27ff8_elex_rhadamanthys_stealc_stop.exe
Token: SeDebugPrivilege	1860	alg.exe
Token: SeDebugPrivilege	1860	alg.exe
Token: SeDebugPrivilege	1860	alg.exe
Token: SeTakeOwnershipPrivilege	1804	elevation_service.exe
Token: SeAuditPrivilege	3092	fxssvc.exe
Token: SeRestorePrivilege	1692	TieringEngineService.exe
Token: SeManageVolumePrivilege	1692	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1424	AgentService.exe
Token: SeBackupPrivilege	4308	vssvc.exe
Token: SeRestorePrivilege	4308	vssvc.exe
Token: SeAuditPrivilege	4308	vssvc.exe
Token: SeBackupPrivilege	1236	wbengine.exe
Token: SeRestorePrivilege	1236	wbengine.exe
Token: SeSecurityPrivilege	1236	wbengine.exe
Token: 33	1252	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1252	SearchIndexer.exe
Token: SeDebugPrivilege	1804	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 3052	1252	SearchIndexer.exe	105
PID 1252 wrote to memory of 692	1252	SearchIndexer.exe	106
PID 1252 wrote to memory of 2816	1252	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-04_765a76931e14973af493c847f4d27ff8_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_765a76931e14973af493c847f4d27ff8_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4624

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4240

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2120

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2572

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2592

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3092

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1136

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1248

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1944

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1932

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4596

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1600

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3804

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2424

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3488

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3052
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2848 2840 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:692
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2836 2600 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e9d63ee1addd859e64e5b24171f59099e138b2198efdd693828af06b757691c5
MD5 9255c8237886a212e751c0af487dd866
SHA1 6f727006e0e656763ec5633ad794d97f1470feee
SHA512 27ed664bb43f285acd42e1c0206f97d03610cc2fd91159d38017f8b33546a554a099b3ccc659f63ef1e67a39b92f65da9c2b4fffc050fc817f196603407c994e
SSDEEP 49152:Jb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnVDmg27RnWGj:f3q6sjBKD527BWG
TLSH
T114D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1f2feb4a3218f9b8d8f60b80f2465c2203ecbb6c6e165cc4d7f755b5c26306d4
MD5 0d8ab7acd01120c471a9821800cdd3e6
SHA1 d9d8a1ba4c3983d19aea343b2a315857a6a5f7ca
SHA512 265841576d7c57554f397f475443538fa3e1eeb9271d03dc46e5f546da414688e16e4263df5a275be126ef2667780aa555dfd7d3fe199607d7b318eac7a4b143
SSDEEP 24576:zXYfDtczAasqjnhMgeiCl7G0nehbGZpbD:WtcvDmg27RnWGj
TLSH
T163650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 34ade5184a50bd4137e4086cf147d54bf8a12eccbc342c7bca2fd744c00f73f6
MD5 e981b8f0236fb8b3279a7a210f9a5eea
SHA1 7810a3c9ed5e72757e2cf476d300721a2e2a8c9e
SHA512 ebeaa5d877dad1aaba3352e73615263eb3c56e649d08e3b9f57eee97e23f1eae44af08dbbf99291ea43712ebba2885a90b9bdaa88a4c1e862f69bc4a7944b402
SSDEEP 24576:60Le5ji0hmxxrMJsqjnhMgeiCl7G0nehbGZpbD:6Pji0AjEDmg27RnWGj
TLSH
T15E859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 40dfd6c86ca2c6795f05b9c66a1721a990809b9d3c422ba909dbc771a0e4620a
MD5 4d53c0f186a6087ddd32cdfb3d3535cc
SHA1 1c319011ca0820e046fd2620785a4cd7cf7d8d14
SHA512 2c00b067a80cc3c8ea4236d0da79529da7cf5a255acc1eec4eee2aca30b84f23756bfb8ab4c0cde39a64930743b79b72146aa9e8bfb7f678fe83b2b22c603883
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWn6q8wyursqjnhMgeiCl7G0nehbGZpbD:t/ezSC6vUzPveHjyIDmg27RnWGj
TLSH
T1F9755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 89dc020d71fae8ab77ed856155f2f5decf54a1bcf4e8d77eebb645f5f67fa51d
MD5 6abc7a539a41dca895a515d19961a9df
SHA1 d11a1789cf1974ec0d3fa9510b1f31ea51ac35f3
SHA512 86874fd1b5d7a5a86521277d1481022fcd6386bad51c88a6a55b836c392eb0864df750714dd60c08e85069caa104c937de6c8d13bfd4d2390d98c134a9511de4
SSDEEP 24576:uVbqPb88hv/l+Y2sqjnhMgeiCl7G0nehbGZpbD:uVO88hXl+HDmg27RnWGj
TLSH
T144559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 df3885b149ea8c3ae33656d54621b02dc4347124512cdc334a1276422cbabe75
MD5 3767cd2c79731ad4bf05374a848e9b69
SHA1 743e24fc5f86d0f43d69f5c307d1010c4d4cdc05
SHA512 e91bbf64de02f297fb8bfd10ef2310e92ec70b078b8cf24db06de5560660be6c178796a6082e76f649155a45ffabe655a8810a63f20ac598fff2ecd2d040eb21
SSDEEP 12288:/LQqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/L1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C94523BF864C50DAEB7608B5C3E9F51EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 369169a4306e2eb1c56a7c7c3d79712c0d9514badc19d867f2e5b7bfde764a36
MD5 83f7ce875159e8d62429d7560cdca765
SHA1 2a2b12d3cb746ca298d8ccdd94107bc6553c1470
SHA512 f0181a96030f0d224ec678725b2d203826339d87b04cd06bb1492ac72e1c2b764482a1c69393bcb1cc94907123f0ebecec2a64b3ddc8f14b9205fb999f4ccb9b
SSDEEP 12288:oeBNUbTVO86UrqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:oJIUesqjnhMgeiCl7G0nehbGZpbD
TLSH
T15665CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4e5e80dc6895a694435f06e62f89d58f4980cc9668a8c4bc94799bf9775917b0
MD5 462a752946d67f647d88014ba3fbe551
SHA1 0fc62f1dcbb839f6cdea4cdac13a76a56016c01e
SHA512 2f346b9e2dd9f6bee34e54e108313f5b93fd89b96f719c6ef0055c3962d26d05c770a298be9fc910006ab32a92d5f9af56b356b93d04bdc6d5e7c1a1a2eb1160
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THJ:rQvGAdlCEL8c/DRNw5CPD527BWG
TLSH
T13A266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1afcdfa3f6d95cd6eb6b948dfc16ac72ad84d8e7b1d55c1d0962e736bc8c5726
MD5 e43a5d298f320a3f5c94e18640c51fd2
SHA1 d5473667932d9f3a300a98786b22c286743cb202
SHA512 85d5f84b9f3fcc4bca5ccb6338d08f9536b70c6f8f3aecc738c16eec795d2602a574aae3cc0346354b72c0036ffcaa863b1debe89caed13b4f99b1d69766d826
SSDEEP 12288:TAwSfxL/2Dc3RDLLmt0LDQewsAjVqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQK:M0ewsAjIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA75E031FA74E036C77B0DB60B36D71A582D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b5d76002de1f3601b7b6b672dc0bb013a158f015fa68b8b5595424404ab121e1
MD5 13dfd56c6bdc46942c47bd476d2d2cf1
SHA1 f6ecccd09cc3c3cbd8b6124798316d2768f4cf72
SHA512 62c14b1d985892ad2314874cfb03781180a212589be532be8b2c5a78fd351a7280771354ac3354dfd99a58b974316e2afb65ccf2503b12397ac435ae6b7358f2
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH8VQBWG:bUEtQevvqc2W1cpV2tI32DB
TLSH
T188474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d50474ef5287a4827f9d8a0f1a851d396bf92e8953e45cf1ef93f9ede1c62806
MD5 6dd483942e2f8f94f67fbf193a203acf
SHA1 24955e9bb5aad0848be4ba4fac0c3ae25c7f77c7
SHA512 866e41a6b00d0655c0ff53bf4b70de59cb560ad6555f24992503c835163b4e2827c233625cd5b1194a4634df2b9cef31f4a257a6c179ac805b341afc7b839df5
SSDEEP 49152:nCbRquA/m2yL5zTfFiV+XenmE3/zUDmg27RnWGj:woquVjnmjD527BWG
TLSH
T10FD58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 45b81617a7ca0908f8d99376b39a7508fef06c6e7bdc07891f2babb66be64971
MD5 d2c94b7dedf9e13cc7a7710dd73ab434
SHA1 ed086817e4c504ca502b1154e7cc55ca4956c0cb
SHA512 7c15a9c1f6c6d5a20e2713353c2cc723a5458d1d1a713ae3f28e2a4820a47948a65f1336143ddd49f4b033081db29ef2813d0d194bdc0cd9c81eca392130d1d6
SSDEEP 24576:0AhGL3IFoiwtA5l7S53fsqjnhMgeiCl7G0nehbGZpbD:0AMUFoiq5TDmg27RnWGj
TLSH
T1EB359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 438743bb5007f9e8f20c4c0a43062e0da0a7fbe8e982a7331981d387058dcb65
MD5 cdfa199e8d0201dfb6d896098384eb6d
SHA1 8ec34cb93fff4963ed3d282b55fb7081856ae5ea
SHA512 74d7b025ddc98de44138a09c5082897b1ea8c1e5901c3f3e5a5a74356d299776c7eec2696055a627fae4110df7e81a1ae9abdd9a00a99eb99c8fecd1977c5257
SSDEEP 12288:Hmw5HEjsChNVBFgl0WDm+CWqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83i:Gwu4OW8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15065F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 533445fa7f875b6652b32d190c86cfd8f77939735e001b380ababc2f79c76f1d
MD5 178b44879fdf4166ce8c2faa081f7ce0
SHA1 43e5ab2429a1ab984640073fc4594179fd542f10
SHA512 fa8241f1836cf6b82602a2c7a84f08ceff95e68e57e8a99d6dc257bddd1fad1441e0151298750adaf7b2bfe9a981200d4c6172e1ba6f0b7a337e62d1341d8d23
SSDEEP 12288:feZ1IyFqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GZuxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD5512AE239820FAE163417CC5E5D609EB337C62673003CF166659AA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6bccfc5182a7ae7af63b76ee6eed86b53610771dc21d1dbdf880bcc9a0ad1cda
MD5 dd42fa3e09a6f8c46ac4e75cc0d4e22d
SHA1 565dfc6879c08bddbe31d03188387cd5dbfe2af4
SHA512 71be44abf79a295ae7990a86176c63b798d3f76c0a00db7e8d84d65d08840fbaadf3a1de5540e0158ee3c86ef02fcd31a74db0edccce0a579bcf3475dab9dd91
SSDEEP 98304:2QRQyi36YOcPbLvw2gAf+PN3GD527BWG:9QyiKa/X+PNWVQBWG
TLSH
T19A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4ea18860455e464ceabdfa64d6a78cbfecc227f5523b7495175d807528368261
MD5 a0ae64cf8434d6a564cc21b0bd1546fa
SHA1 f483b9732ea64f518e29e8d31b918b2e56c15979
SHA512 bb3058335301d53fcd023db9271002d9de81d7c8d42a278c1abbb8456ffe010d1fd69abc25c05d6f8f67f9e3ce41528b4e27e2d0adc67922d69325bf27774da4
SSDEEP 98304:fQRQyi36YOcPbLvw2gAf+PN3GD527BWG:uQyiKa/X+PNWVQBWG
TLSH
T13D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3c4b7d3c3c8d1214b7e67bafe5d5a09d35d3fc5408c06cdc98161e17f811ae10
MD5 461499010d13723ced5690349d0dcc2b
SHA1 484a53bc44bd8edc8d4e28edab99b5536fd1277e
SHA512 3c2b1febfd62238f4c7c9a0cc381a2ec0343941ed5827bf08ba20eb72a14869ba50a6d6f066a460cde87c5d7377ff590ca66a76b4addd547dcd134f59a71f9bc
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0BsqjnhMgeiCl7Ge:F68Qg55nhceWu7PNU3/EDmg27RnWGj
TLSH
T152B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 420647e874cc1cf3a3b960cd3077015701e3cb6b828fb3720a8c7c9f0b808399
MD5 fa30ef74222397c22056b9c8ef0c2bfc
SHA1 686bd66f03284cda6058dc750ce7d22db664b86b
SHA512 e0ac907334b967bcf067832463e5e9d10eca4e8ed7147aa27d99c9e2de2965610216d8f7d419dee129d031a861eaab30c6bab39ffb0e4e015b65e7027082b7e2
SSDEEP 98304:3y5112gYy5azzVvt69nLKnhZpD527BWG:KLIHEWhrVQBWG
TLSH
T11C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 248953676b1f8510f859b9982962ed93af17f22ee303e788586c2ee19c5e35dc
MD5 72259e206f988237ecc7e7cf3cde417e
SHA1 dda9ac84bc012bb8749cc2b23f5ec8a23446c52d
SHA512 f08eb93e3fb2c32942aeac9e3edd50d2c5a2bf3b28a5ea44ab9eb8d5f446e2992f51cb9cd65351c6dd8e3628774f0bb34b876fb34f94c7f4bd77b23655814c6d
SSDEEP 49152:9B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl+Dmg27RnWGj:ju6Jmdxd2d+D527BWG
TLSH
T1B0D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5497d5b8afd03c77a4350548bfade63e32b094ca3aebbf0626b6d3f8670ff97a
MD5 5508a6d44a344e89ea53d836261e43b4
SHA1 039d30e16e09a4cbcf2cab50a8d62a3405804266
SHA512 9022f0af7e3413c1d1a7e5e28318a6b18e78b56251aa3790bb618d885e67eede28dc3d674f319dae70c0c3612665d5f978ede1632897250c30161693227547fb
SSDEEP 49152:D1hpsNoJpF1A63U44CwH7R4xSDmg27RnWGj:DmifPWRjD527BWG
TLSH
T1F6B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fd2c98067c53400b71c104e5932ad8e20c37955c85f2b7127b55cd2c3d37377a
MD5 79a013ebb28a3bbf10c1d20e1c874ae9
SHA1 4107624c1afaf3d9f766786aa5826a08b1b17837
SHA512 110816a3539b219d8e5c94f77fb52473c7d7443ba139f823098b9a5422518d7c73e50f146df70067324c1310be7ded913467695511c006afd056d57bf053fa00
SSDEEP 49152:2SuZQIY0Be2KcRVtOnks6NMHqFDmg27RnWGj:Y5dKii61FD527BWG
TLSH
T149C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 db127618efc4a494c0781cb1a313e020b8dd76b47b1b827fa1e48ee9363052f2
MD5 b8cf00a24c2bd5218511feaa2d57d985
SHA1 94687a30136682af3215a2d5a93cd3c9ad282dd5
SHA512 717f5f03e448985a02ecc31a8bc7be5c90b70d54ec6915c6d969f91543096194e263b112a8b1db92808d3eb4625d215c1bf8d9d0b72c23eb8a3e1ec858a237f1
SSDEEP 49152:ghtSn8EApI0fig3giDn0AP5wuDmg27RnWGj:xX2imph3D527BWG
TLSH
T17995BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 29d7ac1be9c68dc33c4e488626e07acdb4b064b8d27e2229eb469a65d38f35b4
MD5 2dc4f733bac6e7c4aa5fbbd42563d579
SHA1 ff3688f85d9bd0d338cbc72ce62421e8449ed628
SHA512 548b16f67716c4faa8a121305720b6123df384a6b222db1eaa5c928a0f8d3af86ef4a6e5ec6f5a7ddc22bf55dc72a4233a92003699a64bec7f86ec8f55b9e6ea
SSDEEP 12288:j4qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B94523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A577CB9FBB24984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 157b784587b5bc4c7a872c45776aa4ddcd49962b4295025bd07861f1875d9a6c
MD5 f24118d33d35f852030415a3c8a81eb9
SHA1 6e9562e7a59f8dd9954ae2747c621dac9667afd5
SHA512 c29d028644cd72e07e952cba086c9a705dac4bb0736f620dcb668563a97f6d3098234ab471ce8419e6d185dd2f007cda4a0906730c0f87de4e7701598b10e85f
SSDEEP 12288:8hqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8UsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1374523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937AA77CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 387f0402392f80fcd80126a6139ffede09130309371ab15009254efef431b41a
MD5 f72334edcb3c5427a8ba57c55f2e8cfa
SHA1 9be4f3409f6174572d92939c03835a3d2c5d5def
SHA512 b13a4285fe58401fb22ba023e85213c6362b0e7eea9568b922948e3a29c3e1fa83ddabf6dc2454a6f3f33c3533ca4b60d71c0d658288ef7ec677a1bd5ffa9d38
SSDEEP 12288:zzqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ED4523BE965C41CAE52648B5C3E5F10DAC073E5BE9200483BA977CBDFBB14984B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a43ec9e5bf51ee4a031f55e002e98350bf3f2ec1301fde47226cb1a30d5badc4
MD5 3904ed26fbae828a2c06fa25b3be5bbc
SHA1 b85dba49df1e9d7c915df8943456276c00a8088e
SHA512 f34d40d2a3606855a5b95c0423383b2ad82efba9759076c8bf229bec54840974424ceec47703e607f895b0360d04c3dfed82220975151b6635d5ddf97877e0bf
SSDEEP 12288:EVKqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ysqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F45237B675C00C6D83285B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d89ef86eb37396673fccff0853d83c779d94f37fb5c798ba3b3bebfff6458cf7
MD5 1f27f8ed79461d30e26d994fef82b6c1
SHA1 0818b3879e8ae0f0e804744e14a3199aaaf946e8
SHA512 13ff505a8b991dfa2b92bcf9485c604f1961c9c9a17ef412b56c45be761540f48497b954f2e05599e83cc726d6fd573a41c59a9a34a2f4db3fb00c6f7a947727
SSDEEP 12288:CCqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:C3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1834523BF965C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e9dcb6e08bfdfdbc5a800f24326b3dc3d332f8f0195bafbbca6476eb9571432b
MD5 74c13061d58e664717c48d70429d2f2b
SHA1 9d5ac6b59fc9dc77ea033959c48ac93706720f01
SHA512 83bf51a696ef51920ecfa0a941a6925c77fc66a49cce63876906d78007687b9fd5159ad566a5b294919890696fa2236d8d6af36cd2b649fd81e53d523e54bbc0
SSDEEP 12288:tdqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:twsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D4523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A97BCBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9c6d9bad5f4e14c8de09b09f434690459fd3a1fd50297e540a04e86d036cb6c6
MD5 ce9064885cae936e2b3dfb8a110cde4a
SHA1 d942a7d4cccd1cf70d0bc07858e1a87ee30ec740
SHA512 ebdd5d3cfb6e51e094b8772ce2d0c432046d2f0bc671280784015cbcbfd4a4e3921b5f68f5a34e5cb1618665266f31b9d1dde41ccc800fb9e4144dc4067c2246
SSDEEP 12288:rZqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE4523BF965C41CAE52648B5C3E5F11DAC073E5BE9200483BA67BCB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 3bbbb02bdc4fb55e09303e7acdbbf7b8d1216282e6d444e6658cc9eaca4353ea
MD5 e2bee452e4579c6c1132306d095bcac8
SHA1 9bfd322fa9159c8d5b4a03e230a722eb72d2711d
SHA512 c332c30a55313b418d79011f1718c19e7c9bf82fe6a371b77d3b82010196da36833b12cc66f16691458f677f4b79dc566948a773901f3035733d276b82fad63e
SSDEEP 24576:GZMRzFVSO0sqjnhMgeiCl7G0nehbGZpbD:GZMRzfcDmg27RnWGj
TLSH
T1186501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d92bee5a3ae904b95aad5b25a80a9509b40bc5da6f2cf77fb45d0f7f04d426e1
MD5 17686d2aa636c1def4dd8170e671fd57
SHA1 8cdf241ccd4a4973ed6f4c0cd2eb0e98840b9a86
SHA512 7b4d2655621dd04c6e3da7124a7002038acb7d907e282ed20bd42db1bf04718691f701dc73d1e82887658b6214f1684a33c9d06408938a7fe2d330a450979dd6
SSDEEP 12288:GcqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A64523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b88f812c9edceff4dd1afc187b629ab024a7a979269afdfd2b6b857e563178d9
MD5 ba28113e097d2f13f7903d1027f9e619
SHA1 c2faa6e501676a1afda8766a6228c6639555b0cd
SHA512 a7239f59fef3677a104851b8f482294f22a3aa456ccc0f8f0cdb1a29903d091aaf3921bca59a6fb6f863c3de87f9a66876999932b14feb355d47ccad08b9ba07
SSDEEP 12288:RAqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1284523BF965C41CAE52608B5C3E5F10DAC073E5BE9200483BA6B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 6d57081277c7349c8a2a9ad63508cd2cabd720e5fe56f6f3dbcfc7dcbfd3ab58
MD5 a5eab03cd3a7f5aab300d1ca8cfdbaa8
SHA1 536e08dbee8916d73705206ee15361883149985d
SHA512 690c4434836d91bf290df2259ab7f1db2b9079c92c832c51ab51ad5243894ac3d459883eb88c5ca7a0856a9d3e967ad5b5d81f1e165e13bd7507f8c60eae93d7
SSDEEP 12288:0yPz5L8FqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tzy4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FA55125B73A530F9D1368138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 426631734081e6fb120acfa9b6c1875f7552a2b42a9c488ee424b875eda65b73
MD5 10f99d0c0e7e7c37edb3fe3e015bfef7
SHA1 a4422d8d2957399c181523566a0dbccb914608c2
SHA512 fea41a181113e9be1ee072b7ec8253ecb4fcbbec011e4abe703ba8ccf9359a39d59789c07481e49904fa0eec0613640c5b1357570d4880ba193fadf06af41d70
SSDEEP 12288:IcqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 78dda82a81e1edd7ef0debfe7d3f35599124978acb469956140409222204a26a
MD5 8f7c06e3b95a7b5a28c6d16aa3f24619
SHA1 047efc13e82955e66646e6952a4e3d1006aabecf
SHA512 a67f5f37a381dbef9397fd442f2a2c1e4b5afb25cc610cdaaaa4f4b398b9ac4d3caec0f6e3ae79f4dc05b1c2edc938c8bb6b7cc2b27d1d62a47d24dcbd96fcad
SSDEEP 12288:7cqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7hsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B14523BF965C51CAE52608B5C3E5F10DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a2faa5594ba7cb5ac8076c00e09316bfafee25f02b6a7b19205f4011dffdbaba
MD5 8b6f9f9d0e930a9262eaa9fc4fdcb5b0
SHA1 5e161b8809d95cf1f76736f3738b706ce5049662
SHA512 aa4c81f51778ce74f549c35d5438fe8cf1833da314bedc231ea148e3cbbe5fbf30dedade56451fc71b29085474dfa403603820daa49e4087479e4be2ce31fc3d
SSDEEP 12288:9yPz5L8FqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0zy4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19955125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 a919139d4530bfb1b25ccef2528cd06097f02c399e702795cb36a1f32f564b3c
MD5 73c0b69dd3d5a2850d5c679598cea6ad
SHA1 b59b4d382c1406ec64c32ae545ae9ecdc7b3d14b
SHA512 bbfaa32291e79d7758643d9e3fbc9438198b25e06c1a50f8e5836dfd55e6b285ee466a8f846a6d32656d413e5c027fbe661a5da70cfafc9e4b2d2ee4b03dc19d
SSDEEP 24576:NTDaLl3z0zDWsqjnhMgeiCl7G0nehbGZpbD:NTuLljfDmg27RnWGj
TLSH
T1FC6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 7566c6b905a01b2139ea1f2810405b569ebf50cd2783d5cb5eb4fd5b0f3ef4bd
MD5 7d66996c37c55123bcb050e93546b56f
SHA1 0a2481fe1601abc9ccf1b5fb9a327e873724cad6
SHA512 86a03e5bee4b0aeb15196bac9bec6283e5740fc628719256d4554cbf0d2e18879c7031e253f71fc39211d1e9ae171b53adef5c992f99d697b83d8e37631a4bf5
SSDEEP 24576:V3vd9CHKy7GZisqjnhMgeiCl7G0nehbGZpbD:1vd9CHKyacDmg27RnWGj
TLSH
T1DB75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 07c9e5fc12a5c097cf8e1da7966672c536cdb3cb839cceda57c5dcd1ca48a43f
MD5 3209ba689c5656a683278c9b3b4e38b1
SHA1 6a8630ae092eb6846bdd19398d70732b583507b1
SHA512 8a2c00e38d8b60254567a05c8e6b859543de4402844a3866c96252477d071ffeb543235319a51955beabaca5c5343e2ade0f7af0b5c2344f979389a3f3d8dbec
SSDEEP 12288:YTqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C44523BE965C41CAE52608B5C3E5F10DAC073E5BE9200493BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 8716eeab6bdf185e4b7fdda6a26d9a4a7a97d8c9f903a4b34f37a36b880c4610
MD5 0bf41c49ef18bed3f6c4537b326fbd08
SHA1 ed3226c45014b3362583b824138be459d23d9e5a
SHA512 ab612381162e97d1b40c784359ac48a13b9b61d5096df4c01e3fc10d7b159fdcd632c95998181bdc4460acb0db5a4b0b2928a8cfdca96cbf28c52e649db2a897
SSDEEP 12288:elqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1354523BE965C41CAE52648F5C3E9E10DAC073E5BE9200483BB977CB9EBF14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 1d071f8c0b61b02e8ad1834f9b6848d7bb2d766e294d1a4cf8f1fc6d2491f942
MD5 4fda43f28329c534f1d3ad2aa6c35618
SHA1 65a428693248574ea8473eaaf0304a8c76356605
SHA512 430fe720bb29c69eb70fc993e795b7ba91efb421fdb61a259b9f75850b150cca55f78b403e8315cde267102c6246443bd9139e7abb9797e78c6113db409a338b
SSDEEP 12288:oOqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ojsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA4523BF965C41CAE52648B5C3E5E10DAC073E5BE9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9162f4a91e58213f232eed135171af4631f8da19fd122c3fff03dc0adf2bb30c
MD5 2b3be533cbe5731b103e413a22f04e30
SHA1 f9ace4455b8a719b7a5b71ae9e885075322a37ab
SHA512 1bca2435320e264be268f3e689dd3925a3da5c8b05d8275cb27de221115f22f2d26a1a7e4c925fd4d2d9f4bd9f9ab2c4c507a67d3d11f9d2653fdac98fd443b5
SSDEEP 12288:2cqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2hsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F4523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6e5bc520a01a9a8eaad7f118f487e1fc07f9f6300c8653afd1110c6841afba60
MD5 9a87d0fc532b4a6011f76f69f30df2cf
SHA1 64b006d3cc50191bed9fb78d2a9a97e9f786a2bc
SHA512 ce10ea699c0a502e3cd879ecd9c308d9630af3ca7e815f047eccca3a7e978a1629f0cf5d5fa712f2393aab88e405d7e33fb894d8144a09cca2613923ffba46c9
SSDEEP 12288:GbsfsqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:txsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10555015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8cdc38be41f095fcaae9097615d6d0919b50ad3110e07b762e40a16488c3aba5
MD5 4918fa49dd5423545799d10446d03bd1
SHA1 b20ca7face1c2790e420986dbe56e2b6ae79cfb6
SHA512 86b54b1f79179803f560b33e756015fbd803add7d22a4b5575909da3b252eda0b3ca7a122cc5a9efe963cbfe0202886dd4d664fa39d0ed3f929bd972b398ba44
SSDEEP 12288:T6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:T6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB45237AD34C518AE97649B482EAF12D680B7E669F2004C3B94738FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 beb6c3da060576a2a1e7ae36d3c98ab573bcb659dc7f19cbe6b12d87550a2190
MD5 8ce8d72f26249ed63d19d77034e13cfd
SHA1 ef41e551654f715325577a893a763fafd6e26720
SHA512 8ed3d9084d9de307a59188eae9004373a92d7a2c3016a2b425281fbb3ce95f42a9eadb1b2865c6118e1d3b44299ce2620f345417b1cb7d01fb7eddac3d338035
SSDEEP 24576:z8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCssqjnhMgeiCl7G0nehbGZpbD:ARZwQCyiHiQEaiPnM9Dmg27RnWGj
TLSH
T19B85B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 e10dc6c5908048a384607a9390abc407be505bef520d6edb19ce2c5979fc8512
MD5 ca29da56f76a06b602f81da63a5420ee
SHA1 02df7af37064b1e25a0bf6391f6fd600dd820f94
SHA512 2b9bfda30d21e15fe5264fd7f8dc0860b87fbce6402df31d0293e2f59731dcd34304eb38fbf3fd3cefc022e824e59c4f22ea94528150a9219bbff91048b62a6f
SSDEEP 12288:ObxA1U7KqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ObxA1UGqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18855123E62AC20E5E176957D86D2C10AD7327C26672053DF21D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b6b00a57040263931a4fc24195a7ab84feba95e872647e462251760047512c43
MD5 691e60f16a733cf1f6586f7abd87d1f6
SHA1 f77455a7b21ea6298288e9f2163ef49259fd3091
SHA512 1c6abb7cfc208fc228f58733536f9a4554bd615971d759c90fb090494916b211bbe0080544c34194babd53287ea5689008407d452e815d88040471d15c32f9f7
SSDEEP 24576:DjsmP0yHaqrVqHra44KDzMsrnvsqjnhMgeiCl7G0nehbGZpbD:DjRP0yHfVqzlAsrnTDmg27RnWGj
TLSH
T1BC45AE2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 179591f661c75a11b5f39a00296605fd02b88b3a1b092e779d20250fa7496ab3
MD5 78e89f4d3353803218b5797644d71067
SHA1 3c78c081f0e119c0441e9119b6a8c5a01467366d
SHA512 d3a8803ef42aedb9b308501eb4c0d7c4901c0f000edabad22000ef70ac9e2c0c7bffdf85fcf158101c9d0acf96f011bd78c2f5e2454d531dd6b1b1df80214504
SSDEEP 12288:n0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:n0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1634523BE924C51CAE93649B5C3E9E11DA8073E669B2004C379977CFEE7B54D84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 75b718a14d3a7ff05a929215b867e86c32476d3656619ddf2a115960f56638c9
MD5 b8c62985b80cf2ef95bd91404ba49a07
SHA1 76452ec29a6c2d6aa125f1aeeae9bfb9b8c6ccd9
SHA512 51561204edc2ed802bc9bac18453e80b1a498dae92bb37f22a2cc43f377557b6b8548a32d8d1f3144ba8eb84bef0a79a9d4ca78c8f03c529b901d18266af7ee7
SSDEEP 12288:oObfA4LWO+vAYFTeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:FbLBUTesqjnhMgeiCl7G0nehbGZpbD
TLSH
T193750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 bcfd88956c55eb859adc457834ada7c3d45d8b99ef626107996f101083b44c28
MD5 0fe05956dd2fe89318f8fc041b6230fc
SHA1 76d36d3cba88303a1ca3fcbbe9c57bae0625377b
SHA512 13144b0fc8304253276da36e68803acd1fc6adc57ebc72402513210fcf404a1de5cae1848ce8be4d64f2f38b7949795d8eeadc9682c7956bd5f1838cf614d850
SSDEEP 12288:x70Vm9IYNvUyBpNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:upYNHDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16C65E12FA2AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 12e612ee2320ee3b09944dd0c6026dec82bed0b6ce7da684d6cca9f2da8ba1ac
MD5 dc28869e05e79e7657c5d2834aabc93c
SHA1 6350c902f1641d9bd4eddd55c68150c00d54517d
SHA512 f4c04815f60b56234dfc7e55d7a668db0cc529ca0da1c2f9e0c5eb3ef49a7ccbb689efca855a153a1e49ff1293435a301c123efd52bf4f285bf35b845994ad76
SSDEEP 24576:6nXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK3:6nXoJJYH84VVS6AmEOJas+cHBjSSKHPv
TLSH
T1B365BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a9037874967c893bf916b08ebed5a14bfd3a70f228f1baf149703b4a469df1dd
MD5 fc4be5486a8786478bbd8838899fb030
SHA1 b06cff2c9b92983abb8b27914bc0bf467d631dfb
SHA512 2d16c1d867ac9e6790b70900a4615437d0a1ccc02e44db534f53b6f244f7f63455f14fe4c69d87d2e86605ae33d7fb36012449d27cc12569a3006ebc6ce51986
SSDEEP 24576:Ov7Xbxd9Tuycf8M/TYlSuxrr2PC1sqjnhMgeiCl7G0nehbGZpbD:ODLL9TuJ0M/TYj2PwDmg27RnWGj
TLSH
T182858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 687c40f7f1ec462a795956d43e352059ee8989b722675448bc0d6a5bb0ed593a
MD5 1b9ca34a0396e14b4353721e6670aae0
SHA1 531f2773fd2f8ce6ca0c3a797c5d8f80f4c20a5e
SHA512 bb1b6354a4b3cc61c95261333ef1c88e7b37cb44d0903b6f8ffee652f38ed78c47889b10819429bd445133c4636309b794151a0b3ee68fdb053d35daa23775e8
SSDEEP 24576:fegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wesqjnhMgeiCl7G0nehbGZpbD:fngOJOmPOHzyDmg27RnWGj
TLSH
T1B755CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 6f380a854122f478683275f92bfb0bd8f12342570f3a7d9defaae0f32b5c0692
MD5 884b1c8beb9b0cd55fd4b923c524f489
SHA1 e29fdb44700cef893b79e4bbe73afc7c6c1b0479
SHA512 39771bc5dc7c53172bad7613c8a30991dcf6b1d82d8f204282e0d8009b4c3004367252781c57f532c5bc4ec8c917091b95fd4179a2b7eb4180e53f4dd3e12fdb
SSDEEP 24576:mLJnJiTk3R3waE4JrOUsqjnhMgeiCl7G0nehbGZpbD:mLJnJK8R304ljDmg27RnWGj
TLSH
T17275E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7cdbfe2b3a2c9c201678d316a1d9b31b60f2c6040905c164fe81b376d91dbce8
MD5 a1ed083173a1c97547b299beed87cdbd
SHA1 b2a69fd666009e7ad66911f29f805ee6ad84e597
SHA512 49e869aeb8e26afb58fd76e828b9e95b73ab0b38daa38c581691a53e31b692ee41c749192952cb35c7062a2e7ae47ee720c604115dc66d872c47fee77e8795fd
SSDEEP 49152:d9mqCzDScAZmlvTcFg8Ph6MDmg27RnWGj:xnD527BWG
TLSH
T197955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 6ab578a40d0cdbd31bb81237f5468e7a6ba629d4d691ab1491d88d6c4267c5d3
MD5 8c42f847ba036d95db3b9cfeb02045c3
SHA1 aba5adc64c187957fe715b649439b0679048d4fa
SHA512 b537e70c56dfaa0cf89f43cfb2d693b8b2c33939dc99f125cfb93dbafb057c7a337f5801834162c3e225da8eae3adf09cffbe2d54e658cb31a5636308f7770bc
SSDEEP 24576:rlYJeXm5jUuEgsqjnhMgeiCl7G0nehbGZpbD:rlYJeXmRUuEcDmg27RnWGj
TLSH
T12655126E669C30E5E13A8079C2E2C508E633B872671017EF65E1D5BE9F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 c96fbcfdc21e2579854f9ac03d4849b07b2679224f4b30d2c92c62208ed5273b
MD5 a24bf3ac828d0e078aa861e5ffbd8dd5
SHA1 7533bd7b195ca346f03120771d8ab0f06979bb7d
SHA512 470216f28007781232207fd0387203e48253fe62f93248b784ff8998fbb2fb5c42e206f0f21b2ac22efdcec73a1f0c431f70c0dcafd6afe66f58f5b56d29720f
SSDEEP 12288:Kmu6kyPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:K7tyPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T192552219639860D9EA760978C6B3C158DD367C219F2002DF65E1FA3FAF726D48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 5db63cabf9c6a3334d44e9a236cb44e29ab988f5a674b21fe5db4b8be534e5b3
MD5 8a2fcc5faca77899a2732e204990752f
SHA1 e721dd48e9d8088c76b6b549ebb13b808244489f
SHA512 c7269ba674ef889053d40edd1433e9b479686f1138ba1988e0964ac2411b7389b453fb9dd77b0aac2b4b7a8a0ea356e19d3e90ff41bcf27d2be35a3913ce7d77
SSDEEP 12288:4PeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbED:IesqjnhMgeiCl7G0nehbGZpbDV
TLSH
T1934523BE525C60CAD93244B4C2A5E11DA8173E769B2014E779E3FCFDEBB64D44B38812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 86e4973342316c6289b0366d0d04829b9b12e139a2b7a4e575f58d85ff58420b
MD5 3487a13d7fabd3d49d308f341fbcaa4a
SHA1 ee7d3d0f8047d7ac20c9a485a95f7c6b15b94e86
SHA512 958e4ce6cb5b6a009f9198d2e86a0b3a73a620d3a5acf97bf961b0b018f1e5403efd50b5bf871b4dbcd526d13238ba9929c15a8b0499dc59b0f4fdc4857fd53e
SSDEEP 24576:kC+TyQIu93VAumZr7jmhsqjnhMgeiCl7G0nehbGZpbD:k/TfIq+Y1Dmg27RnWGj
TLSH
T178558D2DA7F919CAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 32cda45bc8d6433d8928c8befe245570616c3f0bcb5dae9475948cce6c7bd886
MD5 a4310136466b133c7e4fb779277b9b94
SHA1 60ae949ca9a28d3f5e2ed75f2508bf61a247a3db
SHA512 f7facc8e6ea67becb919b873d27ea54b276b2a021987ac5d477db004305dc898d32889254aff1c58ffaab28eabe11a6a0898a81f3514e8cdf4d418dbcdb5fd1a
SSDEEP 12288:8cyrWOstaa3kcsiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:5LQikZisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD65F11FB3AE0095E0A7817CC9858116FA737835571163DF02A1CBBD5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a7ec30ba2ea03185e963f74bd9c303e667ba92af84f64c1f4518bde72919ee1e
MD5 745bdef191f0b872949f735615c06e89
SHA1 850f3acca8f1ecb7143ad3e2aad6b38467247ffd
SHA512 315c08e213eeba9a7dc542a3493a5e806926e0a185cee29fbd2324f67de55b30980f8b9e925baa0fadf406e5418d1121f7d5b43f0c9eaefcaa32a0e690f5d287
SSDEEP 49152:9pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPzDmg27RnWm:+pC7b4+80GTk0D527BWG
TLSH
T16CA57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-525-0x0000028584D10000-0x0000028584D20000-memory.dmp

Download

memory/692-530-0x0000028584D10000-0x0000028584D20000-memory.dmp

Download

memory/692-531-0x0000028584D10000-0x0000028584D20000-memory.dmp

Download

memory/692-532-0x0000028584D10000-0x0000028584D20000-memory.dmp

Download

memory/692-533-0x0000028584D10000-0x0000028584D20000-memory.dmp

Download

memory/692-534-0x0000028584D10000-0x0000028584D20000-memory.dmp

Download

memory/692-535-0x0000028584D10000-0x0000028584D20000-memory.dmp

Download

memory/692-536-0x0000028584D10000-0x0000028584D20000-memory.dmp

Download

memory/692-528-0x0000028584D10000-0x0000028584D20000-memory.dmp

Download

memory/692-527-0x0000028584D10000-0x0000028584D20000-memory.dmp

Download

memory/692-526-0x0000028584D10000-0x0000028584D20000-memory.dmp

Download

memory/692-524-0x0000028584D10000-0x0000028584D20000-memory.dmp

Download

memory/692-523-0x0000028584D10000-0x0000028584D20000-memory.dmp

Download

memory/692-529-0x0000028584D10000-0x0000028584D20000-memory.dmp

Download

memory/692-522-0x0000028584D10000-0x0000028584D20000-memory.dmp

Download

memory/692-521-0x0000028584D10000-0x0000028584D20000-memory.dmp

Download

memory/1136-265-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1136-381-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/1136-256-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/1136-259-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1236-516-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1236-403-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1236-397-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1236-407-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1248-391-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/1248-271-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/1248-281-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1248-275-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1252-503-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1252-471-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1252-431-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1252-422-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1252-518-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1252-487-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1252-428-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1424-359-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1424-369-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1424-365-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1424-367-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1424-371-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1600-311-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1600-317-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1600-319-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1600-505-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1656-379-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1656-511-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1656-373-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1656-382-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1692-355-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1692-510-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1692-353-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1804-224-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1804-36-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1804-28-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1804-34-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1860-24-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1860-14-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1860-23-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1860-223-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1932-417-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1932-288-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1932-296-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1932-294-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1944-406-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1944-286-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2120-73-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2120-226-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2120-65-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2120-71-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2572-241-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2572-346-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2572-239-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2572-233-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3092-267-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3092-244-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3092-257-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3092-251-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3092-245-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3488-415-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/3488-409-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/3488-418-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3488-517-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3804-330-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3804-508-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3804-328-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3916-341-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3916-335-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3916-509-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3916-342-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4240-61-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4240-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4240-64-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4240-57-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4240-51-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4296-6-0x0000000002400000-0x0000000002467000-memory.dmp

Download

memory/4296-2-0x0000000002400000-0x0000000002467000-memory.dmp

Download

memory/4296-8-0x0000000002400000-0x0000000002467000-memory.dmp

Download

memory/4296-0-0x0000000000400000-0x00000000005F7000-memory.dmp

Download

memory/4296-22-0x0000000000400000-0x00000000005F7000-memory.dmp

Download

memory/4308-392-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4308-385-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4308-515-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4308-393-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4596-512-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4596-430-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4596-299-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4596-514-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4596-306-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4596-300-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4624-49-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4624-45-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4624-39-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4624-225-0x0000000140000000-0x00000001402D4000-memory.dmp

Download