d50bb609cae63f31432bdeaea2fcc76391c6301206d36448ab879d6fc0c69ef7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_9c62939094b35608ef76a194b42e0e41_amadey_elex_redline-stealer_smoke-loader_stop.exe
Size 1.4MB
Sample260415-thg5msc13j
SHA256 d50bb609cae63f31432bdeaea2fcc76391c6301206d36448ab879d6fc0c69ef7
MD5 9c62939094b35608ef76a194b42e0e41
SHA1 d7e548c893ff297b52708bfff78d75441dd7c4bc
SHA512 2e9efe67ba64f69793716c7d5ec985ed32c031a1cb76ccb45af46dd06fa8fc86e718610b77632618982e6c0d279f286f90d860aa6aeb3a787d68d13cd70325f9
SSDEEP 24576:pFQchQSkjiqNC/TtrnCk0TGGV8uKMgWy:r5uSkji4678Oux
TLSH
T12665011037E1C433D163317A09AAC37929AEB8704B6566CBB7D41F7D8E706E25E3438A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
1520	alg.exe
2596	DiagnosticsHub.StandardCollector.Service.exe
4596	elevation_service.exe
3992	elevation_service.exe
1408	maintenanceservice.exe
1076	OSE.EXE
4536	msdtc.exe
4060	PerceptionSimulationService.exe
4752	perfhost.exe
1780	locator.exe
568	SensorDataService.exe
4812	snmptrap.exe
1080	spectrum.exe
208	ssh-agent.exe
4400	TieringEngineService.exe
1844	AgentService.exe
2504	vds.exe
5088	vssvc.exe
3532	wbengine.exe
3312	WmiApSrv.exe
4776	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_9c62939094b35608ef76a194b42e0e41_amadey_elex_redline-stealer_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_9c62939094b35608ef76a194b42e0e41_amadey_elex_redline-stealer_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2e3ab433e7d1e4d4.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_9c62939094b35608ef76a194b42e0e41_amadey_elex_redline-stealer_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-15_9c62939094b35608ef76a194b42e0e41_amadey_elex_redline-stealer_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_9c62939094b35608ef76a194b42e0e41_amadey_elex_redline-stealer_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_81171\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_9c62939094b35608ef76a194b42e0e41_amadey_elex_redline-stealer_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f3fbe2d7f5ccdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d428cd8f5ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d36369d7f5ccdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee23cbd7f5ccdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019d8fad7f5ccdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa313bd8f5ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7ef15d7f5ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2596	DiagnosticsHub.StandardCollector.Service.exe
2596	DiagnosticsHub.StandardCollector.Service.exe
2596	DiagnosticsHub.StandardCollector.Service.exe
2596	DiagnosticsHub.StandardCollector.Service.exe
2596	DiagnosticsHub.StandardCollector.Service.exe
2596	DiagnosticsHub.StandardCollector.Service.exe
4596	elevation_service.exe
4596	elevation_service.exe
4596	elevation_service.exe
4596	elevation_service.exe
4596	elevation_service.exe
4596	elevation_service.exe
4596	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3956	2026-04-15_9c62939094b35608ef76a194b42e0e41_amadey_elex_redline-stealer_smoke-loader_stop.exe
Token: SeDebugPrivilege	2596	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4596	elevation_service.exe
Token: SeRestorePrivilege	4400	TieringEngineService.exe
Token: SeManageVolumePrivilege	4400	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1844	AgentService.exe
Token: SeBackupPrivilege	5088	vssvc.exe
Token: SeRestorePrivilege	5088	vssvc.exe
Token: SeAuditPrivilege	5088	vssvc.exe
Token: SeBackupPrivilege	3532	wbengine.exe
Token: SeRestorePrivilege	3532	wbengine.exe
Token: SeSecurityPrivilege	3532	wbengine.exe
Token: 33	4776	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4776	SearchIndexer.exe
Token: SeDebugPrivilege	4596	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 1372	4776	SearchIndexer.exe	118
PID 4776 wrote to memory of 5092	4776	SearchIndexer.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_9c62939094b35608ef76a194b42e0e41_amadey_elex_redline-stealer_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_9c62939094b35608ef76a194b42e0e41_amadey_elex_redline-stealer_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1520

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3992

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1408

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1076

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4536

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4060

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4752

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1780

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:568

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4812

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1080

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:208

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2820

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2504

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3532

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3312

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1372
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c08b9434d29dbbdd3c1830137d9715b6b160825d4eeda8b697313bf97e3a6445
MD5 757b142fbbe6f0f26c4322cacd0f9685
SHA1 88f9dd4744726d9fa5d45551aaf9b7b1b2b2035c
SHA512 18bd20f2add4a13be44ad2c0aeb8561118cb073d90992a10ed1b468fe904a7f334840deb632ca84025154384c73662103e01893013901eb9bfd189b5c6568658
SSDEEP 49152:Zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnU4678Oux:v3q6sjBI8Vu
TLSH
T1ABD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 c511cba0413f7320e9ef11ca9818d1148ad2a4fc707b95988ab80285fbe46b9b
MD5 ce4231047e21d6c8eb36aab2ed7812ad
SHA1 e0f240071e3cec487921076ac2fac53095b7ec52
SHA512 3ac5362bc6f1358cd6eb5dd3ca91e84165ad7bcda1dce576fdbd33ee4d34f8b955b6c92348ec29464d7cd5dcb2b525212506028d258d312a46ef013cbbda0d31
SSDEEP 24576:/XYfDtczA7qNC/TtrnCk0TGGV8uKMgWy:KtcW4678Oux
TLSH
T11865012867E409F9EC67823CC8A28516EA737C954760F79F03A49A250F337D85D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 b8bab0311915b66a1bc1308ba1ed14b868e6fa98894a79c4331158b68a532ed4
MD5 ac53dbb743d39e4eb2cf308b3a7eefe3
SHA1 533bb9ac672f4ac7c859ef695e52bb685672dd41
SHA512 363cec88b4ca89a58387c033e9f728aa55fa485e7cf909a1585e13abf0c3a4d5df8de03a40cc71159af05b170c1957369b33f1c513df799db5b70f3dc44265e0
SSDEEP 24576:w0Le5ji0hmxxrMMqNC/TtrnCk0TGGV8uKMgWy:wPji0Ajx4678Oux
TLSH
T13A859E15F6B48335D073C0B9C5D2A69EED7130865B308ACB4286D77C2F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 44e2c123343da40891065756c9679b3da506a01cbdec6831d02b528a58f03650
MD5 3b0ee3eb74212b4f5c814e799256f877
SHA1 4e272ff76f611412bef28e324770a1759c1b29ff
SHA512 b4548dc370327eb2c083b71f4ebf030e318281ec627919063aaa10033bafaf794c1e8783e3f01aead0e29b70a4f062e7f1767159ed65bde70092f5922e4206eb
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWn6q8wyuGqNC/TtrnCk0TGGV8uKMgWy:1/ezSC6vUzPveHjy14678Oux
TLSH
T147756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c42f005ffc4ceceeaa7946730c34a470531a65c965f271fc3c5c66005b8a4b0e
MD5 993f4b15ebc519c195d862045b03fbbf
SHA1 9233cfe8df8d24c5ed1de800c0053435b420e26c
SHA512 0714ec6039a7a1f6a7f05b9803bd2bece78568a64491ce9ab4ac7da0c36cbea1df5e7d41ea2e121f9711246b37f8c8456a9d7c40bfb0df954a7770b81ba1b85d
SSDEEP 24576:9VbqPb88hv/l+YHqNC/TtrnCk0TGGV8uKMgWy:9VO88hXl+O4678Oux
TLSH
T13555AE65F5B48331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8ae67e3daac1f08740cc89100b5dabdae9f5f8f9928d1fc4ba8bdcb33730097e
MD5 38cb6c9e70dee0b68852902f0b264675
SHA1 fc805e05c31f248c23184978aaf02a09b402396c
SHA512 fcef37170705e733d6aed99a5a422bd2c32b0cdea96a2727258aa9dee2f8171ad69a84b8aac20408fbba0b3951686367e8abed4c10d87ba22391d20e4c5a2388
SSDEEP 12288:ILoMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:ILoqNC/TtrnCk0TGGV8uKMgWy
TLSH
T1264523804AE90239E5A7233421BB897B1D994DE868093D3FD5353F4905349B7F876A3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 486661d679046177e2ebaea0c18d84d6806f646b3db127a26ee80600239958c6
MD5 214ae119b96372928a26fd74673f014b
SHA1 040cf925359f529b1e52e4a50822eed63df8bdb8
SHA512 d84124faf022c28832b0be2232e04c92cc949a1f1722aa1808f8631ad41d0e75fda7359d496ec039453fbcacf70987853a29c54f3f5ed268764185f15e7272ac
SSDEEP 12288:KeBNUbTVO86UfMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:KJIUfqNC/TtrnCk0TGGV8uKMgWy
TLSH
T16765CF7BAE68FCE2C27A5DB85691C600E77278704F12A3CBD175830E8E235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b655ee80b2647b44b73aa14a6dd5c7ddbc89021facb4c3ac3cd6679bdbc2f4e3
MD5 65b07f54f07204f52aa320bfd17efa14
SHA1 97407b3bec3fcbaa33ccf095b2c3330976a2da23
SHA512 ef1bddeff0b56cec0fb67c576a5c9d1f1a1378fcaf6eb6f5862a68d818117e89294a27dacf4ab1af2fb73322a8c9dd7b3185d2781cc4509c2d1d212f8240594b
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THG:MQvGAdlCEL8c/DRNw5Cv8Vu
TLSH
T1D2267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 95547c7c02521dc1dd76f9eb5971d661e1c2ab57f28c011aea3ace3cdbc5cc3a
MD5 04b339616f9388b535c3cc05595ba5b1
SHA1 64b550e4c1fb24755a4c7df172b05b336bc1e0d2
SHA512 fb8026b0c684aa3809a7f8213487b1859c41887957941d90e50963f6f52cd6eeff1e3aa461e0cac7b7c1272f71fd360034992a184499ff13c83911c840c58c74
SSDEEP 12288:yAwSfxL/2Dc3RDLLmt0LDQewsAjhMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MZ:30ewsAjhqNC/TtrnCk0TGGV8uKMgWy
TLSH
T19175E030FEB5E036C2BB0DB61B36C716187C69604F5129C3E3A85E9D49302D26776E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4fff38ab68922bd4aaaa48f1d34d66697f753cdadb803cca23bb54f6780185ca
MD5 a10bf0351da5f94f3373e98024d6210d
SHA1 a1b4ef345708ebce25812da3e355d9d42f159cc5
SHA512 7ddaba06d815e38582ab957ad44c5724e37452345ef6a21cf8d8d95c479dced0687b52a27f6732b585e4c3212b166ab0fad383f7076b867b422721cf4153bba2
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHuku:KUEtQevvqc2W1cpV2tI327u
TLSH
T15A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 87f030a79c0dcbe0da44b90c79e4de163032edfc3835265a55e20889b0495335
MD5 09b783c18ae6b5fd58d4cc7a55996556
SHA1 5d506189bdc5f2b707377d20a62bc2cab97502de
SHA512 5e034ee67c30ea806f4b12f57fd69b23f8ae47c77936b6c23b8bc6dddd15d0c23c82b642d7ccc85b3c1773cadb47977d7f9c8e53f21471b4ebcd4cff1c9a4d6a
SSDEEP 49152:KCbRquA/m2yL5zLfFiV+XenmE3/zB4678Oux:/oq2VjnmD8Vu
TLSH
T1F9D58D0976B8C2E4D1F6C37886A2C647F37178154B35ABEF4265461E1E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 03d1628c49147c79372022c4307b3bf5d04ffb154038c16d594d45d0ba1ad874
MD5 97d32ae44755b492438b2b93c1a3bfbd
SHA1 923b0b3367be38c696ef78035128d7e734204f48
SHA512 971178516b590eaea9a77c5fa5f4f2287736a637b86d8b2c35aec207674db0e3a306826bb61dadbb2cf4422d51294093798119a861ab9f778f23fbadfe803344
SSDEEP 24576:8AhGL3IFoiwtA5l7S53aqNC/TtrnCk0TGGV8uKMgWy:8AMUFoiq5q4678Oux
TLSH
T1C235AD80EBF945D4F5B3AA7899B68571EA76BCA95E31D20F2160D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 14cd193f7bc28f849b6d66797556eb774a03e4ad8a9139873d938f1ccfed3f60
MD5 f1393e4f646b06e2da29d43929105368
SHA1 2167a6b968b1c8e45138e7e003a66ed5f4616384
SHA512 15cca86134cc9e4250683456a2c04b6522ac27777a66fb1f985c3fac320ca24ab36777de17dbd4c5bd2923251629657f4e427bf51dd45872f1c25efc9688ba5b
SSDEEP 12288:8mw5HEjsChNVBFgl0WDm+CmMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2z:5wu4OWVqNC/TtrnCk0TGGV8uKMgWy
TLSH
T18D65F14536E90CF9E9A742388197C536FBF2BC112A259B1F5360CA5B1F33361BD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ab0ab642a257039120b659bcdc805b65220a7aef3cc4b77e436347b0e0eeacfd
MD5 d6cf824545025089d415a20eb8f04903
SHA1 3a991995fa56686f8a173461e9308fa7771d841f
SHA512 965bb67c31b9df1a6cd1935b8cde9f49574d3fdd397acdc2172977abc205ac9634ee6ea6d052e0c68980e8fe01f8384c1ea13f9129f99351fb2e6601ecd81879
SSDEEP 12288:VeZ1IyRMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:gZuEqNC/TtrnCk0TGGV8uKMgWy
TLSH
T14755128523E821F9D0A3523C95F68A5ADBB178A6273513CF52251B590F33EE36C39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 71358278a9b3e105db2b8c9d94d02e966dd61562157b2f3fcbfbb0b9e336ef87
MD5 971c13c8c8d0b949f6ef81ce75cb9df2
SHA1 6dfa2555d711c14f54809e262ae462488c16f572
SHA512 549c9a585f4d0043844c80e90a620695caacea96b9bc7a7327561758d2be9ee92064c0d9867a1f6c5ed5c6d4c2abb38bb064983313aa6b1ffddfa2f3ca260543
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uy:2QRQyi36YOcPbLvw2gAf+PN3k8Vu
TLSH
T1D5667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cd1561a2371a0cd4d8b49ca5161d0d8f4be3c0c4cb18bc8c4cff6f6cb3fd8c04
MD5 34ed8b0a4bf427da410e79a427c50a17
SHA1 b8247284effa15b2c319745872440cb70d1fa151
SHA512 649fb8cc4afe90c0a492137bee786704088fb5f0975c96aa94aeb927dc6aa2773be84bd8f6c91b041137c63147fc334b5ae20fb7b7d19fea062ac85d7a8131b1
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uy:mQRQyi36YOcPbLvw2gAf+PN3k8Vu
TLSH
T127667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 854e0e0aece12fc54e6f2050a0cd0a937cee325ff72fb21129456da7b9f6cafb
MD5 2ba36a8b900eff7ef6338fe556c37911
SHA1 76d5232713f5ab6365290b7aa7732bffcb730d47
SHA512 0671a1e80ab0de42cc748ef2e52ea7d826720d0c571081362bbd2884c7dfb77fdc3c54be3a484fd0e0f5b47c0b613599122ca59f732cf0795b9fb961df0a4d36
SSDEEP 24576:QwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0UqNC/TtrnCk0TGF:W68Qg55nhceWu7PNU3/x4678Oux
TLSH
T102B55A33B2F600A9C44DE1769F4A873196D17C758FE0E7DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c6520eac18af49a651e435887d65284d9b1e4d4fad515583a35b73e136c69689
MD5 6626625ec91ecb9a6490cd74bbc5fd10
SHA1 8abb2adf57f79a52ccc02bd8fe04ff55e8c7b55b
SHA512 d29901435845219f698e13c6fb0ce4b2cc18c1c35c087f287037eacff8d7927b73b5faf71e59cade3b3824640b9dbcbef598865562c3cac8de7d4387e36f427a
SSDEEP 49152:B3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99s:Ay5112gYy5azzVvt69nLKnhZV8Vu
TLSH
T119167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 35376e26f293145605bcf8a767a423bd198c4f597bc9695e2def92f355a0521b
MD5 3bcace9f1fd54b5559a90e31a8347363
SHA1 201e8175502db318ad2012a15f1df58135add1b3
SHA512 66b25038a159145652812dffd640911a311556612d9fbbbdf8915397fd3b4c67ac5ce6593f78619c8a6f1b895c52a49077e80d6c68ea70953126c0c6b715fd94
SSDEEP 49152:zB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glL4678Oux:Fu6Jmdxd2ds8Vu
TLSH
T1DBD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0c8465aab37ef858199c6eb1a29784449728c6d444c2177af367b81179293750
MD5 1f3a5ebd6769c2db56138a670c2146bd
SHA1 474679e502a9f3fecda58fc4a0b0aaee75f25e5a
SHA512 473597b37b73878af8817be8f7e4e6360a3e57eed969de6ebc7d167d0b37677c86b869ab4a08827f5d9b6f7a18f0149e30ebbec233c99920127f11b465f058ad
SSDEEP 49152:r1hpsNoJpF1A63U44CwH7R4x/4678Oux:rmifPWRD8Vu
TLSH
T133B5BE13F2D901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4a85b0bc85f19a4b30c80fa49fafc81c4fd20e4135e8402086281d94839d603f
MD5 9fa03177511fe439334d9fdded4d62f1
SHA1 60933eb8d024843acdff2fdc933161e50a4d14a0
SHA512 f05d725a2c9629245750499243191a0b73a1e073c200139e986cbf3eca9dff5274c03040e5f04f0990ef426054021e867d6528f3696a80051cf127fd90acca99
SSDEEP 49152:kSuZQIY0Be2KcRVtOnks6NMHqE4678Oux:25dKii61h8Vu
TLSH
T1E9C5BE03F2E901E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2a765ecb9dfbd5d1a61d05f30d32580b9798c29acdedf54565ae484d171e79d9
MD5 7c2a95f962007fd5205117526aac0be1
SHA1 c35a0b9850c5aea2a710e38f465cc948900c5a1c
SHA512 111b0d32db64dc87b8449fc34676951a6c6d00265eed368bfb39045188d8a903a267c0b7790eedba0f229249e873701821c6761d2b7d0d7f663901fa2c152d10
SSDEEP 49152:fhtSn8EApI0fig3giDn0AP5w74678Oux:OX2imphH8Vu
TLSH
T1D295BE13F2D900E8D05ED178C7568632E962BC150B39BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b9401d393bedc2aea20f2b1401f134297dfacbc4497f2eb67ca69a4c549441ae
MD5 4a7175f5e9aaf4ff0d3b0e0d1bc2361b
SHA1 ff0730c6f08b7c6aaca9ee4c8c9e881dc9792609
SHA512 17653e183174c332da6fd16625eb923100734e3aa0ea0cb063e83f027dc92d2f2ba34d324512c3aa1c3bb68d272e0d7d1544e400fd5e4e5c2ef89dcf9bc90f15
SSDEEP 12288:6AMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:6AqNC/TtrnCk0TGGV8uKMgWy
TLSH
T11645238019FA022AD053137461B78ABF5D9C0EED7909383FF62A3E0506359B3B875A7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5685896420d124c8c128041b18e2093c93a6a6be7c5bb94e1628927a524ade51
MD5 c4456d7c80e4cf05e040234837a26be7
SHA1 70f793b8cc362299044ab77bf18dad1569b6b7b3
SHA512 2cf761d193067ffc73f1d82d871c601b9dd076aa957350012d4a96a668a476de23bd7429dfcb75699a3157c680f853917fcdde130c6f991c779156a62a51fbda
SSDEEP 12288:JdMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:JdqNC/TtrnCk0TGGV8uKMgWy
TLSH
T1C045238019FA022AD053137461A789BF5D9C0EED7909387FF62A3E0506349B7B865E7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f79a7b9a3f64b9f5c9d5643723b4d64db0587d5c92a639ce90a975b1aaeeba47
MD5 48dd3c839678d99d18f223c91f87b5b9
SHA1 e92498c3201ad606ab991d4266b092da7eead112
SHA512 12516c3dc804195052b9dc785429a59ddf9a58a2f618dad348402336a6683f6388803ecac6bf7a24df03ad4b19fa5070bc107e77f6e7e675d468bedc87c9da55
SSDEEP 12288:4XMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:4XqNC/TtrnCk0TGGV8uKMgWy
TLSH
T1E445238009FB022AD053137461A78ABF5D9C0EED7909387FF62A3D0906359B7B875A7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e412c5a39c7e7376770afa20682f7494724ad0e9b9f8c0d15c2e5fc259067bdf
MD5 52187201c622cda1d50d22f5c5e9e0f3
SHA1 44599f15ab73ad0f852d533e45d796e5dd693820
SHA512 f7157f37ef94bea77701f05cfd1a6e39c62fec9b8c8176dd8da8a029221ea46d6a55952b7ced2aea676b4711b4e5c7da34c5abfee6122a90c2a0262a9216ad6b
SSDEEP 12288:yV6MiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:VqNC/TtrnCk0TGGV8uKMgWy
TLSH
T1D84523801BFA01A5D463933891B7857AAEF87DE876252A6FD6111D090E317F2BC31F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 61747500f8f5fb3312f30d62d96af835ff646dd4ac1b2d3d4ae8195dac38cf1d
MD5 6f33a2f98c53938098170090a8ab4ee0
SHA1 69ac1c183359d56f3505a158ffc5ab338eae055a
SHA512 ed85c562eb177b9549c04fa7a019cffea0ae8eb7d1fe6a9ccdfc6ebee1c3387315baec80bc552762ae19b8e760316803b9473b1ee8917668a2b88d0de987cbe8
SSDEEP 12288:gCMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:gCqNC/TtrnCk0TGGV8uKMgWy
TLSH
T10245238019FB022AD053137461A78ABF5D9C0EED7909387FF62A3E0506359B3B87597D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 459da57776334b2e4e2d7ad75fd36439f7e85ad03b3cd11177469aed8d10efe4
MD5 d58be10fcb0bff5ecce529cd874ea6a0
SHA1 6c4ab77798dee5cb6ec3021ce079636115d3e1a2
SHA512 a4e818cacc1ccbcaa90c4e5ab44efa19d62a38e670599e52cb72af4368508f80f46d850a055ce78d8a6938d9062f7b6d65779ea54925291f17336322fab9b26d
SSDEEP 12288:lZMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:lZqNC/TtrnCk0TGGV8uKMgWy
TLSH
T1DF45238019FA022AD053137461A789BF5D9C0EED7909387FF62A3E0506349B7B875E7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0545d8ac73a86353fe3e25e20b37230c9face6b0faa5711acb696e833381d0c3
MD5 62e04a22e8dd90abb129b97649d71471
SHA1 ea9c0b9a37594f67275734f94cd6779783095bd5
SHA512 3aa73365dbe0ba8926607ebc19fb1b0b7a0d1646a8fb37512f62ab5ef267c1846bbc6db8ec88eca8ac62fd1f6351a33b2388f2f9630ec65ecc695d14ee7126db
SSDEEP 12288:0lMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:0lqNC/TtrnCk0TGGV8uKMgWy
TLSH
T16B45238019FB022AD053137461A789BF5D9C0EED7909383FF62A2E0506359B7B875E7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 5066474450cc519fb12f80f6d317ccdf3c07f3426a2ae3ecc44d4dd08c10444f
MD5 f0a76001a4dbcc28557482fe5e39735f
SHA1 b923d34b1632a7b0a68e5c19445842fd940db7ad
SHA512 084983929d6e7961d727c76473b7da8d03c64c57632f24e17bce60dc1cce2693b6dbc5fcfa6eb62c985a753979a11e82f1f53eaa57e21cbef537c8d3f310b58a
SSDEEP 24576:uZMRzFVSO9qNC/TtrnCk0TGGV8uKMgWy:uZMRzfJ4678Oux
TLSH
T16965029473A018F8EC63823DC9668916D6B27C591B60CA1F53B436670F337A15C3EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1ce47060eb8c7384d153b1528a01bfb3ab6b87d6386de783e5e931254dd15661
MD5 c49167c44994794bd2d3d218fae2186b
SHA1 91500c388563242a72a873a1672b6dc4f618ffd0
SHA512 3fb0363d66da8523422ccf644cedf4f102c4d85d62b614848f7fd8ac183b9ba6e7adb87c58360fc9e42665a6c07d3e9123898a9a820a490058e47adb43088bd3
SSDEEP 12288:20MiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:20qNC/TtrnCk0TGGV8uKMgWy
TLSH
T19A45238019FB022AD053137461A78ABF5D9C0EED7909387FF62A3E0906359B3B87597D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b3fc9f71cc5a3e3a2c947a5b61c1801041727e78a972be6771cddabed1652f01
MD5 ee3bb4cbfdc158152680e1f62b93f053
SHA1 3aad9cc97fdffc29fc765278d0001edf362d6ab1
SHA512 a67a607037bf711b385f0b5db826cb9ac7feb135d7a8edc06b0c381dfa3c20b2350dc2e46a3a8f2caeaace76cfbeb11acdd0259f646ed81821f9f5d9f92f303f
SSDEEP 12288:pYMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:pYqNC/TtrnCk0TGGV8uKMgWy
TLSH
T1A845238019FA032AD053137461A789BF5D9C0EED7909387FF62A3E0906349B77865E7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0111991eb95d6e24c27721299b9e2e81f455eca75bd5a0fd04219b9492c90d02
MD5 1c925938060cb3518aaa87f6fdee3b56
SHA1 82dda9aaa0ccba6cfa274a7fad50ad5ca7292385
SHA512 468a41805143e15424d584328e5b765a6d229c856bdfdf7e367d422d14468018d3271dfac036bde66ee6a3af890ea4ffeea85d72116736164a037f82fbaa1f6e
SSDEEP 12288:3yPz5L8RMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:6zyRqNC/TtrnCk0TGGV8uKMgWy
TLSH
T18D55124733E521F9D077923884A20A16FBB5787617245EAF53640B7A1F336E1AD3AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 679013cf58644b54b4fc1ffb66e9b646db83de5601f75967a8b3922971b48d63
MD5 46222fc8a8607aaa61bc15ae42ea3b0b
SHA1 a8290466dd5f124cf0f0d3fd2ee7b27a1bd29099
SHA512 15e078cf317e256b64098e05d5a4322658bcf894fb6c69746c53845d5bf528b98fe8862658daf8e94ebdc1e011b1761ea820ba69a5dbd1cd5e0268ee8ada7c37
SSDEEP 12288:Q0MiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:Q0qNC/TtrnCk0TGGV8uKMgWy
TLSH
T1D045238019FB022AD053137461A78ABF5D9C0EED7909387FF62A3E0906349B7B87597D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0b139f1b7b67ef7efe84d6b89445c282d1f2c8ebf89e1d3de0aef80d96297ea8
MD5 c5a58f64f1bd1f79725bd5c59bb09d7d
SHA1 5fdb8dc073ef18f64613f5ade9ca8d3f32eb62e5
SHA512 74c6b49d10f5545cc7784c1d4fbd6d31dfc5aa80dba0a63db7d1bc1be2a2e9fe8c7b304d965e36c7d7d19fdbbc38edeae6c22bb856437cb911c2c9832d92698d
SSDEEP 12288:I0MiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:I0qNC/TtrnCk0TGGV8uKMgWy
TLSH
T19645238019FB022AD053137461A78ABF5D9C0EED7909387FF62A3E0906349B7B87597D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 27fec8293d3d380ee68fa4ecae30b62f642caa5a972f7d5b5e384e1fee0785d6
MD5 9f15a0da8454477665c25699361da5c7
SHA1 38eab853195175d930151597222e767373dcd7d1
SHA512 1d23d38d8bb558d21ca12a5b4bc7dcaf1bca6ab6bce7a9cec9f619c1531d6e4bb53b42752b20bb2ef8f1c605a09e5978b3477df3ff05b0987f8ba8dfe7922992
SSDEEP 12288:CyPz5L8RMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:fzyRqNC/TtrnCk0TGGV8uKMgWy
TLSH
T18055124733E521F9D077923884A20A16FBB5787617245EAF53640B7A1F336E1AD3AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 ba59da98288a8a8a0dc08bbaf9e1ce209e7b17725d9db570c60b97bbebf5cf4e
MD5 21dfd35e49f86a5e26268a553d44588a
SHA1 6f2ff99ad970f45194f2fd87bcbf2e85f1d6d5c7
SHA512 b4a8c58ac4ce5c0d31331b8a4adf611d3d89c33f5f25aa121c3da104247b8ff9cb09af492b4910b05e42d6699eef9eb4aa6733a5744a01768742e7c2bc16cd9e
SSDEEP 24576:5TDaLl3z0zDnqNC/TtrnCk0TGGV8uKMgWy:5TuLljG4678Oux
TLSH
T10E650294739018F8DC67823DC9668916D6B27C5A0760CA1F53B43A6B0F337A15C3EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 7ca4b56cedaa7f80c85f1b7029d62e68d643e2513533f0d1686804df39a13216
MD5 7ab12fa4c09ede0f0047159c0cec918c
SHA1 2bd5aea1962b1dad0a6e329015daad71e9bc6a59
SHA512 f74a398731dcc37107fac94d608c17ae31fb2acdf7844b6bf755db49799b962e67ab018535853169d4d9f2cd55caa860ac435a6cf05113fefb4ebd41a5ccec31
SSDEEP 24576:o3vd9CHKy7GZTqNC/TtrnCk0TGGV8uKMgWy:yvd9CHKyaJ4678Oux
TLSH
T1EA75CF90F3E410E8F0B79A3589764512DAB67C991B31DE8F03A4261A1F33AD19D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 2ac5dd8d17ec5166389e97be22c6616d5cdfae6f539abd679a8177ab33235ab0
MD5 7b04763c6ce3a041418cf69c236a4b82
SHA1 71cef245b58782cfba3196d13204d5c2a767b35b
SHA512 e77ca921404bd239b530baf191bd50b4559c83e7ec349933608431d956bb7d66030a70add4796380cc8fe0d44ce59debae505c4ba2de7c2d3712af544bb78236
SSDEEP 12288:n3MiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:n3qNC/TtrnCk0TGGV8uKMgWy
TLSH
T15345238019FB022AD053137461A78ABF5D9C0EED7909387FF62A3D0906359B3B875A7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 fa5a9ca782a61eb623fa865dc016dc902cbae5be82670f74f50a54dbf9733f32
MD5 aa2cfb564d5a3d75c09c0da3ef7f11f0
SHA1 af8eebcb5fe5218939f2badbfb8e46ff3782511b
SHA512 a46b55f87f2939f7c89a3ca14c5a34960952a4f7c2c60c5031430b54e46e05c33e6f7b8e973b50ddb64c25a5d667cf64c0cbb65e68425ef6859d96487c9e7123
SSDEEP 12288:cxMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:cxqNC/TtrnCk0TGGV8uKMgWy
TLSH
T1A345238019FA023AD063137461B78A7B5D9C0EED7919387FF62A3D0506359B3B871A7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d2dcb8af57917228a499c0b806c5959b2f168a113f426b02a42c3cb522ed38c1
MD5 82f2070dfbe7967463f6ff081bfe80e7
SHA1 bf362668186841ee35d67c3b002a6c731e9ba031
SHA512 091868337996e15f71e5d13f07b5b814ac08864992130259a52e3241a7eaee75f18aa99618f0ce58c53e5a20c5e20c1934366bd7d7317a7ff34d3e5d096c58d1
SSDEEP 12288:/uMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:/uqNC/TtrnCk0TGGV8uKMgWy
TLSH
T12A45238019FB022AD053137462A78ABF5D9C0EED7909383FF62A3E0906359B7787597D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 794c5dd7f32db91dd4e6cc1f91c562892de382d38a0fd41b4c4d1497438537a0
MD5 f927a83ba713a988af334c332154fa65
SHA1 33e9e4027a199b7142e8242fd1dcdfca697452bf
SHA512 ca9a6b066447d578ce4e588c12aff8080a23efefc87dbc100a6b4365c963cb5a27e317e093252beeec40b690bc09375c50d550039c763ef6c9cd9a1a5af22f9e
SSDEEP 12288:A0MiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:A0qNC/TtrnCk0TGGV8uKMgWy
TLSH
T13A45238019FB022AD053137461A78ABF5D9C0EED7909387FF62A3E0906349B7B87597D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3a6696c2de0ea852b36cf33b2370de503a8a04ec270eeead09d5d584d55916a9
MD5 75ca387d57a4aa9008a3c3a79aea7b28
SHA1 5d620dc47d9a45e1e40c764887078d8357a212dd
SHA512 0d784f94fac707c34e0401d628b647a9feef030f6527b3e92c9afa995533e1e6dfad3748df225b39b52733b79693660f619ebacac668208f89bf4db2baaebbb7
SSDEEP 12288:DbsfEMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:WEqNC/TtrnCk0TGGV8uKMgWy
TLSH
T1BD550149D29802E8C06E6238C3564A55B7773C6597E193CF52D0F93E0F366E1ACEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 bff0145eca7966ed508bb609f46b4c7054c401d54a8e7a90982377afa33b44b1
MD5 307aa865243ab458797f1c6339d5458e
SHA1 ab2faa9de3c307913d6e9b50663b972f15d2cff6
SHA512 d161bc99241b25ee064b129a1a7fee0ca06cc176fe88957810df7a5b0674a2d85653a4fe78142bf625e7c9bccfcb10251ba8a6afc51317e2d7d583917486ce0e
SSDEEP 12288:+fMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:+fqNC/TtrnCk0TGGV8uKMgWy
TLSH
T11F4523804BED022AE0B7637421A7C57A2D5D1EB86E08286FF5153E490634DF3AC75A3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0933769277d5c5417efab4c83960baab7a825fd74df0e8c3b91e4cd6f4735ae7
MD5 86cfbfb83629a4cc70460b199a14991e
SHA1 4b5d907ca5fc9dd5d4107f8ae5e1b1d0d5a37b07
SHA512 91304e746de0e766ce37bb65f06dd49ae04b877c1e9694aea2dd54565fa349178045b2f54b751cdeaaf62de90c8e6003ac6236f029fadddd7da1828d5de1b11a
SSDEEP 24576:loiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBu9EzwwXg/b9qNC/5:la0h2GEkuAe73q3pp46zwwQh4678Oux
TLSH
T1B785AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 6229d2001f33fdc6e8a56903c27851e133805f6e476de96c5017c8794ebd9f7a
MD5 3f238f4dd96ac898e9fe2acc1cbbe755
SHA1 e681f681a41e79551be88092850123dbc3d4772f
SHA512 1b32bf09ebcb574622968ba6c0f2cdefe18ea57a1e35e521fe29923c95ef65cf074d90acedf24f02f95c8502c086137819e4c6c2c81a714e2ee8dfa9bfa16220
SSDEEP 12288:bhbHjfX2MiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:bhbHjP2qNC/TtrnCk0TGGV8uKMgWy
TLSH
T1E95512BD16EC1199E072A27C91A2860BDB70BC69271127EF6292423D0F37EF55C35F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 f701ca0ecf4be24b707103bfa890a0ad93a4c2f97157dcd5043899c6e904617b
MD5 591389bb134b30314e7431b98e336fdb
SHA1 781ec20d38a54319944bf7940b494dbf150c193a
SHA512 322ddf184fc09f5f39e220023f121a06c534ab16a008abfb4a6beed0f125861e2f7582514e1f136d0050c71738ba1863cf4ec0e8927f7d0fad2edad7673690a3
SSDEEP 12288:z7MiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:z7qNC/TtrnCk0TGGV8uKMgWy
TLSH
T11C45238006EA022AD463537411A7897F2D9C0EE8671539FFF4263E090635DF7B875A7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 5ba718fc004f827fc74438b1800ff00d6b7f15249442d22b2f431427f648688e
MD5 421f63274e56199b7eec210f9ef0a772
SHA1 372a1d36d970e4c4bc89cdf0e64c7a34c1afae50
SHA512 2e3cbf4f603b9647b662ada17263dee9d023d04bfed04ba9d46f04a70910114dc3dfa90aaf51221b92ed10a3bb9d7bf340498755d42f04d1624cfbec796c1aa7
SSDEEP 12288:RObfA4LWOsvAYFTUMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:GbL3UTUqNC/TtrnCk0TGGV8uKMgWy
TLSH
T10D75F154E7E500F9E867923CC5A28A26E672789D0724E7DF43684B550F237F24E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 e430f451bfdd9b2a9aa54553636d0ea5ea50ea6f942c890ef3be7cdf2361e6d0
MD5 1dda082bdf90cfb04f5edfac32b3c0c8
SHA1 49f5455874405064d87531c130d08441b1391dee
SHA512 c35edc6beda3f8c4117a3d33cfcebb6f54e8f1b30583099f3cffd04fa1d795d37dc9c77f7297140e3fa300d610efa43296ca5ca282775535655b4e0da026e484
SSDEEP 12288:spFtIOAMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:nOAqNC/TtrnCk0TGGV8uKMgWy
TLSH
T1BE55025936ED10E9E076A23C8593831ED7B178A5171227EF42A0456E0F73FF86C3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 00631d79b0c2152621301cbbdb854be1c3897f7ff5551eb0dd6a9c8c7e40d415
MD5 1495f5deef32ef137ff19150f06bfb60
SHA1 8068d52df75a7e2e28ac300a8dc73bf9c2aa1a94
SHA512 20528512a6e7d05a477d11482edbeabf18e6a843fdd5d2ccff4f644544c214327b956a734d759dcb240785ea833a4e9d5b9b0b01333f41e49209e0fa89562d9e
SSDEEP 24576:J7NM9YqZqmWMUkPjZM48Mv6bEhsvqNC/TtrnCk0TGGV8uKMgWy:J7cBWMpPjN8DbEhS4678Oux
TLSH
T116659E2E6BEC81E5D477D13DC9A28206F6B1B4611B318ACF5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 7411f08e8877c832124b32b7c315587173dbaa5ad06b61f082ba02f14b110b4c
MD5 9fe19559542cfbb2087576bdfda63de0
SHA1 5b0a475466a9f3a8041496c1f88fad381e1c5a1b
SHA512 eeab113ec372878c3c828fe3f66daaf4253f5f005340e6b1129193bcb0cc5c2f58c9b39ea355f157ff42604cb6209d07179002fa7ccf36707c8cc985de74d11b
SSDEEP 24576:OW6BApg2YuyuNDYTabvcdvNYf8km11qNC/TtrnCk0TGGV8uKMgWy:OF2YuHNETovAvNYf8kmP4678Oux
TLSH
T1CD857D2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 51837bca75af156ff9f63b7af340d3197f37684e6fe42a26c386b24e55ea09ca
MD5 5f813eda5734a6e5bf75a2313b9f3c83
SHA1 e7c53ccfa2ed0cf2db250c910da358372f1529e8
SHA512 b990259321b44fcfe3fbeeda6be61d8659d8664e2bd6c9eef7df5f064669a11732316098f09cdd8025eb4d192af78418577f67728c17d4ca56ba6a3545afdf8f
SSDEEP 24576:gAFs06+OmlfkNXEbTo8qNC/TtrnCk0TGGV8uKMgWy:1Fs060lwXuB4678Oux
TLSH
T18865AF2F62EC00D5D07ED17D8997C91AF6B1746707256ACB0260863E3F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 5243bb9a0dfeed4eab118c4de966ccb085d421f4a4b8a3bef56a9df2639c5abd
MD5 4e90e71a994a3fb708d51f1b04b34787
SHA1 9694ad014a92635e108809fe74f159a8eb7fa5fe
SHA512 6e9ca6a497c25a1f50d8694ba6456ff5ff1de27e2a188498df5caded298b3844f35b1ca054f5e8c29b658baed828ae8b99e9a5b45bd9db949188aca232587bae
SSDEEP 24576:LJnJ5D3WXBqNC/TtrnCk0TGGV8uKMgWy:LJnJ5DGXB4678Oux
TLSH
T11675D02CD2A810E8D4B7C274815A1B56FE72387D2F2269CB6474D5353F22EE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 410f524080f38ade0d5b9092e681451bb0632ce2079c2de97fb2a2ce6e6c050c
MD5 31a1260215accd7db28e077e1830f7d8
SHA1 da31a7f196c4030ffa35d86751cc50f65b5a282b
SHA512 29860994b778f1121e4dc0eee1f367ed852dce1cf1dc3ec54492fe42fb5b074aeef7f72e0d137996709e971d1cce41f0bbfa854fd061f8916f9c644556d9352d
SSDEEP 24576:5EPghm6/7IIXdwcXrif7qQncjlP65i3VuqqNC/TtrnCk0TGGV8uKMgWy:+g06DIKdwc+eQnSt65aVD4678Oux
TLSH
T135956C05BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 527535155a458332beadb93c5407b3e30a699bf526bd42622c05ee5aedf6a175
MD5 4b3d7130202af1a42c4e9da1f11021de
SHA1 fdab5b54c91da7b7b63e5e66f3adbf64339e6724
SHA512 70dfee5df68727399e1e08942bf5f937ff201a2b83834b5b8f53dbad7debd624a53b5fec51b14ac3dc5a79c3edc5b661100815308cdeedecd769db09ed1429c8
SSDEEP 12288:oEP3Rn1MiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:Dn1qNC/TtrnCk0TGGV8uKMgWy
TLSH
T1B955129C27ED20E9D027A13C51A1865AD7B1F4B42B1227EF51A1863D0F37AF66C39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 2e0c451c8d40ef02f02d5851fbcf24372bb1c6cc9bc19f397a4f7c2774541d71
MD5 cde1a1ce74a90edd8a796b7e6e38d469
SHA1 aa40f1cf156a7f208b9a90156cb373aa39f81a57
SHA512 30f4280759c9ac91b2213a4142c0bcf44e3b7cf66a11541adf4afb9abce15fb17f1790ea8cd7d20722127017d8375b20c2ba8c23a1523d5c4b60b3219bafdc3f
SSDEEP 12288:njkyiMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:nIyiqNC/TtrnCk0TGGV8uKMgWy
TLSH
T1A055124413E81199D5B6133891B381A55E78BC706F2526EFA190BB3E0F36BE1BC35F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 919fb777d6654f5352528de12fef5fd5524064e68b4a6551f0e15bb66ae913d9
MD5 5d69ab1af01dd93acc0896e803feb3a4
SHA1 465ac21d7f2ab8b159a6c839dee6e18f6839a47b
SHA512 6a1d4458b3f9d40c4b9cc9cfb29f76a464a7d48b1a08a019573d63c125ca3339224ce66e93d48e24aead0c133c13cc297b3d9b347de360aca5072b6485a5aef4
SSDEEP 12288:cywMiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:JwqNC/TtrnCk0TGGV8uKMgWy
TLSH
T17045238816FA122DD423137811778A7A1DA82DB83B1538FFA0A57E350B359F37871E69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 705bdc473b4d1a8a56a321d772c9e442b01e5b5c755e45459ceab52b8cc7b72c
MD5 c22afbabb88045cde72b5470ca35ee24
SHA1 6fb984bc737932eeed5110c4d92ea1fd83a81b82
SHA512 4caca8839e540fe2186f4ab51faed392a34faed7440144dc24428398524fe11033bb9d7403c3139c60d790565aa2f79f113d052f0e74e0cc295c7210b8f8e8d1
SSDEEP 24576:GQ9MxZKdcz9dw33qNC/TtrnCk0TGGV8uKMgWy:GVKZ34678Oux
TLSH
T136558C2DABE9059AE177D23995A240C3A673B4301B35D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 f7b0deeefce45649be354489dd3f8dcd7543476eae3185105d0af3411bc58a69
MD5 f99d0b164266b427abc259f58d8df21d
SHA1 9f7ce4905241bcc080e91d8e7133f79f0b1fc197
SHA512 c5fda70fc17bcf91143bc3e853346f9ca5414c18071f500a6f0db72d1b3a6c0f67e2fa711a64cabd384a756aae3a04485e04b8375c1559d1638d51aca2d2ab80
SSDEEP 12288:/yoKo2JRple9p+MiB6NCYhKTmornCwIh77O0TGGVsp04svM/MgT8y2ypK:/yocDAp+qNC/TtrnCk0TGGV8uKMgWy
TLSH
T19965E05F7BAE00A2E072823C85858655EBB3B4705B2227DB6591C73D4F37AE9BC34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 fb9d1e9c0ac27b11ec485070e1283b0bb15f34a1c7064fe7ead9238f63f8bf45
MD5 3b53059c426b7502a9232256c62de24a
SHA1 1045ab1a694fb25b93eedc9fd27837e48b95dfcd
SHA512 99d73a3979731eb2bcff22501b5470a10bac2028ff418428b6f813a291f936087660bbe25cf308b9a78e28acc70c8b4fb56d77bf4fe3f18af6178ecaf9e7407e
SSDEEP 49152:vWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK+4678Oux:X0zuNIR8Vu
TLSH
T12AA57B3DA2F800A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ef3f865a1ba22372191bc274fcd48b08813d29a5f96a803a9905586e82a931d9
MD5 dc197f010382417e9ae2aa426e8a86e9
SHA1 ab7d0029a2eb7ebca5b0c93aa3af37e9ddfd7c31
SHA512 d6ccd6c7681547244710ac32f83d7312a6e6d53a68bdbf18fd881b91d75505d7818cb9f15ff74d0b218f69ee0bb99888b63270e27a04590c1720aa5c76b0ca3a
SSDEEP 24576:f1QT7EcpfxR+N5AWAz3ooiYujMqb1qNC/TtrnCk0TGGV8uKMgWy:iTDxR+N5YzT4jMM4678Oux
TLSH
T16355B02EA7F915E9D1BE85789A23C512FA727861033153CF42A0C17E0E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 5487ad32b8fe11aa6a551228faa9fdfc2a8ae03bceb4862c305d4e2ed9cf1dc6
MD5 c5ae99f1e0649eed4d2671ec4bc33e01
SHA1 de19d83397403dc03257b09305bba62ed2ada323
SHA512 8af1539d328eb0e860a8dec0d9213f57c5336e76a0624dd4a6f08bf2c2dac29d1cfdd98b2ed708e6d61b13196bc54f3be225b278d4e85f4df50de045ea882865
SSDEEP 24576:03YgnJcRTk4yti+R5dBR/OqNC/TtrnCk0TGGV8uKMgWy:0IgnaTk46pBR/O4678Oux
TLSH
T18C45BF2DF2F910B9D8A6D236450147B5BB71782D1F209ACB0170C538AF1AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/208-301-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/208-293-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/208-409-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/208-299-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/568-328-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/568-408-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/568-274-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1076-73-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1076-80-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1076-79-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1076-235-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1080-287-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1080-407-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1080-289-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1080-281-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1408-64-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/1408-71-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1408-66-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1408-69-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/1408-58-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/1520-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1520-82-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1780-271-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1780-324-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1844-311-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1844-309-0x0000000000610000-0x00000000007B1000-memory.dmp

Download

memory/1844-307-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2504-431-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2504-412-0x0000000000620000-0x0000000000A92000-memory.dmp

Download

memory/2504-312-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2596-98-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/2596-16-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2596-24-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2596-23-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2596-22-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3312-325-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3312-482-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3532-414-0x00000000005E0000-0x0000000000A52000-memory.dmp

Download

memory/3532-322-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3532-433-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3956-0-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/3956-1-0x0000000002370000-0x00000000023D7000-memory.dmp

Download

memory/3956-8-0x0000000002370000-0x00000000023D7000-memory.dmp

Download

memory/3956-31-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/3992-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3992-234-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3992-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3992-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4060-257-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4060-251-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4060-250-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4060-406-0x0000000000780000-0x0000000000921000-memory.dmp

Download

memory/4060-315-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4400-413-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4400-304-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4536-405-0x00000000006D0000-0x0000000000871000-memory.dmp

Download

memory/4536-245-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4596-43-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4596-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4596-34-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4596-219-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4752-319-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4752-261-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/4752-267-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/4752-266-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4776-339-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4776-410-0x000000000CF60000-0x000000000CF68000-memory.dmp

Download

memory/4776-329-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4776-483-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4776-355-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4776-401-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4812-278-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4812-403-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/5088-316-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5088-432-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5092-424-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-447-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-429-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-428-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-427-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-426-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-425-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-423-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-422-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-421-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-417-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-418-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-420-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-419-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-437-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-439-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-440-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-449-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-448-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-430-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-446-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-445-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-444-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-443-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-442-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-441-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-438-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-436-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-435-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-434-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-451-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-452-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-454-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-453-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-450-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-416-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download

memory/5092-415-0x00000246AC760000-0x00000246AC770000-memory.dmp

Download