631f7d240c2a3e6369cd8e69e26b1b018e84300ee24152d363bb53a4aec8b187

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Size 2.4MB
Sample261023-ccmphag18x
SHA256 631f7d240c2a3e6369cd8e69e26b1b018e84300ee24152d363bb53a4aec8b187
MD5 f5f9394c3981eb7b0ea7d3b2efc7791e
SHA1 e20efd799e714dbd88c5e50715c7a87be515e040
SHA512 1637c12ff1b08e4ea0c821ab0fea390172c832aedcd0cbe6820863a68dc280559aeb317cf499d359fb8a65e1301ad780beb034a1f778ef0e71a47cb1bad4b9c9
SSDEEP 49152:GtAW5Q+tgauhwbR3P8wT8QjQx79G1poWl9ddLD2/sK:itgaPJux+b3LD2EK
TLSH
T18EC522147364C037C7A2117A487AC330A9BABD20AF7956C3B7D55BBEDE315D24A3834A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
2732	DiagnosticsHub.StandardCollector.Service.exe
1728	elevation_service.exe
380	elevation_service.exe
5008	maintenanceservice.exe
2408	OSE.EXE
4408	alg.exe
3992	msdtc.exe
3836	PerceptionSimulationService.exe
4520	perfhost.exe
4480	locator.exe
4660	SensorDataService.exe
3092	snmptrap.exe
1500	spectrum.exe
1140	ssh-agent.exe
2672	TieringEngineService.exe
4944	AgentService.exe
3824	vds.exe
180	vssvc.exe
2140	wbengine.exe
736	WmiApSrv.exe
1320	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 39 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	alg.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7a43b745862f6ed0.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0001000000017046-55.dat	upx
behavioral1/files/0x0001000000017007-53.dat	upx
behavioral1/files/0x0001000000017007-265.dat	upx
behavioral1/memory/4408-266-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/memory/4408-352-0x0000000140000000-0x0000000140167000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\inf\oem1.PNF	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File created	C:\Windows\inf\oem2.PNF	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File created	C:\Windows\inf\oem0.PNF	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b82e8f69162dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000149e03f69162dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d8988f49162dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c36d7f49162dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ed9fef59162dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa987ff69162dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083bcc4f69162dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2732	DiagnosticsHub.StandardCollector.Service.exe
2732	DiagnosticsHub.StandardCollector.Service.exe
2732	DiagnosticsHub.StandardCollector.Service.exe
2732	DiagnosticsHub.StandardCollector.Service.exe
2732	DiagnosticsHub.StandardCollector.Service.exe
2732	DiagnosticsHub.StandardCollector.Service.exe
1728	elevation_service.exe
1728	elevation_service.exe
1728	elevation_service.exe
1728	elevation_service.exe
1728	elevation_service.exe
1728	elevation_service.exe
1728	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5056	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Token: SeDebugPrivilege	2732	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1728	elevation_service.exe
Token: SeRestorePrivilege	2672	TieringEngineService.exe
Token: SeManageVolumePrivilege	2672	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4944	AgentService.exe
Token: SeBackupPrivilege	180	vssvc.exe
Token: SeRestorePrivilege	180	vssvc.exe
Token: SeAuditPrivilege	180	vssvc.exe
Token: SeBackupPrivilege	2140	wbengine.exe
Token: SeRestorePrivilege	2140	wbengine.exe
Token: SeSecurityPrivilege	2140	wbengine.exe
Token: 33	1320	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1320	SearchIndexer.exe
Token: SeDebugPrivilege	1728	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1312	1320	SearchIndexer.exe	120
PID 1320 wrote to memory of 3328	1320	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:380

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5008

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2408

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5064

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3992

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3836

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4520

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4480

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4660

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3092

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1500

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2572

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3824

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:180

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:736

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1312
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ba656df1f6d3e8113acc2830a7cf21a88c276ef9cca9e16b2274d33f1f7683be
MD5 ac25f3875368b34aa650b646ac798983
SHA1 fa5ec285069285bf7a9cd4f85e35cfac0e5e3edc
SHA512 151d4f7b5c23e93233374cb585867bf5d0547744d8e12ac2a001af172fbdab1ff660db5ff2457fbd9505dd3a3d55be1c9b4a0b2623df7af9421d49899ed689a9
SSDEEP 49152:ob+632BuPkFKRrdE6ohdstBhuXjfS4LWxny+tgauhwbR3P8wT8:C3q6mjB0gaPJ
TLSH
T11DD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 230c06a7038e070dccc0ded4208a9378006570bef8dea6ea95d9f97af81d7872
MD5 2e4044ad6a07088a84fda160a2623d32
SHA1 6a8eb54a690ff8a31acf6a016ed4262e9b599765
SHA512 0e031f0b0afa782b16bf8357eab2f614748210d40cddc571663e89e70c85bddeb38496b53923351194a968823892aee981869f39eddfab255c3873bd9d3043a7
SSDEEP 24576:ZXYfDtczA1+4ZAgayjhwbmY3MaReFeDvSP3b:ctc4+tgauhwbR3P8wT8
TLSH
T18985F128B3D408F9DD67823CCDA28511E673BC954760E78B03E4AA654F736D84E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 1a9bca19110d32bd699c34b703103c9ee90a084a1dba915cf0e291fee7f0816a
MD5 63b1439e2a7e11131452e4748b32f7b1
SHA1 db02f7092a5f84c5bddd2c5129fc13c78faa6dab
SHA512 5d21236024c28a1a416f57e6509fccf2d5bc524cfc795f142cf709f61c6a7148b1ea2c513ed7d5ca7c5cd4d846c9a3ef30f4c4aa187a37d8505f24a4718715c2
SSDEEP 24576:F0Le5ji0hmxhrMa+4ZAgayjhwbmY3MaReFeDvSP3b:FPji0Az/+tgauhwbR3P8wT8
TLSH
T1EF95AE16F6788335D073C0B9C5D2A69AED7134821B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fcc6eb366777a6099477629cbb7914cee041afed7ac77592b740b8cfa19309d2
MD5 79f8cefbadc122bd25df886aff0f99df
SHA1 29a216cf5668481636f624c5ceb30071c7f80959
SHA512 3fedf1aa4dac2b281a488a02e7fe75caf9b36486d6ce6194fad06b14d8b323a26504a067ddeb6dc3cffb27455dac993ca7b1c5aa9267f908c6595550183307f1
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWj6q8wyuo+4ZAgayjhwbmY3MaReFeDvSP3b:q/ezSC6vUzPv+HjyT+tgauhwbR3P8wT8
TLSH
T1D6756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.0MB
SHA256 9df118667a4a61a8ab2bef6f48910f8a2a4508f03ff9470bb8180e6248bcf4dd
MD5 5b94ae02e5f55ba1ef87d19a23f41193
SHA1 8893adbaa9debd3c57e81ab137afce9aa3515580
SHA512 b34a52d62f255bbcda3a16c20f387a212805e3d7bb5156aaefe6262a84e9cb422e132695d8188718ae87901904537306c2f43a721cd2eaa650bae6dc57930c1f
SSDEEP 49152:NVO88hXl+f+tgauhwbR3P8wT8FjQx79G1poWl9ddLD2/sK:O/h1+CgaPJzx+b3LD2EK
TLSH
T105A5D065F2748335D073C0BAC5E39A9AEE3234425B318ACB1246D76C2E77AD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 ae3c83a91f468eee907663e84c27af2fa7ca2477348b55eb353b7fed2123624a
MD5 331df75aaf783df6b61343a6464b002f
SHA1 9e06d686baf7dc10708dd77a4e94099cbda5af11
SHA512 1a690b0d06a1b588bbf931868338d195aa111781142fdcac3b1d7f4a875b4131d001ce0b918dec7e311cc305dd53460b30d41f24eb05051b9446f593cfab7c61
SSDEEP 12288:1G/eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:1G2+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T14F652381D30C98CACB7B0B348B7E0D606699AFD52D85A504E5C97BC9CCF0DADC6B2395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 2.4MB
SHA256 49fca65a653cf6c2b9d897bc54edd4c11237b148ca913500de54fd38851226a0
MD5 2273e214e4ff56d7d1641a9cb9e47185
SHA1 d3948f28d4a62e5dc77972e7ec113e33be46bb4d
SHA512 6dd605d763a68239d52aa971824f2fdb1db5e3fea8501a4abc6d2b971d31f30956344ddf7896684630a7b6686587d3f9604f1fabed5c451f5e14470660bd724e
SSDEEP 49152:PJIUp+tgauhwbR3P8wT88jQx79G1poWl9ddLD2/sK:6gaPJax+b3LD2EK
TLSH
T1F7C5F13BAE28FCE2C7BA8D794AA1820097627C714B61A3CBD175C34EDE335D14E79914
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 5.4MB
SHA256 86d6918df792026b91e08e2bc8a72643943242b707247d422737d083dd1c7ba8
MD5 86754ffc13e70d57bd67a378b43adedf
SHA1 9900109df22b91330448f0b0a5b8109f0c2ef5d1
SHA512 d85153bec933a32622152722f5f8897b138602d345c71ab146caa04c11c9974b03b9d5dd89c89d7c5bd0388331838a2707d9f741bad9ce51544a6cff0c3287a8
SSDEEP 98304:eQvGAdlCEL8c/SRN75C7gaPJlx+b3LD2EK:vvyEYc/S378saxeb3OEK
TLSH
T1C8469D656BF880F5E1A7E138897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 2.5MB
SHA256 13bcf0c47afc5f6f61187e30ed204a1a7656352143f7f94d1bf4d51d951c3498
MD5 01a1faea32ec51bd8173cc6be4303936
SHA1 d920e58f6ec4cae70807ad4c058db839b8074497
SHA512 86d59c35346fc42e661ffcf1bc2808bf5a7387f6fd962f9587bd3525c9d105706919a78fbe323110951aca380549eca4014d16f56b6718bf6eabf2e891e203a2
SSDEEP 49152:Mljv+tgauhwbR3P8wT8jjQx79G1poWl9ddLD2/sK:zgaPJdx+b3LD2EK
TLSH
T18EC50230FB78E03AC7BB0DB60B36C712186D7E504BA519C3E3E89E8E59715D21376A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 84f045a063978665e3b551a0c7cc3a852ac27d4894f4f9208db1d4552fb29812
MD5 88226989654d3c9a81a256e8d770c822
SHA1 ee96c073d0b6908a7cdc59a0e9bd5dd2ac104156
SHA512 9715c2f664391c2632e78b1c735c282c897345e20762b55a7bd4811dc4d407d641e1f53249730c7d901a04ef478dde13e6b8df9272db40b855668ab26c53a721
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHpax:nUEtQevvqc2W1cpV20I32C
TLSH
T16E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 3.4MB
SHA256 10ae5620da167482875fa1589c669dd39b9de69680668fd53988294cbd01325f
MD5 b00f6b54ef0cfb5f316de1990e2d5d20
SHA1 e329b4a949e633e4ea51411538e2a8437127378a
SHA512 0f5775462bfe17a717a41849bd9387f4d8f05c468faad3a45c6fc6c27615210bced02107186e97643786d288bf83ab5d765c0d8c09d51998ca7e3bd58de70fb1
SSDEEP 49152:JCbRquA/m2yL5zTfFiV+XenmE3/zP+tgauhwbR3P8wT85jQx79G1poWl9ddLD2/j:GoqCVjnm/gaPJ7x+b3LD2EK
TLSH
T14EF5AF0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7318519f2d4887cc7e855fded863e2d6339f165f586c00ab7e68027179716ff7
MD5 8536201e0e7a721f3f0c23c298bc8a51
SHA1 dfc61764a5ce3aa2e9d6c110eb6a15cc12dd9248
SHA512 1f542ebea84105af048a4bb8d9c538165b78a52fbf710fd4eabe8c13e814350f7ba1a49c838064f3ab1cd08955273025e19d453e5e4d177494fc7135b4a4e6a6
SSDEEP 24576:VAhGL6IFoiwtA5l7S53M+4ZAgayjhwbmY3MaReFeDvSP3b:VAM5Foiq5c+tgauhwbR3P8wT8
TLSH
T1A4359D80E7F955D4F5B3AA789AB68570EA76BCA65E31C20F2150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 17935781c2c7c3e4610a0327dc78094e909c9cceb34190bb0cbc6693b3f085ca
MD5 40bf1104d247ad6e5219a91bbb093cf8
SHA1 c00ce27ea38a7b33b508fefdf9729184dbe684cc
SHA512 f6d604fdb29f576ec8939d238fbb29214242868e4f0a7818142876d601669adfdeccb58a9f887941cf91d80d7dd54e49eb3e7b95f4fbf949b212a534690d1e99
SSDEEP 24576:0wuROWz+4ZAgayjhwbmY3MaReFeDvSP3b:0wSOQ+tgauhwbR3P8wT8
TLSH
T13185F14573A80CF9E9674238C6978532F7F2BC022A21DB1F57A0C75B5F73661AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 5fd12e96fd1777c08345b95e6553e4e4e0a26d0db000ce68ccafa79319247667
MD5 b04f3983a13e1e3b7ebf04c45a985074
SHA1 1c7084fc2c1a9f2458b0fcc56aa9e94f15e509b8
SHA512 1d6fb482e7ec5d0f7f0c44fec3b1ff85e47dc9e969990934b344aef715b912cf5b4de5a0c8e703ddcec7ce47b25aba44ca453a147b59039c3e91f0dd3405f854
SSDEEP 12288:4yZ1IyKeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:tZui+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T163751285239860F9D1A7033CCEF60A10E7B2BC922B7253CF9594679A5FB2ED54E35321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1d0a9fe5bb83956343363fd8c1532cf97eaf8fe6f88945a3812fa8b7ffaf7651
MD5 3465999724b8155c3d37b87a089d2289
SHA1 611d0bc2275e5b4d4701f3d0d1b24c71bce7d84f
SHA512 ddbaca48b0cf80c2a81c0d1da71403f8e2a721ed1d8856a722a0622e5d517df92eb281a773c05d6da5d758c1afea032998cfb040df7e78aecd60a50e74e82cc1
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UH:tQRQyi36YOcPDLvw2gAf+PN3wgaPJ
TLSH
T1C9667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8bfeda7cbd64a2a3297a94a387e691824534319a09caeaeca86753ddd485eb4b
MD5 5b62f4f3c18ab3c3d4e0eb259e6d0d60
SHA1 206f6d2edcbfa5e39b8c6129e01f6842a7386c7f
SHA512 ca3847ed8db6a575510360b26423c121502788578c9061d5df27b4b37ae3e71b207ab8fbd692951d51fdef0bfa5ad5b2f7efd3ba31386a7cba74721e70a20816
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UH:JQRQyi36YOcPDLvw2gAf+PN3wgaPJ
TLSH
T1DF667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d985de28dda0d9b10794c8af7e54fef0f538dc8536674c048d38fbf56c867ded
MD5 f34b7954d0dac75b1f87dc37a8c18b2b
SHA1 56ff123fef17f52f1b85c766a6a1096bf2eb876b
SHA512 bf1ace4ecaf4e4817a7b848deb7eccb5b4238e735def14f05df1afb40ba1d56de78f21acf1391cdc773fec55c13e069e16c76d9ed0152b3bbac48ccdd4c25dde
SSDEEP 49152:f68Qg55nhkeWu7PNU3//+tgauhwbR3P8wT8:ZthTRc/igaPJ
TLSH
T1F7B54933B2F60099C44DE1769F4A873196D27C758FE0E3DB8545720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d1c6c8a264f4c338f10f3e1b62c1762ba73621026eef79266ccd3f4c040ecbd1
MD5 664f305740b022953d2021d28adcac8a
SHA1 cd274a397c297bdfd2062c4eefdb0175aff7e5b6
SHA512 95ec41ef2e9f483acf1c8777b923f536544a023f16ec03e6ec27e6091dbee87877155f466f35c31e470a0a2fbb7081c23d84549e8868f834c050459047df0519
SSDEEP 49152:t3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99h:8y5112gYy5azzVvU69nLKnhZ5gaPJ
TLSH
T195167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 575085d2e706e5f37e29e42bc862522ecd0a7af43edaedffd741bdfc8740e183
MD5 ba32f6bd139413f2eaf5a9d13cb14aca
SHA1 b4899b7a0e06be5a4186cc005f1540e55f1d3c68
SHA512 81f4ce5c31f70a7dba3b643822eac12b87b2cf3bd30d839013f42f666239664b779d13d8467026e959e03b83c708fa2aada749eb78da58d77fa32802b53e06ab
SSDEEP 49152:EB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gly+tgauhwbR3P8wT8:eu6JmIxd2d1gaPJ
TLSH
T111D59D13F1DA01E8D06ED578874A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c527faeb6976abfae2aaedebc633214119f381289225c0bd4460c307cc6ea97c
MD5 40a6c53b0575d99ecab984f562adb767
SHA1 a883a15f4047da1935711027ca147bdbbb754f2a
SHA512 bfb3f09dfd00f7a5b254d6ca6841fd25c8dd9d5def82886c8225d91f177600011d5e49ada2ccc85e6cf8149be012020e7fc77139bdcab793c4c528c10681a5e6
SSDEEP 49152:w1hpsNoJpF1A67U44CwH7R4xJ+tgauhwbR3P8wT8:wmifPqR/gaPJ
TLSH
T1FAB5BE13F2D800E8D06ED17887569632EA62BC460B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 84c2cfbc1e96f447a522a3c0a1e6cb6218aae5c524b2a9e23263c7d631f2edcf
MD5 ff11f1e3c3a16eba5c575fcae936f6e4
SHA1 69f8cac77e45ed7be005a75215650c8d5a4ebc8b
SHA512 f93c90fdd75cbaaf931f7cb8b992c14685f5d3ccf3b738f1da9fac1ca3305f75133e726650b15059327028448c46c65cf6ebfaabdf5e6107afd9ee8ee8f9e5d9
SSDEEP 49152:FSuZQIY0Be2KkRVtOnks6NMHqi+tgauhwbR3P8wT8:L5dKqi61lgaPJ
TLSH
T17BC5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c8725aa69a4ad51f109519271504dccb4b9e4950c6008103da02a2790e27ba57
MD5 ab5af24feb7980bde04f1e0ff9b7234f
SHA1 1285a78cab3c07fede26affa1ca9de6dc0acfe3d
SHA512 aa2fafb0e983d4d499b194954ad6352b7006d72a15b4401e83c6bb0c56746aa44f874a3b93ba541c4c719e192d26dbc057a347d644de0be160d1cfa1d0c3a7c7
SSDEEP 49152:BhtSn8EApI0figjgiDn0AP5w1+tgauhwbR3P8wT8:QX2iWphjgaPJ
TLSH
T14B95BE13F2D900E8D05ED178C7568632EA62BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 39cc4a698be6ba4f2d17b7a6a68c711d53a1d5561b2646f2c139130ed1cef1d7
MD5 789cc6858ea5258d95cb4c147426b62b
SHA1 d9e8fe4a37de2a46847ae13dc3b74345afb97ea9
SHA512 d214856adec07633cad64b741ab6163e10481f6157bed0a346ad3400568ab9a77cda4d77a14f2b444a0b2d582a929dea2adf0888a204c2fecf28f3a09a722980
SSDEEP 12288:CneH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Ce+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T12C652381D24C88CEC62B0775CB6A0A60A699AFC73E866144F9CD7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 8cf3b197bcf9b37273d4b26a5fdaa62f2661f9bc27e9f0fa47a7dcbd255a234c
MD5 656a59e7b96c777e9301ae70f8fe6b25
SHA1 c77b42a2fb0d3a37436c746abf5d33a105b6b32c
SHA512 571ca2fcc52c7e87be40c0dd08f8ba0f017d0a7ea14881307c78ec6ac1f57435df40b66374a0293fc27c230e36b1feb077044f9a0fb5268e847c27480a79f107
SSDEEP 12288:3meH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:3L+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T110652381E24C88CEC62B07758B6A0960A699AFC73E866144F9CD7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 4854461c3c98f64bd3bb4d56962b8969737bae67810d4a0d599dc8ba15784f93
MD5 d4d21048276acf19c680fb262f6f7b02
SHA1 f25d979db75c3cbeae8fb4d0b633ee2c1da3ea42
SHA512 2669ea2a196b611c859565e266d2c9aa905df6693f8fa92a04f50d1613b24477138047c64c57df1a4d5c2c067fa1f31b69fe2d7463d1fe8f21b7125a3e76abad
SSDEEP 12288:ygeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:yR+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1B5652380D24C88CEC56B07758B6A0A60A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 56d5d579981d0d5aa47680d11ded69f380adaa0802a1501990fd30497bdaed80
MD5 4e3ac7179bcc1266d102fa548900c2aa
SHA1 fe096e7e392d63c8813ef323be3e41e23b8d25ff
SHA512 96a419e935acd3fece043c067305756daaf118cc34574f13b06148a6dacc526999c005a0f55ce1d525c730fa1069e62b45331d2c37f60ab44cf69c56ab8c7904
SSDEEP 12288:sVheH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:F+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T14F652341A35C44CAC9774734CB760520F3A9BED66F62628FEA853B854DF0FE88A70794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 2f9d13cf38a6835f6838f6e9b5750f1490e276929739ac85485dec412459b504
MD5 593d0d602181f8ed641013e246d74969
SHA1 68afdee06cfe4e1eefa8055a7dd234e791a4cb9e
SHA512 1653d6f406d0b4fb2b7ada1806f59169a7a92f4fd831c68d0a39e184bda862b9e362b29b7b66ed0c731bc1f1614c081c04f25d9a6211339ddd80f6d8634a11ba
SSDEEP 12288:H5eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Hk+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T101652380D25C88CEC62B07758B6A0A60A699AFC73E866144F9CD7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 d63f504d7b112b8564bbc5d4b20bc6971e0d39f8715fdd736b0eb4fb757d43c0
MD5 220fb4581efc2e5453c6c7ac3bc4840b
SHA1 61e163438b7f4d45b2cc4f28d587977499dc25a8
SHA512 bf89f99a47f3e7e99c6e49d3f987e526b68c197bf05ef51e46fbb9a2da0db7cf0a3fd6f3f846488a0040fc048b692f248058bdffdfab0d75c8f6de2364bf629a
SSDEEP 12288:NCeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:N3+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1BE652380D24C88CEC62B07758B6A0960A699AFD73E866144F9CD7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 9df0e4eca33d71a5058b04e329b38e985336ac14e1f9985a1ecad8df7252309a
MD5 924d85a3609cb0a7f85328fb1590f13c
SHA1 4a0cdd33b0afa442466cca359b35160d4ba5d285
SHA512 e9d0082c555f4777a727e12976a0e7f5952f14c778eeb491eec9feb1f65397126203ffcafc7b044eec73dacacec93dc798162992467a851b14ef23e26227ac8e
SSDEEP 12288:K+eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:KD+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1DE652380D24C88CEC62B07758B6A0960A699AFD73E866144F9CD7785CDF0DBD46A13E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 7f038fc60423daa12fbd24cbadb4eba89dcc1b546e49505a09fb83f8bf4c6d37
MD5 df5e9b448fdc254a1fef3531f8030a9a
SHA1 0a7eb8d175608ecc16ff90b0878a8e1e886bda93
SHA512 1f68e031fc914179cd935dbc7930a23fbf6a9a85641f7dac08344a6b5dd02a6a32fbb95628644afa5ed6bd66832a18602735874b10d2051a0ccf413afe4e482d
SSDEEP 24576:7ZM3zFVSOr+4ZAgayjhwbmY3MaReFeDvSP3b:7ZM3zfn+tgauhwbR3P8wT8
TLSH
T1F1850194B39418F8DC67423ECE264911D6B2BC5A0B60C60F53E837665F737A10D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 321a4139fe7262a8ef7b1bd138d79f3758c584befb576998a6c49d3196aa7d23
MD5 1831b60104cec7e86c616ddad0444307
SHA1 cca69563774e069589b125e6445ef26f19ed306b
SHA512 7ccd66d39584b8ba3191aeffbc963a37846cd2cfccde1f8318d9a35b35d82ee5091461c3332ccf706c3e9852b09b8baf3331b14ceba5aaeddff97d8eb983d5d8
SSDEEP 12288:W7eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:WS+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T190652381D24C88CEC52B07758B6A0A60669DAFC73E866144F9CE7785CDF0DBD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 750b027b05c30c5c4f3ae6bded561ac560e861b6e25c9244994e951a6d1400df
MD5 2eb88c18d82da50d6bed2509693764ec
SHA1 afb07c161ee2552e7665ac511e40911cceffd9e0
SHA512 ae46a31e50ee2042718749cc720dfaf62e6d09aaa039e546b34db3416be9120998823c52d3d94278a4ddd051a4109b2f421e521fb7f82fcf78b6541374ebc474
SSDEEP 12288:VPeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Vm+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T174652381E24C88CEC62B07758B6A0960669DBFC73E866144F9CD7785CDF0DBD46A13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 33a48663fe89c24a3872565d8b622b2e89ecd94e9fbcd5d8403865a6d156c7a0
MD5 535709c16cb57491ccf55269c93ef78f
SHA1 62a7963a656b51a3106f0af746d35307f873febf
SHA512 6d7e3da486e97f9ba404bf316522fd6e346d5e29d5e32839b6f6b41ce07d287c9171ea4a3e43ce4beadd5026dd3406e06f5ab7f5b66f98e2caa4b54bc9288ee1
SSDEEP 12288:kyPz5L8KeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:9zyf+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T11C75124773A430FDC1374238CA620A11F7B6BC721B609A9F579417765E73AE48E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 bc9f35b52d5f8f1af72e1debf8e8bb8ac09e7649b7a182382ff14d3e857a9459
MD5 d03c644254584b0c179f4dd98c5e2f9d
SHA1 631382e5b33f0541389d42e8739370f94c0925ee
SHA512 4009a7d144382d1e6914fe0c2d9227f8f3a3d285efbdb0ef4f2c92a3e8a755d75d8c49278f9309997ab7cb8f20455259eed588fcc7de3c9ecdef88790c17dc7b
SSDEEP 12288:F7eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:FS+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T110652381D24C88CEC62B07748B6A0A60A69DAFC73E866144F9CD7785CDF0DBD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 8b9ef9793f9df998f53d09d7a0ccf8b9b93988edf25a6a6d690d867b4dc43240
MD5 ad2e3d4c86c87ef7db41d59d5bc02a60
SHA1 2ee087cea8fd4bdd0f4750947e12aa225b3b5ed5
SHA512 d9ae9ff3d2466b7a3b6e33fb51d8d5080d7f340456b9703acb2295807247f34afb294149a9cf4fb8fbd553c15b67337c1df58152fab44a40c0b69c343897e16d
SSDEEP 12288:Z7eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:ZS+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T114652381D24C88CEC62B07758B6A0A60A69DAFC73E866144F9CD7785CDF0DBD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 464db042698bf45b1d3615b910bb0b1247060ac11336188b81b6398cdad87e5c
MD5 b1cf6e35968a759f39914d5f8ebd97ae
SHA1 55ba58ddde884a4cf24f49186bb2a92ddab60e6b
SHA512 b9fd3a570360e26c66ce633471e978d1253cf0b414069be6f0d0fbf908abf003a3d853a5d16baf0c8673306fee0554356118da5e766e21416a3e8f099f5773d6
SSDEEP 12288:1psfreH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Wi+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T13375F149D29801D8C06E1279CB564A40B3777C6657E2D3CBA6C0F67E0FB1AD48EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 153d35d5d7a41e4dfca51af70072eaed5bbbf4525507b18586e37e2bcd0b0412
MD5 7b0a903904995f453ae28c8ffd42310b
SHA1 62728b634d0111fc1076522a928da567593662a7
SHA512 65fba1f3aebb0c4a16af3bf55ae671f8bfca8e7e947815c1d472adcc6c29eaac2e6eb260f6e79af4a86efd50ff1d153056c1912f9b21a3c9224e20a420080135
SSDEEP 12288:cmoeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:cmZ+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1CF652341D34C988AC57B0B304B3A4930765EBFE62F41E14AF98977998CF0DE98EB1359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0c5009ee7cf9b2666318bb08b85a9452950516b3f1a4794569c81534d1631821
MD5 61d6cd705cdc90e82a1f20ad7dd357e6
SHA1 a389250e5e33d7c7856fab5758693a18595e7697
SHA512 fdcee62bd5681f2d7275c90f64f52fc4512494163ce8e5bd5ffb3a7ab2396aa08c44c3ea23c6c8fb8145575e24b6447d22214fe274677676670e81c265db8fff
SSDEEP 49152:ea0h2GEkuAe73q3pp46zwwQc+tgauhwbR3P8wT8:ea0hNYG4JwWgaPJ
TLSH
T12885AF1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 2a37b1dba0003304cedf22020f5d27118e58f60e9cd5ff1159945fc778b122f1
MD5 a983b30b4df064f9d185f7e218c09d87
SHA1 d1d12c05bd6ecd8c8cdf33edf86dffa4635cf332
SHA512 da99625e63259e9e7b329d0723969789d1b67f4d5fabc2cd0e78db5f8550efd781f030c16f2859d694a6b15580e2d1ccce79971e1a90dafda12173a53165a8c3
SSDEEP 24576:+hbHjPc+4ZAgayjhwbmY3MaReFeDvSP3b:+hbHjk+tgauhwbR3P8wT8
TLSH
T1EF7512BD52AC20C9E176927C87664502D371BC661B12A3DFA2C593BE4F33EE84D35B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 1609c1189032ed9c269a473c84c545a8e7ed16f5251a06c6a0a5edfccfe24074
MD5 03d29cfd1153f25b78fd181df5465a1d
SHA1 6333fb52c84b0dfee40e057bc0fddc0ebc1bd184
SHA512 dc5eee53e1ea3809ed3bfc3abc37a0495634f04a32660824ea60c21784c6b3e35dad109a4f8061a006537c1093f21c3ef255ba95d2cf271043f016d9891fc199
SSDEEP 12288:06oeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:06Z+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1D6652380D20C98CEC57B07748B6B09206699BF862F5662C6F8C977958DF0DFD8AB1394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 daaa2048ee6d4d4e407a35b29366cb9e33c65861b732e5bc27f87b8f91062322
MD5 458c81195e7a66f2406522a6400225dc
SHA1 356c8137841f8f81d53759c463cfe053a4d71b11
SHA512 c6b35f04299438862de9a0cef299af54d3861e1c2952b5861636f7694e567abd3b0e93f161a6ff7fff96f64ece9960489d24286250c2b00b98a2a49561ec1e37
SSDEEP 24576:zAL3UTDZ+4ZAgayjhwbmY3MaReFeDvSP3b:zAL3UZ+tgauhwbR3P8wT8
TLSH
T157950154E79800F9D97B823CCA668A12E272B89D0760E7DF43A84B651F737E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a9720ec1fbf4b9c432da213e60e4936f15befda93a519a762e9ccfc30dea0674
MD5 7fc2a0c76ee33cb44113819bc9a56b60
SHA1 3105a8ee4b7a50dc58a32ed4e876897c44f19627
SHA512 3b5480e5c90cf4b0f8427aff4599ab986d08718de8b559d5e6d8dcebb32ca9205adb2310cdcf53991c632b6714ac0599fc54278467fab87cddb6c6e992e9e4ea
SSDEEP 12288:mpFtvOHoeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:aOHZ+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T154750219339C10D9D57A523C8A974205E3B2BCA61B1253DF86D092BE4FB3EF89C36B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5bad436589a59518f450b9d7c6f92574a9c7d334abf3802e4d40aa254d33a784
MD5 5529ed7a21bcfd1ffd9bf7785098ce33
SHA1 343bf9833be90a334170429af02d256eac92e8d3
SHA512 e2ebc695e6a9f8d8c405de2b378de8b568532335b2c3b7ad9f3cbea91f83a1475e6c46def2828c563b4d246e3aba7e35a18268c42f2feab0ddb7d6307686b259
SSDEEP 24576:H7NM9YqZqmWMUkPjZM48Mv6bEhs2Z+4ZAgayjhwbmY3MaReFeDvSP3b:H7cBWMpPjN8DbEhv+tgauhwbR3P8wT8
TLSH
T15E65AE2E6BAC81D5D477D13DC9A28205F6F2B8611B318ACF5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2a48c8951a237c9bdada07a379aa3089cb44a531f90a9beea020953c36ac0b84
MD5 eb570c957451e06e2e435b4c34f0a30a
SHA1 95f1791e46f6dfa30105e2db80e852604351de63
SHA512 1b16b8873d4cb13cf26a2d3ebe98911e1bac9ecca6197f85f70886af54ec592f670de08216792c67d56bd56ae3fa6d21f731a8693d12d2fec6bcd38055fb2975
SSDEEP 49152:RF2YuHNETovAvNYf8kmW+tgauhwbR3P8wT8:U6BCf8ksgaPJ
TLSH
T197858E2927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 534c3dc2174906811acf03a32f3f53cac0b30f5a919db83e435560cbce85487e
MD5 a98fa3351bcf738d967fedd09a14b375
SHA1 9c60a8f47dd2a9855098b9b86559bc40028aaa03
SHA512 375323a6b68438383db4bdf1a349f8211054ffd66989810fd973150eb556bdb3a8de6d44605b9ee0cdce0f583696bf2d856f9459c71ad39e92722eebfab01476
SSDEEP 24576:OAFs06+Omlf8NXEbTorZ+4ZAgayjhwbmY3MaReFeDvSP3b:HFs060loXu8+tgauhwbR3P8wT8
TLSH
T11765BF2F62AC00D5D07ED17D8A97C916F6B1786307256ACB0160867E7F6BEF81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 af1bed44c19b1a56c0af3a5b0cc9ca6b376073963b4da12a321f5c2732cac39a
MD5 f012d6396e6f1d95b76f5ed7e0cb0ab5
SHA1 12a37b18b818d6c6ec2d3bb2c3f38f24b351f9b2
SHA512 577571e189f75c12f17fd49f65412e7a5604888ddfedbbdc747b65518c6605c15874c9bdfd34ed1206614346e43b1ca85ca300fbcd51389845bd8e87ef1de8e3
SSDEEP 24576:/JnJ5D3WX8Z+4ZAgayjhwbmY3MaReFeDvSP3b:/JnJ5DGX8+tgauhwbR3P8wT8
TLSH
T16C85D02DD2A810E8D4B7C374825A1B51FF72386D2F226AC768B4D5357F22EE09979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 fad2aed624c2b280a6e1abe454c7ef11df6bca9774a759578482bed64e9bcc1b
MD5 c9c7505466129ad263042b0ee7805354
SHA1 b21574bf04ff8404174fbe720a9d0f844cc12e42
SHA512 2d3b16ef9e5b414a81926bfa07987578f29307b4fe03300bae25277a6a682f47f25b390c24838ce3b32d05554e9402f757f63fbaa345a6443edd627877587d11
SSDEEP 49152:6g06DIKdwc+eQnSt65aVq+tgauhwbR3P8wT8:TjgaPJ
TLSH
T1D4956C16B7EA5294E8B3CAB1CA6295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 f7525a01bd29e54c383bb06aa5bb20caa9cb5454815049923b8db4757a3808ee
MD5 9de54d0b1a468289424238f437570bd8
SHA1 35ea02af51f35bbeb6ccba35729362eb81234fc6
SHA512 a9fbe4ce3395b5549d2768b138707f43ca0718c18af761134ac9adda665b7f19cce484d4115221e7f6581fff43a100da041e88f6a7529c238cb6064756b1cad9
SSDEEP 24576:NpX68APIx79G1EGpkb9hYeu9Am8iioBvjVzi/NKJZ+4ZAgayjhwbmY3MaReFeDv8:NpKjQx79G1poWl9ddLD2/s7+tgauhwbI
TLSH
T14C65231C334C60AEC7A6823985B24110C376FD5137AA17EBA6E6D6BE4E73DE50E39740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 2444e78da0f7bc8e3fdbde3fbbaf296b5cff8973dacf868b1a2ca425e9131020
MD5 8c3f9f283909dece7ea5b098239b54bc
SHA1 517fc98daf7d798805280edbdb12d96cca94c2f6
SHA512 4bdac0f1446efbd456f99b2ef55e51d8cb063cafbac9e6729a8c335c35ee6906a4afa19c415bee44bd49ea560b4f4d6d6d539abc6e39d9c7be81367715498dc5
SSDEEP 24576:KiX68APIx79G1EGpkb9hYeu9Am8iioBvjVzi/NKK:KiKjQx79G1poWl9ddLD2/sK
TLSH
T1F005122D375D60BAD7E1817984B28105C772B82177AA1BEF16E6C67E0F339D62E3D600
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 3e3e0e926bd9ea78155e004e61023a6ccdabdbd60b4044f74b9e38539e17b6ac
MD5 6dfcea99831109754b62d0b1eb17fc60
SHA1 188610b93e0966cb9dc452bdb617b35469b366f1
SHA512 dfb30ce0152c7261ad7d62262d9a0bcd3ecd69ddf1451444d1eb233a3e62d0ed8cb8fd6680bab0331c0c3862d27d08ce526ab458aa8cf4506c7cfcafb3d2d33c
SSDEEP 12288:ljky1oeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:lIy1Z+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1F2751244A39894C9D6BA07388B7741A09A75BC612F1193DFA0C0F73E9EB1FE89D30B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 a65976681c0e90fcccfb7d24b0df7dcfbef27b32b761e53afd69138298012cf1
MD5 3dbe14b8374a2bbbd6de1ee65403d2d1
SHA1 c763169f5275267adf76614b933f682bd16b7586
SHA512 d8160142e57819b2dcb956e2d3ef490a8a721e82fae967c4af666f0da0023786597bb20758d65ac4bc756754f5aa1571c85b44f5d8305414412d9f1c41b2b4f0
SSDEEP 12288:jy3oeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:O3Z+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1A0652344921C64CEC92B0774873A0E6062A5BEA62F4271DFF4C9B7B5CDF0DE986B1784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 252aeba4b88ccd8394a82d9b6080f504316e680d1fc2c78c07621feb3cc0914d
MD5 ca8cf2f932193ca0e2022118b6ec78c3
SHA1 cb45abc262fa40f2d8289d9a26bc261ebe1b1e3a
SHA512 53efe488cf776d65ad072dfe0e599d52afd24d030b160edb79dffd52c1bea1b8f2f440796e7fbe656f77de40ec7cbc1012bc83171d89511dc6b083a81a816689
SSDEEP 24576:KQ9MxZKdcz9dw3+Z+4ZAgayjhwbmY3MaReFeDvSP3b:KVKZO+tgauhwbR3P8wT8
TLSH
T16A558D2DABE9058AE177D235D5A240C3A673B4311B31D6CF2448D13D4DBAEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 0bccc920975cb78fa3da935dc293dfea907a48a4a7b1ef7101bf79095690f02f
MD5 6eaa41698cab4bab635f9122a3efa296
SHA1 c4547d316d2cc4b33cf58c34a71c4c3567044585
SHA512 42749260e342124b0308c7913e386e3c8385e8b3a7e5b5881b680262e2f6d1fc7f64de9453c1585c6f6945e1d1332992df3ac1c8d3ec7fc8b7c9d086a6ea1135
SSDEEP 24576:myocDAppZ+4ZAgayjhwbmY3MaReFeDvSP3b:7ocDApb+tgauhwbR3P8wT8
TLSH
T1ED85E01FB76D40E2D176823C8A858641E7B3B4701B6263CBA591C33D8E73AE9BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 975c56b54c38383361e1929764bc4c6e84d1a6ae8ac6222353957d411ca85fdf
MD5 9a535dbb49af84ad023ea36f6d70edc7
SHA1 3248a6be1d0ab4090b8da5e9295da68a3f584c86
SHA512 bcaad58cbe8245510aa8c2b48d11d54257236fe321ceda541a970a3264cec0f7b0f37f4c8c1bffe8028695bc14928175105ed8e195d0597f06d69f63b8675da7
SSDEEP 49152:EWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKb+tgauhwbR3P8wT8:u0zuNIAgaPJ
TLSH
T15BA57B3DA2BC00A8D9AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 321c21f7c47ee81198acccb22848debd467a56fb860a6db4c2dc036745697bd5
MD5 3574e2d3f403c048e975da17b272d090
SHA1 9c36ffa22a0d03ba45e81b36dc37c24276290f42
SHA512 058d67e443b5859e77018178cc24d741e7b24ff193be47387d38df5fea537c9ae69d0d29ed81b9ec2bd0b1ce1736d985cf2dd3881ee4424b5f94bfd47230e36b
SSDEEP 24576:g1QT7EcpfxR+N5AWAz3ooiYhjMqbk68APIx79G1EGpkb9hYeu9Am8iioBvjVzi/j:dTDxR+N5YzTTjM0jQx79G1poWl9ddLDC
TLSH
T1F475C02EB7F915E9D2BEC5798A338512FA727811133193CB42A0C17E1E279D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a43b745862f6ed0.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\7a43b745862f6ed0.bin
Size 12KB
SHA256 97d6cab7fb59a0dfdedce45c76b2de2dd551d13ed3639a34224e35a634862b20
MD5 5fddbdafc1f784830d2e47c8852a1a59
SHA1 84bbf62e38b419109ba7379c183f35246c32e142
SHA512 851d65f951f034ecd6d5732e1e3a09d6b09e31b1a5b2719093e3a33048b4c2d810246b62f8637851b1c84b10a397e6aefc1b3e3b88c5d35a0137db413dff7fa9
SSDEEP 192:SjQpJqlpwVqt3my3CUm2Z53emYF8D3fMYY4IJSgQaLMUANgYWuHEGIzI4J+W2D53:4SJqIC2y3CeZwmKuaLMUpSkGj4EW0BMs
TLSH
T10542BF6C93D5C96D50EE611EC37137ECCFADAE899C641C3050ACE300F96A5D2ACE5C99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 3d3269f43758c49b4fe769e9afbf272809434b180de8ef6709d98c6ea9e7ed2f
MD5 c1e4522437a73c62cf3da12e4dfee334
SHA1 b52542dabb578be63576c1bb87e8191ea0108f51
SHA512 32f15777acd777044c4c1a1e5bb887b5256806950b7cf67c25f9fc4326fec8fae36dc20706194438e8e0742748713c54574a4c9c597969b12e93ae4613b06f85
SSDEEP 24576:X3YgnJcRTk4yti+R5dBR/9Z+4ZAgayjhwbmY3MaReFeDvSP3b:XIgnaTk46pBR/3+tgauhwbR3P8wT8
TLSH
T16945BF2DF2B910B9C8AAD236450147B5FB71782D1F209ACB0174C638AF16EE89F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 2.2MB
SHA256 8e83dcc4c0ff883d34019ae03be8eb1b6e43861f154c2e6aa237b912d9138658
MD5 59f0769c9b41d26729d2d62087beb9f9
SHA1 12749cf94bd23690382c3001dc75ea854c34a342
SHA512 dca9118626c3ae5b6517ebb5102c130b5ef8a8b34a074c1268ebf5e8ac6d8f31a79bbace3ed916e6daa840fedccda8a1efeb6db8e473a1d768f1db1206e5ca26
SSDEEP 49152:+N+tgauhwbR3P8wT89jQx79G1poWl9ddLD2/sK:LgaPJTx+b3LD2EK
TLSH
T147B5230C339C70AEDBE283358A7600204535BD5237A919FF75EAEABA4B73DD58679340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/180-367-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/180-455-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/380-80-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/380-71-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/380-258-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/380-81-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/736-375-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/736-457-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/1140-347-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1140-341-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1140-349-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/1140-446-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/1320-393-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1320-409-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1320-458-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1320-441-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1320-381-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1320-452-0x000000000CCF0000-0x000000000CCF8000-memory.dmp

Download

memory/1500-336-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1500-443-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1500-328-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1500-334-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1728-69-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1728-68-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1728-60-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1728-257-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2140-456-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2140-371-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2408-104-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2408-259-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/2408-98-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2408-106-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/2672-447-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/2672-353-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/2732-43-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2732-34-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2732-242-0x0000000140000000-0x0000000140268000-memory.dmp

Download

memory/2732-40-0x0000000140000000-0x0000000140268000-memory.dmp

Download

memory/3092-380-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/3092-325-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/3328-492-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-470-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-495-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-486-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-487-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-472-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-474-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-475-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-478-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-488-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-490-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-493-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-497-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-500-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-494-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-491-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-471-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-489-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-499-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-476-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-477-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-485-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-484-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-473-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-498-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-502-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-483-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-482-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-501-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-479-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-465-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-480-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-481-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-469-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-496-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-463-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-464-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-466-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-468-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3328-467-0x0000018E51C70000-0x0000018E51C80000-memory.dmp

Download

memory/3824-454-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3824-363-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3836-362-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/3836-293-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/3836-295-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/3836-287-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/3992-357-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/3992-283-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/4408-273-0x00000000007E0000-0x0000000000863000-memory.dmp

Download

memory/4408-352-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4408-267-0x00000000007E0000-0x0000000000863000-memory.dmp

Download

memory/4408-266-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4480-370-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/4480-317-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/4520-300-0x00000000006E0000-0x0000000000746000-memory.dmp

Download

memory/4520-310-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/4520-305-0x00000000006E0000-0x0000000000746000-memory.dmp

Download

memory/4520-366-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/4660-320-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4660-374-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4660-448-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4944-360-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4944-358-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5008-83-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5008-94-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5008-96-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/5008-92-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/5008-89-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5056-21-0x0000000003440000-0x00000000034A6000-memory.dmp

Download

memory/5056-57-0x0000000000400000-0x0000000000AC7000-memory.dmp

Download

memory/5056-1-0x00000000026F0000-0x00000000027B2000-memory.dmp

Download

memory/5056-14-0x0000000003440000-0x00000000034A6000-memory.dmp

Download

memory/5056-8-0x0000000002940000-0x00000000029C5000-memory.dmp

Download

memory/5056-0-0x0000000000400000-0x0000000000AC7000-memory.dmp

Download

memory/5056-2-0x0000000002940000-0x00000000029C5000-memory.dmp

Download