b40b405387ba6b725380dd3c3ed09d641f4d6592dc52097162177cce95677750

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-08_bae358b3aa1f14b20810833f6831108e_elex_mafia.exe
Size 1.6MB
Sample260608-qa671sew2y
SHA256 b40b405387ba6b725380dd3c3ed09d641f4d6592dc52097162177cce95677750
MD5 bae358b3aa1f14b20810833f6831108e
SHA1 1de5323a19d33864cc48a8a61447666ffc9884ab
SHA512 1af09f460420d4ad82a7aeb0db393e4e422b8488b08ed1b7e775e8e20c0b074eb27d02bc17199a4f779152d21612c766027da8007af94822eb13e2321f39496f
SSDEEP 24576:8KqMmodg+eDZE6nPA3mVSbGhK1VqehzAysqjnhMgeiCl7G0nehbGZpbD:8K8+eu6nImVkzA2Dmg27RnWGj
TLSH
T14E75F0223685C036C59201B5CFAED75B687DB9710B2018C3BBD4AE6EAF762D14B3531B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3468	alg.exe
1084	elevation_service.exe
4200	elevation_service.exe
2108	maintenanceservice.exe
2644	OSE.EXE
4352	DiagnosticsHub.StandardCollector.Service.exe
1960	fxssvc.exe
4076	msdtc.exe
5076	PerceptionSimulationService.exe
2076	perfhost.exe
3976	locator.exe
3320	SensorDataService.exe
4048	snmptrap.exe
2752	spectrum.exe
1548	ssh-agent.exe
4012	TieringEngineService.exe
1612	AgentService.exe
3664	vds.exe
2536	vssvc.exe
4712	wbengine.exe
2948	WmiApSrv.exe
3344	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-08_bae358b3aa1f14b20810833f6831108e_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-08_bae358b3aa1f14b20810833f6831108e_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e1f714ebfc4568d2.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-08_bae358b3aa1f14b20810833f6831108e_elex_mafia.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072aa2a9947f7dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007383239947f7dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000066ed29047f7dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009daab19a47f7dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fac9cc9947f7dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000930bef9047f7dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1084	elevation_service.exe
1084	elevation_service.exe
1084	elevation_service.exe
1084	elevation_service.exe
1084	elevation_service.exe
1084	elevation_service.exe
1084	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	672	2026-06-08_bae358b3aa1f14b20810833f6831108e_elex_mafia.exe
Token: SeDebugPrivilege	3468	alg.exe
Token: SeDebugPrivilege	3468	alg.exe
Token: SeDebugPrivilege	3468	alg.exe
Token: SeTakeOwnershipPrivilege	1084	elevation_service.exe
Token: SeAuditPrivilege	1960	fxssvc.exe
Token: SeRestorePrivilege	4012	TieringEngineService.exe
Token: SeManageVolumePrivilege	4012	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1612	AgentService.exe
Token: SeBackupPrivilege	2536	vssvc.exe
Token: SeRestorePrivilege	2536	vssvc.exe
Token: SeAuditPrivilege	2536	vssvc.exe
Token: SeBackupPrivilege	4712	wbengine.exe
Token: SeRestorePrivilege	4712	wbengine.exe
Token: SeSecurityPrivilege	4712	wbengine.exe
Token: 33	3344	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeDebugPrivilege	1084	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 3908	3344	SearchIndexer.exe	105
PID 3344 wrote to memory of 1992	3344	SearchIndexer.exe	106
PID 3344 wrote to memory of 608	3344	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-08_bae358b3aa1f14b20810833f6831108e_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-08_bae358b3aa1f14b20810833f6831108e_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:672

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4200

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2108

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2644

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4352

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3772

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4076

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5076

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2076

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3976

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3320

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4048

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2752

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1548

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2504

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3664

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4712

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2948

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3908
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2820 2852 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1992
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2876 2872 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7ce2f588cae1b52619d1c7cf75f5b74aed89d1911b95801746e31505e9fedecc
MD5 fff49348f0d4fdbab7a13bf0cb132b79
SHA1 56659c8e5758ae433e77288ff9c736aff2c0510e
SHA512 e5aac2824c7677f0dd62f0421f0557d61c29df4988e3d978d6ffa493b14dd2535b839f6973d5b04d89632a9c581e247404bffe8a9d59b751811e1f57233dc266
SSDEEP 49152:Yb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnHDmg27RnWGj:y3q6sjBMD527BWG
TLSH
T1C8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f931fb31bbf8104ce51a6de036b23d76341aeb3e5d294fa4560124609763ffc2
MD5 95850b718882eecaa5cedda080f9a980
SHA1 07165dc91b2f313bf628796ad65a545687bdf56b
SHA512 8b338d46bb4fa3c078b8ae2a144888364ac107d9f6e120f32e34889c07afebd67c5beb56c0cd44187f7454fd32131c2f2aa64d36ca623897e3702a036f4d091e
SSDEEP 24576:GXYfDtczAcsqjnhMgeiCl7G0nehbGZpbD:ltcBDmg27RnWGj
TLSH
T10A65F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d280992603e154217068735d2ef7f736c17ce7f0612abc428947a60ced1587cc
MD5 78a6cba34ead5e3f2092bceaf838d3c2
SHA1 55b3fdc84562abd6aa2dcf2c6cf4c341e70273c2
SHA512 6e141a159c622f5524a007e32e554f182c9be876db244042e88f28697414ba6863e0ab70e257e1ab06f7231ee7fa54eee93be308766e8106193f7df3695ec635
SSDEEP 24576:r0Le5ji0hmxxrMrsqjnhMgeiCl7G0nehbGZpbD:rPji0Aj2Dmg27RnWGj
TLSH
T14D859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c2b408bb169b04cf9616c56ff37ba124c1564d20b8eefb011e1a22bbac4f4f92
MD5 4e0e082b3ea7a1605104810b1247dc27
SHA1 5364420d1c60ff3164f19da7f297b9c840fe01b0
SHA512 298e7df8f120e36f4ccac1564c0104819e9d485b57427977b11ae9debdb5c11e536a65099c90e13f132e1e45242f3fd3f8647cc58611eaa6c973fa17ab780a01
SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWn6q8wyutsqjnhMgeiCl7G0nehbGZpbD:X/ezSC6vUzPveHjySDmg27RnWGj
TLSH
T193755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 dc3ba9d91ad38aa7c9c6b24f45083771f70a6cbe8dbcb886719095968787271e
MD5 78aa2eea54423464b6c645656bca12f3
SHA1 438b04c2f94e4d1628473a6a46d275542ca83c7c
SHA512 2342801f363c2efd94722ca4d03769574b7929b7e340dbc3051b06d6ceb230674a6b9bd5dc69e38412094c6e92192b7dc053b264b1b0e4cebb1204dd4bc0d9fa
SSDEEP 24576:tVbqPb88hv/l+YgsqjnhMgeiCl7G0nehbGZpbD:tVO88hXl+ZDmg27RnWGj
TLSH
T16E559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8992b882d6c7bbe7d25597f5ba8e58d5d77a451d0b4898fa15077394f7ef33b1
MD5 bf383c81b7deb257f5de0a860261eea7
SHA1 7bcd8857a2db113bc73d75f29fa97167a2132919
SHA512 429cabe9fe82ea0791486f92622a9dc47753def7a63433126cf8d48ddc8c15e24acbf52bce0d56df3e8642716ac5e9a426f8c48159291a57fcf888626f4796a1
SSDEEP 12288:4L/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4L/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1884523BF864C50CAEB7608B5C3E9F11EAC137E56982008536A637DFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 cec22b2b1d790c8455be4806f8ba30166ada5b47d8f05a40f25e4055fe32005a
MD5 2a6fde5ee8f800347e82d81e4049ee19
SHA1 e8f37eb5db83c3041fe23777a127dc644821c5d8
SHA512 db1ade4ccff6a0e24258a9fc3ba3992a8aa3e4b50d85e7a74df545bcb7a516609c1f0c541a70b463c1e5e0a19335e992e18c0bea7d6e71aa8717dde85ef603de
SSDEEP 12288:xeBNUbTVO86UIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:xJIUIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10165CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5b6f0af7cc77822deb34283a11a8b8e234b8caeac0ea5afdb86c67f9c32c1f03
MD5 9715a028fa95ae809770d320936d96d3
SHA1 7bf6d50d8a9bc4e988a5a360766072c56815e3e6
SHA512 8ba58b5d3785972425eca97cae979727caa883a0d2badb0bba883071500b3297480c3b92ae94697c3a2bcce066f733182f03a74322cc1ddc7847e9eada459f0b
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THH:nQvGAdlCEL8c/DRNw5ChD527BWG
TLSH
T1D4266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0bb26751c09a2a2e7b8ef8674a99a80a96a0e559f84abde03043918a998eeb77
MD5 47306722740b64755ce086e6d6fd26ff
SHA1 301b19ed400380718f58c62b7bdae55e1d1c1983
SHA512 974dcee329d0c771ebadd95430650d205f62a73b785241129ef9acf2cd90cbe8ed911c564393b5872c3c345c2caf543106b8a23d13c278e908263df4a1b75243
SSDEEP 12288:EAwSfxL/2Dc3RDLLmt0LDQewsAjCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:Z0ewsAjCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15275E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7f92b4991251c26e9bfeb0d707a199768e9afbae3bd7a15ac65a6c5096aae760
MD5 1eefdf785538b0ff8813d45caf64f6ef
SHA1 331fa0b04932356bd4188f8a76910cd02252be31
SHA512 417b13088ee1c294dd408d9a357f949a632938d9f2fc9f6d4952ceca05ba49925425f99caa11b377187b79b7e30e5dd6d277a7efae6ec09eb41eebf85eeea3ff
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHuVQBWG:9UEtQevvqc2W1cpV2tI32hB
TLSH
T122474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 860452db2693b442a4f584286ef33e0ccbc35eb6d7b8b22b32bdf0cf28df92bb
MD5 4a6eb68310b5ee333a0e9da5b0696bc9
SHA1 c5850bf9b1c44032090bd71656d971a16a5cd91b
SHA512 eecf5c4f5207f2072ceaaea6753168f1dc20bf3ccfc1dee2f64d28602c6562bcfc76b710fc710bcd408b5d30aa33185217c31b78efb8e01bbdd8ad5ed7b14ba6
SSDEEP 49152:yCbRquA/m2yL5zTfFiV+XenmE3/zmDmg27RnWGj:XoquVjnm9D527BWG
TLSH
T1CCD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 45c591f7568d9608a339493c54405ee6ed46df9d54e2af5264ac55a979ed02fe
MD5 565da84510eec7f21e8020697b808876
SHA1 a6534615aadaa00e26b9d96a6cf9f39007b0d05f
SHA512 dfe15e21a2aa7437324f70fabc133d2091852362657447a0cdb5d248b29ddf3bd8cdacc400252c74bdd91a54e282fcc9627c3f74f684b772c55eba1cc7dcbf1c
SSDEEP 24576:XAhGL3IFoiwtA5l7S53ZsqjnhMgeiCl7G0nehbGZpbD:XAMUFoiq5NDmg27RnWGj
TLSH
T1FD359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 40ad3bd9ab650d98cab6469d69f2b4e2444462c6afaa9e3304637f12cf51278f
MD5 5f375f3ea0ac78ac49bc9a36fad59129
SHA1 4157407b0b231818897cb09d3a522ddf1eb634b2
SHA512 308934c61010f3462bf290496321b5edc50d8d1e12b6ec2de4472af7b953d308833816ce948091e139ea00f738d43d218697a653b71f0cec90c999e5f774b922
SSDEEP 12288:vmw5HEjsChNVBFgl0WDm+CNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Owu4OWesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B365F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0c6814e9f30f2f5cdd89467a49823a5d4c41ff258fc4227e3ee504044a164117
MD5 d69f5c06aa07f993d9ce1bf80d004f77
SHA1 ad150db3a04ca98cd5b7b1e8177316f020d284ac
SHA512 c169109ee626d68dd2b8f28666556cc648c9b4585d24ff24be757b824ecc4f2fe0ef0480b14b9cb8d12019e06f715742a055591aa74e70a07d179c4e99af260c
SSDEEP 12288:6eZ1IySXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XZuTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1465512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e1ddb803d7966a56a5fd9ddd440c24064878c8fd1272cf457bdedee0dec20268
MD5 488498f38a21896e484ef68d0582fa6b
SHA1 69ce743cd6b88ccb15edf8969ae375c495bbd50f
SHA512 254eb93b932fdb3137efb4e7640108b5ce7236b114466b4c2284fa1e97b72d93645faaa192646d8858ad43f0dbb2dcebd20eeb76842635c3d67430865a824ee6
SSDEEP 98304:uQRQyi36YOcPbLvw2gAf+PN3AD527BWG:1QyiKa/X+PNwVQBWG
TLSH
T14E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2d029c67b169cbd3db36dd3ca6946be0653d544ce2fd284a44d4730d2c054a22
MD5 d36a9cb8787a45bae34d97911be28043
SHA1 06addefb4055795898437cc81c3bbdd4cdcb08bc
SHA512 81e71a969101b83c7e7816ab0440049b3ab01fb3345b683cddefa17e890e224444a685f507ec4c25ff94bc1fad75fa3fe0519049e0e291b506d07179b2332e7e
SSDEEP 98304:yQRQyi36YOcPbLvw2gAf+PN3AD527BWG:pQyiKa/X+PNwVQBWG
TLSH
T10B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 abadb4b14e38928e7f2d6b14975ae31c6fc1d7858e77c03828610281673ae1b3
MD5 b8e98a86ee1283c2cc4b1b68d8bca495
SHA1 7c739ae4f9c550e9284bed7d984222be251dfaa2
SHA512 1e51e1ca8a0e9955a88bf3b194dfde01cbf36b55a1b0e98a12a456f82707b5cc2dc512fec92c4813dce721145223df07e5b48111c0175ec79bb331d9f4bec74c
SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0DsqjnhMgeiCl7Ge:q68Qg55nhceWu7PNU3/2Dmg27RnWGj
TLSH
T103B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 99da26229fabc81a0372465c496dc0bfb9c057cbce9e1bc091e629c591d2dbde
MD5 449c2a1c3fb87ba75f990f2f3516c556
SHA1 244fafbf8ec09d937fc6055a73632e9d2dd01753
SHA512 39848cb42ce2111371f0c22e1b692aa3f71352e39647037961d0fca40f2bb414a2ff11e9d5be58659a4b86b0b09c8f0ebc298828b7be21968b54c5058cd6a3f6
SSDEEP 98304:Iy5112gYy5azzVvt69nLKnhZjD527BWG:hLIHEWhFVQBWG
TLSH
T179167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 85ac023c3458b778387cd3bfa798bf5f00c0352bd502a6aaafaf28364c429cfd
MD5 f126cd862799b08c936b36dd76ed5d6e
SHA1 0fdce5ba46ff8f64c825cb43535cabba899ae862
SHA512 c6e4fefe520eb545878c6f2ade71cb981c005b83ced188b4a30601e0e542639b9298c058880ad713055155af8a3bb2bcb99d29bbf29d2ffcc6bc632a186a7d0a
SSDEEP 49152:XB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl4Dmg27RnWGj:5u6Jmdxd2d4D527BWG
TLSH
T158D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1c28011cdecfa1751e08fcf273c3624f86ca20571f049c8493f3e40fa315f94d
MD5 b256fe48a9cc18f4ac8c49614f24fc2a
SHA1 28a80fc96ed7bca802a9002a93dc96f4f5e2d0dc
SHA512 2fc18d97cac88dff6ada3063fa4f4449f39c7d26b1b890acd8809f1b80bde6b46fedae9d559518b2194a16633600ebbc5af643efe259fb51765738723972ce7b
SSDEEP 49152:21hpsNoJpF1A63U44CwH7R4xUDmg27RnWGj:2mifPWR9D527BWG
TLSH
T178B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 02dd78e7b2c105feb1c94019a1518713d15b31dd27c9106d7b56748d9b90f815
MD5 39c4dadf60e5a53fa97b85c969eb5795
SHA1 1d7e253ae9f537166b5f5a709643918771844fd9
SHA512 4504d695d69f63a0c54139e4919dfcc3e9f0d21cd7480347cd5c50cb2cdecb6fb99da58b7e1f6e03cb01848c8db473b33f582da2e3f05ff56f4730104b143e2e
SSDEEP 49152:ZSuZQIY0Be2KcRVtOnks6NMHqXDmg27RnWGj:35dKii61XD527BWG
TLSH
T1C5C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 09ab9fe671dbdd59b6ae8b5c9cb4af4945967c55e2bad6a3ee137cf3abd1ef16
MD5 1aeea53391eb91abe7246e95a041cd4c
SHA1 016a7be4688b673649ce3e2b4ce273d9ac6a7a4a
SHA512 d0b7a35e22c25e7846880b9b32f34caa57ad272d1cca8916944557dbcfef71fead549930559f31cc876c82ca59600e1a50bba05ce036ca40bd1583585da38bea
SSDEEP 49152:xhtSn8EApI0fig3giDn0AP5wIDmg27RnWGj:gX2imphpD527BWG
TLSH
T1E095BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2feb0ca11ad4910fab2069faba13941314699ef5c41556414a05a83ce6600d35
MD5 c1c12ab54daec28ec79c7c1e7bdca68c
SHA1 b6ba95cb7d7b7d7f07cc02364e378361b8f89492
SHA512 bd81d05c746d10798abcd666810bf324b213b387140b0d85079295e5d56f5d1634355fea9b62d35a0c973da9efb13c9e25c92fd36352e07062eea08da35d0259
SSDEEP 12288:QnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15F4523BE965C41CAE52648B5C3E5F10DAC073E5BE92004937A577CBAFBB24984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 339aafcd274458f956280ca21ab440f16f2dd85cc334e0741b8b392929225a19
MD5 563c6d50453daa393f36a59adb2fb2f1
SHA1 cbd0072f24bdd50b4b80eb64df864a06fb3ef63e
SHA512 43f883a2fea1d590966d0f9e158be8452a64961441c41046978436897a781a7d6749f714304b366f4f77787c8705cac755c0c8d9a8b9d0632036ed65b81b8b59
SSDEEP 12288:62Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:62sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1794523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 31df44c615153896b00c0eba29f3d403a5e0f1c74c1226933dec4a20d25490f0
MD5 df85858a198894ea651760f64f58feb4
SHA1 934dfab953e81e48a0076b1fb85d0db7b43a5a0d
SHA512 ec7f4abe6b080b6b3bf55b158a9a895576d6fc5c2f3a686a2f31e6f8f2df29b308a284e007e2766e8899d5f1129d1b65270b30e31016f700b1492634294270c9
SSDEEP 12288:6QXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6QsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F4523BE965C41CBE52648B5C3E5F10DAC073E5BE9200483BA977CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 b9abef5d9254a480c9c80467220a295d00ac1f8ec294ebb7c973ab30d2b45142
MD5 5aeeb44ece1245a7cc6c1023f0768122
SHA1 eba36941c84783fa8ad607889dcce766854dbab1
SHA512 fcffb52efce0d7ba51d88117db856f4fe2a93797eaa83a7cfef2b702a3a3da0c81b6cf0ba6969aa2b7cbe76e29ac4cd98f3a58ea5b4fed458cf3e7cc3ee75d12
SSDEEP 12288:JV5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B045236F675C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 081431aa3e7aa0b39820e1fdfe9ea69bf844eceaad437d40d2fb7bdbab187136
MD5 7c5d9abd91ab9b505e3bbfddbf1978c8
SHA1 4ae111ec29742f66847358feba70bf6fef87739b
SHA512 190fca7505c848aa07c2a6fe45cbfb5284f5e059d4ac7fc1fc42ab714bc9cbb67cfcb6914a953d580e4ab8566f0d8d660012db635d9e5049bc4866eddac5aa6d
SSDEEP 12288:2RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2RsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC4523BF965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f7be3985b4b4b3a11fdc3e511acada1e295397d264c4a332baafc2f9a941a15d
MD5 d2dc855929be68bbe60ee00df6ee2109
SHA1 76c3e51a847d35b927fee900d63d23443be93b07
SHA512 28bca2a3f44678528052e1819dac9145bc464c14f7eae7c8c093f5cde6b2531344e1451266d9d1e00852a6080031eaa6f618b6da7ec388455e42a6fe2f4c0683
SSDEEP 12288:ZqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F44523BE965C41CBE52648B5C3E5F10DAC073E6BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5975dc0e04029cff237bcd967938d0adc7f49d440e5b8e1cc47f3487f9436614
MD5 0908c3f74d3d5e2aecbfa9811b1195f8
SHA1 9d0f475ad5d5c7a5f7e21d9819af184df234793e
SHA512 0e41c9c372d53d1b2f530c5ca25e226995dceea9a3024312be0920d58d4f208eed003dd825f162f64864a99afc052774125d8291c4f1aa27651a0a2eac5dd148
SSDEEP 12288:0OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1504523BE965C41CBE62644B5C3E5F11DAC073E6BE92004837A67BCBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 af1ceb39b0bf1559f393c71cf8d8c869c2bfc512c34b7413d5eae1b9bf6f29c2
MD5 b9850783518c3cbd73ae61cbad5dcaf9
SHA1 110a2fd76618d6ac1a2ffd75dfac88a0e19d8388
SHA512 85f1e431138567d4b7a6c7bf21a929063ee72f0050646f5c644ab42a5dda31df2520d61be11f361d536467cd3693c0c2c7b7a810ea50982cdb95891012ad85c8
SSDEEP 24576:HZMRzFVSOWsqjnhMgeiCl7G0nehbGZpbD:HZMRzfODmg27RnWGj
TLSH
T1246501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 be5a92f6aaee847ba097b9d07d14b3bf18d46d17e02b78892721d953f6110080
MD5 35a5d0a720b185a8d1caee9df3e4c34d
SHA1 649b44b0dd86d206d0304b42549f1e1112eca771
SHA512 6700bac361e6291c8803c21d0a2b54b789e0a922e67e8848d2735591482fd7da0ea80a07479062a8b2dc74034bd7f13876f317fe94ba9faa370fb1e84b27185d
SSDEEP 12288:PjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF4523BF965C41CAE52608B5C3E5F14DAC173E5BA9200483BA9B7CBDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 67a4284f1f6aee0b41071d04d4a9f81f80b55f7f0919ef225939ea0f0c18a582
MD5 a56d8eb251aa237728ebb72454cea879
SHA1 f1f74944fbc3d3ed19893125b0223d6ee5d3de92
SHA512 64d925a2da371ebf65af25f10631e624e0a889c18526ea87679172b2491220538430c60ca6fe2062120f5cf918f21d357f14dfb7727ac447ab19ad73bfe64f0e
SSDEEP 12288:lPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AD4523BF965C41CAE52648B5C3E5F10DAC073E5BE92004837A6B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 3deb3656fd14c974e8003951e5a297d7a7994bde6987de3cdbb9252153187566
MD5 8b54561c2944c9f8e4e7aa12cde45721
SHA1 f4f9993045ee2a7f128be3af3ac662e1b0c07359
SHA512 0cc7fd345f4e6782c0aa8f1be4846a9732b54d1a1c6e6ef84db28d5fb86a9cd7a5004042a17afef8ec7c319a49ad03d8d4ca8a2259f61989a17481f4773ee908
SSDEEP 12288:9yPz5L8SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0zySsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC55125B73A530F9D1368138C5A29A06F7337C3647204A9F17A516BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2831f3be907701e746c222d18015a1f9f9d96b0dda9e51f11799a62f39610d6c
MD5 a8f4bd013de4a786b29c471f4fad28fa
SHA1 e7c1b2b7a66aa68472c0f4d3bcd5b4c414381ed5
SHA512 6ea205c0ecfc7799d1bab948225847425ba4580ea0fa49996ebc3c0fa0079db0b7aae5bd70e42930ba8f31230c14b2cbc017b3dfd030fb5918b6df3dbb8390f1
SSDEEP 12288:fjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E34523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 45fdfba1c596a8a95a20fc9af1e59783bb1dd3a0fd370d909c310a41952a9fae
MD5 ecaf0c5d6bb83be0e9e36f35c0de7623
SHA1 e248c88e4187fbfc16b94ac089bafbae44a1e6a2
SHA512 348989f36c54ae91ba9c5f450ddf5db5f250d95d0267d569f76151854b4234a376ff6f970325670f88f19f69b121a968900221ce28284db99d396a783fe63c80
SSDEEP 12288:bjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1884523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 5e351cb7f51b51846f58a1b4c5875e46b32e3b321339257790675e43aa072196
MD5 d51479dc2750f6ca201d62bba726ffb0
SHA1 9bae182f66597a477a44b60c71309735dac90ed3
SHA512 68df827c24d15efe407b059c8808023c66036dbc88f34150fd9207335ddf887a851ce3f81304462c9c4c0e1fa77304b969f766fea7de0b93719b65902855aaec
SSDEEP 12288:kyPz5L8SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9zySsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B055125B73A430F9D1378138C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 8adbfb6441865c9198839ba97c3491fdd6b1000dc936fad9f368e3135552ec53
MD5 ac1c6a76a2589aeddeb0b5258dc64aa0
SHA1 4273518e1d5d8b492ea4c9600fe18c0754b4ca5b
SHA512 ed68d977c2ad1e0cbccedf36cc83d83cc4c79c1f50328572d92ef91511a24dac05e9a4ca5cd5dba93b51d2328b38d868e2d21b1740fe6a2d19ca88bf32d9abf9
SSDEEP 24576:UTDaLl3z0zDAsqjnhMgeiCl7G0nehbGZpbD:UTuLljRDmg27RnWGj
TLSH
T11D6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 4360e7b134ac06ff46d4a452a964e18c48f027a55c4956cfb9415fdc784039ca
MD5 2ba812a2fe0b7cebdb409733dd9da1c4
SHA1 2cae6f21519a9149fc52a8b0deb5d06a269d4014
SHA512 e2a301b6699fc57275ec21639e2538944f1a1882e8d588b47a676d38d3c86c03438ad403865057f1ba8ce3a5aa78348dc5175a3c124ab963d9174032b37cac93
SSDEEP 24576:M3vd9CHKy7GZEsqjnhMgeiCl7G0nehbGZpbD:2vd9CHKyaODmg27RnWGj
TLSH
T1DD75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 a13d97267ae34d0e92bbea2eb048322603b265bdd94f581e94c868be1a4c29c5
MD5 6d13d56f11b1ebe66a710c6945d5866d
SHA1 ec6e179b7cae29b52cf70b83d1c75241d4333114
SHA512 47ce9c8609a7cb132d012929d49860f43d06624ea0ee15638ac0d98d56bbf2b2cfeb567baf59685c1876b1d244114de3e01025f48d14a025c0ee750e5a24430a
SSDEEP 12288:wwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13B4523BE965C41CBE52608B5C3E5F10DAC073E5BE92004937A977CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 74ff88904079e3d34801977a8c5df6b2374d78396de4411cb44cf8ff941047e5
MD5 e54bcc50cc1da4ce29ba0c125fa96c83
SHA1 9db1a0a0ad4a4e7f025c2a33a8e0fa5923c4383c
SHA512 991c8f67660afcb4d3356ce9e6f970d23f671dba34984c995aacee1f972e525885470db1f31de06f0043007ae63ea3e97049dd9740f65ad128dba3d25ed22f18
SSDEEP 12288:/yXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/ysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1804523BE965C41CBE52644F5C3E9E10DAC073E5BE92004837B977CBAEBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 8eda60474f89fa7474c5a17b02123a1ce9fa9bb135c4c0b0766d12a71974f948
MD5 b53929285b427b1844f3409b9592d8be
SHA1 7e288e68da4d49f17d3cdefb984379634ed06f86
SHA512 3afa18e8eaf331330cafd80ce46f6871fd92b9ba9ad82a89a98e437f00f4797308b23bb353c29c3ed7260504d41e145159d08b38d764ea3721422ccbf4aa974f
SSDEEP 12288:CFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BD4523BF965C41CAE52648B5C3E5F14DAC073E5BE9200483BA977CB9FBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 4e2c95739e5fd6e9394ae3fec4d48dc452dccc2d58ddf08b81b9c10867530911
MD5 8f677b7c4bfee1f5a0c05efa2d1cbb88
SHA1 236131f67e568e86246bc4677e2f37e4118e820c
SHA512 c03de2dcbf1b8dbcdb870591a634a80a660a19c65d08384ffe4b0cac96d850418b2405499b93289e03ff9d066a4ab077b393005fd1ceb6f5a0a3fb11c142b411
SSDEEP 12288:nbsfTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6TsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13D55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeUpdaterPrefs.dat

Path C:\Users\Admin\AppData\Local\Adobe\AAMUpdater\1.0\AdobeUpdaterPrefs.dat
Size 185B
SHA256 10547a91a927f3ce40a88153fbc8c42c1f4ff7dfe0594c2aeb15bd6a7ca8ab0c
MD5 2e3b734b8e788c792e5befb866e223ea
SHA1 53d7c18cd350e799fb01c346bfdb3321e4b1408d
SHA512 856da42e755de6cd31763273fea9dbc4af713f4bda79d2340683905889d6cba80fa249922ddfb9f0b2165040480910971b7ec08cc7a1a731bba780d53e10f176
TLSH
T12BC01200904B89B64A904A6D8E67F70B5675992364F72B488E5CC8080907D4DD1C1553
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c3f5062497113a02b3fa1e68096fbf4e732e2afd0e31c3a6e370198c4d431656
MD5 717ea84fac3708a08ce3f14e6b51f3e8
SHA1 6a1b0995ffb713a81d50cc2253559c693e026a3c
SHA512 03b3503f081505b39f5e19144b750d770387caa1cfc4be38a15b0c1c28855a7e1e0b268765fa53e69b2f772b2a3c716528aa636183786bd8456f4ea4a8f6a778
SSDEEP 12288:6oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6osqjnhMgeiCl7G0nehbGZpbD
TLSH
T15445237AD34C518AE57649B482EAF12D681B7E6A9F2004C3B94338FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0ca42d192b460af2340e68dd1573402d684e2bdf26a68353228807b7ad1e53a3
MD5 180554c1d8682c21a8dc10b5f6fd8b57
SHA1 f80e51d126b7bfd7ba4d879ecd398bd5ad28ff98
SHA512 4762ba4c089e30e9f4dcfd0e41906ea12ebd9cf696d32aedc674c8f30239cddd9742c10bbaf93c4a8b16f1ccb5bc5069913c60e1f6085f91bb7a4fb992a0efc0
SSDEEP 24576:v8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTC+sqjnhMgeiCl7G0nehbGZpbD:0RZwQCyiHiQEaiPnMTDmg27RnWGj
TLSH
T1BA85B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 bb8b954aafa32f3fa9c7d0c442a683ea320fd2d0ea3282eba99dbf0aa8c095e9
MD5 99ab1122a3501199b05ae89bdaec2e42
SHA1 aa3589ca2b565356ade1aa1430d834f75fc9fcb2
SHA512 b979879885e71ec26035e4b0d60f2c8dea6c0e49e8f403fcec5ad4f5ff141db79cf33ced663c175613d506f413a3af0caa9e0bd663c4229a01563015eb9a7437
SSDEEP 12288:HbxA1U7KYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HbxA1UGYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19D55123E62AC20E5E176957D86D2C10AD7327C26672053DF21D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b8619469ab869aa8df10d453bccfe8eb04402761dfab50b6a7b068972a732884
MD5 4a14c9977f7d4c1640bce8132767f886
SHA1 de37663dca2fe7422496a2c947df5593ec8223fc
SHA512 00d977d5d6909983752f000f7c03b865301fea2a2be1dbb5d1d9bbf1500b02c1ebe53823f9c3f9987ec0d69ea727d49a2ac4de81f86a994b279303655d2150db
SSDEEP 24576:XjsmP0yHaqrVqHra44KDzMsrnBsqjnhMgeiCl7G0nehbGZpbD:XjRP0yHfVqzlAsrnVDmg27RnWGj
TLSH
T1BE45AE2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 e0e38635a7a011f3ef05804bfdcd3a3e24310ace6411b7987ffc8d0ba91c0da4
MD5 6b2830eec3a6060c3e6a7d3ab9560ce6
SHA1 3dcf035e2e3072550e835611a5cd180ea5f0a589
SHA512 3ec8133995c461d7904ea3578884df767b0657e4c9ca1ced39a0923e18b595f6427641655a3eb3d73ff50d1f0ca341a0816b39045fc00201fc745433bf6d8a39
SSDEEP 12288:wmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1264523BE924C51CAE93649B5C3E9E11DA8073E669B2004C379977CFEE7B54D84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 e60d11bdaf7ada85f5301f3656c2ddb9ec70a48b13ab6615d5ca45b1a974db36
MD5 035b9669d83c59ea0a70aedc324054a7
SHA1 d80019d0433556b71212dde3b76efa10f6f8915f
SHA512 9212698affeb69ce3e70fae54615801cd77da090ef0aea878413d41c95700b7c4f53932dd7b00b338a04748ef1e80e17a24d8d84749cffd7a4abe6bc5d4fbfd8
SSDEEP 12288:0ObfA4LWO+vAYFTMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:ZbLBUTMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19C750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94A691F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 435179e82268b9ecb3f51b1f52df043f1bcdbd1357abb2429e7547bb644ddafb
MD5 19fda65a06c951c4e7adfdb6cacf343e
SHA1 ec8c40540ca16ae84a0bec46163da4321960808f
SHA512 62f8ddd438fffea0d2f9e5217a3f9f1d8c69a76cbe1252cf3f3a8a59fd6ec2d62e618049365774e83855cfdfffa072d4d26ea231fd4f060b38f93753c43a0441
SSDEEP 12288:n70Vm9IYNvUyBpzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:QpYNHFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB65E12FA2AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 44238d42ea25cf42994507863fb6e7d77ecda4ba56630467986e7a7f978c9d67
MD5 85a948146224b82c43ae79be5a8ad904
SHA1 a67b6da8884db524de1da90d8b7780ae3638b2bd
SHA512 161dee00d7e54a2ea73e42a21d51397550e8bf923cd4c190ef0403e34a2c11e427f2aad352c8814c4cea19d8e42634e1e86651731d511fcc8616a5be064da12f
SSDEEP 24576:TnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKx:TnXoJJYH84VVS6AmEOJas+cHBjSSKHPl
TLSH
T1C665BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b5ec97e99a84642372dc6e017e0b2449e742a61c866d7fbe019f150692bdfe94
MD5 118e1e6ecaa026b9dff129db59780496
SHA1 d72d49955250394a4ea64fe4189ddc095d9aab5e
SHA512 dbd64b7f7adaa07bb7a156735d2fcaac1dc6f5139e1913615849c2543477356f1f4d79aadea91c39cc7dd209217964ac20e4049c2b71851e0aeddbc821367d14
SSDEEP 24576:Zv7Xbxd9Tuycf8M/TYlSuxrr2PC7sqjnhMgeiCl7G0nehbGZpbD:ZDLL9TuJ0M/TYj2PKDmg27RnWGj
TLSH
T1F1858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 69ef9f0f228b86d2309744e4e4089ddfd49fc60f10fc7f8992f38f399393c7f9
MD5 9419509e0dd7e5619b068e54bc218b8e
SHA1 c201aee866a86e26bab648de4f6c2d8f398f095f
SHA512 848ae187eecbf21efa39d21980c19389fa7115c549ff6c7064132491f6accb9e496ea1862c3c48c30bce2db6dd0f8763ebb6c2b0b6c06b74b48517412d5df745
SSDEEP 24576:uegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wMsqjnhMgeiCl7G0nehbGZpbD:ungOJOmPOHz4Dmg27RnWGj
TLSH
T11055CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 d6ac646232d586f86c8d4fc16961cf86d1c152754ee3b6a4584c4b536f317201
MD5 82a7a8566b5f70515e5cfea32e1e17c5
SHA1 9c99fd4b0e2184d8182e1d251a6f2379632b2cf4
SHA512 f982414906c11fbc2d4a058bd1793a0484d27d468abe320cfc2e51e9671d438d092e3f8429caf379c668daf133d6565304ec3a73f463bddc492d7fe5982ef75b
SSDEEP 24576:SLJnJiTk3R3waE4JrOGsqjnhMgeiCl7G0nehbGZpbD:SLJnJK8R304llDmg27RnWGj
TLSH
T13D75E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 bc1c602b17dd683f33be35a2ec4ee56abff08a3a385346c87b7fe16331829423
MD5 0df61954778fcc72a2eca87c3f2bf39f
SHA1 83d2d3e292e2a8b3153a76d877ac18f59ca36c66
SHA512 f80f5ad2d0574904658a2e2b79fe59f86a2e9c7361a8a2cc45a8f980b8f576f0503ad2533229308073bcdcecaab3838baf536f87bd0900277077516a49b79426
SSDEEP 49152:X9mqCzDScAZmlvTcFg8Ph6mDmg27RnWGj:LZD527BWG
TLSH
T155955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 6b02bb54bff9c6c158bdc6f5853c81812dfd9c29da9ad7f089d6d96693a17463
MD5 5c21bd76cc6d060354dc12ceeadfa354
SHA1 ae89cef433949321cdf5a092480ac7a63f996c16
SHA512 cd5b420f8c9c83661b4b3c8992769c3bf1ea0156b5325f3706eda87f7c16429feec20e2a465efdc9d838dc27fedb3c76f8cb3686185d6eb9e9d5def3017d9e1d
SSDEEP 24576:plYJeXm5jUuEesqjnhMgeiCl7G0nehbGZpbD:plYJeXmRUuEyDmg27RnWGj
TLSH
T1725512AE669C30E5E13A8079C2E2C508E633B876671017EF55E0D5BE9F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 62ddb118c611ce8b476b5bd707fcfaad69f4d51972764dc5129e8da1591397b6
MD5 046d82da701e32570523b25adca4a23c
SHA1 1312a561217bcd453c54cdfd54099e7f95fa768e
SHA512 89e10d65014b9462696e35dd045b87d4734250f6200a00037222c4b1a2f90b4c24db7f83468f70467559a4e18d039e588808ea6fc4f1cbe7773a1dc9b6e21e22
SSDEEP 12288:dmu6kyhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:d7tyhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D552219639860D9EA760978C6B3C158DD367C219F2002DF65E1FA3FAF726D48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 6b54296f46ab90ba9fa29a136c3dabf33cf662ec8623999dbbd41013404ff09a
MD5 83b8101545e2ff74d78d70c42a78e413
SHA1 efa6f52b0cf4f7f628cb52ce02fe8fcaf1f41ef8
SHA512 291a983308c269fea1da405310d737a3bcdd2c014677584f98c2e808c33aa6e702cb0543b8c75c1261563a2c56338554dd71471bc36c530cd5714c6380583b60
SSDEEP 12288:6PMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1394523BE525C60CAD93244B4C2A5E10DA8173E769B2014E779E3FCBDEBB64D44B38813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 95e938af41c4d8f0a6de8981199299bf4a3a8d85e078344f56865626bf4c846b
MD5 d7df81ef7104b82af101ddbf5956d034
SHA1 737e7a4ddfa57ac8f2f3ab5de2df5eed85452d25
SHA512 2fec9f031c7e3ca2d80066af0d2e357a4a3d1e65def87c9786700e662402eac80817704b11638d5dd7ef6b67ee007e8ecce7b12e31cfdf3b3225e800dda8fd24
SSDEEP 24576:kC+TyQIu93VAumZr7jm3sqjnhMgeiCl7G0nehbGZpbD:k/TfIq+YLDmg27RnWGj
TLSH
T1E1558D2DA7F919CAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 1d86ea296cfd9f17fc76255c637df86db6f665028c8ff1d6816742b8ce89689c
MD5 be275d104c197da25067206af8715f9d
SHA1 d7397b87aa7bc4d7d8b89ef018fd8add0e295dd8
SHA512 eb57161795aee73f4d8acaa6a282bebee12f003c8f731d2a8656f4c1cffde0210da173b8512c4d98269ed74c5f985c2ac5a345e6709a3662843bc60a7bc6328b
SSDEEP 12288:IcyrWOstaa3kcswXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:tLQikZwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF65F11FB3AE0095E0A7817CC8858116FA737835571163DF06A1CBBD5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6d69951673654ec1a81681802c68868401a558526ef7dceac9c64d97a415fb37
MD5 60e8380e901178de9a6b0179632f2906
SHA1 9fc066623f9d37454322747fc7fbc5ef473615c6
SHA512 20335b454e73b9b8ffce82bdc23e72e544d006c51e3fdba572c5abca03a6d7f0d1566607e40237136998c88a9ed1357729c8102eb2fc314aafd13854800aa194
SSDEEP 49152:kpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP1Dmg27RnWm:lpC7b4+80GTkuD527BWG
TLSH
T1B1A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5b1d757b3a4f63207fe6b443cfbfeea05b9505313751f673d6106dd5db05be84
MD5 db68d2545f6017f0ebb07d7149cb371c
SHA1 b477833ff1e8ac7a0795280b750f08f1e57a924d
SHA512 d243e22ad5d587a78d5d6cbd19a51df1a1516d8e0e1feb90a0e65273d941d4671cca7e5d74deb557ca4320d1df06086fd124fc37bf622c3146806f0b9236afe9
SSDEEP 24576:fSAwJPE1IDAo+4Kt+l4413JUQfsqjnhMgeiCl7G0nehbGZpbD:fqPCIo4Kol4vQDDmg27RnWGj
TLSH
T1AC55BF2AA7F956E5E17ACBB4C663C601FB733822133163CF5290857E0E169E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/672-43-0x0000000000400000-0x000000000063E000-memory.dmp

Download

memory/672-0-0x0000000000400000-0x000000000063E000-memory.dmp

Download

memory/672-1-0x0000000002430000-0x0000000002497000-memory.dmp

Download

memory/672-8-0x0000000002430000-0x0000000002497000-memory.dmp

Download

memory/1084-232-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1084-34-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1084-35-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1084-44-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1548-350-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1548-342-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1548-348-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1612-377-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1612-375-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1612-373-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1612-365-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1612-371-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1960-274-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1960-252-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/1960-251-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1960-258-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/1960-264-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/1992-537-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/1992-532-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/1992-539-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/1992-528-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/1992-527-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/1992-535-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/1992-536-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/1992-540-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/1992-534-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/1992-533-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/1992-541-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/1992-538-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/1992-531-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/1992-542-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/1992-530-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/1992-543-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/1992-525-0x0000024AC6610000-0x0000024AC852A000-memory.dmp

Download

memory/1992-526-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/1992-529-0x0000024AC6320000-0x0000024AC6330000-memory.dmp

Download

memory/2076-412-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2076-289-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2108-69-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/2108-65-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/2108-59-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/2108-71-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2108-58-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2536-398-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2536-392-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2536-401-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2536-519-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2644-234-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2644-79-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2644-73-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2644-81-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2752-335-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2752-337-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2752-513-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2752-329-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2948-424-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2948-521-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2948-422-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2948-416-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3320-314-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3320-514-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3320-516-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3320-312-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3320-436-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3344-428-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3344-508-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3344-492-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3344-476-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3344-437-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3344-434-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3344-522-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3468-21-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3468-217-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3468-18-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3468-12-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3664-385-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3664-379-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3664-389-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3664-518-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3976-301-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3976-303-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3976-295-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4012-362-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4012-359-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4012-517-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4048-326-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4048-510-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4048-318-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4048-324-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4076-263-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4076-388-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4076-272-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4200-233-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4200-53-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4200-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4200-56-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4352-248-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4352-246-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4352-240-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4352-361-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4712-413-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4712-410-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/4712-404-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/4712-520-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5076-279-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5076-400-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/5076-285-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5076-278-0x0000000140000000-0x0000000140209000-memory.dmp

Download