8fe2500a5654577d2728e3d04eae6002da2979a1fca9fba715f0d4d1ea09ff65

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_ae2f02c4690b5e7e60e6023ccfb0974d_amadey_elex_stop.exe
Size 1.4MB
Sample260604-tnelpsbt2p
SHA256 8fe2500a5654577d2728e3d04eae6002da2979a1fca9fba715f0d4d1ea09ff65
MD5 ae2f02c4690b5e7e60e6023ccfb0974d
SHA1 e4ccb1934562edc13c285efee12276f6b70e392d
SHA512 920d1a94f66bc2d2133e47a8922dcf206ae23dbeb4adc5afa2832d90935513909f078d3e236cd5e3da29a1f5d2283e4e648f320af2595383be1afb5c03d6afa8
SSDEEP 24576:FqLaCKP6MLsqjnhMgeiCl7G0nehbGZpbD:Fq2dNDmg27RnWGj
TLSH
T18A65F1217BD58072E9B62E3509BAE209593FB9205B3485CB638D2D6E5F737E08D30367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4452	alg.exe
3480	elevation_service.exe
1840	elevation_service.exe
1536	maintenanceservice.exe
2536	OSE.EXE
1868	DiagnosticsHub.StandardCollector.Service.exe
1716	fxssvc.exe
2996	msdtc.exe
4552	PerceptionSimulationService.exe
4120	perfhost.exe
3288	locator.exe
1604	SensorDataService.exe
3508	snmptrap.exe
1220	spectrum.exe
3912	ssh-agent.exe
436	TieringEngineService.exe
4060	AgentService.exe
5016	vds.exe
1912	vssvc.exe
2260	wbengine.exe
2472	WmiApSrv.exe
3868	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4daae376fe8d2f74.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-04_ae2f02c4690b5e7e60e6023ccfb0974d_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_175984\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_175984\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_ae2f02c4690b5e7e60e6023ccfb0974d_amadey_elex_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080787f163df4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000852971163df4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff2d14163df4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053ae0a163df4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc016a163df4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f93d46163df4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3480	elevation_service.exe
3480	elevation_service.exe
3480	elevation_service.exe
3480	elevation_service.exe
3480	elevation_service.exe
3480	elevation_service.exe
3480	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3880	2026-06-04_ae2f02c4690b5e7e60e6023ccfb0974d_amadey_elex_stop.exe
Token: SeDebugPrivilege	4452	alg.exe
Token: SeDebugPrivilege	4452	alg.exe
Token: SeDebugPrivilege	4452	alg.exe
Token: SeTakeOwnershipPrivilege	3480	elevation_service.exe
Token: SeAuditPrivilege	1716	fxssvc.exe
Token: SeRestorePrivilege	436	TieringEngineService.exe
Token: SeManageVolumePrivilege	436	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4060	AgentService.exe
Token: SeBackupPrivilege	1912	vssvc.exe
Token: SeRestorePrivilege	1912	vssvc.exe
Token: SeAuditPrivilege	1912	vssvc.exe
Token: SeBackupPrivilege	2260	wbengine.exe
Token: SeRestorePrivilege	2260	wbengine.exe
Token: SeSecurityPrivilege	2260	wbengine.exe
Token: 33	3868	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3868	SearchIndexer.exe
Token: SeDebugPrivilege	3480	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 1804	3868	SearchIndexer.exe	107
PID 3868 wrote to memory of 2108	3868	SearchIndexer.exe	108
PID 3868 wrote to memory of 1336	3868	SearchIndexer.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-04_ae2f02c4690b5e7e60e6023ccfb0974d_amadey_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_ae2f02c4690b5e7e60e6023ccfb0974d_amadey_elex_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3880

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1840

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1536

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2536

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1868

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1932

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2996

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4552

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4120

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3288

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1604

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3508

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1220

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4148

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:436

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4060

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5016

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2472

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1804
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2876 2832 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2108
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2920 2916 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a6e072979888592e70b911208491e7839f558fac3d67c6e9d9addc7c774925d5
MD5 5ac6b014a1c4632b568fa1949d990ce8
SHA1 d175b4f627d26f5e84ee1a69092db573b4a4efd6
SHA512 6bb4d15f481591ab81ffae74b2f828086d28be9b7bdec92792c7d0bd2ca64b547f0236cea605511500f73a734abf12946302a44cfa89afdf620c51d0d66a349a
SSDEEP 49152:Zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnKDmg27RnWGj:v3q6sjBhD527BWG
TLSH
T11ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d7401530b0fe63d121cc8d114d125760c0349af92f7d13b4174768c138ab8abc
MD5 74cd251547ea8ff858d6d407b38eddad
SHA1 ad7d593a5fe66c3752977367f88ba4805db2c7d2
SHA512 e2673381d0f4241b3f608d77bc91b909ae6fa07de1eb8ec750077570e5be1f11a5bcdb060dd25682821034cf59c220f8b115fea10cf13bfb3105f57557051eaf
SSDEEP 24576:gXYfDtczAhsqjnhMgeiCl7G0nehbGZpbD:XtcYDmg27RnWGj
TLSH
T1EA65F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 803d6f09050eabc2a9846eeab0f199ac1aa4a35f386f4910b5e10c4a2111d7ee
MD5 72fe05463136ff6243a7bed77385fef5
SHA1 2cb0e70cbe4a5b0d8e4ec8f234bb8ef829ea8cde
SHA512 e08ea5a395d28f202d6ff87d0df42810b5473e3b7a1df6448b3a6f5171c5e95276053f3bc3faea28067ab22da0ef9f437a1c00b2492187f4f7935e95095d895f
SSDEEP 24576:T0Le5ji0hmxxrMusqjnhMgeiCl7G0nehbGZpbD:TPji0AjHDmg27RnWGj
TLSH
T159859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c6fe65725dd9a93a4d14c03ef284c9465376e729b77105f45c7fb9372878b7f8
MD5 b13ffcc7fa30cfd79c8396b0dc6c6a8a
SHA1 db2e4c7b65d87354ba3ea9bc657b51314f03a7ef
SHA512 0661a9db7f73c06632edc3632985c30796b926718ee5a743cd80720b2e6d487e874822533bf7b9a1f44ced026fa8228070ad93793bd77f14277f5841f89ea7b7
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWn6q8wyu8sqjnhMgeiCl7G0nehbGZpbD:n/ezSC6vUzPveHjy7Dmg27RnWGj
TLSH
T1A8755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d141650352b492223a81ff67fb4c830d534abf98c99368231a32638ce4c8d5bb
MD5 d4b5bd29a6f5ae40d246cea2bc3fb757
SHA1 e7ff50e490a414ab1dd60d70044156cb9a3add48
SHA512 184a29b791beaeaa99ca3ecd418f4f0b5069b9af1b6e3f32392b184cbc564511562806307681ef65ff5f74f4f332523b4334112903496a9d51516ad0299e0ec3
SSDEEP 24576:ZVbqPb88hv/l+YNsqjnhMgeiCl7G0nehbGZpbD:ZVO88hXl+QDmg27RnWGj
TLSH
T16B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 03998e4db3f35f5cd4dd02675073eeed824fdbb0011802697918e1be2f3ac635
MD5 1374ad41f1ab4c9023fbbc09be8007b3
SHA1 b87509ea3a9ff9d8fe12462686305b483449eca1
SHA512 ef556165206044992d50bfda63ec879ecbcb7991e82b7d398c313f57f8dc247bd0e8a87e8e4e70259d4be9e709272c69cbed1c00fc1ddf0aca781382601ec530
SSDEEP 12288:eLaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eLasqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E4523BF864C50DAEB7608B5C3E9F11EAC137E56982008536A637CFEE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 d15c3e3ecb72781da05dbd3cd1eae3c18d48f1390b527b54fd1a270b85067c7a
MD5 fff1e3b01318dfbdd8328d05e751e73c
SHA1 eb2ce66b25d68cd760667e5719758fa61e87b8e5
SHA512 2cb5c8b792bb400c030c564f13db3068048a06dddeeed67a41a9d87314888dcd45930fe820f08b14ef93938ecfee4e39b450fe241cf3ce9544c2b7354e01daff
SSDEEP 12288:7eBNUbTVO86UVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:7JIUVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A565CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4bfcfaf6eaa9e8e31d5ab31b22fbff978dffbc0de8cc55070af1cce04603c3bc
MD5 d540f768d7a984535eebfcda05172a51
SHA1 2231e28392c0307dfa13fd032943914838d404ec
SHA512 38d5b8ef573c6e31034002521917a29aaabb8347a033ad3f33a5211cc980e7b6023dafbe29bbf944f9bac57ba23edd4cefbb3f9ad30f0f7eba04fc7227f136d0
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THc:jQvGAdlCEL8c/DRNw5C4D527BWG
TLSH
T14E266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c27f2571b8b9df02bdb3025888a6a92d585f39fa3fc7bfe7b34ad46045189e5f
MD5 9b7eee948abd84901e1288421da35f07
SHA1 63d03eb1a18ab904ffdcb1fe5927b01728b6fbbe
SHA512 10a7865bf31d688f5bd9272aaa9cedb505eccb29360d620e06314fe130e1aefb5653d9ce83fb240495d6af9a6945aa5d3a22a5a24cdb29b27210801867666b18
SSDEEP 12288:vAwSfxL/2Dc3RDLLmt0LDQewsAjTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:40ewsAjTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11775E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 46e5fcdb7144f56e9a896cc5dcf1cf0db0ddff4dc24036a2950921f5d96b94c8
MD5 0f68efe04b98358546233f3638093473
SHA1 567f2d3b9ade83ce079242627ac97c37a6702f16
SHA512 536503cc4181d59ab3b651db97fbb9583992bfa0d337e7d0d4d3596452d2afde9944e9710b662f7c1b8571364007abfcb9bb2c72834f0ba1207d3e6ffe5f905e
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH/VQBWG:kUEtQevvqc2W1cpV2tI322B
TLSH
T16B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0c9cb685383189b1b533332c5d139a8e0e0fc6c101545d4871d1bd72ba684293
MD5 26cd64d7e6b6f8eb140089b2afef0dcf
SHA1 e6bcf232ae307ece6f74765e8c42ac6158881d64
SHA512 9dcd228e41393ee0dc8eb5dd18edc51a69305135ff756530ab4289799d893162b7a2ed084f467a14e8583bc0f4d4f834de328977ff0e0915549504479b1e3634
SSDEEP 49152:ZCbRquA/m2yL5zTfFiV+XenmE3/z3Dmg27RnWGj:2oquVjnm8D527BWG
TLSH
T191D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e3afca8135a621d732fcf0a16ba844815844e3ac9a48679cde985e940dc54bcf
MD5 dd85b95f693cd5b64497494fb8e7f9ae
SHA1 ef5d71e2b0e4192241a4ec1bf3d645572b72f157
SHA512 95ef5a91b5eee560ded94444e48facf0e016c5fd2e330b9ab09ede99f304f5af042fd53feb9bd8e5bf16a94f04d9239c8bc5cb1819e33cbbf74a5c16ded2781e
SSDEEP 24576:XAhGL3IFoiwtA5l7S53gsqjnhMgeiCl7G0nehbGZpbD:XAMUFoiq5MDmg27RnWGj
TLSH
T17D359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 cf60768f8c01d4e9aa93163fe2fcdfd041a8f45bb32f74cfd96978e78d3fb2dc
MD5 a4f71b56b4ed7c067a6456a8032c98c6
SHA1 4b9fcc79517f874c122bda67c916e81c00550247
SHA512 2c455393a70e1b3aaefb32ef351f8e1884cc6a7d23ea9133a4db2b8540e5569c1d45afce8e9153adc610e7c1c7c02c30789c3bdf648cfdca72e2e98a064521f1
SSDEEP 12288:tmw5HEjsChNVBFgl0WDm+CcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Iwu4OWHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD65F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 25ee8816982b5b913ccf45944a1d73e90607cba2846d59af5758c79d248ddb7e
MD5 7f4efd0a32fbf195e0eac98ce0705e86
SHA1 a24754e3f1fe9b183ede17799be522328b7bff01
SHA512 59aa1e5ef04015a2bea5978aa00b449d3a12675d87c65c3df1e99a78ad6881174e9b2a6e931988c6ad996a361e0871d5d7111054f2dcaeedd13b9a6eac9ab132
SSDEEP 12288:zeZ1IyjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iZuWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA5512AA239820FAE163417CC5E5D609E7337C62673003CF166659AA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 568a9ad32e5267ccf211436f73f7b0844835ab99d0b178770badeaba2d668c3b
MD5 8d830a69436d670fa554fffd7751c8af
SHA1 d4121df8eeadc94204413f98d2eb15adb31abbb6
SHA512 3a980aa901c9e54216cd18ac3226c58f962d603ee4659104e79cfc551e628244368005af24371554a3ee9ac06f1019553eb35e5765c4dde68ac08bf9c37b9473
SSDEEP 98304:yQRQyi36YOcPbLvw2gAf+PN3ND527BWG:pQyiKa/X+PN9VQBWG
TLSH
T1C8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d6852566482d04b3112c6a39d39b738554d11a53b994d39510b8d1301f189d07
MD5 2cd491938cfd93f1cc95ce7ffe126b4f
SHA1 078fb1a2524ed6c40acf5fb913e40b30206b641d
SHA512 5c153e39e3bc61e5a197db573abbacb2391217ce55c87e2d72d03d2f80092a63c90aff36892bca8712cce4f428d1c339bb931cb5ddd3bd33a327ae4bef263bdd
SSDEEP 98304:3QRQyi36YOcPbLvw2gAf+PN3ND527BWG:mQyiKa/X+PN9VQBWG
TLSH
T1A6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2d6fb119aad7d362fb2067cf7c096ee737ad5dfafe71b036a66b8e797180bf0f
MD5 445f865f2172e0ac96e02e010464216b
SHA1 fbf84a025638dbf148a5bd073c7f8249fab852f8
SHA512 f17c1edaafece118801d5d09c27667d64918466eda41c53a6628197b6a16655e83a3dff3d66d4997ab9a9eebbfff1b014ee524d8b7bea1b2ca4b6de7c4a6dc29
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0GsqjnhMgeiCl7Ge:968Qg55nhceWu7PNU3/HDmg27RnWGj
TLSH
T109B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7fde4644b4379230c639cc3357e9e7fc8410ed0392779b19f67b5cac0198d6d6
MD5 39fca1e50d505c87b1d227e20f6a7028
SHA1 3d619d7fb76e33433e96a07e9f41cf3ae68dfa6b
SHA512 472096a340378edbe65b7de2d5bd2b5c8ca298c93ee38b9716af21a20277960923f05135051eef21bc7379cd9758e57a2d12634bdb97680848a3f660f29b6331
SSDEEP 98304:py5112gYy5azzVvt69nLKnhZuD527BWG:ELIHEWhkVQBWG
TLSH
T183167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 be773ef082fd08fe342501a02c944ab6eacf0282bf0a9efd71f04b4aa3143d38
MD5 474020e3a11c12ea3578273cb1b4cbcf
SHA1 206300e208633f7f144e4b3dae108aeb4e7ce87c
SHA512 0f5033c0935bb0f1cd5b2b4464494425846c988be14a3e0be0df59658251226bbd574c6a1edc7f037b562a0956e8c97d8b33175ac5fcf2cf54f9ee72519b2e95
SSDEEP 49152:SB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gllDmg27RnWGj:gu6Jmdxd2dlD527BWG
TLSH
T107D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bddbd0c1f33efebf34d0bf10fad742cabe64346186ac78a7105bd5209a221bae
MD5 180b3b1898ce8d3b611916633131b991
SHA1 35bc41dd0494c3e755fb4add2c7b406415d51507
SHA512 d70c4e1945809d18788c81cc918012baa8997414b89909e1d0faabca40b70f9a23e4cc2b4a0b6e49cbd01f0efda9ef46ba88ddde35749be57fcae63012d375af
SSDEEP 49152:S1hpsNoJpF1A63U44CwH7R4xpDmg27RnWGj:SmifPWR8D527BWG
TLSH
T18FB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0125e046356a43629068fda6c434dc23399075fa9b88d06e68611fa5a6eccc4f
MD5 e037a8ecdbd2c23e43c7abccbea138cb
SHA1 a72c326aeb38a13e372c3b9c741e387c098301d5
SHA512 fbb00451b66464966d10f23a69dc56a48e699a603615fb2af1616ac106bb8cc15b40d259414a7b6164f6d401c02f66b140ca594bbcb9baf83a840452b3bb9d19
SSDEEP 49152:6SuZQIY0Be2KcRVtOnks6NMHqaDmg27RnWGj:k5dKii61aD527BWG
TLSH
T1BDC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bec62206da07b21b18939306c2bdfa960e6d889e70f37a44909ff0aec703d575
MD5 bb3560420d6a931e14524f49b81cbc41
SHA1 540cd5f531d73eb5339a3ff94e9e5848b9d1c256
SHA512 b193eb4ec95790cce5a3c34b8875e8a30d4b00f95bbf29b5ca9743fe8580ffc5e693066b03302af676c20f689eb2388b53d59abea0dcca11b4c3ff41e5cf460c
SSDEEP 49152:BhtSn8EApI0fig3giDn0AP5w1Dmg27RnWGj:QX2imphgD527BWG
TLSH
T1D795BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 66599cbd4b5335a486f798fe7c4c55c06b4cfe1240e715d1884f0cb8261533b3
MD5 4d2e21e3156127b12efc1d85752f2c25
SHA1 ca0bca1bf2254faf8dc7493911a2216eefaf8052
SHA512 3202ca3e063e7e0e1c7b4d125136d4d90fe03dc86d16cd084075c1dee6649a9e1a41ba4618cbc01ec1c901ad1f9a9244a46dba0ca22353a049e20c73e000d04a
SSDEEP 12288:5CXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5CsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A4523BE965C41CBE52648B5C3E5F10EAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9069d1ba8ab96bc197eeefa9f9b44ba701f9c67cf62b42e701152d0798ec66dc
MD5 2c0a9769f6842b38c857ef2ebc247bb5
SHA1 d6f1e194d480c62d008f89dfa2169c380e8637de
SHA512 222328f86bc8e0d796b99946ce67874b42fb2b2f59f0bd504d99fd8fc741e6a659c3c2a8d22286ee43f7c7d535f1a2cc0a6a1156585685e21d932f11cf5309ad
SSDEEP 12288:GfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1034523BE965C41CBE52648B5C3E5F10DAC073E57E92004937A97BCBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b1357fc1951320580b8ea0ed191a73eb2fab9c258e8d2858e8ed9e2797ac0a83
MD5 6f072747760587c1026025786667e719
SHA1 a0d0a79c2797badb10c38b78fe5a1025db57efd9
SHA512 a46edea3d07947b4c77ad639b073c6be9bd4e4fbc9bbb1bfe7c79dc5c4eeae3f4783e954236a3861389083a09af3d953e65d9ae8bd77f62fede5961f147d5958
SSDEEP 12288:R9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:R9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1834523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 09829aa4b5c752b0996041fd0deebe5b2a1f83456b84f25b74a2fd1120e0ce61
MD5 ae74b7870b108424e142e73150f9fe4b
SHA1 726098a9ea24d62cedf847411d4e5303633ad43c
SHA512 1bdfa9c63b73969fb4eecade0194c98781ca23f32a4f1af843b1451db48a326b2f1916d3ad14f5a640bd9b368971e7d2e227f2c2e2b084339ff4f97081cdcb56
SSDEEP 12288:ZVAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16745236B675C00C6D83285B5C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 952db7bbb7ec333452665e48a12472f52143163082253d671f68a1bc71860207
MD5 dbf9a7cad10f01309111256cafd7d9e4
SHA1 d1d54d4c6f0ce60e40342848c724843d9b472be8
SHA512 e568b43fcf5966e217541a798de7fc21726eb754bee121e8c8fb797580f0d67f83a6efe2e3f1d3cc9cd54d107af8019563247c3557039b459d255bc069988a12
SSDEEP 12288:iYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C34523BE965C41CBE52608B5C3E5F14DAC073E5BE9200483BA9B7CB9FBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1274386c6efe36e1daef7168bcb96c33ed5825263608be2d22838ae70623c015
MD5 b109314b7967ff4739a12207bb5d22b5
SHA1 3a0ba02d6378f823e2111f2937632149204d5c6e
SHA512 c2cf9227f6a8646b3ff192549c20a98ae528682007f335c1ae14386fee8a635b49294ab13d058842b432d62ae3daec55fd09793eb086d85030b771d9710c838f
SSDEEP 12288:ibXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ibsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1224523BE965C41CBE52648B5C3E5F14DAC073E6BE92004837A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7169eaac9f274acb4231b9fc835ee93b9a0d587ec69d052215ba1995e9e13583
MD5 78961ee05f6c9b8488916a8dc21ae400
SHA1 bda01dee2e825fccba4dd0a30eab5b141894ed95
SHA512 e0189492bbc488192fbb19decfc41067a0bca9ea28eaaf6ae5be3074f2cd04d0ce072ddee27d94358d678c5e39cea78d2723235eb7fa3ec3b36b70d3c1cfa595
SSDEEP 12288:63Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:63sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A54523BE965C41CBE52644B5C3E5F11DAC073E5BE92004837A57BCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 0aec1d21ebf8d856f9aee8025dadfe7db841b38bbe3fc59ac5f21702b1fa9bcc
MD5 0d1d236dd09f9632e98ec3151324fad6
SHA1 e41fecacd27df5a5b036f656a125100397e32ba5
SHA512 903ae5d1cb7102369c207c9a3338f1e67b8da65c32907cd4b31feebd07632155bd2ab777dce402df37b69168b22ac717c58de06b21146bae9f0abedf6e15bd59
SSDEEP 24576:UZMRzFVSO/sqjnhMgeiCl7G0nehbGZpbD:UZMRzffDmg27RnWGj
TLSH
T1E36501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1831354790ea676c23bdfff592ecb34ed25da9d0759adcf369bfdfc8550c3ec6
MD5 6fc5e80c9c832e4f889b65e3d5c9bff4
SHA1 a691204fec431367d35d08bc81ed9f6e7de61b30
SHA512 ef8b722829b3a70b40601d82d063d61b2b19526cdd993efa97d93aade7c100d95527e984c0aa5fc7f112be482361837c650a38e1c4497fa08538eafc931e9a39
SSDEEP 12288:amXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:amsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B24523BE965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 cd9b5ab8bec7a144e7b036e25223d7221e10c19ff77f80d6ef1708dc4607b3d6
MD5 a44975360ceb4c36286f397abdff9f6e
SHA1 c2f537db8e5fc11b505b7e6a35078d04f9a1d4da
SHA512 6acd5afea751a05950735fcae2be70f931a3e3b9a771c1e7ccf004750aaca55c9766cf487d82071903eb80d5c25a8ddc6c4ed6f158828370bb0c67f41e4ed9c0
SSDEEP 12288:QqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BF4523BF955C41CAE52604B5C3E5F14DAC173E6BE9200483BA9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4f9f0d27325b7a2f9f463e796c3fc119ceb3a9a61e42d836f072af5835ca771e
MD5 4f5e4d1057ff03e4c500a160e14f4b9a
SHA1 cebbb3ed8c81368481a2c3b50f95c45de3790289
SHA512 ebc62b7c38e86cc1a630b51a2a610b475a51f0755c68d43c37263aeff1a2621f2a2624577394eb210847a20ce23e2e5a1f35f41b0b694462e088fe1f9edb8930
SSDEEP 12288:8yPz5L8jXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lzyjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB55125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 223066f6c5b1cd1e0ddd00a89605b863dd9cd400cdbc41322fdbe91845170702
MD5 3afa24692d96b05a9972e9b51428b100
SHA1 4df2970f8b2b769610df77f4103207072c3dd620
SHA512 72cce82ba8959028b90befeef7e898d5b8522fc82021586c7058451d36f8693b5f6df45397bac38c71b136ce917aac448e19a45118672b5da04dfb5be9fde6d8
SSDEEP 12288:dmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d2219160083e4042a611c0962e43db27adf18eb6d01f77c46a0a31495c4c6e1d
MD5 5a22d59420fa082abef90a890eff71ec
SHA1 b8f52986fcb9de35f34291bc43cfe6528da58aa9
SHA512 e1d520c51edd7983400d264ff11800a6d2d706a6617cfc793bb0af1fd023fe483dbecc4992d94fc4d14eddf3f0c3422c3047fd264d3d14c05dcf17e70ffd4553
SSDEEP 12288:KmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1374523BF955C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 c5460d56414aaa69e8fdeceec0c80216ac7b68af3cffd1bc625d80f01f771da8
MD5 77e41d627db55017eef2bce702f7f433
SHA1 1d76bf4c2b7ae59f58bb8a5c1a616ee691f18f26
SHA512 af76422e7428630de5a8d5560df0c0ab06bab5526406b1a75a70e1d64e6dc241b29655e12069441a2045994bba1aaf69e4fdae384c21bed00dd87db0828b53ec
SSDEEP 12288:OyPz5L8jXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TzyjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16155125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 8943c22fa09e73bb4e9887b98d20aab12f73304cd3c0d38078687c15c42b7603
MD5 fbd2f9585b9a7d93caba9d77293af286
SHA1 867bbfdd830fb15bb551910c98955f41dd5c7d6a
SHA512 84fdf655cd906f83153efef140cea1db5d6156f7c727dbbd4daeab66b4c25f97f31703523ca5cd3a5d569582f3f73e538d019cb87ec4163f2cd9e8e29060ab79
SSDEEP 24576:ATDaLl3z0zDtsqjnhMgeiCl7G0nehbGZpbD:ATuLljoDmg27RnWGj
TLSH
T1916501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 85bca263245381b394839a989db9fab92b942c10dc99606507a431dbb04bbd7f
MD5 387e1e47839468bde81e949d08d49341
SHA1 5d6fefbb44c6f3571c8a6012c3d6004e81169b48
SHA512 034148fb705406feba282bc6ce81a06ea7da8bf70c29eba1c9fb685b0f4942aafd8b45acadce3c2f86c75b88de7f97558f0fc23e4be7e10b70055bb1c876566a
SSDEEP 24576:Q3vd9CHKy7GZpsqjnhMgeiCl7G0nehbGZpbD:avd9CHKyafDmg27RnWGj
TLSH
T12575CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 7bb4e547a7a7b6632782ac8d1d4946694c0bf14c6f1f6c8cfd7e2a5e0bb30985
MD5 c8f97d564a409deecc0133f1fa15287a
SHA1 c37e1923ff0473fd65ebd13df2315b6f10510329
SHA512 d82e4c933570cf7a5099c148e31ed77d0d9de21475260467dc2ca6dede16c0a877e4cc9b472b2ca9ba6ead215e9c4c960eda652de9cbeddb92b551dff69f173d
SSDEEP 12288:odXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:odsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1044523BE955C41CBE52608B5C3E5F14DAC073E67E9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9d911fc5b7a70f548b046d97c50a78ec17cd45808b54b36e7b7a95f862d16ac5
MD5 e74cbe637e25cd2f04486dea8b18c4b8
SHA1 a830247e1da86a3f4099b946de0ec26800255dd7
SHA512 357fdd8472e482fab50d8fce2834e4f670613d77fe7c4574fd6765b8507d38f7653fb7a72e90a5236ab81da1a798c5f3a49972eac90de189ff48fb94f57b6f73
SSDEEP 12288:6DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6DsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F4523BE965C41DBE52644F5C3E9E10DAC073E6BE92004837A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 da05c81686f2c199632537c99cc27f59267318f732f487f37f5007b5bbf2d5ba
MD5 85f798a9bdf4322fff78601f94621d39
SHA1 d15d26947c4fb7f7522483721fa09613a054b00f
SHA512 b4ee28dd1a2486adf55fc2553d9e50a8346ad506c90bdaaab727d7f00bd00850febffb998447c97c0a49c2f3ed634177ead0e076c790ca645f6be0d35ec3ff7f
SSDEEP 12288:NUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E14523BF965C41CAE52608B5C3E5E14DAC073E5BE9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a34db5250ef4cc566f17d6ffdd1a9215438a8716553c11061b439c802d12d49c
MD5 68ff4cb8652483d7750a63e8b8bcda35
SHA1 71ee42471d938b04d5b2a8b02c6df6def362c773
SHA512 d8e2bd7a1e72ba1873f8a76587c6d4f6d56cb3d063c185c6189f7cc4f14f73a2492d51b7b86cf55516cb6c7c49ff7ab1f3d0579a5d9a74c45022bddb7ec9b682
SSDEEP 12288:amXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:amsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 5c21100e997f3dfeed187170097d2d4af47c19ef43a36d2e2adddb1986844c07
MD5 b210822b8a6638cf9a3c2d569b5b722a
SHA1 cd6190fdb01cd8a039444cab6b116e2c58515d4f
SHA512 0c749e8edce96446c00d7c77f76132eb69729c1deef7bc9404416beaf000b59c28a55aa6aad40f43343003ccf7d6a52b9f065906c444576c12c5e16433aaff02
SSDEEP 12288:lbsfWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17855011AD29802D9C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c87c4374bdcaa01682f7a7a3edfdf088ae33039c2738b7c024004eaa2c30a572
MD5 239dc74ca97400641b082edeb353b8e0
SHA1 b17c767d48d62d8461acf1504ab42e0204033f97
SHA512 1779869ff96fc4924856c199763e351ee6ce98f427e2ce11a9da33d693e17f98524b7936085a3742d5e5abb1a9ad380b53631cf446fdfe02617575cdbf6c34d8
SSDEEP 12288:TPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16245237AD34C518AE57609B482EAF12D681B7E6A9F2004C3B94738FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 9c348a2ccf7a89ee35cc17085cb9c2d520d23d2d7de3450e6fd83b67f593495a
MD5 eb993193e2568d44d56c3cb89af2d451
SHA1 dd6f517a89b19458cd29463318f1c4f197d171b2
SHA512 a562fc59257645ece2e36904648f59bc65277e379149e9bc000868ad60b9404392078ef25aef24d6959b56a9bfa8d2bef817e9336f1b24bc95cbc9c5b4e23dac
SSDEEP 24576:W8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTC9sqjnhMgeiCl7G0nehbGZpbD:vRZwQCyiHiQEaiPnM4Dmg27RnWGj
TLSH
T13A85B01E62DC42A5E0BAD2B8CDA74407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 8d462377995d5ec43c723c19e507595dffe9575ddd3f400f626725d79eb7710e
MD5 c221ddc9debed7ed395b119208f38971
SHA1 5102d39a8096cb6e193dd8bcb0660cae082499cd
SHA512 6d41b156062982a4e0192eabb5f39bde7fe585e557ba137d53a5bbcfd05854b76a863b3453a39c29fae3ccd38c62b93480a06c9c6e41c9a7a3396da30c716ba7
SSDEEP 12288:WbxA1U7K/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WbxA1UG/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14655123E62AC20E5E176957D86D2C10AD7327C26672053DF21D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1c1c38ccd665300f08100b3cd6c00d1832bd0a396c97d1391462368d53ddd43d
MD5 b176469058674b89c043ffa20a0ddd40
SHA1 c84a0aa7250373e491734ea127dcfc6c2bb79f06
SHA512 664e7f69c0e0e6303795fa4753588431cd359219813289af2240c6d702e9ce439a0eea22c919272c613e690804ed6fd9ac65d1e6bb59630164f949928e4cc32f
SSDEEP 24576:cjsmP0yHaqrVqHra44KDzMsrnOsqjnhMgeiCl7G0nehbGZpbD:cjRP0yHfVqzlAsrniDmg27RnWGj
TLSH
T13745AE2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 db360db044845bea6bfc780eaa50d9eda4b31d1504b2007889a02287a7ff48bb
MD5 d3f7a560871193240d60b527ba4f4e82
SHA1 f66bc790d789bc32644a499b0669f9d72020fb58
SHA512 84208cf219f64091de2621e869fa1bba77ddbc124de7c644ff6a24dbb8f43b10cf4c35f80b1be2c3d5779a1795b50aa2b8f9db4eab594ed265c534807deb9b55
SSDEEP 12288:21Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:21sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B4523BE924C51CAE93649B5C3E9E11DA8073E269B2004D379977CFEEBB54D84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 3e7133efa60535c8a357ef79cdeb92f9e156b5be10e8a871bc0040fe0c8a0c15
MD5 26147de423699036d652d7e307237037
SHA1 66111c7aeb18441efbb02c704f659151359a11b4
SHA512 13aff5f7efa1b80dbae6e0a132bae0bffb72bc8478d390e0ed8b06f6168f5f50144e2d04d4848cfb93b5b7a559fd1ed46ab4a52efde49171ed2272e97687d9a2
SSDEEP 12288:CObfA4LWO+vAYFTLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:zbLBUTLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T184750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ed4cc14c3ac97e02d6d88dd5b4ce64df39fbfdcdc5b9334d15e6acfd63c2667c
MD5 26caeb6c86dbc5f0b9512e5e7642a4bb
SHA1 24a1a4cd6dd6d2b3b6cd9407c2b9a80d7c89b507
SHA512 7bfc032849ddf218972bf7d5a1e50337f1793df7fd674f3cd3321624bb918ba9c9c72b98088fc68d0f11d0dab4e5dcf3f754161f801a9a5da43e55a5d128197f
SSDEEP 12288:I70Vm9IYNvUyBp4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:lpYNH6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E65E12FA2AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fb984d5795cb52ce8f1bd52b2034f6cfd8ed4c24c594fe2d4382e7d99bccf29f
MD5 be3c7552c1f455d2267b80e9eeb6b641
SHA1 64d45f6903be0a5c4f8b42475f16a61467c8ff16
SHA512 13bee3c9ad4d9cc2bc832ae924184e0fd2095a448bd1e590c861dbe4f395007b14701df91a347214276579fed70f45d5ecc1bd26824c5d4cbc19fad13da6ca9b
SSDEEP 24576:tnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKW:tnXoJJYH84VVS6AmEOJas+cHBjSSKHPI
TLSH
T1CD65BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 11fec07556e03bf6845412f2a9654b20435281cd7daec5a933cd139a7a4de0f1
MD5 95e5150e3fca6c16cff7477e2e3a6d74
SHA1 e3fbf570a2560e51af358880dd529feb828d1e6c
SHA512 097991af6db40317afac43831116170cab1fcf23761a0b3616692d3480548d226e1eac1084441c2fa8ced6346fe29f7e2c769984dde8eae3481fa21e026c8d20
SSDEEP 24576:6v7Xbxd9Tuycf8M/TYlSuxrr2PCwsqjnhMgeiCl7G0nehbGZpbD:6DLL9TuJ0M/TYj2PJDmg27RnWGj
TLSH
T1AB858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 4a3d4af1fb8aa961688b2b0d4e064e5c19cddfc62d18efdde8d18deac2c82210
MD5 b978e9f7500dc09ce3ff822f80d9d1f2
SHA1 082911fd41ccecd483994339b6b5ff53ee4d942c
SHA512 404b2c05ce7c2b0f9480aa7a0e0b9d0bbcbc1f7b6601c6a9b15ab9472a8bf8bd61354dade5640a8d37349a4ea6b35b61a42f87a3a701e025b7bdd05298cfb7ac
SSDEEP 24576:LegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wLsqjnhMgeiCl7G0nehbGZpbD:LngOJOmPOHz/Dmg27RnWGj
TLSH
T16F55CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 e44de9db3c6ba69edf92eead052c9e68ce0faf26a2f2456d411881d2b80b6236
MD5 6a0e05bbf4c80bbd5c2359daba9ecb0e
SHA1 143fa27705ba7f5d3034be7e1ec18d7f7a60f5b3
SHA512 b6179930e7739a3023f9286b312c9712fec3ad6a155f73a5fca2cf31ffeea972d66c81c105bed144bb5ae351de0cb9b23cfb343bca7417e0d7a0e4576af1acae
SSDEEP 24576:TLJnJiTk3R3waE4JrOVsqjnhMgeiCl7G0nehbGZpbD:TLJnJK8R304lyDmg27RnWGj
TLSH
T16875E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 37124e4e2d8fc1fe25c8114833aad1bebfc4a4700626db8ef3402a9ac4cc4170
MD5 e68beda6fbbb539fdc1a7992620492db
SHA1 c5524167e4c3b70eab91dcfe192deff46003ab08
SHA512 97946433a8188df3f5534154f113755163d22dc117c0e7bb6aaf0bad2e2b42c35559329235665a5919a9eaf06ac1c845ae02f42dcc47317e9d069d4af47cc2ad
SSDEEP 49152:u9mqCzDScAZmlvTcFg8Ph6NDmg27RnWGj:guD527BWG
TLSH
T128955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 104d708b942a6ba4f6ab5196e6bf53aaf639b18e478f323e204b0584c987fd2b
MD5 5f553e65217d1a3d7e6a3085d752b9ef
SHA1 0f47be16d25c1771e4eaf08ca1ae69f5dce1a851
SHA512 e1050c85fef42fffaba686eef1de7ea73cbbdfa1aa03ffbe92ca8df9c7ebd1390d1c34d1b8bc85c8de7d1c71fe4f2dcc6bccf01c6034b962e631139cf0e6bcf3
SSDEEP 24576:1lYJeXm5jUuEtsqjnhMgeiCl7G0nehbGZpbD:1lYJeXmRUuERDmg27RnWGj
TLSH
T1475512AE669C30E5E13A8079C2E2C508E633B876571017EF55E0D5BE9F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 34b8f00f09e8f5ced5e89f601e38bfe1dd5fe8efccc150b6bce0a391f52b8062
MD5 5ec96a07bb008504e2b644cbc98e6187
SHA1 5bbce81403a749eb8b7fafbfad887992f32bf311
SHA512 4bf75d0559c1d2df5fd4fba670a452567e10871285bfaef9dc86ab01940bb4425e127933cb6d35a7a1eecf875450b74ce74c326e7364a9287a712b9a074b0a09
SSDEEP 12288:Zmu6kyuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Z7tyusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD552219639860D9EA760978C6B3C158DC367C219F2006DF65E1FA3FAF726D48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 6ade6c681d37c2b013316467fd85623d0f96884e4b89dcbaea299e2aaa26a643
MD5 a1ad32d474a3ee25da894e29d26c4f58
SHA1 08be7b2fdf8e9ba60ca4bbfc9a924b96b57a35c6
SHA512 46a3db3aba628f83ddcbbca185afbffc84cbf5da8e123855ea0ca9c4edade20dbb3ea82416f1e39b2152ead1d7b26354ee1094bcaf837703a96cb1a834efdf43
SSDEEP 12288:XPLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/LsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1954523BE525C61CAD93205B4C2A5E11DA8173E36AB2014E779E3F8FDEBB54D44B38813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a02f3f7dba2ba8a4fd64ea495a9cbfdff3b4bfcaf832c68f382d27b9b1b85aae
MD5 905e6225032e79e770ea061bb6880655
SHA1 377594218adb1c726802b349ba4436fef0478a6d
SHA512 5614c22eacbbe1d648029f85d0d840a23a0b9d6f747fb34af0c2109dcf021cdef12fda22990dd2011f504c947be4d2f333bac1cf59b9792b3a8db21ceab95074
SSDEEP 24576:CC+TyQIu93VAumZr7jmksqjnhMgeiCl7G0nehbGZpbD:C/TfIq+YADmg27RnWGj
TLSH
T1AB558D2DA7E919CAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 2a8080c9d6e62448335323f99241c6ecb4094e14e8fe9df79cdb8b9a4522a6e9
MD5 ea11d52f7ded5b254b50660d8d6f3f13
SHA1 8559608bb36e16f9d23057c026390019b4f285c1
SHA512 aa0a0b1a90fd8a3ff366f772d7f1b430122da12fadfe1bb1c7ff2d4c1d3f362ea21be66238942102eaf6e4e796cb11c27a5fdfa55f68bfa14f1dc7c419d78071
SSDEEP 12288:NcyrWOstaa3kcsHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:oLQikZHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E365F11FB3AE00A5E067817CC8858116FA737835571167DF02A1CBBD5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d134898a353fa18b945d933372fabedd28a01a0ccc0f55b1f2ac9ed062ba9ae5
MD5 3048d71411cd70efe4fc5d0c689835d4
SHA1 98ad7748142aea7d0c78395b76dca860a7d3b008
SHA512 d6b652fcc6b4ce8a9a7d563e19fc740aa61f5425dc0f9843b0039774550260387910782d73e6a76cf0ba1c5cfe6740f66df52168d50f2a9b269fdf9ee2cf478a
SSDEEP 49152:ApJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPCDmg27RnWm:xpC7b4+80GTkFD527BWG
TLSH
T1A6A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-356-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/436-514-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/436-353-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/436-347-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1220-509-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1220-331-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1220-329-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1536-57-0x0000000001750000-0x00000000017B0000-memory.dmp

Download

memory/1536-62-0x0000000001750000-0x00000000017B0000-memory.dmp

Download

memory/1536-59-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1536-51-0x0000000001750000-0x00000000017B0000-memory.dmp

Download

memory/1536-73-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1604-300-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1604-510-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1604-512-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1604-440-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1604-306-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1604-308-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1716-254-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/1716-246-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/1716-256-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1716-252-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/1716-245-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1840-39-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1840-47-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1840-48-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1840-226-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1868-234-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1868-241-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1868-235-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1868-355-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1912-393-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1912-394-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1912-386-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1912-532-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2108-527-0x00000224CDB20000-0x00000224CDB30000-memory.dmp

Download

memory/2108-524-0x00000224CDB20000-0x00000224CDB30000-memory.dmp

Download

memory/2108-530-0x00000224CDB20000-0x00000224CDB30000-memory.dmp

Download

memory/2108-525-0x00000224CDB20000-0x00000224CDB30000-memory.dmp

Download

memory/2108-528-0x00000224CDB20000-0x00000224CDB30000-memory.dmp

Download

memory/2108-520-0x00000224CDB20000-0x00000224CDB30000-memory.dmp

Download

memory/2108-523-0x00000224CDB20000-0x00000224CDB30000-memory.dmp

Download

memory/2108-531-0x00000224CDB20000-0x00000224CDB30000-memory.dmp

Download

memory/2108-516-0x00000224CDB20000-0x00000224CDB30000-memory.dmp

Download

memory/2108-517-0x00000224CDB20000-0x00000224CDB30000-memory.dmp

Download

memory/2108-521-0x00000224CDB20000-0x00000224CDB30000-memory.dmp

Download

memory/2108-519-0x00000224CDB20000-0x00000224CDB30000-memory.dmp

Download

memory/2108-518-0x00000224CDB20000-0x00000224CDB30000-memory.dmp

Download

memory/2108-526-0x00000224CDB20000-0x00000224CDB30000-memory.dmp

Download

memory/2108-529-0x00000224CDB20000-0x00000224CDB30000-memory.dmp

Download

memory/2108-522-0x00000224CDB20000-0x00000224CDB30000-memory.dmp

Download

memory/2260-398-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2260-407-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2260-404-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2260-584-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2472-410-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2472-622-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2472-416-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2472-419-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2536-65-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/2536-227-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2536-74-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2536-71-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/2996-261-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2996-267-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2996-260-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/2996-374-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/3288-292-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3288-286-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3288-294-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3288-418-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3480-37-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3480-225-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3480-34-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3480-28-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3508-312-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3508-320-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3508-506-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3508-318-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3868-472-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3868-504-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3868-652-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3868-441-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3868-533-0x000000000BCB0000-0x000000000BCB8000-memory.dmp

Download

memory/3868-429-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3868-423-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3868-488-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3880-25-0x0000000000400000-0x000000000061E000-memory.dmp

Download

memory/3880-1-0x0000000002370000-0x00000000023D7000-memory.dmp

Download

memory/3880-0-0x0000000000400000-0x000000000061E000-memory.dmp

Download

memory/3880-8-0x0000000002370000-0x00000000023D7000-memory.dmp

Download

memory/3912-513-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3912-336-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3912-344-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3912-342-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4060-360-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4060-366-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4060-368-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4060-370-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4060-372-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4120-406-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4120-283-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4452-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4452-17-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4452-12-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4452-210-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4552-392-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/4552-278-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/4552-280-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/4552-272-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/5016-515-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5016-375-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5016-376-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/5016-382-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download