8b4139f3efe61e30c55743187201d9ea0a741777b316671d95e699525f41e752

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
Size 1.5MB
Sample260702-ar9fpsav2s
SHA256 8b4139f3efe61e30c55743187201d9ea0a741777b316671d95e699525f41e752
MD5 0bd19f404ddadcd0ea8c52e9b1326393
SHA1 e05a12ddde2c64e237e4333cf502131e16be93fa
SHA512 3c4f43eb29bc90bf99abdc80841ea041c47dea427ad097cd5576ac35c840305dade99e3a557a768550e48bcca8c6bcbb9af7220ee4c596fac4046ab01a1211f3
SSDEEP 24576:V3qgcetbQz43+wSatr0zAiX90z/F0jsFB3SQkj:xbNUB/aB0zj0yjoB2
TLSH
T16E75BE0137E89131F1F73A7679B692254E3A7C61BE31D68FA240AD1D2E726C1C934B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 16 IoCs

pid	Process
1688	alg.exe
3316	DiagnosticsHub.StandardCollector.Service.exe
5676	fxssvc.exe
2836	elevation_service.exe
3412	elevation_service.exe
3420	maintenanceservice.exe
988	OSE.EXE
444	PerceptionSimulationService.exe
5900	perfhost.exe
5732	locator.exe
4648	SensorDataService.exe
4752	snmptrap.exe
5796	spectrum.exe
3516	TieringEngineService.exe
5540	AgentService.exe
896	vssvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4ce0f5f65a3b5d25.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f243d3dab909dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6ecd8d9b909dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d5a89dab909dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000684b38dab909dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd2412dab909dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004dd9e4d9b909dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c4dfad9b909dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3316	DiagnosticsHub.StandardCollector.Service.exe
3316	DiagnosticsHub.StandardCollector.Service.exe
3316	DiagnosticsHub.StandardCollector.Service.exe
3316	DiagnosticsHub.StandardCollector.Service.exe
3316	DiagnosticsHub.StandardCollector.Service.exe
3316	DiagnosticsHub.StandardCollector.Service.exe
2836	elevation_service.exe
2836	elevation_service.exe
2836	elevation_service.exe
2836	elevation_service.exe
2836	elevation_service.exe
2836	elevation_service.exe
2836	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4888	2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
Token: SeAuditPrivilege	5676	fxssvc.exe
Token: SeDebugPrivilege	3316	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2836	elevation_service.exe
Token: SeRestorePrivilege	3516	TieringEngineService.exe
Token: SeManageVolumePrivilege	3516	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5540	AgentService.exe
Token: SeBackupPrivilege	5300	wbengine.exe
Token: SeRestorePrivilege	5300	wbengine.exe
Token: SeSecurityPrivilege	5300	wbengine.exe
Token: SeBackupPrivilege	896	vssvc.exe
Token: SeRestorePrivilege	896	vssvc.exe
Token: SeAuditPrivilege	896	vssvc.exe
Token: 33	4852	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4852	SearchIndexer.exe
Token: SeDebugPrivilege	2836	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3852	4852	SearchIndexer.exe	126
PID 4852 wrote to memory of 4240	4852	SearchIndexer.exe	127

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_0bd19f404ddadcd0ea8c52e9b1326393_amadey_elex_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1688

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1492

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5676

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3412

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3420

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:988

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:444

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5900

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5732

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4648

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4752

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5796

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:5752

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5352

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5540

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1776

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5300

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4688

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3852
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6975bd078ee63d9d7d0d846e22a1fc2a2759849c296b205b7fef94605edcbefe
MD5 fb4f81057b42f16ae59688b17a7400c6
SHA1 53e2a05b231484a292e6b8f4859e8ee6669c9a19
SHA512 63e0a8f57b3740838b8e7264ed0dfc873e779bb07e6c62d372d49ecad9757388242f1f8c66796e91c50e4c1f7de7709795bfaafc17b65f06209d75c07830d977
SSDEEP 49152:/b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnZaB0zj0yjoB2:93q6HjBPB2Yyjl
TLSH
T10DD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e08307fc2335fe52a6e5c341f8e1729d46395c916104bc9f59bf90d028533ba6
MD5 39b10c617a56a7bdbdd906c1b7969147
SHA1 65ef954f8170306c29d180f3fda931fe1bcac935
SHA512 d0249f87706a0dd7fe74b9b5efb461feabb75a9ccd09bb2838c217602b04862efd8a6bcfe8070689caccf019b58823d54b9b8b3841eae82028a5fc4f39e91fe4
SSDEEP 24576:sXYfDtczAkatr0zAiX90z/F0jsFB3SQk9:Ltc7aB0zj0yjoB2
TLSH
T18A65022977D504F9DC67823DC9A18506EA73785147A0E7CB03E4AA2A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e935547accddf8e8f1389f9f27b5f76a6981ae54349678f670a091961897ba95
MD5 ba9775565b77b8caf57dcbdf5b265a71
SHA1 658c53edd8b67d57a79b26fa8fdc5d473a44cae5
SHA512 b071832b6770acb3617ab8f36841702718c82fe199963e84eaf3990e9074afd80f4565d81d09b846566e9c41c548d0763e7db54a23a7100f380ef0049f207440
SSDEEP 24576:f0Le5ji0hmxirMGatr0zAiX90z/F0jsFB3SQkV:fPji0ActaB0zj0yjoB2
TLSH
T122859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3e0cce41f4ef430e6bbf1fc9608c509d06548249ae09730dee71336129501506
MD5 ca1ed639946f89644e3e9fc99693a707
SHA1 6aa90f87ce2fb3575c85fb1a84eaf5c43535ca7c
SHA512 7299b4d236d1825311aaee896f556c11ef9ea268850d9af3afaef0a3283194a5af772a77a9fda80a8c5d08bcfe32d34e8d64fccc75b88f471add3c1c0525b573
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWE6q8wyuUatr0zAiX90z/F0jsFB3SQkQ:I/ezSC6vUzPvxHjyJaB0zj0yjoB2
TLSH
T1D5755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 beb51139257fb60112b8d850e90265fc932c06fa2ce4715eb9b4d441edc8c7fa
MD5 ce2f9d83c9f85efcd12d9e2b7dd68d32
SHA1 efe44267b95e7659a450fe0c8c95b387253e0c5a
SHA512 3a0aa5b8512db62317f7ce65d2b610978e7faf50d9940fdf7dba26719e08ce3b7571249ed08356869b9547346945d700b3bb8b10476ddf3f39047d6203dc4bbe
SSDEEP 24576:cVbqPb88hv/l+6fatr0zAiX90z/F0jsFB3SQkp:cVO88hXl+CaB0zj0yjoB2
TLSH
T19E55AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a43185488e6b7950832a0ef3192112af70a54adc1895b1cbfef1ed8b8113958b
MD5 1fa80eabc37a243aeb131725d5dc1887
SHA1 72aada197f79a3dc72d4f563ca68cdb9d1aadfca
SHA512 06a4a486d7ba3320e5050781a0bfca2d875dc73f99ecb6bac878aa866cc143efac77ce1be9fcd0ea90644247ce5e578b1e884ba80400169a37b5ad8ce36b2038
SSDEEP 12288:5RqUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik85:5Rqatr0zAiX90z/F0jsFB3SQkW
TLSH
T12245230B351E80F2CDC31B3526989C4B1ABA5EB065E2AF45A2D13F4F8D3C1C6E5666C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 b10b683856c2d17eff8696d2fb6866fe25a26fc9fd546842cadfafcb0727d2d2
MD5 db7fe7fdcc233a584f07da34a442093d
SHA1 9f877411f54b44ca0d6b6dc276b3c264cc179a68
SHA512 03a1ca5ebdc7e1a3c0bc9c39971153bcf91471b5c43eb7c6db4e4ffad655cf32cbdfd513fc17c0c5c8097144994adee949f4786975713294f7ba82897052bc9c
SSDEEP 12288:KeBNUbTVO86UXUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik80:KJIUXatr0zAiX90z/F0jsFB3SQkt
TLSH
T1D465DF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 26c0c0a7990bfc88f8f8af01c2599049d457cd609e19e86adbfdc303c9d4500d
MD5 4627a55d6c0fe4089b7fca9bb86b78ae
SHA1 cc72a169600a5003f87e4da76227271bd2edb735
SHA512 d70a574ad2f98b4ba75f74e707bd4abdd1bacf55e4ed76d8cb224a74264bc230d0cd2081e4b331408d6b2e75a5e060231543aa18af2d3217c5576311bd862086
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THR:aQvGAdlCEL8c/yRNw5CbB2Yyjl
TLSH
T1A6267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 5c0b2eec5af5af73c68e47b713371c93f86e8fcde4c17ea1236d0910671860b4
MD5 e7771fc5d6764d9ba143c1ce06f1e121
SHA1 5332854399f152770aedc3ae3bba09560d074041
SHA512 03369e81515c7407b88548039c0c2513a1241551b13f21927eae08d2e1829f78c78b79d5c61d9ef4bfd6a4488a6adea572c00294fdd09045c98c8dedc8f3b57b
SSDEEP 12288:8AwSfxL/2Dc34DLLmt0LDQewsAj9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHR:hdewsAj9atr0zAiX90z/F0jsFB3SQkp
TLSH
T1FE75E031FE75D032C6BB0DB61B25C706147D7A604BA21AC3E3E86E8E59342D22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2cbbdfd4cfd140ede4b60fb4fb284a2dd32e8cda5fdc9765bbde9cc9d17a7ecf
MD5 618134af2cfed7ef643eade3fbaa7922
SHA1 06f457652b3d2af1272c9570dc6efc1f5b47f15a
SHA512 94002cb34b1095420f8461bfe66718bed4924aebebc3af76cae286f9859b021d6de9e8a684948d328325a1969f75358d6c050b524f1b7ccb0e5402cfc8283d00
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHUZ:0UEtQevvqc2W1cpV2EI322
TLSH
T146474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2afb8feecf34c5af310a3a9148dd0bb35fcb51fff36a3832086e90ded9514b09
MD5 0a0d0be3c80843870884707b416c6482
SHA1 82149da2e900684c13af59689bc6f8d7feea6342
SHA512 a711d82d5e7d4505fbf00227614576594f5bca85f66962b30870e449ca6f5b612a3ec19a0fdd2c28eb6e8ad5e9dd09fde6a26fc1b6bd81e373489a27ad390b86
SSDEEP 49152:TCbRquA/m2yL5zQfFiV+XenmE3/zdaB0zj0yjoB2:soqtVjnmfB2Yyjl
TLSH
T160D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cd0f9c3720a0e8750fffa66eaf3a61c06924d0c3845566b0f846fee157b9ebd9
MD5 e83ae02da63517a46a92219a1ec84b96
SHA1 3e8c705d30e57f0cdb7ed3e0c2b1b3acd2e04cd2
SHA512 4a911e8177431503c5ecae8f86e576bc0be6973336ea958e41a9eefc99649cf38a2a69fa56e13b0fd9e225854a8c4e7fbb4feac3f8501210c85f297d441ea803
SSDEEP 24576:qAhGLJIFoiwtA5l7S53gatr0zAiX90z/F0jsFB3SQko:qAMyFoiq5QaB0zj0yjoB2
TLSH
T14B359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 354f538ed41dd6a98feb45a05f42a6d60f5c861d904a8beb7458fdc63887ff5e
MD5 1c6025b469bf3f1da0a6b736731bc277
SHA1 2bc61b95483f3a2a38a6c70c7fc4b2f7d221ee28
SHA512 95c6493222808d22fdc31977a92282ed53b6a644ee3051fbd5fe4f197388361396bc9a0dff4cae80cf241bd7ad8f2a9d90b2d69f3e490ef6213ace6db063b639
SSDEEP 12288:tmw5HEjsChNVBFgl0WDm+C0UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8T:IwuoOWpatr0zAiX90z/F0jsFB3SQk2
TLSH
T14365F14A36A90CF9E9A342388647C536F7F2BC112A61DB1F1360CB5B5F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e534f9ad66fdfbd8dea9c39ca816242535b27269d2de7432b1f9f0ebd583219b
MD5 a25cc13623fec1fddcc4b16d7b194501
SHA1 10d31f0e6308c099ad667e43f345eaa3de9728ed
SHA512 d7f06d4fb7f135a4f76c0c94cbad2356dd9be42afddf13858d0a56c30dbb3afcc56e80c009a168bec7e00d57f93c76f303e806be524fb51bccd11073a274f42c
SSDEEP 12288:gBZ1IyNUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Q:eZu+atr0zAiX90z/F0jsFB3SQkh
TLSH
T14B55124B32A960F6D5D3523C89E48906D7B2786123B283CF12607B5F5F36AC25E39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 39c0c0a86d5fe7419120e16fcaa0fa83df33f70748a5ca68880d3d88aed19b6c
MD5 138efc374f868beab9d1f75ef611e26b
SHA1 673de97c1990cf26e571886c641127c1c704b4c1
SHA512 458566c56984e1a7d233c627a1c80cae18642db07c7143c40b5934ad9053697a2a696ff8de5207b8e0a12da4af3daf96426fce1f390a5fe2bf93debf3ca51226
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UV:MQRQyi36YOcPQLvw2gAf+PN3eB2Yyjl
TLSH
T113667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5819b1ee2af199071247b942f95affeb7db960b96e8083fb86d9fa2402de54ea
MD5 3518dac9335e3f6cfd48a915fca06975
SHA1 a97ac3c053dd905065e718d96a2b26d1d739379a
SHA512 a10f43c6a7c962775966e6226a4b6b4c8d0c43c7d7098048a9620a2eb247693f43926c92a34f6be724b66efa1a7a09a5c3761058dc8358f1f734aaf8836a825a
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UV:cQRQyi36YOcPQLvw2gAf+PN3eB2Yyjl
TLSH
T196667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6ac6acb8e89685fafb687e9bad967e39df8a48a868cf5dc2a0b71a9b427df089
MD5 6398c94753c0a538eeb1dab6e2ec92fd
SHA1 068509c662942960cc24f0a3e88f9549ba64bfbd
SHA512 8ead60e1111a8c23adcb189d1ef2bf0f368101c83a516a9c46e1a75a2950ea24eae634ddb32168de1999276ee79c63caa1a8eb37172b18a666ecbe5ed1628282
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0uatr0zAiX90z/F1:w68Qg55nhheWu7PNU3/taB0zj0yjoB2
TLSH
T1D4B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 10cd09562b97210f07269987b0da38a53884f4c193b01399c8157fcbdb3bf621
MD5 a9c51e9cae1d850818ab13aada46b48a
SHA1 3855519250febb96d86dc062fd038c109b0854ae
SHA512 d4bb5785f6f25677db5b7c3a9c8f109a228d19db743110d2c8a55caef347b31ca34644458e390a46792fdbcd0e89303974ee21c13f48aa73ddca8b57e804d107
SSDEEP 49152:/3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99b:yy5112gYy5azzVvL69nLKnhZtB2Yyjl
TLSH
T166167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 29141a364e4b90ce3814f145bbc88698e553325e15f164c7e2dca8c6f7999888
MD5 c1d9391967ce1f46c340258ec22fa9ab
SHA1 bf556ebcc558681c7f6c1e52e7ac5c4c655e4c82
SHA512 57fa6366c826abc92ab9d489c3ea40f89007a74c3e0749f29a95fcce42c29ef85a2fed9a2e309ab555c8e498dcf3d01ef530f0d5739375b1c4ad78917349627e
SSDEEP 49152:JB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl0aB0zj0yjoB2:fu6JmVxd2drB2Yyjl
TLSH
T156D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 461e88643ad272cb6f9945e3976066254f49695c766c04ad977a29b6d16ffc58
MD5 e0b40269759b6c9f3f23fdaa4ea3b60c
SHA1 2531ad4fd6bd5ca45c7a0d039cfe76e356148f05
SHA512 3edc575f41ba7efb30c66694341b2c4fcb847b61df173c413256867cdfbb91648f3ee10e1d163072d15f7da68b5ca88f170f4141458176fc741b2c1c27649c7c
SSDEEP 49152:M1hpsNoJpF1A6UU44CwH7R4x3aB0zj0yjoB2:MmifPbRfB2Yyjl
TLSH
T170B5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ca0d189345b2c68d9e89871052388887622b214aa2d138c7d94ba9177b893d1e
MD5 cc60d3a84c775df67a8a3bfb0b3bb47a
SHA1 8783027915e93747a29e6047170264f501350c17
SHA512 d04a569f927e7d1e003471634beaa268e7e7d199f54f87c0a8d68f541b7285a596d655c5d8035685a41dbe00b01e8531779f02e5addafb5712e3d88936c50890
SSDEEP 49152:nSuZQIY0Be2KRRVtOnks6NMHq+aB0zj0yjoB2:95dKTi61pB2Yyjl
TLSH
T117C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f19724f3a0048cc21662a43c99232cd2d8e2d1c89e43d6def9ad65013417fbec
MD5 244ec640d907aded75740f52d903edfb
SHA1 62dbcdcd3d2db929057c6c7714f036d06ee8acda
SHA512 04844e0c48e39ce8c9720ccd85aa98922849e352f175ee8f48b17ce0e2361bcd3df6ff2bcedb71c1695f491bc0acebddb382a2d31f20f4598dbfac0ff1fd9339
SSDEEP 49152:EhtSn8EApI0figngiDn0AP5wbaB0zj0yjoB2:FX2iyphDB2Yyjl
TLSH
T1D195BE13F2D900E8D05AD178C7468632EA62BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 bd617e28fb51c3489bdd0b03238774d5626be4aedc0598e04343135825d42e9c
MD5 87ab41203f2a581d2b64434f23aa3b5f
SHA1 b854f4fdcc43f399ec1830df4435d39cfa4cd21c
SHA512 d547c4fd69defc79a8bc7c4c3422d6af89e0371bf5f7eb41a61d1de144720ea49dbc18a2030b9a7a95fdd629be2b017664a3c6b8a230c9c68efe8fa7dda97aaf
SSDEEP 12288:BCUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8K:BCatr0zAiX90z/F0jsFB3SQkb
TLSH
T1BA45230B341F81F3CC831B355284984B5AB96EB4B6E36B85B2913F0FDE382C715656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 693a685059c5767b9b7eea96f49fd7cffaf56312ae17034654f637a4b5821f48
MD5 04923cc07a4a4f084618ac0237ff26b4
SHA1 90c2c2952161d87ce98df47f102afd82f6a52872
SHA512 d64d84aa54c3fb240a467c148272c59f5650d76390b11526e072b57261abf4a3f414f733990c5e9148cced92d873f449a63c746725d359155c0cc2042dde6254
SSDEEP 12288:nxUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8K:nxatr0zAiX90z/F0jsFB3SQkb
TLSH
T1FA45230B341F80F3C8831B355284984B5A796FB476E36B85B2953F0FDE382C71665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 db72759d6ceca60a3aad4154f1461b445deea71c9e0d1459f383cffc2c8ddbb7
MD5 e0404c3c9fd6694640f8e45e24c4a8c3
SHA1 2de7a2433c11966245b3752088c2f5cfeebf7238
SHA512 a01479ea5b851478e2e68f3657e18b595366e752e1540d4b7abe620475afd58f424d73a2ef7e7688737a1fe47835f853b638f712c61382b911e4387dd9bfe411
SSDEEP 12288:xPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8K:xPatr0zAiX90z/F0jsFB3SQkb
TLSH
T1C245230B341F80F3C8C31B355244988B5AB95EB4B6E36B85F2963E0FDE382C716655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 aad477f18f38e256c1a01ce93f62289ce5f8fa00cd3db8aad56cf914f333f8c8
MD5 d3e34d23c84f48aa30cee7152e79d672
SHA1 ba297e03a4860ec347b1d8d6ea143754b9d67b9d
SHA512 13db163b6ecd9d6c020b4026c9d5c3a3fb2323a163705f0f8554555672337f504c55acc51f775224f35f1578af2ba0d6ee8c91d8b96fcc1008f422bdfe1fac80
SSDEEP 12288:UVAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik81:zatr0zAiX90z/F0jsFB3SQk8
TLSH
T14F45230B351F40F2C89397358694884696B9BDB0A7F3AB9FA2413E0F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4ee6bd506fec8cbaee72cfd06ed6f5d79917bc9efb570f68462104b1e3c8f888
MD5 b54c9ae891710153d4f05f8c35abcd88
SHA1 b0e45fec5922804675109893f7402c131d98def4
SHA512 ddc3a057dcbb478584292e4439342d26bc98faac1efefd62f208584415625956706b77b1218b03a21a6485fdf1161087ddf179b8719aaf584688d73ab18887c6
SSDEEP 12288:OoUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8G:Ooatr0zAiX90z/F0jsFB3SQkr
TLSH
T10F45230B341F80F3C8831B355244988B5AB95EB476E36B85F2963F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6debb0335904acef8e0879bebd339c1bfbd04f05be2d8c04bb050345bbbda228
MD5 f741dc17f5098791e0a32876baba7ecf
SHA1 4ef6fe3512193905a32a1a5c2a3c5b2d5e7a73c2
SHA512 4fb48c1650fe35eb8a361db6d61b77f5fdc0f8cb74d302e78363752ceafb1d57d7300319ba5044ccbed46eec097d31c0a7bee89b9776ba80d2aa77365e3851a1
SSDEEP 12288:11UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8G:11atr0zAiX90z/F0jsFB3SQkr
TLSH
T10345230B341F80F3C8831B355684984B5A796FB476E36B85B2913F0FDE382C71665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 309d0bb328ebb5e258d4a6e3ccc42d57b38b65fde2c1cd41085f719247e261f7
MD5 83ed7aeb2c3b502a6eba183c09bb5b24
SHA1 b6da4421e28a20dc4acd2075603500a523551b22
SHA512 95253128dd11cfcce67c55769ad22309eb433bbbd2b26c8e83a1b64b73e0017b0d492eabd7b9f66e3e2014200487712264169b77c2bc26e1f8d04f4f175951dc
SSDEEP 12288:5ZUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8P:5Zatr0zAiX90z/F0jsFB3SQki
TLSH
T13045230B381F80F3C8831B355244984B5AB96FB4B6E36B85F2917F0FDE381C625659DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 1789738f70eb8076e009cdc31b449979d4888aef59df3ae3582c1e1dc733573c
MD5 1f1bb4d174be30690755b4551d2c2fea
SHA1 e91685f75c863d9626aab9b08c49e0969a189faa
SHA512 7fbaea954d03a5998ea2d18e2200fdd99a1db967c819cdd690ad8ef27f961519575b98568e98ca91b404d05762a1e7b8e3a6f687b194863c71a3a045c362f761
SSDEEP 24576:JZMSzFVSORatr0zAiX90z/F0jsFB3SQkE:JZMSzfFaB0zj0yjoB2
TLSH
T17A65019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1c06f97e98233d31912ad658ae20cfe941bcff1bd1e9c154507bf99ecec5c915
MD5 b50e3e9b16fdd0318f1de2bcf35ecf41
SHA1 b4f52e9ffe44ada62716b2d0069a4dab5b83b937
SHA512 6856bb652d967792d14343b2e93936d71923e43ab39dd70b7f8f65d4f7d59212c51477b8dbb37d5f8d2d726b6a5726b6fece625a5dd55dbac886c93d5ae85d91
SSDEEP 12288:lOUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8L:lOatr0zAiX90z/F0jsFB3SQkm
TLSH
T15045230B341F80F3C8831B355284988B5AB95EB476E36B85F2963F0FDE381C716695DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c19ea9a6eae20811f6dbd1e20ba45ef72f3dce99b5e1bc07f09b21c5240ffe21
MD5 c22469b729e05cdce9fc99267ed10ba1
SHA1 b22ea091a0bda1cedc0cd1a086041d4cdce4f3b3
SHA512 b8f73ff4a67e49c417aacecc4a210d899f203646a6f1f9b3068b9f90eb1e84445c71c0f6e7bd98edb353a3025228c3a5e5c924ed9f3088b157d602179600a34f
SSDEEP 12288:m6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8L:m6atr0zAiX90z/F0jsFB3SQkm
TLSH
T1E845230B341F80F3C8831B355284984B5A796FB4B6E36B85B2963F0FDE382C716655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 83d5be0ff887f679b3f7153e51c3ebd032eda83de5ff2c44e888fe988e950a2d
MD5 a99089b618e8d3fbece9e4769bf88e71
SHA1 4b6c417107a8e1222cfa183f7af124d4bc6cf8c8
SHA512 77861a9c561c3516affa3261db71186401665f820fe5215448365cb995d3521bf07b542b98cdb3a9fdefe9ba47923089c699ba7254c32c7d85e0e04b22f64c22
SSDEEP 12288:ByPz5L8NUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8d:QzyNatr0zAiX90z/F0jsFB3SQks
TLSH
T108551207326620F9C4639239C9901906F776B83117A19F9F53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 af894e771dc40ab70191b18e818acbe7d9dee53a7a3aa74845f91b62d150211e
MD5 b43edd2f990089899cd8b999b1bd8296
SHA1 a4651291abb89987b2fea6bea02b7d987f60772f
SHA512 a9c7812ff40b40cbe7c098ff5489dc01e5fcf392458546327c891424648ad1d22c3006445b14422da04abe1cda9e41d7c44f2be658906f792b82289f57942e4b
SSDEEP 12288:2OUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:2Oatr0zAiX90z/F0jsFB3SQkY
TLSH
T19245230B341F80F3C8831B355284988B5AB95EB4B6E36B85F2963F0FDE381C716655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1d6cb446f2172f7d4c45bfc17f3f755ec25ff5a8dc6ff57fe19a7f0f2c5bd008
MD5 4ff4566f42a3373f70e7a84b9aa0e1b6
SHA1 d664f3aab51f16925530097f4801dc7a4a3bb9db
SHA512 52e2bb39b63a5bc411208ab89d3bdd051ffc90a7b4b6fd6a667d2c46ce541b62983152aa2d216c50a4ccc72e204893b6e3fecf87a5667d78f9a5d66acdd8a88e
SSDEEP 12288:dOUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:dOatr0zAiX90z/F0jsFB3SQkY
TLSH
T16F45230B341F80F3C8831B355244984B5AB96EB4B6E36B85F2963F0FDE381C716655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 feebaafec63c604341447498241d3b8eaef951a31c567d768f89814fdea5451a
MD5 e48a396d7f96ae85db3b74d4b729f50b
SHA1 3a816d37b8cf0ee78fde8e5608a06fd52b572ba1
SHA512 e7d1675720c4e3af0bcb100d12835dc930f87df4affbcc879f0579a46cc1d563d4d5e5fbac3a906a1a5c41af2890af9f56ae6cd7c98e1afabd7d2c1e04294925
SSDEEP 12288:TyPz5L8NUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:ezyNatr0zAiX90z/F0jsFB3SQky
TLSH
T1AC551207326620F9C4639239C9901906F776B83117A19F9F53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 20ae07dc88cfc0537517277ea5da07a7634b64270bdde8fc0e37e6af6adde173
MD5 741bed3573dc2d431b4c6c2e3d3415af
SHA1 c53818fbd5d141270e1c7d706f4324f4763c9b41
SHA512 da13a1ac2c36353124a062641f1d031451fbccf66127aaf660eedacfaa706f46083cdf377405ea1095d8322e379dcc906fb4fe2185f7c2f3969d69fd0ca900e3
SSDEEP 24576:GTHaLl3z0zD/atr0zAiX90z/F0jsFB3SQkx:GT6LljUaB0zj0yjoB2
TLSH
T11C650199735018F5DCA3823EC9548906D6B27C6A07B0CA5F13E43A6B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ca9aac3a55da706814bbd265c704a8e4a51e8973678c535f205230bb4757949b
MD5 d22b574eed9d14134318f71f692ffcc8
SHA1 3c1f26180e67996fa5d0e7dd004d88469a258fc2
SHA512 7b1de94d009d8a9a7f6ce614054efbda358b48ae9f4844419c0a2f837ddc9f63b6625ddd10857679a7b06f760f317a16f4bff9b5fe5fa21061fdc06ff4b63e50
SSDEEP 24576:537d9CHKy7GZzatr0zAiX90z/F0jsFB3SQk3:J7d9CHKyaFaB0zj0yjoB2
TLSH
T19575CF91F3E810E5F0B39A3589758512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6b061c2ae0d7e936f306b7305eb54d54b6b9cb5b48fd424fb5a26039388cebd6
MD5 39296eeb1c01f70371a70fc601c9404f
SHA1 f1f154b563ffb38225c71cee70e20307d94dd3c3
SHA512 1b344960be6805732336fb1b61b741093e355001ec20a575e91f18b21b13e556a8e1a4f675b0066ff01354403b624098914c687b2d3755f0dfe4e1808e0b7504
SSDEEP 12288:cvUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:cvatr0zAiX90z/F0jsFB3SQka
TLSH
T18245230B381F80F3C8831B355244988B5AB95EB476E36B85F2963F0FDE381C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 88c23519d9b103865fef11d705c6afc4013b4f0ab231c4684c84e55325876480
MD5 0f68d63c23e587417a1e0b15cd3763ac
SHA1 0d7eab741f17e45ce05e2c7372ff6f7da1b7ffbc
SHA512 d3c3d6a3f4f200ddffde750e1debe54dddc4e32a48a5a0d19afe9d947e04959bd25a16d00f4f9c10a21a8091aea681be91289ae2b53f7f5a49526c0601a2204a
SSDEEP 12288:ftUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8v:ftatr0zAiX90z/F0jsFB3SQki
TLSH
T1F945230B381F80F3C8831B755294884B5AB96FB4B6E36B85B2923E0FDE3C1C715655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ffca7312a17eca2dee1f944e44c69d6422515f970a17b16015297161efd54775
MD5 a73c61b470aba7e63ccde9a4bf0e858b
SHA1 fbdd27ab8d464807c3c66e381eb4772395eac763
SHA512 272a908a086ad0ea3d68ba923cbb2d0fef6645942c4e301490ba93acfcf8970baf5d75efaed595d0b450172a36ddc24032dd3f7940478d3726fc04aafcff2df1
SSDEEP 12288:WcUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:Wcatr0zAiX90z/F0jsFB3SQk+
TLSH
T1B745230B341F80F3C8831B355244988B5AB96EB476E36B86F2963F0FDE381C716655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0491f2f6ce7b42bcd913614a5153b62b92bed038f2337bbaaf9022851f5da40a
MD5 6bf75b568f8b050896d4ee166402ed67
SHA1 4e983e5d12900ce05b4a501a02bbe4b3a3ead22e
SHA512 8df067608986a2b61e92971502d1556de4b335d29ab42511d5a80f2122eb289391738a0aec5e3729e583020e459291be76a6a63061c3cac38cdde6862aabfed2
SSDEEP 12288:DOUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:DOatr0zAiX90z/F0jsFB3SQk+
TLSH
T10845230B341F80F3C8831B355244988B5AB96EB476E36B85F2963F0FDE381C716695DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 4e0fc14fae1bcef01c132b07a711a562d1b0795f16f791039a9ce680b766e4b8
MD5 3440cb6c1f680a98aae499b769d24dec
SHA1 781a6ebaef239fd3b14048d783b1cee60935c936
SHA512 703eed960648054c6d6a764cba039e83d0315ce9d3bcc8dde488331a8a60c2cb4a0e173ca8ef63a168ea6599525c95a07b6895b37d3955e7fd2ddccbffd7314b
SSDEEP 12288:OvUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8i:Ovatr0zAiX90z/F0jsFB3SQk/
TLSH
T16F45230B341F80F3C8831B355244988B5AB95EB4B6E36B85F2963E0FDE381C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 689f4884bed862986d3cdec63daf8abb6abe5de2cd9e58e106458379ad29443e
MD5 e9de9f19433c661d09c3b509997ef40e
SHA1 793817971d8f80d9796b2d36bbe2eb46c0900d69
SHA512 293f928667b1a4eac700040e2312413ef9540846e30071b4722d152dcb01f7d736ba22c424d83d8f435136fdf25a2fac383e5e944b8d1354648e7f49695af810
SSDEEP 12288:M2UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8e:M2atr0zAiX90z/F0jsFB3SQk7
TLSH
T18A45230B381F41F3C8831B755284884B5AB96EB4B2E36B85F2923F0FDE382C715655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a029396ed57204cc1a47dd376f1e52411c7c57730a45da46e89be89143411719
MD5 b104d9f229fdc5106190f2489ae8d0e7
SHA1 377161df18008eba3fcefdeddff3f09176395f97
SHA512 2c14f033022abfeda8830a8e145bcc8a2dea4accc611fe33573ce4699f8de10e5e5fcf9ee7ec164d48f224de26030a79335a7a5b85b3458b4077c8c06107c20e
SSDEEP 12288:8oUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8i:8oatr0zAiX90z/F0jsFB3SQk/
TLSH
T10145230B381F80F3C8831B355244988B5AB95EB476E36B85F2963F0FDE381C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 fb9d7ff91a388e3e1c64b6301107b04f80a22e4836774c75ce6fbce850511376
MD5 6c122ef95a57ef70a3ca98e73e068488
SHA1 1594ada4194302be7d0a83231cf50bf537fefb08
SHA512 f36391b0c644e377ced5b1bf506a3eb6f32789d35365cbb18aa4226a8bdbe31d3101b912a17b48a65fc2a4831b769f4e05e5d3657f9c463c2b46e77e6c49b29d
SSDEEP 12288:wnUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8V:wnatr0zAiX90z/F0jsFB3SQks
TLSH
T19045230B381F41F3C8831B755684884B5AB95EB4B2E36B85F2923F0FDE382C715659DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 c13a75fd137d8809db43367facbe411372246c94177510ea9daa5fc49d327ae6
MD5 20868fd2593f3e038d105d5155a6aec1
SHA1 9b5d93d8f99276a4163123d5e6f3d68d04b9ee54
SHA512 927d01fe92ed447e1ff7bae21584a770b59f9cec0036f7ac3e2739574ea171c61e7580f01e7303ee691563aca912be8d5006ce6100941ee737ec0101b4bdfbe1
SSDEEP 12288:DoUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Z:Doatr0zAiX90z/F0jsFB3SQk4
TLSH
T1DF45230B381F80F3C8831B355244988B5AB95EB476E36B86F2963F0FDE381C716655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 823e0b338d7916ee2c84a16a73e1d34c3949ce388e293338178cc6de2d2dbb7b
MD5 b865d9579caee7d776bde0b0c6efd3b6
SHA1 6077f1e02799da33893e3dc77c040686fe1fa439
SHA512 904feb274886550279bd051c434499fa3257e98497edd752f4326b40144f675ce30552b8609065932e343902ce80c7a76cb047c39f2654578fa3a97c3120cb36
SSDEEP 12288:UNsf+UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8yP:l+atr0zAiX90z/F0jsFB3SQkL
TLSH
T15455F00AE25801E5C4AE6239C7544A41B7777C6493E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f41e96d2ef6355d2ee211a79ead68938ecf8a735c47bc4140f0a512630772ca7
MD5 fa526748b60ec34bdecc6b7af2f6ac8c
SHA1 7e8779ad979c94614500ffcd56a44ad63c252435
SHA512 4bc790106ae664cc5e2c07962b1d34076b8de32fb933f91f5d8f29386dd8222edd70510d4f595a4b8d461393f223df75e140dcfea5bc57c3b11deed5c203af7e
SSDEEP 12288:m/UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:m/atr0zAiX90z/F0jsFB3SQkm
TLSH
T15D45230B351E81F3D8E32B301658C81A267E7A746BE29A87F1813F4F9D385C259356CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 08ff78a1ebe4c7300f9e47b2901523bda89a8d8465d82f161058808500e90b93
MD5 f2fb4f7d3570c97b9d34b979a2635105
SHA1 9420fa903400f29876d29fb2a719d0ad2fbc6332
SHA512 466822b8d198a4503a5437fe8447d776b4d00a02ca403759c82c8b1f9abdbd58e74029ae1917e73d5b129140514c93a2f266c1fea211ef43228ceb6d3cc3d5f9
SSDEEP 49152:Aa0h2GEkuAe73q3pp46zwwQhaB0zj0yjoB2:Aa0hNYG4JwDB2Yyjl
TLSH
T13E85AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 7e10b81abea0d459a93c0b623257359b932ebed1cddfd0dc69848dcb34967d54
MD5 14ec93e18aed035bccb44aa604c85168
SHA1 f48d4a06bce97c0d3c2aa3e6bd13eab948cfdfcc
SHA512 d161874c3cf49de3897e08c8b2a29f6b32b48cd57d2384e0225468212aa7340c5278182ae2549007a057ed9d41789eff188626a33968a0b211125cb692c57e11
SSDEEP 12288:4hbHjfXmUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8E:4hbHjPmatr0zAiX90z/F0jsFB3SQkR
TLSH
T1FF55126F26AD10E5E4B2A27D8594850BC731B8301762A7DF23D1A27F4F3AAD51C35F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 f30c2c4eaad6d6d74e4feacc9ad8e70c3a511059370b97745d5a77bea9c551ec
MD5 957134f488f921eef54ee26fbf77e828
SHA1 ad99fe5f698a1f853cfe4f7bb25aa562db44d870
SHA512 7d93b8ded5bc408a34ed553bc930faa8e54dc7552b1d8dd0ff2091bdd385fd4da2c4280f27ba88c7c492e3f07531fb33227fc9f6dbdc852bd8fe4a654d341093
SSDEEP 12288:ZbUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8g:Zbatr0zAiX90z/F0jsFB3SQkZ
TLSH
T12045230B341F80F2C8832B755688884B1A796B7067E36BC7B1927F0F9E386C716756C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 f5d70e84bff48d1f994dfda982a6472e5d7399a1344a1e1a76a752604f94a5d6
MD5 9fdcec1a408326e1693ed68ef5ed83ee
SHA1 3a446e9a9c11a4c2e483ec9b9c8baa25054eba81
SHA512 3dc0b1120ebf11763d3ca1c229f4070ad38fece36d09940b42d5335763ede10247f3319a287e398a696d6f7d10525a5464cf6af28dc06eb3ea8b59efe3574c19
SSDEEP 12288:epFtpOWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8J:0OWatr0zAiX90z/F0jsFB3SQkI
TLSH
T14A55121A36AD10F1D473623C8A81820ED371B871176257DF42D0A66F5F77BE86C3AB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 6236ba183dd5ff2d8cf5cb4f4ae8cc1b36f351061d691aa43587eae2d80dff21
MD5 7feb464e22d88b8f2414b835b448889b
SHA1 10915d9319a6864336f8add21fb556b0549a16ee
SHA512 35e48c6437830a9c13ed204cf04cf8394c6c519c18e52703a6abd8cee32068dfa4aa91d85ff4de2b0a9dacfd1b892ad05a7d8ac658c33b3517d133cac1e61785
SSDEEP 24576:aW6BApg2YuyuNDYTabvcdvNYf8km1Vatr0zAiX90z/F0jsFB3SQk4:aF2YuHNETovAvNYf8kmvaB0zj0yjoB2
TLSH
T15B857E2A27ED80E4E0BBD27D45B6D146FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 0c930d5b73ce4d922369bb512f656c39a14ff96a74758bdb6fd4e5b6a2800df4
MD5 0a8c5a26b0b4ba5a103f39db1940266c
SHA1 1df5f7be7e06d037139fcce8c525b074719a9d41
SHA512 6d011029ea3c3a9b97abc9e0a1ea5f7f343f4c186ed2f239c887d0e773c5fdd2d30ebad7041c539fa5a1337adafb277c00765b5da4b00900623ab57e3bc2596f
SSDEEP 24576:YAFs06+Omlf3NXEbToSatr0zAiX90z/F0jsFB3SQkY:dFs060lVXuBaB0zj0yjoB2
TLSH
T13A65AF2F66AC00D5D07ED17D8A97C91AF7B1746307215ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 cef9a6554f3b33b2eaf065940ecdcc986cb808f1892a1c4588fd096891d9f92c
MD5 9777851770a65cba64b1361dfd3fed7d
SHA1 1412608c2af815a2735df098da000859ecb05636
SHA512 48628b9f291ebe78405989fbb53be4ea128248d63ff93e6721ac7b20382aa1545b747d85156f946f67da2b6a49e094692b789ebc3dad33e257551b80d6f64472
SSDEEP 24576:3JnJ5D3WXBatr0zAiX90z/F0jsFB3SQkN:3JnJ5DGXBaB0zj0yjoB2
TLSH
T13775D02DD2A810F4D4B7C27482591B46FF72387D2B226AC724B4E5357F12EE09A79F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7099093d7c8b4f965d409859d7d99c160a6779b29b0abaeb8c489a7195407a47
MD5 00822b4f00fe958f88b214cbf339fd33
SHA1 9e9535e163f26e40d781f1f58cbe8c8c94910d68
SHA512 bef89fc33026025d0fb3e1ac420be83046c41bce4e7fca4261d38d29606f7d457e016d30225214ecc3d3a1d98c53854f33f086d529e7e5a5f31580fbc85117a2
SSDEEP 49152:Gg06DIKdwc+eQnSt65aVjaB0zj0yjoB2:fkB2Yyjl
TLSH
T104956C06B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 5994e8f2c039da0994a95d0a1ce18a0042ecbc16f0a9e323685c05dbc801fc85
MD5 710b958979af9e7fe83dcf971c158afe
SHA1 3443f3d517c259776195d0bd0a4b4cdcecd80eae
SHA512 915ac7a3a9cae4bf9640fee231a57e11e7b5b787aadc07f2362fbb893f8b0f718f4a0507fc74ccfd4e369ad9bbeede80ac0150e7d5b76689163562a02e11e104
SSDEEP 12288:IEP3RnLUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik81:jnLatr0zAiX90z/F0jsFB3SQkE
TLSH
T16655125E365D60F6C463A13D85908506D372F07027932BEF52D1A63F8F36AEA2D39B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 df8baedd240a8bc7bfb5847ce7ad2fdecc5b2c5ec27778c82dcbf72a2a870583
MD5 6a6b4f37b8237c7ddf74a68ca18aae16
SHA1 412d953c9816f1812e95d288b7237b69de85095a
SHA512 55c050eaf46f8623b659f9262d83027ea15a144ca2d7e5b96f16d68b927dc4d28e6797909de6e6afb81dc2c4a238b9d12e11f8232f697876373acd00fe50b5fd
SSDEEP 12288:zjkyWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik83:zIyWatr0zAiX90z/F0jsFB3SQk2
TLSH
T13D55120A335950E1D9B307389AA181858B75BC306B6297DFA1D0FB2FAF357C16D34B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 5f0f401d572c51006ffd12f94a5ed92b551876e585d9b783c8fddec6ef98be7b
MD5 62400a74ea380cdcfc86d506f0380937
SHA1 90148d320c9126c2f9b5c8e0c23bcf45d1fe8237
SHA512 2f3ef495b1ec74a452fcc4893cbadfb415e39e50c4ac52a76d93ae43221898b50d1c2b2c4dbef18a70dc5b91a2160116866f163fedde88a2e3e5145e37393011
SSDEEP 12288:CyGUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8J:LGatr0zAiX90z/F0jsFB3SQkY
TLSH
T18A45230F342B50F2CC831B3952548D4A56757A7027E26AEBB1D1BE2FCF382C62575AC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e25b39ff13a51714baf1ca14975975381050e78eca8b82deb3a28aa4c4a5780b
MD5 5cd9a1cf976c14796c283e3b936169ff
SHA1 239815b7c3ce0d0723d6c119de530273e7ce4149
SHA512 ef5585609aa388159cee35c9d1c45b31af79ace8c677428829ef2ee0b1b650bdd424624a551e7549e9cd5426942b0e542540e5dca690f33fa92c4776d7fe8a28
SSDEEP 24576:S1QT7EcpfxR+N5AWAz3ooiYtjMqbLatr0zAiX90z/F0jsFB3SQkl:PTDxR+N5YzTfjM4aB0zj0yjoB2
TLSH
T11055B02E67F905E9D1BE85799A23C502FB727821033193CB42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 0cdc59bf60ad444e6763138230e7d7544a7ca861344290473efe80298951e1ff
MD5 defd2faf555f6082e60e0f6d6c8b2a3f
SHA1 b6b00fffd678be5bd330dddd55f33aeb1100c84c
SHA512 715a56f6a771bdf4228e58a1975572f11d2e12e03bb04681d59ab84b0b55c6bcec29402a6a1c46f96362d9d14c9019f4d3e1d96b8a102aa757177aa16b488895
SSDEEP 24576:R3YgnJcRTk4yti+R5dBR/uatr0zAiX90z/F0jsFB3SQkP:RIgnaTk46pBR/uaB0zj0yjoB2
TLSH
T17045BF2EF2B910F9C8A6D236450147B5FB71782D1F209ACB0170C639AF1AED85E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/444-246-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/444-298-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/444-245-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/444-252-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/896-299-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/896-507-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/988-83-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/988-237-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/988-85-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/988-77-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1688-234-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1688-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1776-294-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1776-505-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2836-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2836-235-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2836-39-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2836-33-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3316-24-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3316-16-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3316-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3412-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3412-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3412-236-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3412-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3420-61-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3420-67-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3420-65-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3420-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3420-55-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3516-424-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3516-291-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4240-402-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-394-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-391-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-393-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-425-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-426-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-427-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-428-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-430-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-431-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-432-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-433-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-434-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-429-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-395-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-397-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-398-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-399-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-400-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-401-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-408-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-409-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-410-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-411-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-413-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-414-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-415-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-416-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-392-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-396-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-403-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-417-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-406-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-405-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-404-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-419-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-412-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-423-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-422-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-421-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-420-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4240-418-0x00000217FF820000-0x00000217FF830000-memory.dmp

Download

memory/4648-506-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4648-314-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4648-270-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4688-310-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4688-514-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4752-274-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4752-385-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4852-367-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/4852-315-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4852-351-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/4852-388-0x000000000CD90000-0x000000000CD98000-memory.dmp

Download

memory/4852-515-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4852-383-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/4888-0-0x0000000000400000-0x000000000063A000-memory.dmp

Download

memory/4888-8-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/4888-1-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/4888-74-0x0000000000400000-0x000000000063A000-memory.dmp

Download

memory/5300-510-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5300-307-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5540-296-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5540-293-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5676-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5676-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5732-266-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/5732-311-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/5752-281-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/5752-287-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/5752-280-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5752-407-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5796-276-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5796-277-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/5796-390-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5900-262-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/5900-300-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5900-257-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/5900-256-0x0000000000400000-0x00000000005D6000-memory.dmp

Download