dacc79b4f27a9b2b27d7197ea6707e195f276be22a42fee80aa21130cb4abef6

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
Size 1.5MB
Sample260930-bbxmmsztcs
SHA256 dacc79b4f27a9b2b27d7197ea6707e195f276be22a42fee80aa21130cb4abef6
MD5 53ed4f8136657ef933849dae232d9c80
SHA1 508d1963788ea8708c71be45e3708b5af7353a95
SHA512 bb644d99db03a3c1ace4cbecb83d6c0de58c14ed85e0cc2f1ab4936c11ada7099dce346717578ddda88996e04094c68fade07457e9364fe3e0ab7966337d62a6
SSDEEP 49152:udbOGlTR0X9fJ4klKXnN7/GM4EkeiqEYG7rKau:ulOrfJ4kr7EqPb7r1
TLSH
T1EA75221670C0C4E2C81155B51DA6F7308A1FBE6F0E269E8B7F832E750DB8691663936F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
3408	DiagnosticsHub.StandardCollector.Service.exe
3688	elevation_service.exe
1596	maintenanceservice.exe
2620	OSE.EXE
3840	alg.exe
2652	fxssvc.exe
2668	msdtc.exe
2488	PerceptionSimulationService.exe
4260	perfhost.exe
2536	locator.exe
680	SensorDataService.exe
3524	snmptrap.exe
204	spectrum.exe
4628	ssh-agent.exe
868	TieringEngineService.exe
4572	AgentService.exe
4324	vds.exe
4944	vssvc.exe
628	wbengine.exe
2164	WmiApSrv.exe
2228	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe
\??\F:\	alg.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	alg.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f0d0052b862f6ed0.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4224-0-0x0000000000400000-0x0000000000724000-memory.dmp	upx
behavioral1/files/0x0001000000017007-44.dat	upx
behavioral1/memory/4224-49-0x0000000000400000-0x0000000000724000-memory.dmp	upx
behavioral1/files/0x0001000000017046-45.dat	upx
behavioral1/files/0x0001000000017007-247.dat	upx
behavioral1/memory/3840-248-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/files/0x0001000000017046-260.dat	upx
behavioral1/memory/3840-338-0x0000000140000000-0x0000000140167000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088742e317750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000718da7277750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002718ad267750dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006379ce267750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000332ca1267750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f1fb8277750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008132c317750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009449cd2a7750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7ec02277750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3408	DiagnosticsHub.StandardCollector.Service.exe
3408	DiagnosticsHub.StandardCollector.Service.exe
3408	DiagnosticsHub.StandardCollector.Service.exe
3408	DiagnosticsHub.StandardCollector.Service.exe
3408	DiagnosticsHub.StandardCollector.Service.exe
3408	DiagnosticsHub.StandardCollector.Service.exe
3688	elevation_service.exe
3688	elevation_service.exe
3688	elevation_service.exe
3688	elevation_service.exe
3688	elevation_service.exe
3688	elevation_service.exe
3688	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4224	2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
Token: SeDebugPrivilege	3408	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3688	elevation_service.exe
Token: SeAuditPrivilege	2652	fxssvc.exe
Token: SeRestorePrivilege	868	TieringEngineService.exe
Token: SeManageVolumePrivilege	868	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4572	AgentService.exe
Token: SeBackupPrivilege	4944	vssvc.exe
Token: SeRestorePrivilege	4944	vssvc.exe
Token: SeAuditPrivilege	4944	vssvc.exe
Token: SeBackupPrivilege	628	wbengine.exe
Token: SeRestorePrivilege	628	wbengine.exe
Token: SeSecurityPrivilege	628	wbengine.exe
Token: 33	2228	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2228	SearchIndexer.exe
Token: SeDebugPrivilege	3688	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1112	2228	SearchIndexer.exe	132
PID 2228 wrote to memory of 1892	2228	SearchIndexer.exe	133

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_53ed4f8136657ef933849dae232d9c80_amadey_elex_hellokitty_luca-stealer_lynx_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3688

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1596

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2620

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5100

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2668

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2488

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4260

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2536

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:680

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3524

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:204

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4628

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4012

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4324

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2164

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1112
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 aa7436aba8634c9b2bd3eca93cba178bcbd1197ebcb362d454af0b7fdc7b44ea
MD5 9aaf07be49eff72e0192187eec4ce80d
SHA1 04004a7a3f53304b09ed9a5b3da4da70c3fe3956
SHA512 8ce16e1c671bea13d90d02349abd4d9355d5b833e4281f131d1217bb495479f44d922c8e0df89e2e3af035125d4fdd013f29e6d1ebf53671e10433b994366fcf
SSDEEP 49152:Hb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnIfJ4klKXnI:13q6mjBDfJ4k
TLSH
T114D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 20281c26ec177d6d359f655efc9fa93708b4a80ef04ecc230747eeaffd24bdd9
MD5 138c4318f174b01726555b90b9985c92
SHA1 66d9c231284e5dc79c0df6ab63321590329d9f43
SHA512 ddde16898e54f72f3fa92499b2153ad36f4bc1824b6fccfb038b80b0bfb0396952c484de0d99f0e042915d8321c0567870a89f0cb9f8f43082213f1e66b2ea07
SSDEEP 12288:81XLsswWkxy2lRq2czA/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:KXYfDtczA/fJ4yL/tNCJPXUQrPC
TLSH
T15205F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 ec628c341af986382ff56db3dc03759e569aec89aa7f3f07ed49a8ccfda64b6c
MD5 6797e20496775f6b635684db0a7c0afb
SHA1 fad5031802f25887b355d089b12b1f5ad0e1e0d7
SHA512 4ca0e44077e3c5a67e09dc52469cf80508be74b1c4407f47d9edb13fd90b8bf02e7c3ab580b75f89264a9f6a275cc28786921e0e606e65e61618eddc59e092f0
SSDEEP 49152:SPji0AzlfJ4klKXn5Va/GM4EkeiqEYG7rKau:4johfJ4kG37EqPb7r1
TLSH
T12695E156F5748331D073C0B9C5D2A68AEE71308257318ACB4296D77C3E6BBE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.2MB
SHA256 0eeb0bdf3f11cc9597e897584ff0ed092cc8f36a332c8f50ccb6585785210f91
MD5 92e4920fbe5d9472c57014d09b698f43
SHA1 d2b7c922416182702a9f69fd879759b5f015fde9
SHA512 de08bbaf55b3f29544f95c447866ac419185f78b34d2ef8dd011f9b1096995a5847021d0f136ed3577fa8452823bf865c00705be1adc542980f29a84ff8be06b
SSDEEP 49152:K/ezSC6vUzPv8HjyRfJ4klKXn/lr/GM4EkeiqEYG7rKau:eezSC6v2X8HofJ4k0i7EqPb7r1
TLSH
T15DB5AF25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.0MB
SHA256 7c9029dfe7ade51b8cc1c6d538d11738a3555f99a68e68f74eb54b966bf8512c
MD5 99884ce2fbacc7bbdaede4cec986d1f8
SHA1 ef044fbd7e6e364d21d78ec5549db1ee02e6826c
SHA512 980fc8bc5ea31c15b68b9a2a0cfd019b67d52c6a6e20ac6c6a8392e670d62855baf65d0463dad159b18a599eac7a0a01f8a0382829a2f9d2ad577f774cd65ead
SSDEEP 49152:OVO88hXl+FfJ4klKXnZGPoO/GM4EkeiqEYG7rKau:J/h1+FfJ4kJPob7EqPb7r1
TLSH
T140A5D066F574C331D073C0B9C5D2A69AEE3234424B318ACB1246D76C2E6BBD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 3b5dfe69990add64e29f6fa5f2bbdd4cbef4b338ab3a290c77c06c4baf6a7765
MD5 65784f64315ace28ef37185f2d5dd566
SHA1 15a6f695f1465fed14ee2375a6d7f6e4ed39cf8a
SHA512 438b1a01ceca5567c550f7ffa5f6c61d48eeb042674453ef74dc5574caa469dd7fe9df14f6f582192b987ddac8cdc8133bc3cffd231e4656727eb96fb54199b5
SSDEEP 24576:GGkfJ4yL/tNCJPXUQrPvEZ5b//32zbST44VkeLGqURYG7rYHxoPNZMn:WfJ4klKXn3Ej/GM4EkeiqEYG7rKau
TLSH
T1FB5533ABA401D655ED489AFC3B08F010874A3ED15A1B9669DB627CE21CFDE4B92DC331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 848bee6e9f0d16643063c2542532acc2859a2eaa7e0ee558c0f35b6d9afad7ed
MD5 27d2c90f2e92c9b280f4a5cd6e824de7
SHA1 4114f5901d15c4f9a4e6a27af2169421ea81f0b9
SHA512 cb4859b48c84001dcb917d96044b4bff49bda31925ec0559db1c99be7588f60cde3a0d8f32d366907ed06025ac834abad4ea5f43ea8d5ae4bb945faa851ff5db
SSDEEP 12288:teBNUbTVO86U7fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:tJIU7fJ4yL/tNCJPXUQrPJ
TLSH
T1D605C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1b55765d87a842dc4fe9bdf3d65c8ee8888f9b2f9dbdfb0b7490d2e280e7a0db
MD5 70bf1d2eb45055a957fde5c5bd2c787a
SHA1 39413f7cb945084ddd781b1a135d7d0dfba4f92b
SHA512 63c2100d70f91ada90b5790b9721a0ad80f7177385c06e229770e451055be740b1b9f0a956d82208f31ab58bbfacd38747789fb98b95285816e90c82689a93be
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH6:WQvGAdlCEL8c/WRNw5CKfJ4k
TLSH
T17A266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 d09ceb1186d79c5690f347b7fde8562fd68aa3048ef29bd0b154fddff1cae297
MD5 ade02d548ed9fe2387d8732025bbd3b6
SHA1 f794decf6073c1ebbafec7443cc533ca63f863a3
SHA512 f793d815a3ef72d3b33d372607aba8cfcb8c8f84c94221f5ad0050840f92032fa6a8d8536b79ed4a6733e4d99ffeab25349e86afe1c3f7af81f51c8d05142276
SSDEEP 12288:oAwSfxL/2Dc3mDLLmt0LDQewsAjVfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWb:NfewsAjVfJ4yL/tNCJPXUQrPB
TLSH
T12A15E031FA74E036C7BF0DB51B25D306552C7A604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f9bc780a05e18b5c6da90dc394de1a6a9e3931cac335f48896dfea462b12ddb5
MD5 a89f0a310883544b4bc03902284ac0ee
SHA1 22c0bfcf370ec58dff95da1259660d988b972352
SHA512 b888cb437811c4ca13ab411adac841a2e8798be2952e3842d343bc5db6ff35dce625b6049182151a567ce718c37abd228372c7a97f3e27c322b29ecf74237441
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHNfJ4:kUEtQevvqc2W1cpV20I32N
TLSH
T18E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 3.4MB
SHA256 b3f410327a1e884ed4d304d65e5077fa01b2b70468b5378148232d2f84d55876
MD5 9dfcf2348af9089d34f858381708df83
SHA1 e7b25da4da4d2fad0d37bc4d9a6bb2b3c5c24049
SHA512 e84597d2e0f9e6a6198081610ee45e7c36563c4280033bc62f278119bd9025d435e27e52f6ef808fbb1efad66c96c006f1e40f8abdb19afc33dd2475428ff860
SSDEEP 49152:SCbRquA/m2yL5zTfFiV+XenmE3/z1fJ4klKXncU5/GM4EkeiqEYG7rKau:3oqCVjnmGfJ4kwg7EqPb7r1
TLSH
T1FCF5BE0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d40e76da3ce9d9456fd434c29ad97167a77d5a9aa7755fd9e824f3b87006ffab
MD5 0bec97ef51684fdafbf39e979260bc34
SHA1 c90dfb898b8ad324ee51a674061f087388585560
SHA512 7264ef82b7c0102032b44c617f3f1c4883bcefd9b89142ab1dc6b0c0b8aa3d07d091c9be37888a57530e5a2ee109009c299ee9dda90915bd17143e4a56063500
SSDEEP 24576:IAhGL6IFoiwtA5l7S53mfJ4yL/tNCJPXUQrPG:IAM5Foiq52fJ4klKXne
TLSH
T1A3359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 4b97b2db3ab37576f4c9caa8dd7c48f786cf1ea10c44c769f27b71c91572b8e4
MD5 10700906d38d0d5af825845226db5b03
SHA1 9acf172ad27ef0e4c330e66382c7b82e1a7245f0
SHA512 77dc5ea008106127147391f2ec35d9d397d2e4ad9aa79686772f3000715e55e89bba9270fc45b991ac2f79ec5893e41dcfc48dd8cdc47c1bf983348adf766cf0
SSDEEP 12288:zmw5HEjsChNEBFgl0WDm+C6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTx:SwuROWxfJ4yL/tNCJPXUQrPV
TLSH
T1F105014A32E41CF9E96782388687D132F7B2BC422A26D71F5760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 a3dc7b71c9da87028665779b2c6a896613460b47f3503bb5bfb15126cdaf7226
MD5 82b9e81417a17d7dcb1d393234c6d1d5
SHA1 aba4e76cd528870d27ff5dd1ec110070de146791
SHA512 6219c56571311ba3ba8aaddb7f983046ff469f8849eeba212e6c86274bf548141d112dde067e3ec1fa9159b44dea2bdd3fc3885ec5b6780100b64a37b86fbf25
SSDEEP 12288:2yZ1IyFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:PZu4fJ4yL/tNCJPXUQrPC
TLSH
T1C4E4129B32D460F9DAA782BC8AD4D101D3317C92273A83CF5A5155963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5441fa4c5a54337e7d5211beb3f03d7114c06043b0dc7b776642b9c56808b986
MD5 55081351e942f5423ac5c2424fcdbf4f
SHA1 86c69e74a81f82e2cd36778b959b2fcc077d8bc2
SHA512 469bdef8284f1fa3f92dc665a574bfbbd9c8f82932efe0a2eeaa4dabc131f589b0bc7332fedd9e1857ff4a4da4410e4799449ae781a5a36b219481a5b77d7946
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uo:KQRQyi36YOcPDLvw2gAf+PN3nfJ4k
TLSH
T13E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 327084a9cee63d2ae1cb96392caa9008a668de102a44d25e0bafeb27d4ef2f76
MD5 4d8ce6578683e9b2f1719f442322ebf6
SHA1 fc71686a97d0a5530f44cea4a2249b6e9fc7df52
SHA512 14e42cead327f0c583335d76c0614c3dff9900f756efc1064eb936570856df56ca3dc02e8cb235e0c0a6e7f58fca430d5a81727262f69781af14c9ee975e0bf0
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U6:aQRQyi36YOcPDLvw2gAf+PN3nfJ4k
TLSH
T136667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 21271b118c054d71c83a523b37bfa9748cab5c1ae97386a45e69d7c61ed77389
MD5 7756e9a6314bd9768518af4dc81240e3
SHA1 3de751e9bee8e241a51b2a67e247adbfac58c898
SHA512 f338c55ac21ae90e0a888dcff0b3ab88a47ba51f700105a83af25f3870601c9d3451527fff203d6b978e9d983a8cdfecfc1724e6a3cf0789500902176896440d
SSDEEP 24576:4wvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0IfJ4yL/tNCJPXUC:e68Qg55nhkeWu7PNU3/lfJ4klKXnR
TLSH
T11CB55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5ff52ee4da348ce2460043baf45b544b2506c3aad28e276c21e66585ff0c3d06
MD5 ba360edf720fc13782975ed5e799f357
SHA1 d4f15a9886af9fcb317347664de7f9ee8e285f26
SHA512 fe5786f6d72c96dd1197d52b9cb58357ef7ac5ba055a9d7bae9a25a7819ca13e62be1a2bdbe8c875064f4a0345eb0743185193991fdacebcfb7b9d3bcab20010
SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk991:ay5112gYy5azzVvU69nLKnhZkfJ4k
TLSH
T10B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1dbd11db291dc559b72178bf659cc32103805889c54f24a967088b27dc1da8ae
MD5 2f3dc47db7546183ae22f608a6ea4ea7
SHA1 3fc2a1f30d927dad71a555a717c4705eb809a7a9
SHA512 a1a853a350c96279f5f3e4318d4a0df73b75b8f44694e18208a805c91517b4873342c0b69822578a47cce87979c7ba8e16fd32ceaf1329d3392f6e33983fe12e
SSDEEP 49152:gB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl/fJ4klKXnN:6u6JmIxd2d/fJ4k
TLSH
T17FD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f8398247db8d70c22c9a0e9a27af273081cd941ed10d25bd818a1138d4dd539d
MD5 eff0671cd152c7878cc083505b75f217
SHA1 4f0834cb199facfb3a57a03fcdd8e2b74126007a
SHA512 a4099ff61b96330eaed5094dc8140016907de6ceaefaef61c27208a12d05c73b60f07a409ab99c13b569ec30b87d1798cf36df837f4ba068141f2ace12c5737b
SSDEEP 49152:21hpsNoJpF1A67U44CwH7R4xbfJ4klKXn9:2mifPqRGfJ4k
TLSH
T137B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 24161be516b7425a64615b54c3878a8c84dd5d6b254a12d5f54d9cfe0d8b058d
MD5 c51055937a48f115ad4785f3ed542f05
SHA1 9798172399335478c334e087edc1f94d5fde38db
SHA512 e7068eeba3c1b1978c055ca6f5a69f51ae2fd728820917c226448da664c33efbfacee8ae1b96e78ad7da24bc90d1503a8947fabe171ac8b68416b0cf161beaad
SSDEEP 49152:qSuZQIY0Be2KkRVtOnks6NMHq4fJ4klKXnK:05dKqi614fJ4k
TLSH
T179C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8056a1a784b14cb8c8d00ae92f4deff9ed7ced0e99f7627fc12422dc46b0e42f
MD5 84509cbfe56f1091885f70b62057ad9d
SHA1 6e94d37c8f37d3f00cede365c95777267e33e6c2
SHA512 596c7ad221ac707804e906c4cbce5084c0afd85c5c58d14ebc2ff4c3bf3ce538f5fb60d81a6404e37bbee0819dd222b74259bce7ae6979db6b425f10431a09e4
SSDEEP 49152:3htSn8EApI0figjgiDn0AP5w/fJ4klKXn+:mX2iWphifJ4k
TLSH
T1DE95BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 7ffcff6bcd91bb7b990f099df65348e30e5fcbe240e1b0575ede1f3c61c16be5
MD5 f6a3ef0c69e383cb33a512ab8ac1f6c7
SHA1 be4b902c0b0a3d0fc4b400be2ab39fbe3bbf5605
SHA512 b1803b45ebb3ef059c61dd7fa16b5c56109bf5a1c822d75745bf4c461ee9a6c2f8a635390c7fdce3f5ae44a0bba19120c17a26a8f68a0a5664554b797e1e5617
SSDEEP 49152:CP4m4IpOO6708KhfJ4klKXndIb/GM4EkeiqEYG7rKau:KppOO1LfJ4kjy7EqPb7r1
TLSH
T190B5D02DABDC0096D0BA917886658A09FAB1742A1F3286CF1160937D3F7BED54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 d6e197f1b0f5071c74b892d4699287210311f76b66e28f92389bac0340a0c8a1
MD5 2a4db73be852141942c1ac77b2fb3bce
SHA1 673cabe9b70c419ed4df8c96ef5b9574d76f471b
SHA512 1c020cff182e70cdcaa1f7212dbbd6986ac29e180bf80ca48411e5b8652b929733e06ed9b73767432e59e2f0ff98690081ecdf5393c5115ecfc47b7a8659213a
SSDEEP 12288:Epsf4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:V4fJ4yL/tNCJPXUQrPN
TLSH
T17BE4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 15bf8cdc58ed5180bd676879fcd73d69805c2dd19f2788aa59085a0f32cfc66f
MD5 3880a7f28c6e5d288cac0e6806036c09
SHA1 d3295ee7dfdb9395fa421bbdb5acc3741b838de0
SHA512 45d7bbeb58d70929aac2f088413ce44cf0d02128d2799bcf26cb9d84983075fb4468a484c6368fde38e30cb6cb4644fc06c5635299ae6146089561ee5b52795e
SSDEEP 12288:4XfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:4XfJ4yL/tNCJPXUQrPM
TLSH
T1DFD423AB61D8944AEE7687F81648E000D3097FD55B2B92E7EE42B4853FFC9161D6C313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1baa80b12f3edd9db29b626047a278ed8e8a07190d5f6c58a29397581d22b79d
MD5 be172007b013c6efcabec2cb9614c080
SHA1 2b89c6a974ed0e8034e99f4d019384f254e25694
SHA512 04109d5f2ac16afe15601353dd85b5d984293c369e83592b49af0b79104b160a849a5383318f80778ce17e7cce4121a3c6afec885ee8018bd7fce2e20df01021
SSDEEP 49152:za0h2GEkuAe73q3pp46zwwQ9fJ4klKXnH:za0hNYG4JwifJ4k
TLSH
T179859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 43c31e6467bece84409157401dfc67f3d3aa4c6e2e0fe21a1f8c0b845ac98945
MD5 862ab40f6186f94a4b3a478b9e3c7b6e
SHA1 c27a966a64751392deeeb16360f436bbc7c37e2f
SHA512 616695996e47b97d64f2dd3dbc1a531ae7813029f0066e94566e27ff3b2ecc1b890ed9de496d4cbb2db62aa05ad28f66ead69a44726503d0c491e718d86a1ccc
SSDEEP 12288:whbHjfXRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:whbHjPRfJ4yL/tNCJPXUQrPu
TLSH
T1B3E402BE22AC20D9E571D2BC4684D106C331BC951726A3EF67C2917A2F7BED51C38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 942ec2a85c1bbfac9974474270871ace1abcf3a053174d1eb4080c8813907f15
MD5 e2fb229f12fc338ec56f871ca36fda05
SHA1 bb7a7ba0fa5fe172af8315de9a6a2028711e0628
SHA512 231697dd8d252af2e018af36ed198299a923a806712c4842ec4907344320f35e73c5e0006cc46177abd6295bf4165569f3547d7951bc0778f9f720506b69bdd5
SSDEEP 24576:13YgnJcRTk4yti+R5dBR/OfJ4yL/tNCJPXUQrPq:1IgnaTk46pBR/OfJ4klKXni
TLSH
T19945B02EF2B910B9D8A6D236450143B5FB71782D1F2196CB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 756409765ec9cfb4f9e4d443174a6df5aa6798cb3614a92114f68b47a26ebd01
MD5 42b0004faaf1c9bd1a0ef277dc04171d
SHA1 ae08c0d21ff95a4fb6b6cd42012ef4c462670602
SHA512 519b83627f762894288b4b2bbc79db885956bdc174a2b2fe46a740228f434f2e4ec7fade82099563da4f6d0f517d1db02db43956dec05a7d836bcc87876bd261
SSDEEP 12288:HrfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:HrfJ4yL/tNCJPXUQrP+
TLSH
T175C423EB6084948ADE6587F81648E001D3047FC5272B62F7ED42B4867FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 9f3f9a9d1366d098e9ccd4b29a6437ff3a6c4f1d5d1ac232d629fe9b6b087d6e
MD5 be8210b6d4a40b65120d0a40c530f0a5
SHA1 b710c253621e416c74621a037f675b20b07f4024
SHA512 5aa361ff5c022a6f226da2b83d28bbd3e1070c15bc1ff11a0635a93ef3eb2a6baf82a22eaad6072840c39c726e405e9003294e78cc6b4a780951252619e6d73b
SSDEEP 12288:0ObIA4LWOsvAYFTsfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sb:ZAL3UTsfJ4yL/tNCJPXUQrPQ
TLSH
T1F125F155F29400F9ED6BC27C89A5D512D372B89D0324E3EF07A88A652F637E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 0252c658fe5d59249d5d0fd8997de1b10af376e672a11a20efd33d5ac3f5e671
MD5 6e70869f3fe5846df14eb42c8508873c
SHA1 01162a6564a722afaf1af373337df15628ee7690
SHA512 b706526403c3880b4d1f446ee42fe9fab3c4248782e9ee0ba4587f0b75a705be038b2114d5db23093e39425b4c5099565134c266571b8badbe8a07446b406c52
SSDEEP 12288:9pFtvOAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S5:DOAfJ4yL/tNCJPXUQrPG
TLSH
T1B1E4026A32DC10E5D576927C4A85D209D331BCA6172653EF46D080AE2FF7EE82C3D762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1d2eb84e5e17b4e0853b3c4a93af18a771514ce13b160d5d36002d3dafd111a4
MD5 a41ba56c3c87a4946ef25842c0a8fd49
SHA1 08d319e54759c75294c99ea97560159b94db7e15
SHA512 32c436066469f958fe291e3bc27bf22b5027a57508f2977a4752472b7d8bb79c5437b8d090385a77fbca78b806a0078f514f998230748404cbe25bd86b963848
SSDEEP 24576:a7NM9YqZqmWMUkPjZM48Mv6bEhsHfJ4yL/tNCJPXUQrPq:a7cBWMpPjN8DbEh2fJ4klKXni
TLSH
T1C165AE2E6BEC81E5D577D13DC9A28205F2B2B4611B318ACB5152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 30f2b40aa9599572f1d41e773cc31d4d19d03418308072e17383f55de34e0e7d
MD5 eb4d6abc964a799452c7f6fcdcedf8b0
SHA1 b5bc728c7120a95079159444b610f99c9f97afc2
SHA512 cef083c71df1b3a14f76f00c8c4e5aa5c5a811a071b48b7333681da98e77f6e2a9dd0d2651662b714c701fad8b4f02dd8a673d62fd37573b8c9a085a44c6520c
SSDEEP 24576:GW6BApg2YuyuNDYTabvcdvNYf8km1pfJ4yL/tNCJPXUQrPQ:GF2YuHNETovAvNYf8kmnfJ4klKXnI
TLSH
T1B5858E6A27ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 147f904dcdc2d33a121ca9f2851d628bbecd20c6dd3e46214642a7378a86f5ba
MD5 0cb2593c5ef2b874653a4b63535e0277
SHA1 3c94f130ca8950a65fc9f8e1830e0cddddf1c973
SHA512 ed8fd4062917e54ad6fcb41e232811c84de359c756926063cde6bea99c8b6550eb3876104198acb23c8206b9801a785a7bf3e0be09123a1fd5cb897bdbc11a2c
SSDEEP 24576:QAFs06+Omlf8NXEbTo0fJ4yL/tNCJPXUQrPA:lFs060loXudfJ4klKXno
TLSH
T1F465AF2F62EC00D5D07ED17D8A96C91AF7B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 d9a285a0573d42a88c358c36759739842ecab52e76cbce737005ff5cdacde27e
MD5 de63812c5dad1d1b4b65d224943c06bc
SHA1 ad86f50d2d910cd6d5002875572e936648bd21be
SHA512 375bb82eb3d5d36389c45b80030080e6204ac8ac0451391648acb4f201e5fac420db60564d472236763f7a7697c679f4c329b5c3417fac179b54ca2800090f95
SSDEEP 12288:UCJnJ5D3VkrDzxnfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sx:5JnJ5D3WXdfJ4yL/tNCJPXUQrPi
TLSH
T11215D02DD2A810E8D4B7C3B482496746FF72386D2F226AC768B4D4353F16EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 877f9a05c34e1e6636bcf2c2fe24ef14e11c6cdf157e4890630a3f9844a3cd10
MD5 a9addafc7693036dedc1e1bce6a0a2e9
SHA1 7dda7ab17ae37e40938188f4815383ceb94c1c4d
SHA512 e845f08a3560ce41f928398da72a37e559371d08fa5d0479e2c9fe75661dedd673173dbebc1d3b0f48f95cd1aa5012578d86be0573212ad5087cb116cda36f3b
SSDEEP 24576:TEPghm6/7IIXdwcXrif7qQncjlP65i3VuOfJ4yL/tNCJPXUQrPf:Ug06DIKdwc+eQnSt65aVzfJ4klKXn3
TLSH
T1A1955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 6d50fc2af8d288f127ce9e61cae770b6c63085eae5c3dc6d44bfbed6e1350cf3
MD5 acbf407ef413ecd24a52465840b5b101
SHA1 b9810e4d57c2edec2f055eaf2cad4d2755b8a642
SHA512 dc13d275a0654ee2163ff375a1439263b15047abea6297da03f636643282f6aded6a11a69122f85e70646ef48be4e19cd332dde7ab428b76ebbffc4c06a9eca1
SSDEEP 24576:pph5b//32zbST44VkeLGqURYG7rYHxoPNZMn6fJ4yL/tNCJPXUQrPi:pp7/GM4EkeiqEYG7rKau6fJ4klKXnq
TLSH
T12A6523AE664DA0D5DC19E1BC6604C104C366B4B11B1763EF56A1D47A0EBFEDB2E3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 3564be202d7a2311bceb6f23dc954ecb23fa3378a2a8a5e9b158f52766bfe556
MD5 b7f5552cb163a346a0d9cb3632f25c3b
SHA1 41caa1778e907f154c0dcf73197a8f5dbcf668dd
SHA512 92aa5e98ac26d7f2ac960f2a7cd9cdc7e1a93653acc533eb76010268abc9c3ccf82d49d11af75a4c8678332fa69532efd5d51745b5698c21a4265d2d1c998f13
SSDEEP 24576:/ih5b//32zbST44VkeLGqURYG7rYHxoPNZMn:/i7/GM4EkeiqEYG7rKau
TLSH
T1BA05126D6B5DA1E5E809E17DA611C604C3B7B0315B1327EF12B1857E0D2BEDA6E3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 b2465623dddcd54ff724cef26d8e2d6233243d29312afd004b84673be6a9387b
MD5 babb539ecced22ab075cca10129664f6
SHA1 4128baa2bd4274ca7cc8b72bb7314529b28dd336
SHA512 a51a24e4892a15921e1091c7e31a72d8ff1a41d23f7a355adc0a45d02dd137d6a952845e0a7579dead5d294ef2e300a2dd989575d71f6709f24c663dcfdc9e63
SSDEEP 12288:sjkymfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:sIymfJ4yL/tNCJPXUQrPO
TLSH
T1C5F4124A23D4A085DAB647BC5A55D140CB34BCA02F2693EF9580F53E7FBABD52C38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 74c1b61e3c8e75fd5b86a8863852e94f81bd3ff7625225298f0b5057c152ede9
MD5 3cfe6f76847452371342b3aac0ee096b
SHA1 79bd3ccf7d8436b8e6312f1b171c624ea50ce8b7
SHA512 5bda11257a5d8761093f1e899d26c6da58ff6f399fd498cba6964b5fdd10308229067c2f7e00e7dc123d896dcf171e559cae32308c13daabfdd0681828017205
SSDEEP 12288:DyQfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:uQfJ4yL/tNCJPXUQrPj
TLSH
T1D3D423AF2095A08ADE2687F81648E100C3147ED5272B62FB9DC2F4B17FFD99615BC781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 53e51797f283871a9e343325baac0e92d21ff76daaf2a4a4b502557298073257
MD5 1a49d198bbe2c5211634de3ae4d4e4c7
SHA1 4e403d471f6446fb5a469fb28c1a43b2942fd6bd
SHA512 32141f696793ba405381dac349e4f88a7757cafb353c599b763c838d0cb5b5a9b161cd42198f6a14306c8a2c99a6ebb3beea7fe39adcc31a3b42c6099294905f
SSDEEP 24576:/Q9MxZKdcz9dw3vfJ4yL/tNCJPXUQrPx:/VKZvfJ4klKXnJ
TLSH
T162558D2DABE9058AE177C27595A250C3A633B4311B35D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 df5c797d53f0bb421e82c3bd68a9b2e839b20541d5abb262da23ef82b1dcb705
MD5 9da04a3b009b8e07107833225d444ce4
SHA1 3cf9ba6fa0e5790bff0c89a15b0d151369cd8a1e
SHA512 0981e0970aa0b9e73b396102efd8c747005d535895efd0a7a03878c13e7f0528fea4aec074f45c9c598bbeb05fabe164e9fc5ac53bbb507792464b72c9bef7a2
SSDEEP 12288:ByoKo2JRple9pKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:ByocDApKfJ4yL/tNCJPXUQrPZ
TLSH
T142F4E05FB7A940A2E176823C8984C205E773B4701B2263DB6681C33D5F77AE97D38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c5f17342a76177ecf2710efd24689aeb0f8e8ed05124833259a1860bd2a78be0
MD5 59ef7e5fed8a54b84273e5c65c3c9a5f
SHA1 0c54abc5506fc94dc87547d34ec61abc9dafa220
SHA512 276d6d5d5bba66de13a03ec38fd62c5c461a2d5e248cbbab10292a1bf802deb13b4b53d44ffcefc46f32e25bd2fc96ec50b137cd636fcebf44b26893bc68c08f
SSDEEP 49152:pWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKKfJ4klKXn0:R0zuNIsfJ4k
TLSH
T142A57B3DA2F800A8D9AAC379C5451366EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 7a279b2831f9f462f229f2249a94939c14a49eb09a714e3d1e81d7f71e71af85
MD5 352ec2a3a1fd01d8edd47f6b3d74c4bf
SHA1 5f6590f5fc043c4590a91dc69318d8c3a3441cfa
SHA512 b736672912ee358ba25f4dd8b8ccbd271ca133a5177bedecdd59d2123f101be7589eb372575077ad07b0e2e2b099437fecb714e3419b346ab67f562a77ba3fa8
SSDEEP 49152:iTDxR+N5YzTfjMe/GM4EkeiqEYG7rKau6fJ4klKXn4:yu517EqPb7r1vfJ4k
TLSH
T1DDA5E12EA7E945E9D17EC5789B23C501FB727861033293CB42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 98c23293438398084e8e6310ac508f10fb66f57e14877f168b90a17260b7285f
MD5 c33fc3778f59afa6cd48fe1bfc5a5030
SHA1 205a28b6e65e99ef475de1dbd0a80dd7fed9904d
SHA512 895fb57648645704703949b7efa7d9cd4eeaeff03052351fb97051456318c6d023226679b75ffe17e2bf919cb589a861ef47191e3177a90016bed6cad5951e87
SSDEEP 24576:k1QT7EcpfxR+N5AWAz3ooiYhjMqb75b//32zbST44VkeLGqURYG7rYHxoPNZMn:ZTDxR+N5YzTTjMe/GM4EkeiqEYG7rKau
TLSH
T13575C02EA7E945E9D17EC5799B23C512FA727821033193CF42A0C17E0E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 09210ec7b0dfdc827801b4fc8d63fc6858d3d0c05e801afe78ad632b5e45a235
MD5 228c55e7f91174ec1f41ec531f5fb39e
SHA1 93efa7dfa114427101f182002918d54fb1da8aad
SHA512 bef0c84ab01c5afa0a48f33ff12173b1f1330bad285d23193e5a3fdc704aecaf58e2b7c98deedccdec0da9853b4e79715e610e01ea7bf54490be824dd36b4e9c
SSDEEP 24576:gTMdOz0FFS+UmSLFfJ4yL/tNCJPXUQrPs:I0K+UmSLFfJ4klKXnk
TLSH
T17515E17E63AD14E5E57BC27C9642D906E67238A6032266DB06D0C0793F9BFE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0d0052b862f6ed0.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\f0d0052b862f6ed0.bin
Size 12KB
SHA256 383a4f5430e21feed29542c35d594bfd534ad213300cff8031467ce15f4781e0
MD5 7cb63251b6407403b388e1c6213a2466
SHA1 e664676e1d7741ff6da109c55adbbea6c56811c2
SHA512 2ba91f5fa1cc7ef5126c8bdcbfca6c9158996dd9a91f1a572decee2247c6ba6a6e04ddda06cffe615a2feb97e3e74f0b451d3bca102ab0bcb7a4282f240c42fa
SSDEEP 384:NCG0U8uTcQ0mHVNv3BY5sha36Y519VSJEfobwHXLn:NhZTc2/30v519V2EAWXLn
TLSH
T13A42CFE550C2B3A027D74B9756966635306CAFBCBAD74B3EA1B34177468942D030336E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 d6a28f8793351d823d1bc8da44bc01c1d46151a8d477ea8f620baedbe5337d63
MD5 44d0a2522801f207cc2358f7fc538dfb
SHA1 ff340930ea1808b0324c9689b9e9016ffbccf679
SHA512 37d62ff73f7fbf5bd7bd70c9b4320958cf3e27b0e0dca7ad44dabaedbe98af2a1dc9ce67159df2c876b0036aee5a63a2722c767303111909ca422f3ae56f081e
SSDEEP 12288:d4KsfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S2:5sfJ4yL/tNCJPXUQrP5
TLSH
T139D4125E23D870D5E87293B84B54D101C330BCA6272A62FF39C1D87A6FBAAD5593C712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-431-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/204-308-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/204-314-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/204-316-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/628-359-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/628-436-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/680-367-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/680-301-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/680-430-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/868-433-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/868-339-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1596-90-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/1596-73-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/1596-89-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1596-64-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/1596-72-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1892-444-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-471-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-482-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-483-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-484-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-485-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-486-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-481-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-480-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-479-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-458-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-478-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-447-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-477-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-476-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-466-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-467-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-448-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-446-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-445-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-456-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-443-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-455-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-454-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-468-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-453-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-469-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-452-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-451-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-450-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-470-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-457-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-449-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-472-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-473-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-474-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-475-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-462-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-460-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-461-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-463-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-464-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/1892-465-0x0000015DB3FB0000-0x0000015DB3FC0000-memory.dmp

Download

memory/2164-437-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2164-363-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2228-425-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2228-438-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2228-393-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2228-368-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2228-409-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2228-441-0x000000000C900000-0x000000000C908000-memory.dmp

Download

memory/2488-281-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2488-274-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2488-275-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2488-354-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2536-362-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2536-298-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2620-85-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2620-77-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2620-241-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2620-86-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2652-270-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2652-264-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2668-269-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2668-350-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3408-39-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3408-38-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3408-30-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3524-427-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3524-305-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3688-58-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3688-240-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3688-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3688-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3688-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3840-249-0x0000000000790000-0x0000000000813000-memory.dmp

Download

memory/3840-248-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/3840-338-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/3840-255-0x0000000000790000-0x0000000000813000-memory.dmp

Download

memory/4224-13-0x0000000002FD0000-0x0000000003037000-memory.dmp

Download

memory/4224-1-0x00000000022B0000-0x0000000002335000-memory.dmp

Download

memory/4224-20-0x0000000002FD0000-0x0000000003037000-memory.dmp

Download

memory/4224-49-0x0000000000400000-0x0000000000724000-memory.dmp

Download

memory/4224-7-0x00000000022B0000-0x0000000002335000-memory.dmp

Download

memory/4224-0-0x0000000000400000-0x0000000000724000-memory.dmp

Download

memory/4260-358-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4260-288-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/4260-293-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/4260-295-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4324-351-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4324-434-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4572-344-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4572-342-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4628-327-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4628-432-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4628-335-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4628-333-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4944-355-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4944-435-0x0000000140000000-0x00000001401FC000-memory.dmp

Download