7059c2ba4e84d7e78eca45caff708147143a2ccd745c22ecbcfca617356f4760

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
Size 1.5MB
Sample260822-nthyestemf
SHA256 7059c2ba4e84d7e78eca45caff708147143a2ccd745c22ecbcfca617356f4760
MD5 8194d2798920c566b7e5ef0514c21883
SHA1 93da90e8ac869c501b8c3a1c4f46ee9ab1cf2d6c
SHA512 356eb7c619bc48d62a665ad9a31c92fabbf43c2d1050dc408797a1bab0e8086770aa686f443e196a7a900d1ae452fb908cb63d309d9e9776aff0e43591e3ddfd
SSDEEP 24576:C3qgcetbQz43+wXatr0zAiX90z/F0jsFB3SQke:0bNUBeaB0zj0yjoB2
TLSH
T1FA75BE0137E89131F1F73A7679B692654E3A7C61AE31D68FA240AD1D2E326C1C934B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4744	alg.exe
4652	DiagnosticsHub.StandardCollector.Service.exe
3400	elevation_service.exe
3456	fxssvc.exe
2640	elevation_service.exe
3900	maintenanceservice.exe
1076	OSE.EXE
3904	msdtc.exe
4436	PerceptionSimulationService.exe
384	perfhost.exe
3548	locator.exe
2140	SensorDataService.exe
4944	snmptrap.exe
2296	spectrum.exe
4256	ssh-agent.exe
972	TieringEngineService.exe
5020	AgentService.exe
3356	vds.exe
4216	vssvc.exe
3180	wbengine.exe
2756	WmiApSrv.exe
1812	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\397622793a3ba122.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004411dd612b32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008da2d2622b32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003fd5e1612b32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000928230622b32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078d300622b32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a13360622b32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024af61632b32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004bddcd622b32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4652	DiagnosticsHub.StandardCollector.Service.exe
4652	DiagnosticsHub.StandardCollector.Service.exe
4652	DiagnosticsHub.StandardCollector.Service.exe
4652	DiagnosticsHub.StandardCollector.Service.exe
4652	DiagnosticsHub.StandardCollector.Service.exe
4652	DiagnosticsHub.StandardCollector.Service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2768	2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
Token: SeAuditPrivilege	3456	fxssvc.exe
Token: SeDebugPrivilege	4652	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3400	elevation_service.exe
Token: SeRestorePrivilege	972	TieringEngineService.exe
Token: SeManageVolumePrivilege	972	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5020	AgentService.exe
Token: SeBackupPrivilege	4216	vssvc.exe
Token: SeRestorePrivilege	4216	vssvc.exe
Token: SeAuditPrivilege	4216	vssvc.exe
Token: SeBackupPrivilege	3180	wbengine.exe
Token: SeRestorePrivilege	3180	wbengine.exe
Token: SeSecurityPrivilege	3180	wbengine.exe
Token: 33	1812	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1812	SearchIndexer.exe
Token: SeDebugPrivilege	3400	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 812	1812	SearchIndexer.exe	126
PID 1812 wrote to memory of 4304	1812	SearchIndexer.exe	127

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_8194d2798920c566b7e5ef0514c21883_amadey_elex_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4744

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3400

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2640

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3900

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1076

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3904

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4436

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:384

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3548

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2140

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4944

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2296

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4572

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:972

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3180

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2756

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:812
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a67a8a2356822c0d8085f2c81275e8ad82b228761d7e125e18e18f065c83f652
MD5 9274a2b943e33a03d63643ab0f8f07b6
SHA1 1c5f1768d8ba313c16f44c289a8f13eb4ecb1c2b
SHA512 acf7915989101a57073ced3b38595a0e8f1efc9f8538d820462d3f5e3869d010e0a118f7a305c14e8ea07248aab662446135c56febba3b9bcfeaff4e7d5e9c5f
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnTaB0zj0yjoB2:K3q6HjBhB2Yyjl
TLSH
T112D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9fea22c129a75d62ccd526f57c122a68477f69b9b2ed04b810043905e708be09
MD5 3f3656ab6a3134f1391ae3d1193de5a4
SHA1 3693ed875d84ac6ce4bf848c7a4828e5fe92e768
SHA512 08cf1f58b3cfbcdb406f5ee91b5aff5a448910122a8b761ea011cf6ca00ea1fb7ada1ad4a1f9cfc4c1360b3b721063237898f2ad559f65868617f3655c9bc72c
SSDEEP 24576:/XYfDtczAqatr0zAiX90z/F0jsFB3SQkL:KtcdaB0zj0yjoB2
TLSH
T19B65022977D504F9DC67823CC9A18506EA73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 159c740cd2d78d5c96458ca19e8883b0d6061c5a9fd102765186fecb1fa63d1f
MD5 9e7ff1a36fb2da05c375c2c003553ff3
SHA1 4d171b96fc362e26dd2630d6d4b67dfb22fb175f
SHA512 164595d6b2d74cca8a0e0c5eddc4d165853f465f7a242c74176ef8668eb7a3fb7869e8e5c9c2fcc36e166a1a5ed9d8a2d35e732d5015ebf1501d43543f1a7220
SSDEEP 24576:T0Le5ji0hmxirMratr0zAiX90z/F0jsFB3SQkv:TPji0AcAaB0zj0yjoB2
TLSH
T185859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 638c4210af4b9e8eeabe55d5c55c53e2d098003415f5a1740f1b145e3396c4d0
MD5 1aed0dc0fd9cfbf0597fa03b47ab4909
SHA1 cb1e2a2f7ba2c364d98688bb43ae3f52126d85ec
SHA512 1e19f28ca584f4d7c3914ace0083a3a18a25924253356feaf680f9481697f9d8892dd8ccae7437b1cbb721ba3f31f30ca83a3aec6a0fde057f60e8849c781369
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWE6q8wyuNatr0zAiX90z/F0jsFB3SQkI:R/ezSC6vUzPvxHjyUaB0zj0yjoB2
TLSH
T1F3755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0295bc41fd1332afb2cde479ca1c401993d2b8bf71f94e16084004428c7dedc9
MD5 848aa8cdc83f44e4f2607203b5efa3e3
SHA1 c4718b24a491513d21cb100f3884f4bfa717d566
SHA512 9fe033d385ec945389167c414b022fc2bf9c527e4dd3faaedc3f302aaa6c1d11641a2ecae3a1365fa371354c06f6d70fe08c04b4fb9dec624e4b1f57d561eef9
SSDEEP 24576:GVbqPb88hv/l+6Gatr0zAiX90z/F0jsFB3SQkJ:GVO88hXl+faB0zj0yjoB2
TLSH
T10155AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ae23c0f10ea9a61204f4e8899f6f733a2bd26dfe275f705376f6082a05486184
MD5 481c76cd104dd4f9d8924c7b844387d3
SHA1 7135a3131dc14c83e893c42b3b3aa6de2d20d48e
SHA512 1867e541890d855f609874a8c16b98d7632ff6f7fdbce0053bd0ca542ad2af9083dceb2b208d9b032a27ee8a8419e19780273dd0ceb56a725b8378888787738f
SSDEEP 12288:tRHUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8j:tRHatr0zAiX90z/F0jsFB3SQkY
TLSH
T1A945230B340E80F2CDC31B3566989C4B1AB99EB065E2AF45E2913F4F9D3C1C6D5666C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 50cb4fd76c1c653ddb01e0db268e98c81743730bf4a1d6093c2f94b09bc3c7a4
MD5 916157418b5881e9e83eea74a8d02485
SHA1 945ba52c8b63d0d29c3b779c9bb0cee90330f11f
SHA512 a471e8be729a6c0d9996dd2b5d2c27c20f1a80eb569c90b1636c9e4d20bd1e760dc6c42f23195950d87fc45e85335299dd24511c061a8c709956330202cfcb33
SSDEEP 12288:SeBNUbTVO86UeUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8a:SJIUeatr0zAiX90z/F0jsFB3SQkn
TLSH
T1DF65DF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 680d12c6bad6ab768436b7597a9e2a5c0887577acbeee9a5ef8d6f27fa29d8a3
MD5 20884a27efb299d86f677b5af7276f92
SHA1 e30d11fe0b11706167fbae7ad1157093b29da265
SHA512 92d22917b82e9acee15658361ef421b006e4edd4537a13723d160422eacd74d7bd4b58e2ec9e94e06fb10e60877bc14a8ffed3983d1bf35ff3d6b24967e4c37b
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THI:cQvGAdlCEL8c/yRNw5CsB2Yyjl
TLSH
T135267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 3adb6747f578ae3f8283388e3bfc9aa7941f8d83c766a4db405704096af2030c
MD5 2eceac6ccca39d92f32957454986bdbd
SHA1 0fbb4a93d41d7ddfab57d2de7ea61a99fe6ee2fc
SHA512 625340f0c0beb1a6c0c991a232d3bacc262b54d50dd8656e08f5b97f225d4b3fd406aba1971dbdff3c8cc30446f673f83f35a9766421b9f9ca2e6856785292b4
SSDEEP 12288:lAwSfxL/2Dc34DLLmt0LDQewsAjwUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkH6:GdewsAjwatr0zAiX90z/F0jsFB3SQky
TLSH
T13575E031FE75D032C6BB0DB61B25C706187D7A204BA21AC3E3E85E8E59342D22776E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e3ab46d68c5cde256ab43c9cd2feb0f247604208a3d855cc9ec05677a1441fae
MD5 f1529aafd2e43cca10b167dcde4186e8
SHA1 9e3048b81ae10d1167aee1d9beddddd34d320935
SHA512 877de8f55e0fa24e56d64379c52324b2a0e6b1ddb48788d13fa15742cf11f27e2a11447f9e1190844b21cee4fe7573d7441188f67024d1f52f26d5dd94cc753d
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH3Z:6UEtQevvqc2W1cpV2EI32J
TLSH
T1F7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7759941052725640d4bed3aa6925eb72b01258cc7a6aaecae3635da29b36f675
MD5 eb37e60596425783a31b856a5edc09ec
SHA1 e0c25e0432260c106373cd2ef533f9e9bfbbe08d
SHA512 b5e2ef9208c42e7d9b33a05e10e68c92398f8a830e806df6c0c16123f24904a0424c5b2494eb91b8a98d9027a68e8a9bf0d6595eed3c679c52ee3a0ee38ba51a
SSDEEP 49152:fCbRquA/m2yL5zQfFiV+XenmE3/zQaB0zj0yjoB2:4oqtVjnmIB2Yyjl
TLSH
T1CAD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1ccc6f889b07d8650f5311c8860199af61f126438f849950ef90c917757b5864
MD5 62e971b316df8a9437c5a12fd07a9c91
SHA1 2f4546423fbc35d188e7c9cd2d7943b5adf52238
SHA512 6b6a5bf2e6c181ae094b8219006055ace332278660d81e3f77e806854e109acccdc3bfb4b96c79e56ca82bb8fe413c6ff8d28d43d8915a188b76d337f4076a7f
SSDEEP 24576:EAhGLJIFoiwtA5l7S53Batr0zAiX90z/F0jsFB3SQkZ:EAMyFoiq5RaB0zj0yjoB2
TLSH
T19A359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8e27ab72f4c997c757a352c1c23245848380bee119a761ac2170dd2332fedcfb
MD5 6f19b3deb9453c0fbaf5a127e482df91
SHA1 b5f0fa6fd3f668852e72b6ff98e4dc57d87cc1bb
SHA512 066173d2108086a141443f8c37a6534d636efad33b412f9236cecd61011b9c08997739b69e38cc4bb89de47268b4599f75476f0d43a997f2a3b71ae2bed305ff
SSDEEP 12288:2mw5HEjsChNVBFgl0WDm+CtUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:vwuoOW0atr0zAiX90z/F0jsFB3SQkk
TLSH
T1AD65F14A36A90CF9E9A342388587C536F7F2BC112A61DB1F1360CA5B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7a02243972e67a0ec3f3358b47a505187e6f2fb5cd1c529648e9c140628ad3b2
MD5 357d61de94cfee31bae38a4173d863b7
SHA1 62bed3da3aa85a9c3e140a861e75ed3267721331
SHA512 00ca5a1b3381fd42a70017a82450d3f572a72ccd8d27dccbb25454849fa60aee334a4c554974526c7dee167db8a3ea6b1af5295e2e74c1fa0d2c2c218091b713
SSDEEP 12288:CBZ1IygUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8v:sZuDatr0zAiX90z/F0jsFB3SQkm
TLSH
T14E55124B32A960F6D5D3523C89E4490AD7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9ded13260b6caf59a5840847a10a3cf37ea4a53528405f1413ffd4b97ebcea9c
MD5 6297ef3251224f7b68d5419251a760e6
SHA1 e6a166436af38b17082214dee23ff10d2929002d
SHA512 f37a2a5022313fb91f8d04fdefbfa1a7c1895f76a82fa5bcace27d04a72c7857b65cb1a70c5e85f489e2de3c883b79fc2c8e360eca8c8248c9cf0a0706368db0
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:8QRQyi36YOcPQLvw2gAf+PN3FB2Yyjl
TLSH
T1EF667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e4678fcfe15fbd7c85dfa80356f2fa661ba6a7ccfbeb3fe13d42d94ef021edfb
MD5 f4ac817635862a03860028a1498d0728
SHA1 a87d44a4c8dde4de35178233f43b11f2bd18de66
SHA512 0ff0c4a160872b2c0cdbfc962cc3d523cdbad353809f60531b2d8b675a8826a14be1af62308df1c66726b77a8a20d426e27bf76d12a6ce6f9033393e8c2f9d85
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:sQRQyi36YOcPQLvw2gAf+PN3FB2Yyjl
TLSH
T178667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 76008f303a6859af8223218a54b801c32cead65ca009e5e1ce53518c45c87df7
MD5 897d858341d78a4b23d4e0af6acdf30d
SHA1 ce9c9e2fcf378fae51e38c04f981f3261acb95d6
SHA512 3a7c6b314edf6bed1ca6c205fadf1e33522d3f63b94a3eb4d525f81d911a0e49f7d840d3607cdfec567f6cfa82d604e6ed0a275094de60a8bde259065937a06c
SSDEEP 24576:xwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Tatr0zAiX90z/FZ:d68Qg55nhheWu7PNU3/AaB0zj0yjoB2
TLSH
T1D8B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a3b7d59e9b639ea2998c8e9d1d98f68d4dbb0f585a8e7b13c6cbd2ab2d3c420c
MD5 2a031054ad81080415d50605812a900c
SHA1 e537d52079394788f9920acc85113fe112b44f01
SHA512 f647bb481a7fac2576c94e74f4bde181a908cdb8fcc473062dc100268eb074f4a6a09f70c5cb0cc83421d8b589bdb916ee4d2fcf1b652d1f33db4096560abe56
SSDEEP 49152:n3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99G:Ky5112gYy5azzVvL69nLKnhZ6B2Yyjl
TLSH
T1AA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bfaf62d6b26cce3fbb589baf93974a566a7bd157cf78d8666a2c84399d8c33e8
MD5 b6ea7d2720f32392711682aff4f41c30
SHA1 e7fb5c6fd099170f4bc34dc67594e54a8f1e16f1
SHA512 f2eae683b2eb2682410e6a927731d28b21552e93a7e62dd810ab1ff727af4f2f0f191e930326c961b6d4d9ce5c5e03106408862f8e397a2d8a377cc6201a5c4e
SSDEEP 49152:jB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl6aB0zj0yjoB2:Vu6JmVxd2d9B2Yyjl
TLSH
T154D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7d358fdb91f89d02496ecf3d2e667377e2ef75b05f2be6ab7efa3a62777a8180
MD5 8bfda679c8641ac7494f3105817bb386
SHA1 a4a5560595c5a06852097f2bcba2ddddc852484f
SHA512 a6f5188aa16de6c4e94e06207e0ecdd3df0c4c04a9b30a4ab5e524f7d572ee53ccc8eaaa3306b79aa58e8a48c8d211ebc7624c55951e952006aae86cc0d8b500
SSDEEP 49152:z1hpsNoJpF1A6UU44CwH7R4x+aB0zj0yjoB2:zmifPbRIB2Yyjl
TLSH
T1EAB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4ce47359d46d2b9a776d8d706804688fff35c5858954c277ca79a71801a69c24
MD5 e282677a7e0c6a81087719b39c6ba19d
SHA1 e98bb34584b0854c6b0c5625facfb154a5e5f4a7
SHA512 7a56ab0ab527ec4e23a1f161c2dc0773d9fd46496f5b1451b8b6b143593191e9b541cd2fb487215f84a174af62ab1e6100744719331e48e0e9036d7f0b60f024
SSDEEP 49152:rSuZQIY0Be2KRRVtOnks6NMHqDaB0zj0yjoB2:55dKTi61OB2Yyjl
TLSH
T183C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 00a6352b24d2eccfbd6b6051c59352369c3283573cd3557accb6ead947771d46
MD5 2cbca08cb19556c5ab1c6a7e3e8e25e5
SHA1 574fe8f6366beb87de3b44f2022dac835639b75d
SHA512 36be7379fb55caba0fbe1cdd9e85fade01b146912b63d1a00bc6f5a530b3ee479a25e21d005174006b82be203a0e5596a847dbb29a3d6f95ff477fb4f45f00ce
SSDEEP 49152:ihtSn8EApI0figngiDn0AP5wqaB0zj0yjoB2:DX2iyphUB2Yyjl
TLSH
T1F995BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a5fa60a2f3d9a57d82bd87616e399bbcb68870de4004b1519da6056207c2dccb
MD5 09607a6d5fc5a694b033762756f0fb7c
SHA1 66683826f8ff510d27b33d1e6ea88404658b2b19
SHA512 3b361f6f030a7547ea77b52ad0add3206d5ba4419e5b3b228b093d3d6cdc090797b4b6f4f0c5ee0d53f4c51d5e402643e08f67909235571628516acab2e21288
SSDEEP 12288:/fUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8b:/fatr0zAiX90z/F0jsFB3SQk+
TLSH
T1E245230B381F80F3C8C31B355684984B1AB95EB4B2E36B85F2953F0FDE382C615656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1801db4f6c479471ea74f1bfe6e152303c9d041b40e18e566fe4c3cb8f051030
MD5 39930193772fc606fc95d5bf22d19119
SHA1 1f816dda3333cc5fe1c89451a162867ffcbf2416
SHA512 1d0247e6a218086df80c91343c69d85efffc55139bfb883b7dc2e9f5d7027a475c253455560b6b03ec0928c69fcc51bd8e935f0ec2693876bcd99a81ef7cdf24
SSDEEP 12288:3cUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8O:3catr0zAiX90z/F0jsFB3SQkP
TLSH
T1FE45230B381F80F3C8831B355684984B1A795EB076E36B85F2953F0FDE382C61665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3dec7923e4bb8218a9af8b796a4b9b1515587cef8efdecdbb3ef083a5d1820d1
MD5 c04cda67906ebe340f233d88190e8b89
SHA1 5bd7840907e2fa230ab91a0fb062c165de0f6646
SHA512 ae18c5ea2d9f2b0dacff11bd261eec042898ea91ca003a307bf94685c1438a5b0ac19608abd4082a1439bf72b1b6b86ef8939c4736e947f48d276467305f534d
SSDEEP 12288:1WUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8O:1Watr0zAiX90z/F0jsFB3SQkP
TLSH
T15C45230B381F80F3C8C31B355284984B5AB95EB476D36B85F2D63E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 9027efa5d0f832c5430134769f69f6e08e57cda071402a6d7937d24fd24c4a35
MD5 e847eb4370b5164879b1bab912ba5a89
SHA1 576493ff42fb02762b98e535368c2992381dc5db
SHA512 8b2d77ac4d45c216fee79fffb83541e1a9fe3372b17dc8c8773c8cad66628276b57b229aaec21a95a231b84af9d36c52da6fc684c6aa3c23696bd1e5e7cf46f0
SSDEEP 12288:EVhUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:yatr0zAiX90z/F0jsFB3SQko
TLSH
T16045230B351F40F2C89397358694884696B9BDB0A7F3AB9FA2413E0F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3d29fbf18193cc0dd4e55103689b3082239a146a325579607183134295ccae13
MD5 c98543d4b060af9a423521babbbee8f0
SHA1 7fcbd00797c49bad0a129c9dd267462b765201ff
SHA512 85169627fea7a8149891e8c6c7d441d507fbad58abd928230c9a3ee3cde1019c5176efb58fe166f9793828ebcd86b08d97da2301d6d600ea6e6073e49912a12b
SSDEEP 12288:ypUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8y:ypatr0zAiX90z/F0jsFB3SQkP
TLSH
T19745230B341F80F3C8831B355644988B1AB95EB476E36B85F2D53F0F9E3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5feef5aeeef1e9e4b55a60d43157fc2f61e584b627a08a29c5055db0019f08f8
MD5 61acdd1e304cf03154621aa77c8764c6
SHA1 965486eba2612b2c5e46f638209da691e16fe30b
SHA512 c9095753709f2150406a8bece1c9df6e35d561aad8a0fb87b6c0b451844e34d122ce5733e0713adee5f109bf1f50abe16a7335fa30fd4af73ec031922dc90cfc
SSDEEP 12288:eoUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8v:eoatr0zAiX90z/F0jsFB3SQkO
TLSH
T12045230B341F80F3C8831B355684984B1A795FB476E36B89F2913F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 bd6464f830c9ae4776cf46053be4986b42febf445218797dbadc267a6015ec95
MD5 446631d202d48ce22b530379bd6b41ac
SHA1 99e771883f740bd088fb50dff75011ebc4be0171
SHA512 5128bd9d7fec0223cd8de32e02d014adbce349ab84887411cdb3d5c5e375e7cc8bb208ab6f6a9c4c05e12502d74fbbf273c84eefe2853ed82e08146cb2e61df2
SSDEEP 12288:pEUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:pEatr0zAiX90z/F0jsFB3SQkU
TLSH
T1B845230B381F80F3C88317355644984B1AB95EB476E3AB85F2957F0FEE3C2C62525AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7a3b44dab3572609f27ccc2580419a00691c93cfb5bc8d12b62d5464d94ab4f2
MD5 bceb67d67ba0e27065d23d132c61ddad
SHA1 e73d102a6b67df56a53ec7c6dfb26fa436855005
SHA512 d96db3aa07bc17fd23e2781bc1bbce54a6a1b82a04c4d68803642df8bcd09a26bcd01da038598a883e8c553fc048acbf7f67013f4b086c5c88215a310b4856b5
SSDEEP 24576:bZMSzFVSO8atr0zAiX90z/F0jsFB3SQki:bZMSzfYaB0zj0yjoB2
TLSH
T18065019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c426e7c4ade29115260bc033f7627ba05b8a4e4e7c0b6daf93f29c2c3a6d38d3
MD5 5cf401f110a2cb2696c56d8503977398
SHA1 b8566977956df95d0ee4de234bb6b67ed0c409df
SHA512 9fc4bcab0eb7b2e6374418c04eecf041698a6456aed0674aeaf7e62d8dd59a00cbe65650b6d2a304d3ee3f878735852f77e98aea3c973582301b4a91daa2088e
SSDEEP 12288:KzUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8E:Kzatr0zAiX90z/F0jsFB3SQkN
TLSH
T1C545230B341F80F3C8831B355648984B5AB95EB476E36B85F2963F0F9E3C2C616256DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 41d1b7e74310a044f3f20e90fbe069d4727c3032a60d63a8436e7b4547e7c8da
MD5 a02395167fe52673ec6019e0c807b91f
SHA1 e727db379d0260c3448e1228b7bd6c7610cb20fb
SHA512 c41c1ec5047a3c5c9d69f8234a01baff2ef8cdf12c0a043bae8c65f6d813ae93ecd730faffac546970adcfd1027dfabae5dffbc6b8d637fdfd697ee4f9c5c4ec
SSDEEP 12288:F3UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8C:F3atr0zAiX90z/F0jsFB3SQkL
TLSH
T17745230B341F80F3C8831B355684984B1AB95FB472D3AB85F2953F0FAE3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 516d5aff3a8f6e355f81d253d75e908d9d0a2e32623936b6b8313c7f7020b5ce
MD5 384b8dd4cd95d20b4537a22d13cb0b50
SHA1 2a144fe88eab680b4aa046bc4e65fcaef022d260
SHA512 68b516b3e3ff0d23e1b05dacfc0ecbe1bd7c5dcda93ddbde88ed2386914a331723a7ee6dad123b9e3263024f3c6c7b4181f23fa04773ba93f24c6532d3454a80
SSDEEP 12288:FyPz5L8gUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8O:Mzygatr0zAiX90z/F0jsFB3SQkz
TLSH
T160551207326620F9C4639238C9911906F776783117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 165775b1bd85ccb086e8942633d7975c911c4747cf1d1bce779b730a5e2544e0
MD5 1712c8f5e7a208c3e50cb3d19e67135a
SHA1 73a628393053a59a292cd586c8e3c61a5b1bcb4a
SHA512 fdf64900e14ba7e98d06c46ca0b292fc8486e58901085f56328ce199545e9fb5fcf445060b4bbfc1d3ce8a3757b3a22b830fde00695fdd44ab9a0e5e4445bbb4
SSDEEP 12288:0zUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8w:0zatr0zAiX90z/F0jsFB3SQkJ
TLSH
T1B245230B341F80F3C8831B355644988B5AB95EB472E3AB85F2953F0FDE3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e372ae0235b9408192c7bb0185181b7a6dc8f879f38cd31d44e3f805f3187639
MD5 e91ff71486bf1679c6e2d835d1b43ac2
SHA1 1e69eeb5954aca1084688c5f89393b4c850ae1f6
SHA512 c6712db1c9106028b4f229d21ebf38048ada5eb8a47a60b77575868615130b3a8402c119740dca086251d34d98f1bf8db386bf702919246aeaa4f61d054876e3
SSDEEP 12288:bzUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8q:bzatr0zAiX90z/F0jsFB3SQkf
TLSH
T1AE45230B341F80F3C8C31B355648984B5AB95EB472D3AB85F2953F0FAE3C2C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 078717e037764b86f7912ccd925dcd3d618f69779b3e6d1fa579a33383709cf6
MD5 62b4f021dd29f16f6ae648e2e0c91266
SHA1 2b564893ca35b79e53175dced361f5a0d47c242f
SHA512 4931193d6650abcf749fcedd2445ce27a8aceea7ddfcd6638b76449fc39859b086ec39c6fd8dcf0cd12c104d5a3c7b74f0b7901c77d67823da08221e88fd6588
SSDEEP 12288:8yPz5L8gUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8J:lzygatr0zAiX90z/F0jsFB3SQkU
TLSH
T1B4551207326620F9C4639238C9911906F776783117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 96b9ceadd72b2464f2d4a03b6bf208dd53ad78b43af58fdd980a8db5a554de3f
MD5 da189765dd12f53870b218c7fc5980f2
SHA1 8951723d560e6b679f408f5adb79eebbce54b92f
SHA512 4cbdfe77ccd40d75663ffd7b4d4f38afffc67e5bc95130249821dfeb13c74673106e62ede9657485ea4ca024a07bcd5bbf7231a7f5ac05a46b7d25d7985735a8
SSDEEP 24576:MTHaLl3z0zDmatr0zAiX90z/F0jsFB3SQks:MT6LljNaB0zj0yjoB2
TLSH
T10B650199735018F8DCA3823EC9548906D6B27C6A07B0CA5F13E43A5B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 83287931f2e14efa4b8f17942b6e453db66befd2645943fdf73e1ddcf8019782
MD5 61dcb137d43a6434d0a068eca5f990c1
SHA1 1ad8f6a206108aad12a1f24d482e869140d74c05
SHA512 8687e888b472148bd92c965aaa9806a32d3cd880f1277ec6cf2eb58341bd9e49fa61066b109f35dfa17d36d9fb6e228612f2f0539b7ff23464968cb424c353c9
SSDEEP 24576:z37d9CHKy7GZiatr0zAiX90z/F0jsFB3SQkS:T7d9CHKyaYaB0zj0yjoB2
TLSH
T1F275CF91F3E810E5F0B39A3589754512DAB67CA91B71DE8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 a7745f63896218c6b21dbb5838ace1fe9afb090e598ff071be67d9df53308548
MD5 adaf52e3217401dab1ad94ff3d76e716
SHA1 8fa5b75762a7acb16f3384afc404d9b1725227a3
SHA512 fb3c9f1a6f7de77084871d732488818afccd782ad9868b232366a5c1b2fc9ca4be7c283c077bb8aab22e4351887a640723e2389e7278e52618d558f3c132ac01
SSDEEP 12288:u2UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8b:u2atr0zAiX90z/F0jsFB3SQkS
TLSH
T12145230B381F80F3C8831B355248984B5AB95EB476E36B85F2953F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 fb3d7a5a73cb78eff28bdc24dd8d11cbcf99939ec6f6b5ba6c89c9d9bd082ebd
MD5 4eb309152d21baff7642bcf15f5cca9a
SHA1 e734c96b43419c856ef546d13b71cdb9b1333d70
SHA512 e37acb26144638b9406e00f17c6b414455bcee2509458002ec72cbf4db8dcae2aa7c708d395e1cf63814bb75eb7265050af3c9b80afaae6b5f076361576d86b9
SSDEEP 12288:pAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:pAatr0zAiX90z/F0jsFB3SQk8
TLSH
T15045230B381F80F3C88317755698884B1AB95EB4B6E3AB85F2D13E0F9E3C1C615656DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a27b675bc2f4534993dbacf2f2b54de722d2b1305dd118ae33f1a0e45368e004
MD5 b54017809ace5a9c12ed07d5465c0316
SHA1 d521aaacd762c4769db8a3af2fbcc35428a47353
SHA512 6c1296bbeb74033b1ec44a44ed536e545fc6ca0519f20972065445c8cfc8d676f118ee18209cb05ae7de2ef092c0cf3b78f07d70999380df37b3e1eec5dd0b42
SSDEEP 12288:ENsfDUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8z:VDatr0zAiX90z/F0jsFB3SQkK
TLSH
T11D55F00AE25801E5C0AE6235C7544A41B7777C6593E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cdb8ddb603b8f695d98c9417e662456e6cb8b678e17c0ae093b3a20286199e33
MD5 2d1ec1262af6e64d9718d302806d78d7
SHA1 d9e5f2d29def36546e10995f0e239e96f9c8cd46
SHA512 06f3862be9520739fa0cea7ea322b6ddd2f456660e4aea9a094924cd4d3a18f034290c20001158e5a14a4692784dac28657b05975ce37113879f4e7a7f803a83
SSDEEP 12288:HaUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8j:Haatr0zAiX90z/F0jsFB3SQkM
TLSH
T1A545230B351E81F3D8E32B301658881A267E7A746BD29A8BF1813F0F9D385C659356DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a27b576834ec9b585adb79d420caa4ab8485dfa803d0bae6d4d34f1c14a7a50e
MD5 27926f2a1e26591deadff0abf88a903a
SHA1 2a69084fcd41d4f324b138ab111f71246b346d46
SHA512 5b78c157954484af1686bbff93010c923c29d326ad61668fce89fddc8db2944d6ef67b707d022e3dade9d344111bb2ccc5ae9fc5bf48506c0b3b53e365179814
SSDEEP 49152:wa0h2GEkuAe73q3pp46zwwQAaB0zj0yjoB2:wa0hNYG4JwEB2Yyjl
TLSH
T13485AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 54c16000500b0833ca083236c5d3581bb63c5ec642859138ee202acb0758373d
MD5 bac7f2437b39000561ed046b75a7b6b5
SHA1 3852b9f758b2d35faf2d0c0504cfc12c9d879a5b
SHA512 9bb04d3789be8effb31b86acc27435bfad456cfc01ed8521e6e9c265e8c1c655840c1979d0146add57a0ba90c58dcdb1a894282a3dd2e16b46d13a1857e0cc1e
SSDEEP 12288:+hbHjfXEUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8S:+hbHjPEatr0zAiX90z/F0jsFB3SQkr
TLSH
T13055126F26AD10E5E4B2A27D8584850BC731BC341762A7DF22C1A27F4F3AAD51D35F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0e77f2fb5c38ad82a4a0af860167897a9c3fe0d9039e170d02a2095d855f8a37
MD5 6faa693eb404f4d0a5d18ca523ec4d90
SHA1 e8ea4af6c0104bda3b71f485c39faef958841104
SHA512 f95203f28fd5e7c550691fae2535f008490c55e87395062379099a2fe2dcd7d3274593712365a3d72e74af51537cefc5421a41527f12ccea78f18bc0647326d4
SSDEEP 24576:I3YgnJcRTk4yti+R5dBR/satr0zAiX90z/F0jsFB3SQkL:IIgnaTk46pBR/saB0zj0yjoB2
TLSH
T13145BF2EF2B910F9C8A6D236450147B5BB71782D1F209ACB0170C639AF1AED85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 0b17e7f42ac2f9a07abcdfcc010e837f52b4643b29d9b3211accc255ed30fa23
MD5 afb82cf3d4e64af54d62d22e3b94f0ef
SHA1 3ba9c8216d124f0fe1d718b7ebde75c0f48483be
SHA512 fdeefac4f201946aff9efa46bb57782cc82f0557f30dfc6a8ea2b58884dce0b4b9b0ad06402d376fba0c1fe313fec8eaa59af86bec1169c7ea5efd2008aa73ed
SSDEEP 12288:BmUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8a:Bmatr0zAiX90z/F0jsFB3SQk7
TLSH
T10B45230B340F80F2C8936B755688884B1A796B7063E36BC7B1917F0F9E386C766756C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 32a7658a650d3e61a7f0deee4537a32f68fe86a004ba12111f80f79cf86eb23e
MD5 6435e87c3f6b64eab237b68fb5a3cb9c
SHA1 f091f8eca2ac3953d29f0a114c275afa30d96620
SHA512 7629bbed177399c2543fc310278e6e669afc092d4de9a21b6cce5ab5d8bb65cb2979ed40885d441155506d1e0e9993e0500fdef01d3c22d101fc7de89d3f0263
SSDEEP 12288:BOb9A4LWOsvAYFTnUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8y:2pL3UTnatr0zAiX90z/F0jsFB3SQk3
TLSH
T1FF750105F69500F5D867923CC9A68917E272B86C13A0E7DF03A85F5A1F237E24E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 9d2ab90bca78630d544121570f1fc210ccca13a2252a294b9b6a88b01fb6dad9
MD5 088290d60a1bccdf57e294d65b80c9c0
SHA1 ade65d52a85b9bb40b80851e0c047a290e932e2e
SHA512 b06925729a661ab3744da25271a21fe46b9ed74666339a6faa71d0ab14f7be7860ddd8a0e574768c090a78728166be6229b52cb5edb31a8f89adbcfc59227ae2
SSDEEP 12288:ypFtpOzUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Z:gOzatr0zAiX90z/F0jsFB3SQk8
TLSH
T13855021A36AD10F1D473A23C8A81820ED371B871176257DF42D0A56F5F77BE86C3AB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a8ef49284060655a1d2e1016b2e3ab34940aeb2dabcb9d489d8f1ad0d5c59696
MD5 00d4dc5ed202ca8fb1f37065aafc1743
SHA1 f61b87d780e2189735db5daf32d55e746eebc94f
SHA512 78b8f192d8e7aea42614ed915039accd6443b5561ed83322bb290e317cc3bca7ece1ccf7e68f1be9aa2ad09708b58d878bc73da3023a6cd52f2f18e028c14cc0
SSDEEP 24576:H7NM9YqZqmWMUkPjZM48Mv6bEhsKatr0zAiX90z/F0jsFB3SQkh:H7cBWMpPjN8DbEhxaB0zj0yjoB2
TLSH
T16D65AE2E6BAC81E5D477D13DC9A28206F6F2B4611B318ACF5152833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 a020611c62838ba1cb6834d812f8c5b48df4ab6db7725bfe1e4317f52c23442f
MD5 af1f1a7be36f91a65104122fcf7d503a
SHA1 10d93f8956b45a0c203b7c204b7468fab317978b
SHA512 07df2f5f70139f0f5356b580d59697c9c3f9d82a6a5be0dd2f49b64146f814c0cdc4f4b930c156f9e71c42ffd09fbbd3b8549e3379ec0ab1c9834cb7ef9e87e8
SSDEEP 24576:hW6BApg2YuyuNDYTabvcdvNYf8km1Uatr0zAiX90z/F0jsFB3SQko:hF2YuHNETovAvNYf8kmqaB0zj0yjoB2
TLSH
T197857E2A27ED80E4E0BBD27D45B6D146FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 7343154264ec2ac4417d6887a6c059ed1d611f56d4a648223a21869ccdb797dc
MD5 345a4ae152c22d15dcf4e20d4b3b756a
SHA1 7460f50c9bdb2a1f255e280a7bac21aba6aec0a6
SHA512 e6fcce468ca72857cfdfc5442609cb7f59b40041995a5a427e99097a3311da187da186cae74267437d7d8bcfa2b7676720e4b0328f4443b7d3b68ad47ce7e7fb
SSDEEP 24576:DAFs06+Omlf3NXEbTofatr0zAiX90z/F0jsFB3SQkc:MFs060lVXugaB0zj0yjoB2
TLSH
T11465AF2F66AC00D5D07ED17D8A97C91AF7B1746307215ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 853a740da70e5f41d770a8886c5184e6d273bbb35398c8a5fcdf97a0d4572d39
MD5 76e5a2aa215e00f4a619bd1ff98144e2
SHA1 06fd1c5170c42e833f12c4b5f5d340a6b930cd6f
SHA512 6d07393e3a1ee451a50df228fff5e51b2dd00a3d5ccee279f233211d478005e485ac155f405e7f5dcfc5149a09eaf5eabe5c3ce6d10cdfd25cd25c26c2345fad
SSDEEP 24576:0JnJ5D3WXgatr0zAiX90z/F0jsFB3SQkR:0JnJ5DGXgaB0zj0yjoB2
TLSH
T11475D02DD2A810F4D4B7C27482991B46FF72387D2B226AC724B4E5357F22EE09979F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 984d5bc02406b339d0d713f3b62b36fe100420b01755333f1673a7b3c03ceb10
MD5 70b3d7afaef741122a3d30b827c0eccc
SHA1 68e2e350606bc387db142568989215d1b18300d9
SHA512 16ab6a1fd5daa9a46a7fddc9f6bcb7749a64b448733a801f846b9a83920a355d2a801ff51ec250a17e3f60164d98d2bb61120d4121f86832ab2ebd7c591edeab
SSDEEP 49152:Cg06DIKdwc+eQnSt65aV+aB0zj0yjoB2:7rB2Yyjl
TLSH
T1F7956C06B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 5f32356268d2fae2d67e221fd773e7b9750a0c1392c64c6c18a621e9895a80a6
MD5 987edcec9da3ff715f8fdec4779c0ae6
SHA1 073d7bead8cd13156fd7fa886f7cec438a9c58c2
SHA512 a1f658379254badd640585dd59375fd59b8f862efc42a4cad318030fe5c00b0c479002dcbefe86378cf85abd28a8abbec012026ab235fbd7f2b6807ba7f5ceab
SSDEEP 12288:MEP3RnxUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8f:Hnxatr0zAiX90z/F0jsFB3SQku
TLSH
T13E55125E365D60F5C463A13D85908506D372F07027922BEF52D1E63F8F36AEA2E39B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 a616a57198d8114279e3214baaf718a1bf234335494728bb6f990d4038f97655
MD5 81a36b6c10ac8e4a73f5443815ca9c72
SHA1 465bc82dc094404d9868846b5ee8ffc4ec0fc1e5
SHA512 ceb675fa8d4bda005fc713762e4761b625c18583683c867075563e545e25f335c61f2d5f6a3a82341e5525949ca669656dc146e8012b1af35461965b2594f9ff
SSDEEP 12288:YjkyhUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8a:YIyhatr0zAiX90z/F0jsFB3SQkz
TLSH
T13955120A335890E1D9B306389AA181854B75BC306B6297DFA1C0FF2FAF357C56D34B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 c48edb27c08ca6a6abea1c51c87ad81f67e42211e20bd1ed1fb26a61691be005
MD5 838133d795941dac7ed6532e1faebf06
SHA1 dbbb0b528df322ea4a300e97ddc7d48cb5d4d6e2
SHA512 524053bbb10fb75276a5ad25978c3d93749bc04a3795f54abb7e149eb24d561a72342e8eb6effb31108cff5b3ae47b7e688a60b197eef9b4c6ce075a52d7acca
SSDEEP 12288:dyDUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8L:8Datr0zAiX90z/F0jsFB3SQk6
TLSH
T14C45230F341B90F2CC8317355258894A16757A7027E26AEFB1D1BE2FDF382C62176AC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4401844ba128afb69983bc1538de55c521a8f8ced5b2dda47ab4eb16c4e513a1
MD5 e8f0cfa266504897f9c337cb57e9e75f
SHA1 0978d71cbbf7c2c3e5834b52af40785486e1fc42
SHA512 b4bd13468aefd4e8d526f6cb29c500f81e5a4e8b759e1379a93c84d8577e16c57647e9858dbec52082dd43ff3d210f18b43df75d2634180d9bef286dbe97e45d
SSDEEP 24576:wQ9MxZKdcz9dw3iatr0zAiX90z/F0jsFB3SQk1:wVKZiaB0zj0yjoB2
TLSH
T146558D2DABE905DAE173D23995A250C3A673B4301B31D6CF2448D13D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 218a10d219df6192bcabfaf15d68a79abeb622a8e33d861831bf81610d8a6dc1
MD5 c22b347dfe6b026fe60b8ba2fffdb669
SHA1 fbf7d7c6a39bbfc5361d29f4f518d9395560319f
SHA512 21a55eefd06ccd67d6977fd268dab24bad87430dba7f782e02454139d40f8700252c207e3e5001f789743713c34f72686be7a2026ba6ecd01224f1c00c1034d8
SSDEEP 12288:UyoKo2JRple9ptUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8d:UyocDAptatr0zAiX90z/F0jsFB3SQkQ
TLSH
T17A65E01F7B6E40E2D063923C89848645E773B0705BA257CB6191C73E8F27AE9BD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 73216f1d8eee6c338ac35df6f60811e415a1d60dc8ff9775ce62c652990e8415
MD5 c63646e49315eed56e22760b4293d656
SHA1 d88387957596890eb79531ed5a090febf86677c2
SHA512 5b4ac318b541bf670a516e36bea8dc381f8ddd5fc5561b9b0d0e11fa26028eccb39eb30c3b53a1337cea4f0ac56212333f97329941766827f5329e90dc27b496
SSDEEP 49152:uWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKtaB0zj0yjoB2:I0zuNIaB2Yyjl
TLSH
T194A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d1db10460ab2e447a44b25a320cdbdbbeded3240ce52b1964b17bfd774c90ec3
MD5 f0ae028d1cb701e206f4b8b4b2a5d681
SHA1 2a67587edb28f7f27d0177ec513d71b02d18caaf
SHA512 1f6e7fb39dfc997b4868a051ef8a8730fefb3a604fc4b066098c539a76aa5ae765c593461c72f77a90179c24f555887b70d2c65f0fde72461f11d3471a8568d6
SSDEEP 24576:W1QT7EcpfxR+N5AWAz3ooiYtjMqbxatr0zAiX90z/F0jsFB3SQkF:7TDxR+N5YzTfjMOaB0zj0yjoB2
TLSH
T1DC55B02E67F905E9D1BE85799A23C502FB727821033193CB42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/384-265-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/384-318-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/384-267-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/384-260-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/972-303-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/972-424-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1076-154-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1076-76-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1076-70-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1812-398-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/1812-366-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/1812-479-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1812-382-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/1812-405-0x000000000C990000-0x000000000C998000-memory.dmp

Download

memory/1812-328-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2140-273-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2140-403-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2140-327-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2296-280-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2296-281-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/2296-287-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/2296-404-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2640-157-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2640-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2640-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2756-326-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2756-476-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2768-0-0x0000000000400000-0x000000000063A000-memory.dmp

Download

memory/2768-31-0x0000000000400000-0x000000000063A000-memory.dmp

Download

memory/2768-1-0x00000000023E0000-0x0000000002447000-memory.dmp

Download

memory/2768-8-0x00000000023E0000-0x0000000002447000-memory.dmp

Download

memory/3180-475-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3180-319-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3356-457-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3356-311-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3400-233-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3400-34-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3400-44-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3400-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3456-152-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3548-324-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3548-271-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3900-57-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3900-67-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3900-78-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3900-63-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3904-310-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3904-242-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4216-316-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4216-474-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4256-407-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4256-293-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4256-299-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4256-292-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4304-438-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-439-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-441-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-442-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-443-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-444-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-445-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-446-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-447-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-409-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-408-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-410-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-423-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-422-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-421-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-420-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-419-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-418-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-417-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-416-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-415-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-414-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-413-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-412-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-411-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-448-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-440-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-449-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-425-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-437-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-436-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-435-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-434-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-433-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-432-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-431-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-430-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-429-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-428-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-427-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4304-426-0x0000018C3A5E0000-0x0000018C3A5F0000-memory.dmp

Download

memory/4436-256-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4436-314-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4436-249-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4436-250-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4652-24-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4652-16-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4652-23-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4652-22-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4652-232-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4744-231-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4744-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4944-400-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4944-277-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/5020-306-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5020-307-0x0000000140000000-0x00000001401C0000-memory.dmp

Download