3468bc8897363a4e77313e47669aaa3eb4efdbfbe60e883d671d8294efa8b479

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe
Size 1.8MB
Sample260629-ejapmady4k
SHA256 3468bc8897363a4e77313e47669aaa3eb4efdbfbe60e883d671d8294efa8b479
MD5 ad9150654bde34979a9e6a311ff23ef2
SHA1 074c3cac3beee9809da451ccfa65455564ce7308
SHA512 b230a2c937b41cd72b5ded001830e3ae8482e4cff93e3fefbfa8cf42a6b548302b36181e83916b8cce024effbbe7f9762b6654abc61a5d3255eae01195c0fb7b
SSDEEP 49152:kQRHjW9IGyhPTppGpgwnRsUsLNiXicJFFRGNzj3:kQ49IGyhPTppGpgwnRw7wRGpj3
TLSH
T1AC85F10075D2C87ED57604F198F4D634AA79FC25B929096B63C83B6E1F703CE9A36923
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4292	alg.exe
4552	DiagnosticsHub.StandardCollector.Service.exe
4828	fxssvc.exe
4920	elevation_service.exe
5048	elevation_service.exe
2956	maintenanceservice.exe
204	OSE.EXE
2508	msdtc.exe
3216	PerceptionSimulationService.exe
4588	perfhost.exe
3252	locator.exe
1836	SensorDataService.exe
1540	snmptrap.exe
3752	spectrum.exe
2472	ssh-agent.exe
2952	TieringEngineService.exe
2792	AgentService.exe
3328	vds.exe
2796	vssvc.exe
1248	wbengine.exe
3808	WmiApSrv.exe
2372	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\333f76d57c8d181e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1004	3932	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c3171ab7b07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1faf9aa7b07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000af675ab7b07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4552	DiagnosticsHub.StandardCollector.Service.exe
4552	DiagnosticsHub.StandardCollector.Service.exe
4552	DiagnosticsHub.StandardCollector.Service.exe
4552	DiagnosticsHub.StandardCollector.Service.exe
4552	DiagnosticsHub.StandardCollector.Service.exe
4552	DiagnosticsHub.StandardCollector.Service.exe
4920	elevation_service.exe
4920	elevation_service.exe
4920	elevation_service.exe
4920	elevation_service.exe
4920	elevation_service.exe
4920	elevation_service.exe
4920	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3932	2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe
Token: SeAuditPrivilege	4828	fxssvc.exe
Token: SeDebugPrivilege	4552	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4920	elevation_service.exe
Token: SeRestorePrivilege	2952	TieringEngineService.exe
Token: SeManageVolumePrivilege	2952	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2792	AgentService.exe
Token: SeBackupPrivilege	2796	vssvc.exe
Token: SeRestorePrivilege	2796	vssvc.exe
Token: SeAuditPrivilege	2796	vssvc.exe
Token: SeBackupPrivilege	1248	wbengine.exe
Token: SeRestorePrivilege	1248	wbengine.exe
Token: SeSecurityPrivilege	1248	wbengine.exe
Token: 33	2372	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeDebugPrivilege	4920	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 4924	2372	SearchIndexer.exe	122
PID 2372 wrote to memory of 5104	2372	SearchIndexer.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad9150654bde34979a9e6a311ff23ef2_amadey_elex_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 432
  2⤵
  - Program crash
  PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3932 -ip 3932
1⤵
PID:2400

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4292

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3992

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5048

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2956

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:204

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2508

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3216

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4588

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3252

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1836

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1540

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3752

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4492

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2952

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3328

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2796

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1248

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3808

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4924
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d513de30edb56cf01a1b56c944ce98a10af84232bf62253376a25b9101ee37c1
MD5 adb602c66e5b55202f4bac5bb0d7dc0a
SHA1 9875f2347c4515e46676960552bab7e10bea4030
SHA512 a05aee6f2b6d7a328bb9c78c8d2c2b707b39b60b3c8bb43bbff59d772d762928fee30cb4a6cefb5e95834c4e74a64cc4de6d4fd069b98792a79d4f45154e9b55
SSDEEP 49152:ub+632BuPkFKRrdE6ohdstBhuXjfS4LWxn7LNiXicJFFRGNzj3:w3q6mjBk7wRGpj3
TLSH
T115D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 3f5c150cf2c4f3b4220eea7e77c2233cc68e8cb665f94e0b6940dfd08eb7c0c9
MD5 5dd97dcd9a74adf1ea60fdfd5e80ef0b
SHA1 be228bf9131c174163e78abafe6679ac43b0a3a5
SHA512 2c2ef4860625d448eb67da5da234e756ed7e2276bdafb7e5384e3c18cc3bc82e1e2a85dffbf0cde314a3ecb00c1b1bd3e46484fe77d1f2db8970f79bc0cfa330
SSDEEP 24576:LXYfDtczAI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OtcBLNiXicJFFRGNzj3
TLSH
T10485012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 b5d73004195903da9f0be55a5d9010b94f7771169361dca74ab5d6285821efee
MD5 20bf27295b391e1a203d6e885f139c3e
SHA1 5a1b00a4804b4f314981bc9a30d13cd954e10292
SHA512 30e707338ca9cad676000de7db85b191964036825d60706507662871049dfed5b1bf84f916b47f87cb1a44ab33592e882426679feb21ec2d5ffcee90dec094ba
SSDEEP 24576:R0Le5ji0hmxkrMD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RPji0AmKLNiXicJFFRGNzj3
TLSH
T1B6A59E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 770593de00b8fbc4329dba66eff3b31b4b6f4d2c84b2ca2f576db0cc0b72c617
MD5 6bf521fb8bd3eb0c53108b438525b6b9
SHA1 5a4d9db9049f343784599910cfb7d64d8e0d0ed2
SHA512 8422a60f0331d2db786757bcb497c966c7c14415d10573c1793057c4cc1e55a2144aea0b98e7ab12677a6b32e289ce92c6332a197af667714fb2f5c66a7954c7
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWj6q8wyuR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:c/ezSC6vUzPv+Hjy+LNiXicJFFRGNzj3
TLSH
T138756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 360e7df15d465cadbaf01d62b355848d057144739c4f07c8618d30b9717276e0
MD5 e1530b13c3f27eafadd1a72a6e27caea
SHA1 1b6ba64c0d65744b31495a9f5d719ac671cc7256
SHA512 292c76d3703898c9b2d192c9509bbd9f78d8ef8d614af875c0468cdcb3611d90cd844cab7846d1bb4311c71ad213d89fc9900b9795d9c85285f66d9f37de95b3
SSDEEP 24576:sVbqPb88hv/l+B0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sVO88hXl+qLNiXicJFFRGNzj3
TLSH
T195559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 96295e8d442f004e1a62835f207f26f91baa30ff817b919017833186adae53bb
MD5 865c2ae64e2698f82a048cf6a035487a
SHA1 38b427df91a66b7e77a0737d99b427e5479b772e
SHA512 490d5292006e58821e8ba08aa8e47cdd7a00165809cce01b849e6d696b17d0dfc8c8f9aa0230bff5d476b8d3c8f2bf432ae48e1dcba21d30db811fde0f351b62
SSDEEP 24576:ak//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PLNiXicJFFRGNzj3
TLSH
T1437523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 85c4f56de18c7610d93322294cd9665f183a79fd811050954b84a0c209250534
MD5 628a960b138547421712ed9a7f308e2f
SHA1 80379c4f55842fa77fdbd7030d000295172d6a8a
SHA512 f27c3cf2dff0d376038c7bec44d2c161f4ca2b192c75a27865ee6164362a6eb4e5927f525b94bc9a9a33e8f52bac885bdf9298715187bc47484e3c6b4c17e832
SSDEEP 24576:7JIUc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7JIUcLNiXicJFFRGNzj3
TLSH
T15B85CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2c4f16f1d15bd8d29bb768a509a8a5dd9985f083499500f05db43949520b9007
MD5 72f0f310e7472ce24df88ca664188c5b
SHA1 069cd1e6e634bbd38cfee6324b9be978f31b41a8
SHA512 a0152ac5162fd8a3a7ec3d5559e8374cf70b2d8d51d0a1f78069b50e233a27bbc47425b55102af3df5bd23a3d3e90d905ea6598647210dfdfef5f954702257ca
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THy:CQvGAdlCEL8c/WRNw5Ch7wRGpj3
TLSH
T1D4266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 f83125acf2a81727f099e59abd1c8c6c930e6ae03720051ba9d906d2572428a1
MD5 297227c590c5fa01763a723eb6288792
SHA1 5fe61f7996521330399db92b66b981de111f0816
SHA512 ef05a3d87d69b4605f0fad6de390851e4f92b8e05c292e2c943665f1ee8a68543b90f18e17de961fffc74fcb63814b46d5789355e0200a57803c70099a1eebe1
SSDEEP 24576:WAewsAja/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bljaLNiXicJFFRGNzj3
TLSH
T10E95E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9c38cff1104de36234b147f02f967f5d0b96c5f99d4b8ef9beae6d92b79ba9b1
MD5 b279e6c2b7a300521e1a3b214a68d83f
SHA1 71300373243702851c022962f31e36756bae8709
SHA512 3cdad5d22198d18349ac844103892752801241e4a8355823778c108fb8419ee1d0c60f3d02aa25ba8c53198c0d737e8b33c4838fbc137c88606dabaaaef7d765
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH2F9:sUEtQevvqc2W1cpV20I3269
TLSH
T115474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6044be6f88c0d8567f650805b97e4be5305b5cdcef7287853aa815741281fd8a
MD5 2cf86ee160772117e66dbdd613a272e8
SHA1 14b0c3918ddaeccc1a2ba69cd2658b80e16baefe
SHA512 417c029e926de250ca999baec4ca147470f9499fb0ef338706110627e4e44066b6bfb72df7c50cc1a21badfb3d554eb2145316f597bdab1dec7f55da9cff22a2
SSDEEP 49152:dCbRquA/m2yL5zLfFiV+XenmE3/z6LNiXicJFFRGNzj3:aoq2Vjnml7wRGpj3
TLSH
T108D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4b034d9753aa1a278b07f9b8f931ad55375fa74e9ce52124693d023b11543b0e
MD5 a24e95a2741027b9591e4735cdabd125
SHA1 c6e2d9477460a4ceac1f3dac3659e91cb9ca7771
SHA512 c7bf2b387d3c18a90dc624fe5274469f43f26fa290ebdd7d09ef4ed3547f33d9691ac13326fe46409417ac9c28e5730f4ee7612c3981b7897e266e20becd04fe
SSDEEP 24576:RAhGL6IFoiwtA5l7S53F/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RAM5Foiq51LNiXicJFFRGNzj3
TLSH
T16D359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 83c352e38eb7605a665b1c8f31dbc288adf0f5fa1679889f2a11052765eb0a0f
MD5 122f82291f4a69b2fa15f6a50ce26d34
SHA1 b3955324c3bd3a7a55242bbc8a280b0081af1d8e
SHA512 1c5ee1a870baa0ecdae6127ae18e35441a025e464150a306858e2a64c14bda0002c1fc8d57517b32e84d0c7c4421072d17a5d32cd5111c4f82effd0510c5303a
SSDEEP 24576:ewu4OWe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ewLOZLNiXicJFFRGNzj3
TLSH
T1D785F18632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 ddb379e866533ac2f133c994e82bbb8436cd5981adfe2d17424a0e763d44af8d
MD5 bfc4a9e97b78ebe38c11cecfbd3af16c
SHA1 27907b1ea9c77728e9f0c8ca3c9cc3399f415bc0
SHA512 4fed6229406be8b9653543655b4e2caf789ac31a1d711e8fb90c0bb753e5e66b8b42c06c313275d74106c76a6c1d9137995f1fbff560a938dd706c9aa4b740d8
SSDEEP 24576:qZuL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TLNiXicJFFRGNzj3
TLSH
T11075129622C820F5E2BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9e506b12482022c6f301568050dc991ece7788df5297bdb82d86c44b8018a0ad
MD5 3984a87ce510d239a6b07a7edafdfd09
SHA1 b2de4740ee6805cfd385a24b4987e94cd173290a
SHA512 4c8209bfb7f18d14e9a525138d47489fea5306d5a9ab523dd1eb8222152e9aea8bf3dd86083908093650ba9fd3fe2ac7ddc86b695770cc7437e8d7198d6f80fd
SSDEEP 98304:TQRQyi36YOcPDLvw2gAf+PN3w7wRGpj3:CQyiKanX+PN8F9
TLSH
T14A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f8c7b718e9170531fe36eeac7b70352465e40a8f2eb06d807c9a607e3ad74e3f
MD5 c40a3cfaf6d7ad93d57eccf784f65da8
SHA1 3d21028fbd2777a9bf0655723f6fa428a2c468ce
SHA512 1660c3c5b4d88fad99d094d601833fcba9890e65b9a0fc8e38cf0dc6dc4ebc52eecace07cdd238723d8f6f7d1d025008bc7d1ad88b911842214613b780452853
SSDEEP 98304:XQRQyi36YOcPDLvw2gAf+PN3w7wRGpj3:GQyiKanX+PN8F9
TLSH
T178667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5c9828e0514a75ff5a46551d959220becba6b3a969e9af31d03b6eaea34d83c0
MD5 1cf17502aee6e8b9a233f2c2153b24cb
SHA1 f04320cb0770e1c0a7264fcf000141c702f0be9a
SHA512 e3a57b433583153f4584f9904fab3cb72b272afde9c2f65767ebd8445e83f1e998fcdc3bf1c74d73c87ad098dd5a4394b44f6dd227ac399fe2811c3730a56841
SSDEEP 49152:m68Qg55nhkeWu7PNU3/KLNiXicJFFRGNzj3:EthTRc/K7wRGpj3
TLSH
T16FB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 084092d91e4cdfb01523c310b4b8f024eaeb16130d67bfc95a763877a0b10043
MD5 5f9cfbb3891b8eda694904aebf6180e9
SHA1 64756c1005821280ffb28e22b44d67f8a03faf84
SHA512 304b265aaa846efabdd28d75660082e7ddc5c510ddbd37a9bd429a58c70d210a22a639fed4db8bf403dfac080fb57b1f48af79339ce83a64e6fa89970a013564
SSDEEP 98304:Iy5112gYy5azzVvU69nLKnhZ/7wRGpj3:hLIHRWhBF9
TLSH
T12E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 77929691faaf04728a54f764b7136a358a7a355531355f109f9fe71e20e11736
MD5 476637247f3ab1d04d7510d4f91f3320
SHA1 253f35fd20e9c7c624a9f64a6715fe60f310d495
SHA512 77a7daa20e0056e5be87884e3dc320bdb3166a0bc967b5c13bde75bd59a52f6316c74bf072be42805bf054758fbb5658475b7b5b7cd9d68d1fb2e25d12f08124
SSDEEP 49152:VB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glqLNiXicJFFRGNzj3:bu6JmIxd2dq7wRGpj3
TLSH
T1ABD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 adfead73fb027cedee57886e1bcf2f78330e4c8da061e52700f61d6665c59bfe
MD5 7ad208ccbd052d082386d811f49cdd4a
SHA1 7cbe1d71a5073efebd1ff512a8d2fab275efdb4f
SHA512 f373ce75dc4157ce83ede02c28433c487778a600496204fdf51a3b092812a6f32bbf34f5d6cf0c5538061de49a1fa37ccf48d14c918e3a180068b9230f8028bf
SSDEEP 49152:x1hpsNoJpF1A67U44CwH7R4x8LNiXicJFFRGNzj3:xmifPqRl7wRGpj3
TLSH
T1ACB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 11a9aaceb5289561f452f62bdcc0d6325c022c8c6d3caa1303e59bcd44d421d0
MD5 cf348e368b4d5e8b7124d9118f965683
SHA1 d672cbde46e657a85d659b976ddccb036e299668
SHA512 2a7c71f9e59d9f8b2f8c6be08273a82a4338b487d098e024a0f483099d1dde242d281ac8fc55c9f5659bcaff9ebaf8b685f5e62ddf201a5954481856e144ddc7
SSDEEP 49152:WSuZQIY0Be2KkRVtOnks6NMHqLLNiXicJFFRGNzj3:45dKqi61L7wRGpj3
TLSH
T13EC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 04b060703df83f73002c3cc9f6018b91300c42fe551210f65f47785cecb44a58
MD5 f71e17d0bec53fc27814e07ec5881ce1
SHA1 3b3cc5eafd89216a38095f2124a4502af21b0a3a
SHA512 4daaf44912b665ad83db249bc7f19544be0616db989684d0b34e2eaafc55754e1c1418777b971c59735c99ccd1aa9c23f201073e6e815204da1a0fa758e26252
SSDEEP 49152:4htSn8EApI0figjgiDn0AP5wILNiXicJFFRGNzj3:pX2iWph57wRGpj3
TLSH
T10495BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 5c4aac51371fb2225d21d942797862aa9844d9e61cb5f18d6fe24e588a203320
MD5 0b254795d69bbc20c6d13958a58ce56c
SHA1 d69045ed7835a22957e420b09a7a59b6e2c620d0
SHA512 2f5bc9a4abe7fa1b7bfa108113ab4b610f2949b22e21aa7ea92b28acb48cd704590a5db398c0a27b348d3d54359e0ddebbbe0c2160f24c1a02cc6f107db931c1
SSDEEP 12288:kziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D77523D3558955B1FAFC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 b0c3724f222cc84acfea760c37817603ef12ee7a497fcded7650dc5295a157f0
MD5 f89f88728ae9da3271a249687e269760
SHA1 af7282b2a78f065e6e57bfebd18e0ec3e6b4c6be
SHA512 692e9fcf9b41843530ae02dd89ba20abcd4ef2cb2ee7f6cf82a9dc10fbbb29201b5a024275050fbddd2edc1e00dc8ed4b3be1197368e3077599e1a1cc2ae5638
SSDEEP 12288:csiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1747523D3548955B1FABC003986754428F5882E2DEB5619E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 94998b32b67797e403cc10823c7eba65ece19df463ce74a071213b389fd8f4ad
MD5 05040196b709c9d1a1368c991c7dcce8
SHA1 aa2083f1bc959ebe334e603d3a38a097d29a55c1
SHA512 8a85fcaee7f7f8847a3d88b1f27f90780580852978341f987465fe2ee337588d622e6ade8885ce6faafc94a851d3827072a2b6f5a49624ef8ebac6e63b7ba835
SSDEEP 12288:tiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10E7523D3548955B1F6FC003986764428F5882E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 c2c239e4679eb7fc921c651a27cf16978a423861894a3bad098f2e820e180269
MD5 04da667df26e46c93295fffa2edb6685
SHA1 b2eee5927ff6ee0419a1509a0b6b947c7f975917
SHA512 f45d13be79f2f8356724dcf9b5905eb209695f58f5d061a1389502f5c6223649f2bffb4a2fcc0223509f80bc5c92ccbb713b7dcd855d52bb6fbed41863020fcc
SSDEEP 12288:bV5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F9752393168901F1E9F98039CA764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 5490b791e5061585f7f6a9c37fa74491a4d99f3b0af4af5ebb2ea9cc34754617
MD5 f7201015bb3bb7c847c050f6c2c09f37
SHA1 c5f2dca05de831587323f80e94890a212acc77f4
SHA512 45397b66881b6ae7f0b47c95c5014024ff9eba69e4b11f5230f1ca9fd58b59ac0ad49c7d91692753c90b08610447c35b8ebbe727bc36ff5c36e66e40004b5190
SSDEEP 12288:0RiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1727523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 ae43f30dcb001c4d1b96bbd77b58bd96730f8af2269d214460002805317a27a1
MD5 a11fcba2171a22de55e769b4a4034967
SHA1 fa15b642b0ee190f2f3425b2c2d224e8e51143ec
SHA512 049640b5ccf9ce5e644ad75e8f129727740073466265b01c5b4acae6152c3fd01002f871863b71dd473d9d142adb053ab4e289f64b81979804e78bb7e8557918
SSDEEP 12288:WQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12E7523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 bbef1acf8d500db77d5c0ff593f0397146eb45200c6472094a283ab4f4183b7f
MD5 4f5bfca5d1475f8ea25feef72742d7c9
SHA1 0a1d017ea40b96677c09c8c38d9b5ba5b3783a55
SHA512 0eabfe03962aab582e85183c8b48b8b7c9d5df7447bba47f5ab589031b2b6410e933af41285c3ee1e8bc735cf6e1413d6baf80829d7bcc89e163cff060924588
SSDEEP 12288:wEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1557523D3548955B1FABC003986354428F5882E2DEB5659E3E3083D1EA278FEBDF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 2107f3deaeab77ae10809c1744607acf12e859c09a0677e32a73d00d675703d7
MD5 5f180ef4528289fb3fb2d2a9b1bb7fa3
SHA1 1226e54f58091f14bb846c8a5464b9a82953368e
SHA512 5adf684d3aa72f601d339ae6eec147f880d76f3203ff75e725fb5bbc05b975caf5045c43232300b184c061abd353e43359142dffd0d23b1a435d0f3b742b6723
SSDEEP 24576:2ZM0zFVSO2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2ZM0zfSLNiXicJFFRGNzj3
TLSH
T105850295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 f49a9381c90df2e525620da1b01b8bd5015d62e0180dd745e9605a070bcc24a8
MD5 32839058420bd42084b600fd749c04c0
SHA1 4c2dfbe39692a2d1ecc2b67d651d89b41aed7b55
SHA512 d0b878d1923a0857b518f2acbb3f30a471cc6ce2918186b7631d019585e1b46c25146632acde3d06bfeae1dc061cfa81b44c477d6fe2537e10ea7d86c5ecf1ba
SSDEEP 12288:LviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Lb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BF7523D3548955B1FAFC003DC6754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 90a2978c2f1b411f875f6ad59a77f3a89c5c424fbc5dc14f3d2a2cdcadcbe127
MD5 5768cfb908a529f214feacf6388f92ab
SHA1 071acdc2b36d39bdae208fd3f15e493aaff79d77
SHA512 a80a8f4c35917f71d9cbf0c2a68b925803e00123986c00ce7e6023352aa2998be9ba3ea4a7b86afa82a59d28cf551d1bddd8579be2370658b6867efca536cced
SSDEEP 12288:3biJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1447523D3558955B1FABC003986754428F5882E2DEB5619E3E3083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 2c20a1c7793a7fd2d40cafff5b6813056d17a1bc1f27682198470ee8f47526d4
MD5 ad5570ae6ae34fc452167f9e3e1ee582
SHA1 e159810cc11498b6ee7af83f5a627c65332b51f8
SHA512 19a36b3b5ef61814ebca46d82600f7436448b1d13ec70a5be555fbaf2b3a83896ce4a005da54ac3b6f612e03fbaf5ac7ace98d83e98f80a39595deac0fb72a2e
SSDEEP 24576:gzyq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:g5LNiXicJFFRGNzj3
TLSH
T107750247629530F9E17A4139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 5c6b59a7e805d066b42d811cb7edc3da373381a80b70f9d58d0d1178429b5664
MD5 e0dd49f195952f9fa1fe8f7057929837
SHA1 16f7404c64fc084e9653e05ad7b55d787b94a58a
SHA512 a038e05b91a9dc3155842675f95fcc6458afbe2431e739f138923288cb6adb9b52e7266ab995ff1d5341ef3ce118f164d76eded68beb61b4b13d2a76239c93e2
SSDEEP 12288:uviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ub/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1007523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 0fcf98d1c71f74a95b0a8c2818473857ae619797682ff36cbca75f1a3fd3a3f3
MD5 3aa740fc9da89b13ef18afdab5a092ec
SHA1 b81fb1ed4704bc68778fa17964755826c3b5beed
SHA512 df689651d3f70039a94d2904f51afcfbc45d4c4332f6a8693555f71fd51a591ec63afb896f813490131100eba05c5714d0e59ac72ae6410fff5c1ef81bc65485
SSDEEP 12288:XviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CF7523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 b14f741da4f4e40c9d65077187b581a665120e565c94f3b7cfbd1d17d2af8a0f
MD5 c1b4c629e9dce96f5ce4e199180087d7
SHA1 3797bbb8dc087fa7991636b7327e27d7e9b11fdb
SHA512 85bb0c9a093d482a77c3900b2bf026bc677d176b891afb3d729e228572c64d773322560180a49011fde502582e7a6571f48428bbb0316455a0f0e2b1f89fbcc3
SSDEEP 24576:Lzyq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:L5LNiXicJFFRGNzj3
TLSH
T15D750247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 2acd7c69dc648732b2f07c2ae60e47cc596c34d4f744f81c084b278ee293e9e3
MD5 36c4e38b153174fcbc363636da21a743
SHA1 92901c9566509167cc9358248d8fbafdd97208c2
SHA512 3f7d71de8cf8d3b42f9acf4cf342aa48e279a33d0fea2ca693f85992eb3c57df78994d8ddfa02645e9ada105b608d0f3ce56ef44a520908062ffe43626cfe8ec
SSDEEP 24576:wTBaLl3z0zDU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wTcLljRLNiXicJFFRGNzj3
TLSH
T1C58502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 92290472ad1805ef3abf1e053a46bb83d7cd46f4dbe2fb4494e901370e59362d
MD5 f736ff0b58558187bc5af4c578b7f155
SHA1 234bc05dcfe4ed7923c6224671749acf48db1057
SHA512 621288b3dda42009f17d1eb6ee75c3d8aadaa54593dd8faa47035ca04c5175bfdd702583929621b38a5cfb55a0d9ac09882d5d1ec218c48fe4c48034aca86d60
SSDEEP 24576:Y3Rd9CHKy7GZQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iRd9CHKyaSLNiXicJFFRGNzj3
TLSH
T12495CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 809e8a635350def1fcd62a84f925c2bf39664e0eb2ffe16a567f9c22f98df3db
MD5 0cf24baf836d01f30aa78ca2a14e692e
SHA1 f4f0dee073fc93dfd51ce089ea7793a56c5a5a17
SHA512 d21ae0aa6f27fba32b128dd09fc04cb76f9805de7c98e2c0201a11b74147f1d93dad9f11fa0a66d4ddd984fdbdc322941ad741a12d2b4b42fe27eb53478c37c2
SSDEEP 12288:sCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1627523D3548955B1F6BC0039C6764428F5882E2DEB5619E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 07288aee59129dfd38d2c291b78bfd35507a6f61cfd54223dcc4a542e83847a0
MD5 8ab2c8ff9aa4ecc3aca904d93bd60387
SHA1 f4c8cec3e305012ae7d6b79c5d9f2efcd31f1d16
SHA512 3327bc06b134cd5987b343911a77a0dd91df63787faa34ae0284db741325a267b45b5ee1a575d520f3ea1ac20f4b49b714751e4403e4295e92700b88afa41ce6
SSDEEP 12288:S4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1817523D3558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA278FEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 52d9b2583b033950c3a2cc5174a7759e51ddec73300754bfe72b20cd7e96eb08
MD5 943577353124c34a90d3b427494ea5d4
SHA1 6b595cb820a66c4e15a408e5884ae5e29526ac73
SHA512 c4fa389dc01eb9cb4f2ce19b15783f9d74a87ca255d8acb6275624fd270e65addcfbcbf32a41ac1a6c31e863130afb784c9b56538c30cb0d5ffac0462d960812
SSDEEP 12288:pFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1007523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 41ed71c71d9e46f7181040324b44e6446044a6d634d1dedf8430a12b7ad7c899
MD5 4702f4b2b13aef1e063fba3190df0aa5
SHA1 174ecb9e1d411e737972de69137c82e4711059cc
SHA512 0dc60b7796233ce950bdfa3c84062efa055c4e23e5151fd0289bd95e60e65627b5cd070138a2e3b69ba2c77744510348622809e57babf87e69e7c3daf806f2aa
SSDEEP 12288:+isf/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11B75F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 ad9f73f2ae451e51b371ac94a55e06fd2ad03544f52b353e92905eaeadce85ba
MD5 1c04e18a20a39ee620d4559b33907d88
SHA1 56725c8ea22f1bd27a5ba3073dc62cf76cfa2428
SHA512 27713c5a3ecc8e145a30061469a28dc4a296f12b5faa8f3a6c09aa8d749d68102de6f8180ea000c67ac4369da20a74fac1c6d815705a2559b382ba147bf85d95
SSDEEP 12288:YjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18A752393528C55B2F6FD1039853A8438B5497E2C9F1598D3E2043A5EA238FEBDF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 26bdbc195023b8d713f93ac23f246d582c0ab4d756410d512f82a4583cc72c11
MD5 c4a6bbdbeb5995c729cf4ccd45467eb0
SHA1 74f77f5700bd08240c76657ff00eb9780af48142
SHA512 5389c9af337f7d1f6fd2d87cef8e63f4dca59476e3848b0591e7c3e02857eb86f330e324d641ea57fdc2bfc8eb400ad337255c1c19e164a749bc6c81bfd34e4f
SSDEEP 49152:8a0h2GEkuAe73q3pp46zwwQlLNiXicJFFRGNzj3:8a0hNYG4JwK7wRGpj3
TLSH
T1F085AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 8a59fd049ff70410964c387f64c88f99a2ad7cfd60fb5eed4cbe7b2fd22a5bc9
MD5 2afd2d2bf9cd3271d554395f183bfc27
SHA1 82633484a0c7d7d3d06590aa1992727a3fb183eb
SHA512 1f5de0389515aae3ff8dc2574c4fbddd25201f27c56f6000901cf2598fc5dc190d160803d4b6174799f7b4eb2df1e593110872e95cdf36b5c6649ae8fb0127d4
SSDEEP 24576:uhbHjPE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uhbHjsLNiXicJFFRGNzj3
TLSH
T1287512BE129C20E5F6B5903D8566840AD370BC29172193EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1c9639fde7e426fafa8300140423a93d8974031c6d549645bfc3fcb91ae70ad8
MD5 6200573cf732b1ad599dac414ff8f2d7
SHA1 35e7e537e349600ecad43e26a3f7b54af9ed7656
SHA512 068a7ff7bf768e54cd1111d52acbe58945d31f56441b04216fd9f996305fd0ac7623c8d6a8c25c8389a04bf9e89e308259aec2c7048f373f238fd143a4768464
SSDEEP 24576:33YgnJcRTk4yti+R5dBR/c/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3IgnaTk46pBR/cLNiXicJFFRGNzj3
TLSH
T1FB45B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE85F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 8a173bc036e231acfb49863d3b196df3e24f35e8c54d50f7a51c9ae87f1b66de
MD5 08e75d1605a5e7e96cd6f8bdd4977294
SHA1 bf0f30ebad77809beb22531b72e675c0c18fa58f
SHA512 1715abacfb29826c2e7e3d6e920748a0337e227d1ddc5dafc8a072088328c369ba5cbe42b362693007212868f6e969beb534ed00c743aa67382bea37b45799a9
SSDEEP 12288:HPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:H7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D37523D2518959B2EAFD003D867A4428F5442F2C9B2619E3E1543D1EA378FEFCF38562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 563f1eaf1850102b7a5ce6ad573d40cb97d646f59cee262afa1b2e7c191bf4c3
MD5 ce8a52ae81ced3cfd6266bc4ca2416b1
SHA1 e85a605144f0008e6f3261bd09f65fa99ca5577e
SHA512 4cb7b96436c07e5f709685509b1543f5903f0627309e7395e70a4cc225951c29039dd327864375090773049e9180c50b0a4d1b719a5402ef14646f5e62352bc8
SSDEEP 24576:4bL3UTc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4bL3UwLNiXicJFFRGNzj3
TLSH
T10D950155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 6a25474aa541d087446864a99f641e99902072597e0be020ec310a1cf4b8e99e
MD5 6ff7f4fdd466a83800ec2415e01ce721
SHA1 bbd303b45a1a2efdcbf67adb8b1ff0eec2d7bc89
SHA512 3578aff3f7a2deb2a5f75852736708f736f26fad675db91e9f81c2a5ffc14960dcefa38cdc7b992a7d650586c0010ede5cf83cd030a111447b6d2ecb55c01c05
SSDEEP 24576:3OQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3OQLNiXicJFFRGNzj3
TLSH
T13A75126A32DC10F4E579903D8AA2820CE371BC29072257EF4290517E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 be5362a373145b4d5c362bb70342377c9380d5be2e4428e4b58a77953484f3e3
MD5 9eb8e55b2ee489f18273f5e671bbe92b
SHA1 fd18f0bc93a77b51e90684cad86d6884413303af
SHA512 94c02febd9682d264d5cb689b3a390b498181fcd0e2053b9bce70af857476dfbe03b309f1ce47ec3158e833b2f5e1ed9d8f793128f0ebac7cdb61d6c4a587467
SSDEEP 24576:X7NM9YqZqmWMUkPjZM48Mv6bEhsH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:X7cBWMpPjN8DbEheLNiXicJFFRGNzj3
TLSH
T10C65AE2E6BEC81E5D577D13DC9A28205F2F1B8611B318ACB5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2f97d58504cc881f3bdbb0a4e1252c61f67707f9ed735601ba2a963875e5a606
MD5 5550a98f41001a50a46690ef16ceefb3
SHA1 1b07c67866d1d3e9e30b0fa6f943d6c2eda6a292
SHA512 1ff77461652825e3db8df511375a54151028a09807ee6ec6796b5b96d3d03f8498b604caebea77120bfa9733bae5aa03dce9500fadc90a70f45bafc7adb5caac
SSDEEP 49152:vF2YuHNETovAvNYf8kmnLNiXicJFFRGNzj3:26BCf8kQ7wRGpj3
TLSH
T12A858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 634809d9b61c51abe1ca353a98eb9a9bf2e26e6ad9219b22354747c07bcd535a
MD5 7dee4d1511576d9bcae5d924ba432657
SHA1 b363456843d1acfdfa2d125829b60e5469f033ea
SHA512 d6b1421f9c65503bc23777c26b08c843f08a1feb4628540fb3b8e6d19ae8ef147c74cbadd8b06c22fe6d9a2e1cffe14750d9cec1bf8e5e4201f285f35d531a20
SSDEEP 24576:aAFs06+Omlf8NXEbToU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jFs060loXuFLNiXicJFFRGNzj3
TLSH
T12665BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 4ec68451681117064698f86ac663e3e0a60907fe9fe56bbb3588ee4d5a352cc8
MD5 d1125cb3df02e2e8684465358b2cf170
SHA1 54b8a9c480f0e73449bfbfc6a992d2842ebfe162
SHA512 66bcb511107aceeff0298fbd9a86d62be627997990c23776b68074fb1f6d5fe14b5043b4ac4fa7bb2a4f482de580ccb0e9d77e8cb7713eaf100b958aec66fa91
SSDEEP 24576:FJnJ5D3WeF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FJnJ5DGeFLNiXicJFFRGNzj3
TLSH
T1F585D02DD29810F4E4B7C274825A1A55FE72383D2F226AC724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c569de1a36967279288c9ad73d4550c4c9f28aa9615071470d6236087ccced81
MD5 f731f8321021c9edb5f6e5e13e2bd9d2
SHA1 9f702be300d466408717114ab43215cb65f0e23c
SHA512 e8ae11d9e30e8e8f199194fa657ca102e45be17b9e937910a5ea4c42311219d24dd6ca26c2d3c5d410aa7ec12acc3f4bdd0eee7f4b57ade683ddac01633cf7b4
SSDEEP 49152:Pg06DIKdwc+eQnSt65aVzLNiXicJFFRGNzj3:IB7wRGpj3
TLSH
T146956C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 bd3330ca96ef6b96d57b54175e383c7537bae2933db17b814e96beb85c43be2a
MD5 d1941cf4dfde6b7cd64662b12a72b295
SHA1 c05bc90f7cb9514bf7d11bafeb97a0e9df83cb33
SHA512 b057b037205726b7a9118aa2c80506cce121e5ad5a6535d876b438add8d224b4120a74d5ecfbbd43f6951617868e3e8ab2690b26d37f42b2fe0e1d4e38137cbe
SSDEEP 24576:C2f/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:C2fLNiXicJFFRGNzj3
TLSH
T1987512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 1842d43eda13b67d81d1ff8295db2237b6640c311bfb88f6a9e14c236fd64ae2
MD5 2f6c44f2d0b3a739651b7d71ba71afd7
SHA1 ea27e17588b34caccb88770017aa05ada47cc1cd
SHA512 dad3bf7507a77069f07ee910422ab35c8ad588732a25d52aa0306bb47436ef3211a9e3e8842f7e0371caf32c79578f9e6384da70010c7c3e95858382458fcaf0
SSDEEP 24576:cIyO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cI1LNiXicJFFRGNzj3
TLSH
T13F751245538850E5EAB9013CCA778064EA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 6085c24d5eb1f458ec19964e5d458567bc06e8ced22d7e23ff5125d55fb3e102
MD5 ed8ed4d3e3bba75d1d12d932d93a098b
SHA1 e5dc1cb0f0d14baec72c1d398c1ca266a3f40860
SHA512 3460567231cd81f3540217eeb82a89031dfd086ce8f9292854832d268bd8733154adc4dde51172cf76e891932e44f9322f2718cc07dccdcd3d25330558376c26
SSDEEP 12288:gAWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ng/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BC7523DA118964B1FABD003D86364824E1543E3C9B2628F7A194793ED379FDBDF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7640b29012fa0ee1f3a517d96c0bb4b3fefa6fbab058facd8d40ec0d9319a307
MD5 83775a10fd5c41715c42b5a37a44a616
SHA1 82099cf3a054830fb86763068e2cf12172b22df3
SHA512 a3e0c3d8346c7924b4e02fd380698af0afc51e059120bacfddb9a954d67d4c63737220ab192d136794e62e1eb590f537308d80837fbcc819bdcd2792f2df1d40
SSDEEP 24576:lQ9MxZKdcz9dw3//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lVKZ/LNiXicJFFRGNzj3
TLSH
T169558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 c082bf40f0f31b8fbea873986109427f30149c5937e5cf5d015dac56aaa087d3
MD5 68d51d49326a574e4ab810e58ad973dc
SHA1 b313354e9f93601de8a6113323cd3874a4d9c956
SHA512 301065a252b01fa8f5612efa651448a9e51e694ca99a871d3ec3227a29dcaf109f81247a6c6160c010afe2068021591cb3ee91d9d8936d76d95faed9b6ae37cc
SSDEEP 24576:kyoceApC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZoceApCLNiXicJFFRGNzj3
TLSH
T16F85E05FB76D40A2E176813C89858204E773B4345B6257CB6291C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e303e197d859c0e15dfdc451f432b6ab69215aa8d18a26eae73f95bb0b31fe78
MD5 c41560bd568f539c578302656202afbc
SHA1 bb30f63a9984b0dbfa9cd4b8b3461e511873b128
SHA512 686e2120d03289e1f64a31daea8ec30a01c643ae99aa1f5dcc0ec7c93eb66a30f025ffa76c48f20375a665c7561854c48fc4c70c27e48a411dae2cd976f95ccb
SSDEEP 49152:oWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKCLNiXicJFFRGNzj3:K0zuNIc7wRGpj3
TLSH
T12EA57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b7da0c6c732f910d78385d9c315bc6b3d70accf232cb20323032e9557a768129
MD5 1196232c7d1dbcdef07fe2cef2423406
SHA1 aa629e218cde0c6d8f4d404c4b7cf76c6ca17ea7
SHA512 8352c7d9f07f7b59347b70bee476ec2e44436430eeadd39c1c755bc199a1901e55abe08d4c9533d21324b546ad36578c706e5b5a3f05d838b03552d9b57f018a
SSDEEP 24576:Y1QT7EcpfxR+N5AWAz3ooiYzjMqbf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lTDxR+N5YzTBjMWLNiXicJFFRGNzj3
TLSH
T14655B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-80-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/204-81-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/204-74-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/204-236-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1248-359-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1540-362-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/1836-435-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1836-353-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2372-379-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2372-441-0x000000000C360000-0x000000000C368000-memory.dmp

Download

memory/2372-439-0x000000000DC90000-0x000000000DC91000-memory.dmp

Download

memory/2372-438-0x000000000DCA0000-0x000000000DCA8000-memory.dmp

Download

memory/2372-361-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2372-395-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2372-399-0x000000000C330000-0x000000000C338000-memory.dmp

Download

memory/2372-363-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2372-445-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2472-297-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/2472-355-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2472-291-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/2508-433-0x0000000140000000-0x00000001401A4000-memory.dmp

Download

memory/2508-244-0x0000000140000000-0x00000001401A4000-memory.dmp

Download

memory/2792-304-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2796-358-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2796-443-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2952-356-0x0000000140000000-0x00000001401CD000-memory.dmp

Download

memory/2956-67-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2956-72-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2956-59-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2956-65-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2956-70-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3216-255-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3216-249-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3216-248-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/3216-434-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/3252-274-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3252-437-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3328-357-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3752-354-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3752-286-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3752-280-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3808-444-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/3808-360-0x0000000140000000-0x00000001401B1000-memory.dmp

Download

memory/3932-0-0x0000000000400000-0x00000000005CD000-memory.dmp

Download

memory/3932-45-0x0000000000400000-0x00000000005CD000-memory.dmp

Download

memory/3932-6-0x00000000021D0000-0x0000000002236000-memory.dmp

Download

memory/3932-1-0x00000000021D0000-0x0000000002236000-memory.dmp

Download

memory/4292-232-0x0000000140000000-0x0000000140195000-memory.dmp

Download

memory/4292-11-0x0000000140000000-0x0000000140195000-memory.dmp

Download

memory/4552-24-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4552-233-0x0000000140000000-0x0000000140194000-memory.dmp

Download

memory/4552-23-0x0000000140000000-0x0000000140194000-memory.dmp

Download

memory/4552-15-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4588-263-0x0000000000590000-0x00000000005F6000-memory.dmp

Download

memory/4588-262-0x0000000000400000-0x0000000000582000-memory.dmp

Download

memory/4588-268-0x0000000000590000-0x00000000005F6000-memory.dmp

Download

memory/4588-436-0x0000000000400000-0x0000000000582000-memory.dmp

Download

memory/4828-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4828-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4920-39-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4920-38-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4920-32-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4920-234-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5048-235-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5048-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5048-56-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5048-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5104-426-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-424-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-423-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-422-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-420-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-419-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-418-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-417-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-416-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-415-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-411-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-412-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-410-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-409-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-408-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-407-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-406-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-405-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-404-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-403-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-401-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-425-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-427-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-428-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-429-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-430-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-431-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-432-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-421-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-413-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-414-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-402-0x0000021E18170000-0x0000021E18180000-memory.dmp

Download

memory/5104-446-0x0000021E15730000-0x0000021E17607000-memory.dmp

Download