36816eb5ea6677defb799a9ee21941002b7eb46db6a93ec2ffd886e2b7a0f31d

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_85121bb987af787edd8013718d6c209c_amadey_elex_smoke-loader.exe
Size 1.3MB
Sample260416-tk2xtshv4w
SHA256 36816eb5ea6677defb799a9ee21941002b7eb46db6a93ec2ffd886e2b7a0f31d
MD5 85121bb987af787edd8013718d6c209c
SHA1 3d0dd00134f745949d50200420adf0476c375a7f
SHA512 64c4590edf7ff265b579de4ec5d9c895c0303eea731c2dfe878191ee04c7248dbf8aecc51524067c5f194898387cf98affe03e2ca89beb78b246e819615a73b0
SSDEEP 12288:bbvqk4iVVnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kw:bTq1+nsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A55232AB1448073D99241F587F5CB3AAC33BDB5573408D3EF5A2DF89B620D0873A25A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
488	alg.exe
3936	elevation_service.exe
2328	elevation_service.exe
424	maintenanceservice.exe
444	OSE.EXE
5236	DiagnosticsHub.StandardCollector.Service.exe
5556	fxssvc.exe
5936	msdtc.exe
3248	PerceptionSimulationService.exe
3932	perfhost.exe
332	locator.exe
3228	SensorDataService.exe
4912	snmptrap.exe
5868	spectrum.exe
2552	ssh-agent.exe
2220	TieringEngineService.exe
3564	AgentService.exe
5984	vds.exe
6120	vssvc.exe
4476	wbengine.exe
1080	WmiApSrv.exe
2844	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c7f2543c89fac755.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-16_85121bb987af787edd8013718d6c209c_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4868	3400	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_85121bb987af787edd8013718d6c209c_amadey_elex_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000caefe567bbcddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003fd7468bbcddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e68ec467bbcddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003faf6668bbcddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8b04768bbcddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007202f967bbcddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089f7f068bbcddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7ed2368bbcddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3936	elevation_service.exe
3936	elevation_service.exe
3936	elevation_service.exe
3936	elevation_service.exe
3936	elevation_service.exe
3936	elevation_service.exe
3936	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
688	Process not Found
688	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3400	2026-04-16_85121bb987af787edd8013718d6c209c_amadey_elex_smoke-loader.exe
Token: SeDebugPrivilege	488	alg.exe
Token: SeDebugPrivilege	488	alg.exe
Token: SeDebugPrivilege	488	alg.exe
Token: SeTakeOwnershipPrivilege	3936	elevation_service.exe
Token: SeAuditPrivilege	5556	fxssvc.exe
Token: SeRestorePrivilege	2220	TieringEngineService.exe
Token: SeManageVolumePrivilege	2220	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3564	AgentService.exe
Token: SeBackupPrivilege	6120	vssvc.exe
Token: SeRestorePrivilege	6120	vssvc.exe
Token: SeAuditPrivilege	6120	vssvc.exe
Token: SeBackupPrivilege	4476	wbengine.exe
Token: SeRestorePrivilege	4476	wbengine.exe
Token: SeSecurityPrivilege	4476	wbengine.exe
Token: 33	2844	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2844	SearchIndexer.exe
Token: SeDebugPrivilege	3936	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 3652	2844	SearchIndexer.exe	109
PID 2844 wrote to memory of 3360	2844	SearchIndexer.exe	110
PID 2844 wrote to memory of 3388	2844	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-16_85121bb987af787edd8013718d6c209c_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_85121bb987af787edd8013718d6c209c_amadey_elex_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 540
  2⤵
  - Program crash
  PID:4868

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3400 -ip 3400
1⤵
PID:2068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2328

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:424

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:444

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5408

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5556

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5936

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3248

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3932

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:332

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3228

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4912

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5868

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4644

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2220

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3564

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5984

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6120

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1080

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3652
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2884 2880 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3360
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2904 2840 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bbc8627d438daa86c50d8ca5ba04143ca13a4d5b749dc006986aa692b92bad27
MD5 0b93d40b5b68aef011d5c9c2e0a85145
SHA1 cd7cba295743ecb0d29ef750d92b604ae2e494d3
SHA512 802cbb60632b87e0d02f9858ef66888d1d19e2dff2a3a6e3fae4a4ce5683b7770ea7a826d39f99088473f5abdfc4444f8e5805aca11ed0d978da54ebfe622c26
SSDEEP 49152:Vb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn3Dmg27RnWGj:r3q6sjBMD527BWG
TLSH
T17ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 2f94cb22958fe3d77f70d15d3bcccc5670a202caa7b4df0060a429ec88927aed
MD5 0655cf572058ee1950798da8097e8f39
SHA1 bbd90f9f3f2c041748c93518f4aef8ea5dc20340
SHA512 c1c249b1323b73a7866237b0c2878e44966370bc17561d98922f008a9ddb85a92be16ba45ec333e6d2531940b8acc42509661fc4cd1ba72fe54ab724521c2a63
SSDEEP 24576:EXYfDtczAUsqjnhMgeiCl7G0nehbGZpbD:jtc1Dmg27RnWGj
TLSH
T1E165F129A3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a6d993f479c13b7de7bf755da8a901429ff977f6e2bfe15e7b9955281dc2cb09
MD5 c73336d049f05759bf77cfd10f9f9a39
SHA1 347ad42f269da61595be167016fbb5beedc8daa3
SHA512 234b528b48621f4336211fb1a53e1e0bac17315a8412ddc0ce0129de991260a9479a12ea99bddc12c2471c8bc52e611cc5f5c78afd56aaa4d5d5fbaf50d80176
SSDEEP 24576:p0Le5ji0hmxxrM7sqjnhMgeiCl7G0nehbGZpbD:pPji0AjKDmg27RnWGj
TLSH
T160859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 59335614b2521b22eab10ab1d53739f7223f44803b88fce34761e5d6fbf07f79
MD5 eec1275c85f315e7ac9e3d7a28abc9f5
SHA1 d563e829b4f8179a491ef53c33137a3f3d638ada
SHA512 775df4fa9ef0651ba525f5f8a6b434624c3d19be7e5d73c60bdc64259d6c51f05e96b200cb2de3cc180f3f4a0aaecadbdc4be8e590417a3ed2a33b3a38d60593
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWn6q8wyuRsqjnhMgeiCl7G0nehbGZpbD:o/ezSC6vUzPveHjyeDmg27RnWGj
TLSH
T121755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e7cf6b84afbf115156fc4ce9b22564cc1a9010aebe7674e693f862cb19591706
MD5 8437c8c81c898300c56874b5a66f3f2e
SHA1 0d6eb8adac4af8265bb2ca4e1d8d560a796c30fe
SHA512 64fc08fad3d03cf86c35c5f53a3c80d9fce14851c3a960b622ff09a479f4cacba9aa450c12de62b8e2adf54182252873bf00b342b36be6ad9a37829f31e23a03
SSDEEP 24576:+VbqPb88hv/l+YAsqjnhMgeiCl7G0nehbGZpbD:+VO88hXl+tDmg27RnWGj
TLSH
T16F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d878bb03a3348e3771829815de24b4ca6137005dae7dfef0a23c60a4fac694e1
MD5 12635b02a84f26d53ff1da8ca03f0477
SHA1 d33af41cacd23f64978211a119797db7666d0931
SHA512 65e8747eef0bd99dbd5c23827437d2d74393c1bb8350b21bb03fd283fde54028409076ffde2c6d88d360c5a241c95f7fb5880c649d864399e705bffc379b96a0
SSDEEP 12288:SL3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SL3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1324523BF864C50CAEA7708B5C3E9F11EAC137E56982008536A637DFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 5b3dfa33b2d7abfc2faa514da93175bfa6d798a2ccdae373943965d3ffc9cc76
MD5 dd0f9405255d20bf746453aad877595b
SHA1 78e88c552f807610188ec8a505e0bea09eccc915
SHA512 29045a0c9e6986d3fbfe0889c80cdf6e651ee51d8e539c21be184b6423e43a7edf0c33d760e8d6e2828252d9cd637e6ec129dd583ea959306669a7f80899db9f
SSDEEP 12288:reBNUbTVO86UIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:rJIUIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10365CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 960fa23e0167333f44e74f2352738074d95e7c46923fbd2cf2a127b9a9368814
MD5 d4c78bf98ea47e0b0ea71ce436239c1d
SHA1 c37848da58eb4bfb3e6272f956c8db2402eae56d
SHA512 193e74142eae410121264a84496c55347ddb59150957638069d488fc13bb152e081189aa4690de3bf54fa3050712d1f4b548b0734b0decb5e2f33a4cfa3a34f0
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THH:8QvGAdlCEL8c/DRNw5CVD527BWG
TLSH
T1AC266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 70316eb68a05d4cd44ed941289902cfa0b2ac24f2313a00547f3fe0fd2064352
MD5 a72d1125d47c896e4c263f2ffffa31cc
SHA1 6057173e19989d9995ffee1269b7226b7b103f6d
SHA512 63e0cee374d5083cbe4b8cb2a0a8d312c92ac50a4c2f7761fec6abfdb4ae3eb25578824336ef04ebd8ba9b8bb1ca5ada199348353cea733bc4b5658f025c8234
SSDEEP 12288:OAwSfxL/2Dc3RDLLmt0LDQewsAj2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkn:z0ewsAj2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FA75E031FA74E036C37B0DB60B36D71A582D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7648ee7d8b328dc02339f8f338a96cef8aef1c5c17736c93143c5e755eda4259
MD5 9f60d3ee19dd0be1247dd75ff8f35292
SHA1 741dd60e40e965501e9e3d48216db92bf4e620d2
SHA512 eebe73393a2fe4390a68221d1051688dfa4b17b8c297f4840c928eb65544a9f3c9d57f1cbc75d2af4eeaf34733e93334baea01f1e25b6309da5e515ffabcda85
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHCVQBWG:FUEtQevvqc2W1cpV2tI321B
TLSH
T1B7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d7eb243768a0b8fa7740f408cc96c98f0e82cee2e6589f1fa07fe68e9f68688c
MD5 dac96befb648fe3b6475e74af4e9167e
SHA1 480ec6b6eac21be5b5e66bb9689f15a452c84d53
SHA512 fde6d6a0c76fee9cb418eedd6a21fdabf4d6d75f59f5838f929cd54ad685f0b8e37c02673814059c748b1b9f13247b138e4f1ea23e0dba5bbd621189fff7e3b4
SSDEEP 49152:CCbRquA/m2yL5zTfFiV+XenmE3/zaDmg27RnWGj:HoquVjnmZD527BWG
TLSH
T187D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 46a3e62316ca921bcef2f4517d6bddb52510fcc41ddf4da15bc830b4e35e8f18
MD5 8e95908eb75bf89b90ff6cf700e8b369
SHA1 5180bdfc2fe228f9a4d9ee8b9d54ab04d230e20c
SHA512 5aef718ef6096a5835ff8a7e89b937ef6996b76907e0e1c7399d79ee95c2f72001b8418a176e8e501557bd03dea40a1eb54d2d399f7385a833864d1a7ad6ec3d
SSDEEP 24576:EAhGL3IFoiwtA5l7S53FsqjnhMgeiCl7G0nehbGZpbD:EAMUFoiq5JDmg27RnWGj
TLSH
T163359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 74c7e9f580ff1525226ffe3f603388b8711ff86a932526350f92ec6b6919e413
MD5 c0dc92f3021d5b0064cf38acd1b2c5e2
SHA1 0fcf851cf9cf93bc0af04934cb4e353fdab1af03
SHA512 4aa9c527b277852238a3d56b5864bd2248b6c14c8cc569760c534aaf78b7cdfabe81d0be5c9172dbc77cc3f802a9d1853a285503388f001edbf6a93a63ec79cb
SSDEEP 12288:6mw5HEjsChNVBFgl0WDm+CxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Twu4OWqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13B65F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e7d574089ddbf944407af1569a407b632f07668c0cacbf22a6383178bb689d02
MD5 6874bdaddca6edb9b41c2ecae43e5e5a
SHA1 8581c372e969c51d16901200fd62e5fd8a1061d2
SHA512 f786c89716f1b83d80fbfb1949f72a8aaa67d9095e55b2bea4f901875c6b17dba99c9338415b18c635fe95de28110313343c44f3f1d36d78d5b8e6f7ffed8189
SSDEEP 12288:yeZ1IymXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fZujsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D05512AE239820FAE1A3417CC5E5D609E7337C62673043CF166256AA6F739C44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 46236dcb3575bce74d27644601211c5ed3d28259f77258cd7f2cd5d69b03e70b
MD5 7a2ea71509e16e68485e4ce8d9aaadb8
SHA1 73325556649aa6030e9a2e3cd3897b5330d43697
SHA512 f337b4a0e5615533e268a90e3cda97024d0398a47c83f5abc33f899c7110e0fa19a9f87fb24d1d1c0e18862ef521ec212ac01a9f3e871c1c9ac871247aefc452
SSDEEP 98304:SQRQyi36YOcPbLvw2gAf+PN3ID527BWG:JQyiKa/X+PNYVQBWG
TLSH
T186667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 faaaaa7e3cfbc7edf741926a0d4394534f3f8ededf72edb1e0aca0c815bf53b2
MD5 f4837df8bca64be5bedd4fa8b0935d40
SHA1 4f4a4b52e11f10150c399070a9c08ee10e7cd280
SHA512 2c18b08a254d2cc54944bd5eba1a61de092ee1ac44b0937d021643ee817361fb3ea05ddd4f6e24c4d73f19fbc9cacc05e822d496defe58a513a6fefa170a25d2
SSDEEP 98304:GQRQyi36YOcPbLvw2gAf+PN3ID527BWG:tQyiKa/X+PNYVQBWG
TLSH
T167667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ff0b607a7e3516e91d4a0d1fa6ce6485bc8921500a055ab295fd5c8685535e84
MD5 370e7961d38da0e46f16619f8f75b24b
SHA1 09902d83cb261f9894f167f9ccff87790d2c9b42
SHA512 eb9871517301023b90d321b9fa36ccaf716681db05a4a25626c85ed3ed5fe7de0024f99de4d25a8ce3887629a6bc6e47a840e4603b389d87edc0f6d5f0f2df62
SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0zsqjnhMgeiCl7Ge:y68Qg55nhceWu7PNU3/KDmg27RnWGj
TLSH
T1C7B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4a98a7251888dd586e4c7109131ccd2c5ac3658565abd6bf8c9f3fce3866d9b8
MD5 1697a015c042f78970ac5c7d796351bc
SHA1 a8f9be967d9625ab9e8c606792708b1ae675bf4b
SHA512 9666ab5a30ef45db1034eb842bb8473742aac7d6911a4d799ddedd1b5f019a2ef5b3c0efafa2211bc2bb769162665670ce0cddde1b9fc49196dfb2c5e3804312
SSDEEP 98304:uy5112gYy5azzVvt69nLKnhZLD527BWG:fLIHEWhhVQBWG
TLSH
T1FC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 81e9780936e4a89cdcef4522202163f03223c2872a6147e7ffcc5b187909aa29
MD5 826ed1973939c42e2adcbbcd320a6e68
SHA1 de43a365390c46b7e21d56d255273811bf6c4277
SHA512 e2ea9581358e1359837b6a0b48f00ec2c4ecf19d26be09f5be9c6bf27c836342796a725daf8fb753e4e62cf95ec712949e3f91327f14106cae66bfbcac7078cb
SSDEEP 49152:CB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glADmg27RnWGj:wu6Jmdxd2dAD527BWG
TLSH
T1C5D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9faae3bbc0ecfa835decd6fe0bc32bb1f0330976cd6dfdeb4019762d3bae8ac8
MD5 3ecd9240ff60920f0f7e70a64e209b1f
SHA1 ea58d542e4a3ebdd93a98bc0bab8d79b005fd015
SHA512 9252038fc01a7bb73226dbaacf281990b26b49b3c79c6305dbd38ffbf6ad1ff34b6afda18440d19f5dd925627b9ed332e0e2dae794b529871dae15f96aa5a51f
SSDEEP 49152:v1hpsNoJpF1A63U44CwH7R4xUDmg27RnWGj:vmifPWRZD527BWG
TLSH
T169B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0dd6c442e9b0e6272d401688cc556d188a0e69fda7a512d7cfbc0f7f37768a79
MD5 ef1d58a17d27d0dd284fa19f4b17549c
SHA1 8f7a665eb13aa5b24f9238126fd931d64121a238
SHA512 cd07ac6a388619cc4df17dd4a1285e03b42d47df84416d219d87858a74d605e805fa1598379c4fa585bb462ea92a1a07a88ff040fdb8ea63c4761acea65c852a
SSDEEP 49152:sSuZQIY0Be2KcRVtOnks6NMHqnDmg27RnWGj:O5dKii61nD527BWG
TLSH
T1B5C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b1be820a8615f13c4aafe23759349c51644df96148e10a79812fc5b1a0d43a70
MD5 1fe68a10a5730a9b8fdbbc63e4edbba0
SHA1 9e4f0ba2c56d10000df954a3b351955e1e672a27
SHA512 fcf81b355bd1e8be128c9c0ae04b03e118ecb433f6e12588fa13cc635c28c191cb8103113b64cbbed20e0acd23dd8e15369ecc9284bbc6ff518cdb917924f61e
SSDEEP 49152:2htSn8EApI0fig3giDn0AP5wwDmg27RnWGj:XX2imphdD527BWG
TLSH
T1F495BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 261ed4827f9b3cea64e3b2fe0c8a138b0c44c22d5f64779994e0161568f14a8d
MD5 45d086ec17b70c732d6ce44a408cab6b
SHA1 e6b61548286dd5fa000a57bd97facd7a3f9dd469
SHA512 b7a05efad2b75e1614d079991943be16ff47211427b8ac57d8e39a7b68f821633beb46cd8630b617849c26ccbce67145021a424fe0035f255e7d19ec46d19f1e
SSDEEP 12288:wfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1964523BF965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4a922babe0ba5a2d9207a8593ec543c11f5aeaaa37bb976f3c252f049f473b5b
MD5 537df9cbe1b5c77e56257f27a9c94449
SHA1 f07b30d48b9cc6c4e958be9edb2ae38868bd2f15
SHA512 687412186a3e508e1fe6e23586e7f084e5333f573fb2ec26f26050ecb4da77bb5522a3959a0d07770005a46f0727281c880e213e1c9316049bd89e329949b4a1
SSDEEP 12288:qiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1324523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4fbab01ba5f204ae13e8303453ad2272628c4c77f0b6a1f139f39bf89d0aef25
MD5 80241bb9c1198962608b81a0a1bd67ce
SHA1 ce913b563ef5d2142867c15478a031af7d1f766d
SHA512 1eee0539c7b28458df5e5a8163b44b7f99d9413096d71daeae14095bbb503a6be66830c2832fa4cd9824ed935a98acab7105c67162f540bd40923f0b38f2ada2
SSDEEP 12288:KQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1634523BE965C41CBE52608B5C3E5F14DEC073E57E9200493BA9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d609e776469833ecc228dea48a651c8d9fb976a3067503783cc3d4927e48a72c
MD5 7e18764acfe7196d5c1d2427141b50f5
SHA1 ca8e6ca429e919839f9ad7130e43132d2a5909b1
SHA512 04b32dc97c4da7899525ea39d31208df1351d098abf19273a363e6a182ca7d7b57660fa3c217450f669fef5eb79c4e1ed7fe6f3a5495aa731faeb8abc3118bbc
SSDEEP 12288:qVlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ysqjnhMgeiCl7G0nehbGZpbD
TLSH
T10C45236B635C00C6D87285B5C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d257e4d78b7b139cdf4f498aee586e508a4bab5b50f17afeb3fadc52e82bb08a
MD5 926251b8cbf9139c84fdba2b0ac8558e
SHA1 cb23d340cfe902f2aa904b1d642dd8531b699d57
SHA512 43542203d362e963e2688e32d472beea01fdd4a664220c96cb434b1279db85835d5423d253cc60dba76e420fc0a44940d161b88500d1f8e7992c099a61a7be36
SSDEEP 12288:ddXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ddsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1054523BE965C41CBE52608B5C3E5F15DEC073E5BE92004837A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 40ed3eb364f233091594ffeb03865006a8c86fc8a7fd6a8c597063eb50a314db
MD5 027d7cf21832f0bee841a3a8f4f9c59d
SHA1 f78af652d238a6f77665d534b15ec877aaf9f163
SHA512 5ebd7d20cbfcec8c95b77fb9c5d96f76a04c103e554383f89e28e9feb301f85d6f67f2f2d06590c2a3cd8d8083552619e8aab34b8f160b5306dc16e55c6fbc74
SSDEEP 12288:OeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A04523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1610e5a38203661767c3d24e0f4faf526334bc9de4fe78450b0f718a6524db2d
MD5 bffd54fb8f3d724c3612690c252a915d
SHA1 c408edea88c86e299b1ce4c09199f46fe8c4c545
SHA512 150b241e81db2d14113f61f7b5f6fefc05c77aa3858dec5c717f60944665b62780f9d23423ed344b624992cd21872a04910b4830fe319610e525fc3969d213e6
SSDEEP 12288:t6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:t6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A4523BE965C41CBE52644B5C3E5F11DAC073E5BE9200483BA67BCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e030e1d551c6aa7a7faed73e82068bf3996e70a65e85f128632bfc8eb9b24182
MD5 96cead19f28c01cda4c91f289d2d36b6
SHA1 f92fa0fb946d38aac00dcebb98a75ebd9ec4e0fc
SHA512 94353e928c209baa8de09241ca3b74acf30ea73e56cbb1a3afc57cf7b2070cf42948b90d9c1f62f420814351484b6036d6eb9ab68e08c066aa87eea5a6a9c58e
SSDEEP 24576:KZMRzFVSOCsqjnhMgeiCl7G0nehbGZpbD:KZMRzfiDmg27RnWGj
TLSH
T1AF6501A9B39018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 03d85c4f689c1b536ebbfc75ff922b70ea800484e2b72259029d3529d86d3731
MD5 07ff5660b3f4ea165aa7dbef4b3c7aa2
SHA1 9f0e06d82943b4ccd02b8159218f5021e6659da0
SHA512 2dfe004956ad4c2f64b6f150ea9a98d49b7801fb3daf1ca345c13759c14c756ebdf0a535af1ff77c65ee6884815c336a032c90663bf891c6a91b8c34dc45a894
SSDEEP 12288:TTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1314523BF965C51CAE52608B5C3E5F11DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 49514109b94c71d44258f5dc4fa9b37917b2ab5dd8764292ecd9258d9cc9c4cd
MD5 50bc5eabce903e1f827ccea3747617d3
SHA1 a865b14d1ee3cf71e7a47a7280e0c431a6af7457
SHA512 61b28c088c15bd886c6be4d9af2483a83d29e5e0128282b86728aa2d3b2cad67b6f3d59bf3a6d3df9b1021bb52cf9c643b48d61e8f31ffbb264664030eb6f2f1
SSDEEP 12288:enXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ensqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE4523BF965C41CAE52604B5C3E5F11DAC073E5BE9200483BA9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c22f59562c04e0d2c0bd5095209c885631e321334b9bf1cc793cb6edbe6155b6
MD5 c70e9c8bcd6d0898462b47f25a9a1214
SHA1 4311776fa048ed7fbca2c8f699e96e8016aed185
SHA512 8ec4e34f9adee7c63bf40acaada3ca4d750a1002254c9c72f6e8be9a688dccbd7badd666df3f01e6554716a42449e826d1219703e91c9a8d138d4f32d1e653db
SSDEEP 12288:HyPz5L8mXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qzymsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD55125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 237afdd035774b2e6ff9dce70c792d4613d45a8206fbd95562666ea9783c0bcd
MD5 0316c28b95878d46a6a10cdad8a5be56
SHA1 2087f6115011de22dbf6336d65ad1fbb7772b6eb
SHA512 b727c845c7a4562c76102776abbc6c8c29be408e20575085a563c79b9667425f4030eda2b59a6aa286b3af0bfc38df12f856ccd2b36fecfdae704b07a83c980a
SSDEEP 12288:ZTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13D4523BF925C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3d4fc9b114984da919966b56b4ecfe4658fa3f141aad57805560bf5ee41acdf0
MD5 fc54e0d3f04e3c6d16f71f7e5428b5dd
SHA1 02b86f8d70d28941e4f4cebbc71df5a16592ebff
SHA512 fa38b34f2c41c392a23835c752809d7eff3857d42a2482e795435b87640be90b1bd53d2dd6b061fb05ae9a576731704705b97d3112adbed7931a1430ee0c27cf
SSDEEP 12288:yTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1484523BF965C51CAE52608B5C3E5F11DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 0619b2cb98235d6f469a4c5562e675f997f4aa9b61c662ae335e69f4f7769e20
MD5 b7888b041f0ed26d9432292fe833609f
SHA1 1ebe9a474da007c04a435adb51a93a0d84262959
SHA512 e052ef5b10867fc5c5a48735819c1f8f81ded735d037a2c4c2cbce778c3e37bbd9c35899785d5fd2401b794e2f5c3d23869f9acc235712f0edca9b7933742c76
SSDEEP 12288:iyPz5L8mXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/zymsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17C55125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 33ef922fdc7b1d783c3edac1beefef4960758a5711aef282cd32b3efc438d4b5
MD5 671db91f3ce2bca6085dd2f3950755ab
SHA1 ab2d16a8184b5f8f3da8c76494a515dc572600ad
SHA512 b42d9fdebe7d523c5b6f6cbdfd78e60844aafb3a5e057d1da3f8fcc1a10e552f21123e22bc001e1da9e6806ec71a170885aab3784bd052e6b3bd7d76d1790387
SSDEEP 24576:bTDaLl3z0zDgsqjnhMgeiCl7G0nehbGZpbD:bTuLljlDmg27RnWGj
TLSH
T1A66501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 6f10e728093759125d1c600ca468fcfda008a5b7a6f6ce0acecccacaa287cb80
MD5 6f824e6fcf8ab0a82fe5c38fd6bcbde9
SHA1 c3afe313434df59a1580b8c20754e2e60d54d95d
SHA512 201200dfba27038b4f3c8db3292f185206325ea15632db2f1f3dd9759d87674817e2cb2410730dc271bf83b1a0c36516443ead1fb2b71e623b9bdb1042941717
SSDEEP 24576:O3vd9CHKy7GZ8sqjnhMgeiCl7G0nehbGZpbD:Qvd9CHKyaiDmg27RnWGj
TLSH
T13175CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 98d8211a403504365cc18b780ff42c31cd09d2bb5da5d39b22be266c76ac1822
MD5 a5dd09d5bc103a7bb6e0a701ba9eef66
SHA1 99abbac43983236bd4e1a10635338e9bf99ef6c9
SHA512 149ecf0f74ce5dbead8cbf1e144af6a86c23fbf6c5b5533e2b4bda5657144b40ebaacce5de710d8cee81444c6950e47b596772d0b7798e0caeb615392ff0c617
SSDEEP 12288:MwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AA4523BE965C41CBE52608B5C3E5F10DEC073E5BE9200483BA977CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 b25e7ffaa1c0db3bac88b508d42e33f9da452fd2eb89c96754edcd997dc113f9
MD5 c13b4edee66f7cb9514b1dbf2b376f8a
SHA1 be278a45e5f951fb9e98559cd4433c400745e066
SHA512 01f8e57b5c23b03ecb52b9949312d1db07bb36da3081041bbe9f6f6d2884720acc100c26ec8e786cee0075bcec7b7d4e56f9ae4a2d83b72acb506228ab0cb151
SSDEEP 12288:CGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F74523BE965C41CBE52644F5C3E9E10DAC073E5BE92004937A977CBAFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 694f84d28856c301a933c8df6007edb7732ace146db0a55676f4daa00d4a0901
MD5 e014066e46b132f8541c51c33b1add83
SHA1 502bd849d372c212681183de946f7d24fc160626
SHA512 e70629598e9bfc30edbd6175cfb1b0419411eb1ca3778ef98a98b87c5537f545f09905f208aa9e7b7f91978f835f1a02b18fbf9ae9c55640728ec86c91b66c40
SSDEEP 12288:qJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA977CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1e5556c1d74adbdb6102a5fcf040fa207cb7b5574873b0278986582d722d0814
MD5 07e4d5938f2e85c1f0d0788736a2c6c3
SHA1 64f5c5b7ca734d4a233b49ff7e56a37b58021956
SHA512 b59b9d4cc40fe8e13182c0a7f1f5f2037fdc652bba875562a226b804832b474f3166b72cbbbb64e3ff846c7da660f9deea2404779e8ee7e1f242ba0e57aa64e3
SSDEEP 12288:pTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C74523BF965C41CAE52608B5C3E5F11DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 fb05507e41b69737f4c0e9f7615eb2a063fec809b8b6f27ea2cb8c498302f11a
MD5 c8ff7f32b008f268cfecf7294aa8b5d5
SHA1 d42cd2a8d68d8b73605af1b5af8d2869393d538e
SHA512 3a9496f0c65c9ee7c06448b8dd7d906fd40f2f7c5ab17f3c41e3fe91318c8fea6d551a696a6496364a529b709fc525bd0e0250b30203f67046acd024a4ee651a
SSDEEP 12288:XbsfjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13655015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cb2d9983c694f860ad1a85d6c1a571bf8e44b84ff470cfc6849e9438dea5f70b
MD5 61255efbeebfc9f5011676fe871c97f2
SHA1 49578351d8ed51a460e7695b423ca0e6458c0a2e
SHA512 bb940d05b399c4b2fab0c853a806cdab88585ca1bf6821525ae8a549f0806ea90cb1359d67e6cac73bef74a2a4a376d988f2c9d1d7d83dea1e6ddae2313c4d5a
SSDEEP 12288:baXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:basqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A245237AD34C518AE57649B482EAF12D680B7E669F2004C3B94378FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 18b892454ec963bc1f47d6834c943efb4fdcf6191ada82a3d49a34bab669d341
MD5 f6419b79c652f49f62bcae9b4e066260
SHA1 e38b1e1a82f17392e99287523bafb30697874d10
SHA512 079204ea00855bdcc62068dfcb23699a4945e4bf8d30da73f9190f6f604b78e81477b842f897c5cb204552ee8468935593c2e0cd522b94de3336b846e352a1d9
SSDEEP 24576:G8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCYsqjnhMgeiCl7G0nehbGZpbD:/RZwQCyiHiQEaiPnMhDmg27RnWGj
TLSH
T1AB85B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 462e00c0f66c3332c980b73be3a2362e4186ce77958aa5ccc20b5b1614f99191
MD5 217ab43507008887e4684fdd07ac1b7c
SHA1 92d87bf78f06a945c1cf86b69ef53021ae50f69b
SHA512 fb1315a550fe5226e89dd018b595aae8dd46047b66a4a13c1ed0480f38bd885e7f5f80d7fcfe00fbf01ba527c10454088d95921645afcb688d3506595f30b714
SSDEEP 12288:PbxA1U7KKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PbxA1UGKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13655123E62AC20E5E176957D86D2C10AD7327C26672053DF21D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 11feab0eb9dee5954049b25da3f14f55a4ee2b5cc84cac891e53828c504514a2
MD5 44393c941e62111cd86b777d573a6cc0
SHA1 deb4e011d710f83a3dbef3e818ba7ec8110383d5
SHA512 80f5ce6462b5a092b5a5e9dda561476a487e4135a74a38f09bb9c73f4e576571c38cb5e3fc5eefd1975d636c9e8935c2cac77a886ff558e46a043007931b45de
SSDEEP 24576:HjsmP0yHaqrVqHra44KDzMsrn/sqjnhMgeiCl7G0nehbGZpbD:HjRP0yHfVqzlAsrnjDmg27RnWGj
TLSH
T16E45AE2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 e48bf5b5d99910ccd83a774e691132626d3f5bfbd4e51cbcef6b756cb8ba2a8c
MD5 aea91cea5330d8b9bcbe5a2a4bb87fa6
SHA1 61baa6aab77e77021d8483a2d9725c94346729d0
SHA512 f06297be02b8fcbf87c8dc33abeb9c3fa143d7862fdd16d40ab0b0d39d6584a234258f01fef5c6ec68d007d25a2f1dff35dfd28f7abe5f3a6c0b15287013e60a
SSDEEP 12288:mQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1334523BE924C51CAE93649B5C3E5E11DA8073E669B2004C379A77CFEE7B54D84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 7fb07e712aece385f39577c5aa4da6da66e843b71d5a9b8135f947c2f4aea87e
MD5 478bb6bc666eaf30a3e73525290666fd
SHA1 dd6fa29c87d22cc888820a92565d9379d0508af4
SHA512 3da0b9795fa97d965d49e37c577f396c7346b9ec9525548dc343622ac4c288384416cab814224d609ef14f0276eeca479f29ea9f0916b02eb3236d8b5fc5c4a2
SSDEEP 12288:kObfA4LWO+vAYFT2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:JbLBUT2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B5750159E7A800F9E87B813CC5A2D616E672785D0720E7DF03A94A691F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 11ed48b5844f284a650399b0cb108359aef9282daf4f9552fbc071e0e5947655
MD5 d689eff9e733f7239847c58b33295630
SHA1 0f0bbfbc48416846430dd27d457186700c31ae78
SHA512 8169e4a9ddb5c23f3fab7896aeb793699bf71f70289cf65cda390bdea1e0daa6bd064fccf4a99c1a9f49e81a7103fc858229b551e23890de894685e0e831917a
SSDEEP 12288:370Vm9IYNvUyBpJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:ApYNH7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B65E12FA2AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9472ad3fc90006854d798ee54cf04ba5f4439fdf6384f16829c4db91ee6af565
MD5 fa802f7e38743dd208d03d9c1fe2be5e
SHA1 97e9226e6de23e8c9c89716b49524af744c137ec
SHA512 03353f2a9729490af5cd1443e599c7a734eb576072dc674d169b2017b49363d0a3fc6f5371e7cefb9bd5351b44273ed03c74b744b785a8bec372f00b70e4c377
SSDEEP 24576:6nXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK7:6nXoJJYH84VVS6AmEOJas+cHBjSSKHPr
TLSH
T12065BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 33e2d15c5dd9df2c48b38edc5239418821e9958a4acf431cdd13823e40982681
MD5 3e1be766ba7419c631bd7f9fcdbf3af5
SHA1 63f6136b7819f1d12bcd8ca183bdee5fad959403
SHA512 42b7690d40404000187c755a229144bdf9393ccdbc04a170707512e1f96755077b8ced634e9039dcaf839e99534ca3f908454f883e9889ebf14dd89ee204f49b
SSDEEP 24576:Rv7Xbxd9Tuycf8M/TYlSuxrr2PChsqjnhMgeiCl7G0nehbGZpbD:RDLL9TuJ0M/TYj2PsDmg27RnWGj
TLSH
T1F6858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 bb125e33db2de3df9e32cced8962fd2e8808d54e07a4a21eee28c533ccdaa8e3
MD5 1cd2c3056a274ba86400227217656b24
SHA1 5292ab135d65b78ed99f253a1d798caaa08cece8
SHA512 a935df483eeea379b2bfc1afcffdc98ff91c41edbb66995cc08a4337e7fcf06c6ab51c19a451265aa8af5492a60e8701020b85493b3333d986e176b404398ed4
SSDEEP 24576:begJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10w2sqjnhMgeiCl7G0nehbGZpbD:bngOJOmPOHz6Dmg27RnWGj
TLSH
T19655CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 7ddbffd475a5e15bf32e88fb4dd76181f2d624c9b0100ea100c847872641c6f7
MD5 6d2c3c78d32a7639783bd465e5f849e3
SHA1 0d4154218b39a7210c2ed96e99f56d9480012872
SHA512 9e69c60428f3266385eb4cfc1b4113b4ccd704086a0bc1d3abc98fd9289f0da11cd0ef91c25da882951007ebecc446e297e8d97f7d58fe04fc2ad4d066364bd0
SSDEEP 24576:GLJnJiTk3R3waE4JrOwsqjnhMgeiCl7G0nehbGZpbD:GLJnJK8R304lzDmg27RnWGj
TLSH
T1BC75E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4eaa6995bd8d5791cada9eb275f3b49946a02c3d680f7e74067ef6325c53783a
MD5 08cffb9579a649cf0416d0b4802aa807
SHA1 18db850370c9366148e31a76e184c8432d89bedd
SHA512 0d84c1a6ca3df4904c351661b2663a6270f497c004575a0fb0049ce6540836478775a15655d2b0ef7998ac5a5509fbd54328a2f33a2090df9516ae37e12d617b
SSDEEP 49152:39mqCzDScAZmlvTcFg8Ph6gDmg27RnWGj:rPD527BWG
TLSH
T1E9955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 9843a06df8e8b9832a63ae0816ddacea5ff8f1a148d4cfd0b975d022c5013e02
MD5 a70d09f31582fc5b34e5df8f07937e38
SHA1 6ed82a8b8c432c5ba6bbf30a64265bfe919c8269
SHA512 54a90476cfce81b8011aa0e6c6b4659db2d96cd551e00cd062342f89d4670b61ba5b16c29d1a59fafe22ac8e3e8786bdf78dd1b815c0f62892e2aa58e5a29345
SSDEEP 24576:glYJeXm5jUuEesqjnhMgeiCl7G0nehbGZpbD:glYJeXmRUuEyDmg27RnWGj
TLSH
T1705512AE769C30E5E12A8079C2E2C508E633B876671017EF55E0D5BE9F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 42172b530574b302d1eba3ce8d7c34548d1e2ff5b9dcebb0505104cc70a9e9a9
MD5 33e7fc0a9cdfbe1d6b6668bb0d28ac66
SHA1 e0ffaf6843beea410635fce4c3bd82a12a6a26ce
SHA512 964f66b71c3e33983a369aeb08ee1a8d75caf9c52d6eb14f93c91e591296e63944d00008bac63c5968f7852cad43c47889aed09e422ab7a3e2ed22a53fca6ce9
SSDEEP 12288:+mu6kyfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+7tyfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T121552219639860D9EA760978C6B3C158DC367C219F2002DF65E1FA3FAF726D48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 ef73e1a64d9d50d9089c2514457b1a836dcf61a49ce9d86333d6b64e1744e448
MD5 2053140b491cc3f70965efc2ceafa0a3
SHA1 1c9a131eb1d9fb37f449d6e4c024c72de08856c8
SHA512 508812eb0fba66d6e3f9893d5806bce26a460f20049a5cda4eb198ce4423790f99e111c2633af0e093fd5486c9bca360f6e0308f1a5f9b610acf6b0bf492a343
SSDEEP 12288:fP2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:X2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19545237E525C60CAD93245B4C2A5E10DA8173E76AB2014E779E3F8BDEBB64D44B38813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 17205b7ecd6f288225e2aaf4b54b00a6fe5ad2c61bcd6c769c1f67a1076a5f30
MD5 9fdd759f2467122f94ae3b37bed6a841
SHA1 0a189315faeca71fff0618fcfb1643a50a7af89c
SHA512 21af13d7485881e4392a34f919e34130886fc38b75499223a6c238b6a86589ff3e9852d64df96a8e29873d63024ad758816ad9a99c34a39e89fb0d0135bbc62c
SSDEEP 24576:KC+TyQIu93VAumZr7jmVsqjnhMgeiCl7G0nehbGZpbD:K/TfIq+YJDmg27RnWGj
TLSH
T19E558D2DA7F919CAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 fc4a770135e27d155d3afcaf379b37c345cc23b822facab799bcd5af32680c91
MD5 58c6d365574c82e0839ba4ab98c75651
SHA1 49bf1e05362f088ff182db7ad496df5f077a9d23
SHA512 c1a3e113b57037d28aa1fc6b5b179c1cb42efd5957c6273d4e0d33d416aeef948b6f250b93e60db187fe21ffae4ce796737287887d4a70ab28c8854ff637570c
SSDEEP 12288:mcyrWOstaa3kcsyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:/LQikZysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C865F11FB3AE00A5E0A7817CC8858116FA737875571163DF02A1CB7D5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 74ae66c66bbb9c21e3400f0b5111e01fc534309597f557b2f5338d790c45f5a2
MD5 8d78b24088c180e989bcee14852f602f
SHA1 b1cbdf4351653bcc9430678902901bc232af8ad5
SHA512 dc0bd7fa79850e74bed2ce29ea9e87300b0ef86e98da53c4dc1610271962b14ea2c682ab24159e259a10fb9317425b281e6888e9c1ba6d4e7462deda77e544e1
SSDEEP 49152:MpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPDDmg27RnWm:NpC7b4+80GTkYD527BWG
TLSH
T177A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/332-310-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/332-308-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/332-302-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/332-520-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/332-530-0x0000000000CF0000-0x0000000000D9E000-memory.dmp

Download

memory/424-71-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/424-73-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/424-69-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/424-50-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/424-56-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/444-61-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/444-67-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/444-70-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/488-230-0x0000000000CA0000-0x0000000000D4E000-memory.dmp

Download

memory/488-12-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/488-18-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/488-20-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/488-195-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/488-226-0x0000000000CA0000-0x0000000000D4E000-memory.dmp

Download

memory/1080-421-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1080-415-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1080-606-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1080-534-0x0000000000C40000-0x0000000000CEE000-memory.dmp

Download

memory/1080-476-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2220-360-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2220-366-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2220-445-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2328-47-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2328-227-0x0000000000DE0000-0x0000000000E8E000-memory.dmp

Download

memory/2328-45-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2328-39-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2328-225-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2552-535-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2552-351-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2552-348-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2552-355-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2844-479-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/2844-432-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2844-426-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2844-477-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2844-511-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/2844-607-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2844-495-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3228-313-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3228-521-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3228-526-0x0000000000C30000-0x0000000000CDE000-memory.dmp

Download

memory/3228-319-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3228-524-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3228-332-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3228-527-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3248-518-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/3248-285-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/3248-287-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3248-292-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3360-538-0x0000023A11D90000-0x0000023A11DA0000-memory.dmp

Download

memory/3360-537-0x0000023A11D90000-0x0000023A11DA0000-memory.dmp

Download

memory/3360-536-0x0000023A11D90000-0x0000023A11DA0000-memory.dmp

Download

memory/3400-8-0x0000000000C50000-0x0000000000CB7000-memory.dmp

Download

memory/3400-24-0x0000000000400000-0x00000000005EF000-memory.dmp

Download

memory/3400-0-0x0000000000400000-0x00000000005EF000-memory.dmp

Download

memory/3400-1-0x0000000000C50000-0x0000000000CB7000-memory.dmp

Download

memory/3564-381-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/3564-383-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3564-378-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/3932-299-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3932-519-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3936-27-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/3936-36-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/3936-224-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3936-35-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4476-475-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4476-405-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4476-411-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4912-330-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4912-324-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4912-333-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5236-522-0x0000000000C00000-0x0000000000CAE000-memory.dmp

Download

memory/5236-246-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5236-252-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5236-370-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5236-254-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5408-528-0x000001B6D0740000-0x000001B6D07EE000-memory.dmp

Download

memory/5556-272-0x0000000001610000-0x00000000016FA000-memory.dmp

Download

memory/5556-273-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5556-257-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5556-258-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/5556-264-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/5556-270-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/5868-342-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5868-336-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5868-344-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5868-531-0x0000000000C80000-0x0000000000D2E000-memory.dmp

Download

memory/5868-523-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5936-274-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5936-513-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/5936-269-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/5936-280-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5936-529-0x0000000000700000-0x00000000007AE000-memory.dmp

Download

memory/5984-532-0x00000000006E0000-0x000000000078E000-memory.dmp

Download

memory/5984-385-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5984-391-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5984-478-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/6120-533-0x0000000000CE0000-0x0000000000D8E000-memory.dmp

Download

memory/6120-446-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/6120-395-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/6120-401-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/6120-605-0x0000000140000000-0x00000001401F6000-memory.dmp

Download