d835887ddb20eb96310dcde678d8670c5bd294a0cd6fda637bf1cd3ae67aad3f

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 1.5MB
Sample260522-vz2faady7w
SHA256 d835887ddb20eb96310dcde678d8670c5bd294a0cd6fda637bf1cd3ae67aad3f
MD5 03a9c75f614628bddfb1af29e2373d51
SHA1 6ee35f1cb15fa640c4a4d03cca0f26789e460e21
SHA512 73214027b6833e7afa0b78f1887e85ef622fa85f85704fd8095308d7772736d573374499e0e8f9a3b8729dcb52b86dd56fb6cac80aa38628a73c714fd066df41
SSDEEP 24576:q1XgAnx52DNPwZ2WR3Yijg/dBQR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OXgAnH2DNPwRoiM/dBqLNiXicJFFRGNf
TLSH
T1DC759B71306E4BB0EA98A071393416755879AC085713F7B392DDB9A82131F9DBE34EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3320	alg.exe
2904	DiagnosticsHub.StandardCollector.Service.exe
4560	elevation_service.exe
744	elevation_service.exe
3372	maintenanceservice.exe
1184	OSE.EXE
2440	fxssvc.exe
3592	msdtc.exe
2600	PerceptionSimulationService.exe
5104	perfhost.exe
2088	locator.exe
3468	SensorDataService.exe
3700	snmptrap.exe
3904	spectrum.exe
1824	ssh-agent.exe
1928	TieringEngineService.exe
4740	AgentService.exe
3780	vds.exe
1208	vssvc.exe
984	wbengine.exe
4780	WmiApSrv.exe
4672	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3bbdd38bf77cf242.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f55855a10eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b18e4a5910eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e703bd5910eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a53ad75910eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2904	DiagnosticsHub.StandardCollector.Service.exe
2904	DiagnosticsHub.StandardCollector.Service.exe
2904	DiagnosticsHub.StandardCollector.Service.exe
2904	DiagnosticsHub.StandardCollector.Service.exe
2904	DiagnosticsHub.StandardCollector.Service.exe
2904	DiagnosticsHub.StandardCollector.Service.exe
4560	elevation_service.exe
4560	elevation_service.exe
4560	elevation_service.exe
4560	elevation_service.exe
4560	elevation_service.exe
4560	elevation_service.exe
4560	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3948	2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2904	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4560	elevation_service.exe
Token: SeAuditPrivilege	2440	fxssvc.exe
Token: SeRestorePrivilege	1928	TieringEngineService.exe
Token: SeManageVolumePrivilege	1928	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4740	AgentService.exe
Token: SeBackupPrivilege	1208	vssvc.exe
Token: SeRestorePrivilege	1208	vssvc.exe
Token: SeAuditPrivilege	1208	vssvc.exe
Token: SeBackupPrivilege	984	wbengine.exe
Token: SeRestorePrivilege	984	wbengine.exe
Token: SeSecurityPrivilege	984	wbengine.exe
Token: 33	4672	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4672	SearchIndexer.exe
Token: SeDebugPrivilege	4560	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4764	4672	SearchIndexer.exe	128
PID 4672 wrote to memory of 2912	4672	SearchIndexer.exe	129

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3320

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:744

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3372

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2868

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3592

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2600

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5104

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2088

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3468

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3700

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3904

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3044

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3780

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:984

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4780

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4764
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fad079ce01ed0880bedaa1d87f0bfa57c62983f40e33d9af93a72015ff3e586a
MD5 4aee73b7530b3700deb0044d9e5322a8
SHA1 3ecf040b09f2233ba8d4498f8f69df64acff5cad
SHA512 d0bfdee1bbb5f5ff4ccbbc6d49972d4e2e44d14ecafc027a641c8b6b8c6db86d63b55fc35dc00dd4b88e04a465262bd2305fa0c0dc3acfd76dd38920e85fa35b
SSDEEP 49152:Gb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnoLNiXicJFFRGNzj3:43q6mjBL7wRGpj3
TLSH
T135D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 c4073d0f667a7d4c7f7aa5f35f129ed871f9056da24b8d54d0ab4ce143971f8f
MD5 24c1508b7ed4e25832a634dac1d22533
SHA1 46abcba7f580ec854bf0b67cc17df82aa848529c
SHA512 2419f0c9956cb92572702e64778a0ce8a5a1927504e1c9f234aabface78338590f827900914e9cb61242ea4f8ffc2578163835a3acae687f3af721ff1490f26e
SSDEEP 24576:jXYfDtczAP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mtcSLNiXicJFFRGNzj3
TLSH
T1B775012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 aef0fb07de578c99c9549b92f2214da439e664a8a3d7babb4bfb12509df5d19b
MD5 357c6a9d02f9296e386344df5c377300
SHA1 ec672cca92837e4f6af1e1ff21a3e5e917c1acb5
SHA512 eea588654e1f24a97483600369f060a62423b76dbe85195916a0d46db4060fdc39153f7c39705e470ad629a35425594f9b4ded3e41ce788869c6193292c26400
SSDEEP 24576:W0Le5ji0hmxhrMw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WPji0AzlLNiXicJFFRGNzj3
TLSH
T1DE859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5c9fdf072e39a085d249df5693e0c276f37feeb560b418e66c0d325636c6d0fc
MD5 82b0f70ea48151095f704e4b4a35431a
SHA1 0af4aed3a4878ed58f0fa95af9f586b03cd69c52
SHA512 b046f33b12a77d71bd9ad3dc1849c9e46aafbb40a5112098e1a0ac4a5fb6b640cd85a0dafaaafe5ef1c540d1ab3413bceee3c2a12a22568548fef56e29f24efa
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWj6q8wyuC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:h/ezSC6vUzPv+HjyJLNiXicJFFRGNzj3
TLSH
T1B3756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c8aa9f4416b8f90d468d5602e3319bce02d0fff2568294a5d235d36584bb1cf9
MD5 bc7987044d58cf47ea9ed20c59bf7682
SHA1 872a174b09d865a3cb38e30ec275d05cf2259229
SHA512 9b9fb74831a8ca5943ab2ab1380d28b10167f8064d6bbb2bbaadb9ffa55fecf4ef330598fd3cf80bb34fad97c5fbac59eb2bc7754f80bc6735fe4e28680b210e
SSDEEP 24576:EVbqPb88hv/l+B7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EVO88hXl+FLNiXicJFFRGNzj3
TLSH
T187559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6c670467ba66b3f3165b5df774b89b45c89f739b57cee2873b26514e15e3c60c
MD5 b15ca22df6bb0fa32e4042474199335a
SHA1 516e55a213e8bb0b83b0ef348795d7a437f89d57
SHA512 064b245de1eaab9ae6c3a1a6960be34cfbf0d64c14d18866cfa223cece98b5b9042cc32aa6aadeca20de861ec38ce945ada0d52454f3f927964dbeca99be7172
SSDEEP 24576:3GM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FLNiXicJFFRGNzj3
TLSH
T1005523D3468865B1FBFD003A867A5828B5845E2CCA555DE2D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 eb0c3b93446769207c618756d2305320e445fdf33f6d924ad29f76e052e012e8
MD5 96b098d07f5bdf601dbec1862c0eea31
SHA1 191dae58dafc75af14d82ee642085565334f1d46
SHA512 b21db21a9b8a8d952802d0fb97b6a6da4cc2e1d89173a21bc956d9c14d64f79c1834409ef4659753d28b49ad1516044d3c2a36486432d3db63e542ba6138cfc0
SSDEEP 24576:eJIUD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eJIUDLNiXicJFFRGNzj3
TLSH
T1EB75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 03193996e2efaf2e8594d91e57bcbad73bc0a18d30328e6c7f38125e18ba6e08
MD5 a74621b981c6a68b1e19fc200ad92d13
SHA1 9cacf6c3b8b17274faf56a87d4607bbc6a326050
SHA512 0476866f564b004b0aeacddf03405aa2d828c47dba60e4366179320125a38dcf782dc12e3e689364700bf5c5dc073fa255f1e872e773e23149fd3a34aba71572
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THn:NQvGAdlCEL8c/WRNw5Cy7wRGpj3
TLSH
T113266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 650f9eec7e5713e1dfacef4d5c323c4e4a00be7b435258dd402eff263cdc0beb
MD5 7a5d18e51beeac8b57a2f46c0aa9d74e
SHA1 24d5148ece30c724bb9810c78e9ee0734fd35546
SHA512 321978924c9bdb5b9dd621d058e3addbd1411b016317beed206a959434f67c027a856370b34ed675d11d4ce611083c5b560d5313145f487d2ff096cbc22ca3eb
SSDEEP 24576:efewsAjV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8ljVLNiXicJFFRGNzj3
TLSH
T1C575E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fe70e694fd237c40585e0b84c1240012595ae94098d7f27ef4f085a741afd202
MD5 00176354fe9a6a4ce2ee6b99ee60e86e
SHA1 06e9955f0c344c29dc10de314dd4c6a2cd1cb67a
SHA512 fb9c35372c6e3f602103bade1dfec5f552a967a357fae2c21f3556f16225a69ef0dd76003524ffc84724c4b760b54d1f57a1695c8ac80387f56ff6dcca926485
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHRF9:kUEtQevvqc2W1cpV20I32H9
TLSH
T1AA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fbc6715730e3992dc90ebd6d716418263c060757fcfe8a65ff56f478e15ea691
MD5 f3a110db9f062454b4e93099ebaec4d9
SHA1 2cf4cc8b8486f5598cbe64d72eed5d8da4adb093
SHA512 0e98930b8111224ce3fefdf8eaed92d9507d2d57abd091909598b2093b9742c400b82b105447848bd1b410f04311fc48fee23e802a0d2fd4c6c4ec263ad17175
SSDEEP 49152:iCbRquA/m2yL5zLfFiV+XenmE3/z1LNiXicJFFRGNzj3:noq2Vjnmm7wRGpj3
TLSH
T10FD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 64b96f8fb08664b73976652821e40ccd27ed4e65ade6737af7fed92d17da3170
MD5 5709b285f70fb15790408ebb248729c2
SHA1 6166d9d5fe18d8a6ae67d0df94f391638b76bd88
SHA512 c680fe349c87e6e6a8135403544ec0faeaa36e8ed9b6ac7ceb94320af388ef2b181b1bc841307aeb98d22751885d0faf02c057d72769a091c7ab704a05362ee5
SSDEEP 24576:KAhGL6IFoiwtA5l7S53G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KAM5Foiq5WLNiXicJFFRGNzj3
TLSH
T1FB359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1ef18f3f876d0f9016f0298193988fa75628155d53be63c6b19eb215f203cd04
MD5 c228d3292f83c38b992235db8ed9d332
SHA1 4879893cdfd6bf919afee97916d3f09be4958b6c
SHA512 893c29efc89499dbaf84662eac90d072eb9d98b0163bfec0261e4a3192efdedf2dbeac1e787e02b87a4a529c034a020a92cd6f29553bf998430841a992b8bcfe
SSDEEP 24576:OwuROWp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OwSOKLNiXicJFFRGNzj3
TLSH
T1AC65F08632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a2be05c1f200981bdeaf9f425655d3a0dc4125168d896a0298ad9cf076671ccc
MD5 153f5ede0c76ae36db5930d8bbb21b46
SHA1 3f44ecac67af0de184b5aaff1f81d07b6719fac1
SHA512 9b9e0356bae0e2701589fc41426dd334e15d0ecab9648d9974200dd9d3dfa17f3b994f66c9aa916c7dbea48e0ba77fc8911b0267393eeef758947483211c5162
SSDEEP 24576:3ZuY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FLNiXicJFFRGNzj3
TLSH
T17155129622C820F5E6BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 334d8f567b72cc768560de377e576516b1d602c05942dbfb63d1ae4d3d692e94
MD5 af53519c401cb0b8046337d79fe20576
SHA1 02062cdff96bc97e06379b8b48a6efa0741148e9
SHA512 8f604c2f80405cce4459da4f8957700d9b05c1db189fda6c4ae2900b5a0676937b0937bcae553fb7f57ee470ef9bba6e4d46bb1af1b1a0be06435e01aee9c054
SSDEEP 98304:1QRQyi36YOcPDLvw2gAf+PN337wRGpj3:MQyiKanX+PNbF9
TLSH
T153667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1916de15645bd5764bccb18de085213175623bda3a71ea7bcca3455534cbf3f1
MD5 8e9ff16e9d959493f6afaf328661fca8
SHA1 ed80ce989448a9dc5e033b2de1c2c6b7c2cb6d72
SHA512 f3ea8ecf6b358718de702cd05f35f50692c5bd1714b40afa5bb0688289a62e2c6cdfa069d281ba6f5ab65317f06cd4f2938c4c319aecb297911c79283cebe09a
SSDEEP 98304:pQRQyi36YOcPDLvw2gAf+PN337wRGpj3:AQyiKanX+PNbF9
TLSH
T140667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 11331a0fdee690fec8cbfeead56e1b39d16c90c08dd69ef949ebee15953570c9
MD5 251583f402f824f373a3151813c95e3f
SHA1 f2b336abcd0ca52ca53e53d94731e36540231842
SHA512 bd45479ee8ec140095742859fb97752767cb67c78cab1690f128363cf6eed0ec712c6a190cc753a9026bbde25f9402f0a53a1ea4970f0d23f3b10c87b683ca88
SSDEEP 49152:a68Qg55nhkeWu7PNU3/lLNiXicJFFRGNzj3:IthTRc/l7wRGpj3
TLSH
T1FDB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 45f1abdec6525d1db01bf611d32ea7c83dc425e547db4237deb8966b12f8ae33
MD5 c8d7a0d22209b45f0a97a3d9ffe895d6
SHA1 394dc3126e2673affd94f4c1142ba6c8adb6bf93
SHA512 9fdb7058f0ec19e2572124e41436f34bbf82ef2ea2451fdc19bc4b9210b12bd3724285fb57c9ad633f29aeed88c75fe77100e115b763e8ba076324e57e7f2ee3
SSDEEP 98304:Wy5112gYy5azzVvU69nLKnhZM7wRGpj3:HLIHRWhyF9
TLSH
T1E2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a4b240553beb438a9521d1ecf912fc8c62fae47b0e328de2e86a91a76fad897f
MD5 0073c836be982ce75e89316dfdd55f03
SHA1 d522bf0f313609bbbc3d43eed0699ef2ea61d8ea
SHA512 0aa007d96124f84fec1190c7574d6da845257868a1c69f67838262ae0e5c727477b3775ff9d02403ec9c01f059121303a3326db9b80725e16dee14e27ffbd503
SSDEEP 49152:nB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glfLNiXicJFFRGNzj3:pu6JmIxd2df7wRGpj3
TLSH
T19BD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d4ed183c60688c983a0acc48a095acbed547ee698cf0b44d37f17ddea8a15fd2
MD5 9f94674156ffaaa7d64ce4a77073b3a0
SHA1 33cdd24b77f03187a8aec3c4d03461be9baafe97
SHA512 ee54ffd7d20071a12347349b38738dbfceeb799c7bb94557996d919485e1b4fb1620eb51577c6f892a570e5b6da78053db33600176ed44a0a5b759c6e431d51c
SSDEEP 49152:Z1hpsNoJpF1A67U44CwH7R4xjLNiXicJFFRGNzj3:ZmifPqRm7wRGpj3
TLSH
T127B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 19f2c1553167c1aa07a1fd6093f2567132a831c26ee51c5116f8feb220c408f8
MD5 0524e0389c5c4ae9f3d1b712f0188f4f
SHA1 2ab62a999cd20574bd783bd70fea85dcb7e48c9d
SHA512 8d2f21b30f74c5a05ec9be6fb6c8d0de9e9972a48bd94876d3b6d726610f5dcf687c604afb780df4e253ccea695aaa0678d5c4d9811c01dadefe5d1522fde2dd
SSDEEP 49152:YSuZQIY0Be2KkRVtOnks6NMHqYLNiXicJFFRGNzj3:C5dKqi61Y7wRGpj3
TLSH
T1B2C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3300a6d439c707dc37b3f351031cdb5dc5faf5a2488b29d114c67b28b367071b
MD5 edcf3f6f3bf0b9bbd199076438b6ef0c
SHA1 771b5664bc593a1ea4bdbd3737b343479e731ed7
SHA512 a70aace3b33e66e13316621c7d0e45cdb3ea3fa0b16838cb6b8228018e4b0c46845ea7cb9c326ce8b7029e4c48f18b5362cc9676a8c31ce394cf8eeba70d8202
SSDEEP 49152:bhtSn8EApI0figjgiDn0AP5wPLNiXicJFFRGNzj3:6X2iWphq7wRGpj3
TLSH
T1D995BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fa199b76cd9d08ced0814131009ecfd0ed91c23bd50713ed3c2ab987ad9e9005
MD5 5d64b594cd8d7683370c13762ae2fab0
SHA1 36439b4346eed1b1d72cd91c9913dc00e9ec017b
SHA512 d71490eeee13c9babfaaa9c932ace8135f57705b8eef5f8be82a041bb77df06aec5e971f92c3d8bf7ee4c679bc4dca708cc28d0f5a61d5b696d65576dfefe077
SSDEEP 12288:/yiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AB5523D3558955B2FAFC0039C6754428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4d34e1d57338c4af7a7d8527636557723ef6b28d2f4180c07d53176d1a717694
MD5 543bacfb51d1938958021c151c890d46
SHA1 ea6eb1f843f1c16031b7c5584e3a5b268924df20
SHA512 6759bf9dff941b1dc07f77264c29294209c8d6af0a6d2c1a55afabc7ca6d62ee16f97e31174fa7b6217445143631dfcd9bce8c5e7979fc55938028e336ccadc2
SSDEEP 12288:N9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Nh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1975523D3548955B2EABC0039C6754428F5885E2DEB5618E3E3483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7bc9a7b980fccea623d337c0543a8fa8e6fead5afc61a1c9026eabe2acb79448
MD5 77fc1d757fc143ac9e6f7aac05171c91
SHA1 88f525b0ae9fc4e2dcde76f25e8175a212e1edc5
SHA512 35d45ef1ce15d18cf5f1ba241bd9f8fcb589b1c71f8e3c6bd31933a2465270e404d53a1993a75c9e66cffbc17f6a964dda3d302940b9d646ce39f9a6e786c398
SSDEEP 12288:K/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1005523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 deb5fde132319fef78d9a4b8343ea7f2c1f4ac3967387d026509ae55c9be6264
MD5 8db1ecbd3838f9dce1bab9b5ecec67c3
SHA1 ea2955d95f17717e5d1524cf5c49776ad774c1f6
SHA512 5b63b94e3a2dd9593d6f00ea3115b2844d65877b7034ff3ffbd18848778dafe6331997c5a7821533c4312a84deec8024d5a69033e36ff4f8a385d6bf317c3162
SSDEEP 12288:1VciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13F552392168901E1E9FD803DC6764424F2A47D6CD7325AEBD3003D1E5A74FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0fd315ce07ccd0a5b1d7c761ce400169940d923ac2310a0dc65a486e80bd5589
MD5 2f74b9d951e9b66961a127423e58429c
SHA1 f9ab7a50ee8e5b13fd3c6a7bc8c8f307ef3b3f41
SHA512 1f708647f560d328407fd39fee74ea43f102dfd4dc3337bb27e50749ad728110b21af92c1a530d346abee98f65417765412d5738879aa2e3c081191ece45dc5b
SSDEEP 12288:b0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:be/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1095523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b6aec8e6e7e061d73a4d8d60e3184806b7c99805dce84d5dc8a4472f822ea9af
MD5 4f79ded0d2ff4e326bda8760592ddf4a
SHA1 795e8467f9662759c28531060436fee03815a805
SHA512 238a1c78a250124fc4f5a37437dc22673b8b9245362a15e56d5665ee6ded39270203f66ac6e525afb0e6eecd663e19257d3b235fca5014c14474b232c3764de6
SSDEEP 12288:tRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:td/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F55523D3558955B2EABC0039C6754428F5881E2DEB5619E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2876e9109b1d851f97087fa411c56d93577979f79515e031e3fbfd2d6567ea67
MD5 7c37af4eb1eafd63cbbcfd212b51d9c5
SHA1 8a38e857a61116d9655af7b03afaab77c26938cc
SHA512 eb7e000366fe3e65caad1af9fa1a971e84db79e313f89aa997e60c0d8aec9324b2650832032620d7eefdf5e9df48ab6a9ed46b6aef914903019ac9b4b2efd434
SSDEEP 12288:5ViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:55/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CC5523D3548955B2EABC0039C6354428F5881E2DEB5659E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 1b7a987be64edc08df206f22473d78df709bcab4b0d82c738f47d48ed66e6bba
MD5 6e7a83e2b4d9f999e1779f6119d2e64f
SHA1 9488627d90d0ef61ff29ee2222297b532e2939cd
SHA512 78c8f3bf23313a5ad61143f147f3dc01df62e8fc7edbab8d216be14d2eac23a5e21ab0717ee54e32be8d5be6f2189d02f77535d66e329b1a1196e58f56cd73ff
SSDEEP 24576:tZM3zFVSOB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tZM3zfNLNiXicJFFRGNzj3
TLSH
T170750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 613b8c7a5b3d52f4a5875ea0767dd46e4f491dd1c8bdc973ee5812fc8378292d
MD5 a560429fdb54b21869bed2f2cb9cdb94
SHA1 1a3165d7dab4e5c2ec528348ed8c23aaa5e8e3e2
SHA512 f419b72a8cf88775023481d1fc84461f241eb39cf13dd41aab562c9a623fe3924d0f71eb55cf40f32a6139c626c427d67507ed0750617135a33250d8768ae43e
SSDEEP 12288:O+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1ED5523D3548955B1EAFC003DC6764428F5881E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 fc0597333a8ece86e0c452406a69b07eb38510c3392314ac9d1f2f55dd04d142
MD5 49a1486a767699f2fb7f0e093a301e09
SHA1 6042366d5603469df5fc07f560efa33c45956b09
SHA512 e9393a916f1b760e198f706ce2b843f05a90056c271d5f9e1a8fbd073cea0f30beb75d3fa8b05c9c1aa5212af55efb0b647d02627d07a7e6e80731b283c9f99c
SSDEEP 12288:FaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:F8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1375523D3548955B2EABC0039C6754428F5885E2DEB5659E3E2083D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 a64824c34e2acd6d6650e4392a35200fcb7f13ec179572230b11066a713b5c7f
MD5 ce66987029994689e2c75512b4424ba2
SHA1 a091fd2d87525d33a22f1ca82bba8baa438abb30
SHA512 828a15dbb0b18117cd65c1458af9c268b550c9b70a866fd6be1fc9dfd36adb808d503a7c181803ca72f83b84ca33d3f4d8b6f36b23840f0e72c0f82726ba9e1c
SSDEEP 24576:rzyF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rqLNiXicJFFRGNzj3
TLSH
T16E650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 cec8805d357783a93cb01a4b33748d66a4da206e34131d02e95f36b3c7990b78
MD5 f9b887cfad552f0d4f2d19760629e5cc
SHA1 09a19a8f8f92f7ff04918c2d20ba29ba37b3b787
SHA512 9bcf8daa8f4ca5c86b76fbed49b6cdd511205fef77f0b98ea0c2e5a3cf8ab11268482c51a0eaf2401eb1e24fd80fcf365830e220ee4075e22d344bdd7a97653d
SSDEEP 12288:I+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:II/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C35523D3548955B1EAFC0039C6754428F5881E2DEB5659E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0101084c7a4bead19457ba2ca4f0c127b98446e5c6c596e5cd3a10b58a7a2c26
MD5 e24144d87069376c0172a21b692803d5
SHA1 a906a25026292cafe6f86a3a7128744cae5813c7
SHA512 932f66d4bd414d6573b7a8e7f3dc74d93babe20ce3e6488ec1d127cf40b07e914ba5260efc71028c29dd284e47fb99b55c75a5c35f3adacf4076884cc88738bc
SSDEEP 12288:Y+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11F5523D3548955B1EAFC0039C6754428F5882E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 1bb0b0e0d021492182cbfada96a11b9d0734100d90bd272091d335bec64a5cf8
MD5 d8b39de330cbe27187f4f404ec1bb9c1
SHA1 3062ac5126b6c05ad952c8aaff54f9e2b64dcea2
SHA512 53457aec952a7ce96e81325f512b3db6d54d6af8fa531c716b4e2d09940663082cd3e8bf205ecf0240f2c3acc7d777d6088709e6843906bc529914c1f68772fb
SSDEEP 24576:OzyF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OqLNiXicJFFRGNzj3
TLSH
T122650247629530F9E17A4139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 b78c176b508a7c96cbb2d2c230ab2d3dcb7185d428d92c8574498f2be0529aee
MD5 67fc9a199591d2eafb3bec7c4730126f
SHA1 c41873f2c4f8867589bd25e7fc3b1272bec75e39
SHA512 75b396d0e606e1b3200141d8d098e9ef3c7db56d8a26eff4b2935ab6b08bbc34f4273f5d83c2a7056fe8702d7fa757c55dcd6fc24173534de66fcb83837dc6c7
SSDEEP 24576:PT8aLl3z0zDb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PT7LljCLNiXicJFFRGNzj3
TLSH
T16E7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 1c8b413ca0b940722818941e60a33fc2ac664be6f2354b0b71cbe56039930192
MD5 30c08413a2bc61598db3f5574785023c
SHA1 4d45e0b17d986bda199a72ba4f2bcef1d28c27f6
SHA512 22060665a0da311711240dd48dd30ae0b3dee00ef51ebbb94e87681c4f2f0c6aa63a7d5d425a4ea3b48e97ca1f4bbfe5e9882fc2f1a31a4340f6ba8e3d3db09a
SSDEEP 24576:53rd9CHKy7GZX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Jrd9CHKyaNLNiXicJFFRGNzj3
TLSH
T13B85CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9bfa17a774a64646a47a008efe660d6bb322ff6224b447d854271f5fe7983d55
MD5 9b5808c6973f4f73e6b696002c0a0504
SHA1 b21948ece74651f54bc92d9f45315ebfac1fea50
SHA512 016e3d7ea8b0ae2f17f56aa40798f2e259d8262bf60a348b41b9def89c0a7d3d8608aa52d648fec69218a2197038ec751956078b8ba49f92dbac7c35192e13b9
SSDEEP 12288:kfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1605523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 093b838321c4cb01e5712377a7fe148441b6d01d0d643e531384993c23740f1a
MD5 7cb58817b5c377e661e8e0f04795f8bb
SHA1 9fcfe5db203a8a2635423224ab5086211c1a4617
SHA512 214bc52fbb87067a9669fed43b6edbf2ee3edf4cb3cbb35e519caaf4872e491bdfa867304e492eabc6cac2ddbe79f8c78a430c3e4d2ac894067a11648a5e3e0d
SSDEEP 12288:25iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2l/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1885523D2558955B1FABC0039867A4428F5881E2DDB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 aa6753a0e5ba09f082a44c61e454b87c7b9a07661ef1f83855bc6c4e2b942a65
MD5 7bcb9b8f8fbbca8d7445b699035f7e0d
SHA1 c0c7528ec725bbef19c32ba621d6879f4ad609f1
SHA512 de404dfe4da64fc0487b7228db334868f12592815e00a7b2ae3fa5dc967f922480734e2e0e030dface3f907eeab8118fe2bf9e009d1ee49b3e164e614d5036a7
SSDEEP 12288:3oiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1035523D3548955B1EAFC0039C6754428F5882E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 049f5d4b8be0d746949ffcc0795939e75adb142ca763c238f5ad416671b8faaa
MD5 8bc2e04987005679691ba7060b1b512a
SHA1 f8b358cd2d7a4fc958f9d2b6af115403f774bc93
SHA512 e5099e96a9bd5cac3158b509921f1f6a204b89801803a22f4801c1899951bf4fb4ea87d87fd4fbaca7f442fb27d5bc1db987999b130012e344bd8fcbc0879e2c
SSDEEP 12288:kpsfuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EB65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f8834d4f6d2c8a49b583c0893063fc0e2723461b7441153dc6c19a8e8b389fcb
MD5 46ea1bc484432ad402064088faa2524a
SHA1 2c671c1ec2b661fdcbfdae5652c2ad1f06e73cca
SHA512 a2bcb16814abdfff4b4a61a48b0c2f5e61e584b09813bbce5e32eb345d2fc6243d21b77087f61ef30f826e19d19ae1d6742ffc08fd91c05f3787435f6133d566
SSDEEP 12288:gaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:g8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15F552393968C55A2F6FD103985368438B54D7E2C9F5598D3E2043A1EA138FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a4d8c173d674ccabfb54c6f531ab2a0a8bd3b71993ffb5ddad8c69a2e0938d3e
MD5 a8f794d41fe7d93bb6759b1ff6959930
SHA1 f8ea9708043e7ff503c29d9093492d5505a56ab4
SHA512 ff97b783a91ab2ba31d590c45b6255265c2daf12ba4a5fa6b59511ed58d09276f2f8385705f5c2d175487e0845a56f2cbd59ffcb2c6f5496833ee12719c344e3
SSDEEP 49152:Pa0h2GEkuAe73q3pp46zwwQ+LNiXicJFFRGNzj3:Pa0hNYG4Jwl7wRGpj3
TLSH
T1D685AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 144ceffa04a9e6bf9e836020197faf6b8b70e88142232ce86599f8df501229de
MD5 d2aa0fa986fe158ba8b569df86ea8551
SHA1 78af195f179abdbb12e8069e90de55f56b5ce7b6
SHA512 a005c9da0d5079d969368665a03caae0d78fb3b9e94737cc8f499b7ee697682781f22c4c33e341b14e895d2c775f3fb996679aee9ca8e22aa1d889ccdf14657d
SSDEEP 24576:1hbHjP1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1hbHjtLNiXicJFFRGNzj3
TLSH
T18F5512BE129C20E5F6B5903D85668409E370BC29172197EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a184120b974b3395dac093ec8556bc02915834973eeb2005e0d3998aad94fed6
MD5 dc2a3ae6dda87c4a3f59593d99059545
SHA1 f0e6e8ddbb769a435bd58207bdb2f2b4ce1ff5df
SHA512 87d29fd35082c8729b5060d904a9ae70029e2098be147e274fe1717d68907a5a67cd449df46bfd2226799acf6e3b8a53380aac8951fccf06cc5479b3708bdc1f
SSDEEP 24576:i3YgnJcRTk4yti+R5dBR/Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iIgnaTk46pBR/ZLNiXicJFFRGNzj3
TLSH
T1E245B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 f8057f3b36f8253f3f9926c500eb64ce3e8e9691610f44db3054e8dd85dd1549
MD5 9575473a7ee67e577cc62aa103e5f0f6
SHA1 dce67f25c0aacd4b772b24ead9d405f42d481b2b
SHA512 929cc2ae84e4ec0450bcc2e679f404a4c53cc7e75141edc7e4cfe4c97c399dfe3b0fbfd1c0cb444b4bd57a0f5a38fb4ed54bff35c69012af0bd2e3238b3ccac2
SSDEEP 12288:GuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E75523D2518955B1EAFD003D86764428B5882F2C9B2619E3E1543E1EA27CFEFCF38563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 0db5bff5ca35816d315aebfc397b32921df56a66f97e343179e4346a0ef692dc
MD5 7c126a53a5c985816356ef1760cb2470
SHA1 fa5bea83657b7e28f3f19e03be4a598c743e9aa6
SHA512 9eff5d6647fad1f8f8ae5d44f7d7d488f4bb2a611cd0b5e63fdfa680dcb2b47410f23ded449d4489decfe9947161a980ffaebc5e1ed06887400653469a0d422f
SSDEEP 24576:mAL3UTD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mAL3U/LNiXicJFFRGNzj3
TLSH
T1B3750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 3319430b052213de3b0d02d9606a50a0e40bda620046b37a64477e96eb17f5b7
MD5 7ea262a0cc08faf6a01d3fd78b80861e
SHA1 440d0ca468142403b668716355cc6f17f7a0b7b5
SHA512 ef7aa02aaa9a4196df1b2b62583750accee6fc089ece48b1040225c27922d9f99b0e9ac3472a290646379f6e3b52f79527d126195fd86646043db75ea1fae83f
SSDEEP 24576:5Of/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5OfLNiXicJFFRGNzj3
TLSH
T16355126A32DC10F4E579503D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7fc01fcd0febcdf3b6299a5269de5ba842ca6b0c4e833c6aa32735ce47a77a7f
MD5 7a6e5c841950c2f24378c41bef9b3eb6
SHA1 0cfc8a201aa1091be4dc5b9b5fe157aa7808f615
SHA512 96fd2d7ffc5e4b8aa8e8515f6a3502d15f230235310a53583a17a2bf9e5415cc0e4f4294d2685afcd75f35218d2e5f7eaf80418314eae3d8ca0abb9811ff8952
SSDEEP 24576:x7NM9YqZqmWMUkPjZM48Mv6bEhss/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:x7cBWMpPjN8DbEhBLNiXicJFFRGNzj3
TLSH
T1A665AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 1184b140ddae7cc416be673f2de7a6af754c4d061b0d7e22ed5fe32f4e416cc9
MD5 af4f38e0b70b529534b5412ba02f35ef
SHA1 4f501fcc718fb1af2ce925a12479663cc497a239
SHA512 b95c682cf64a92cc7943755bb39759d3ce84acc79d9943ea68608a5aabd40f61eb7b9040f5a30862cae895c33055fb373f97086a97f3c9c804620b282cd05f2b
SSDEEP 49152:5F2YuHNETovAvNYf8kmMLNiXicJFFRGNzj3:s6BCf8kf7wRGpj3
TLSH
T1F4858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 3508ef9b7a1df0111c0c4600c59e2fed7564772df0a2037a22bf5004933d19a4
MD5 b567c9493ee87bb3d1b14996ee81dfd5
SHA1 9e75a1ad0263464bc94657cf7ab1d9060f9a26c0
SHA512 2e8e244f1e09c7d13e232f5547346a4d15d4b167da7d5366de08b81a6923e9f09195ed9998c0b12e4e5d1b74884340dd8eccf97e45f19a059df2fa1acb030389
SSDEEP 24576:YAFs06+Omlf8NXEbToL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dFs060loXueLNiXicJFFRGNzj3
TLSH
T1AD65BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 da81759af6d57646c4b5b8cf982dadd1ff060a1fc90f6744a439427f5d592c74
MD5 b486d65700de5fe7023d8d1ff2163ec3
SHA1 8b048af44835f3115aa043fce44c9f5828293130
SHA512 53dc1dc1abd697d2bce00fc7d0871af74f2835f68709dfb4870dafe9d9ddf99408ce7de70390e4e3774731616c583bffa9f700686aaabde0d0905f43fbda04ab
SSDEEP 24576:qJnJ5D3WXe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qJnJ5DGXeLNiXicJFFRGNzj3
TLSH
T17375D02DD29810F8E4B7C274825A1A55FE72383D2F2269C724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 44c82cde01215d3336453667886546ceec8f970728db645cdb0b8fcc6310c537
MD5 c553cb257e8acb27ecd5f60a8f91c691
SHA1 59cd2287b52d47d0f18dcf3c8d929633c7f3ae25
SHA512 68c22dedecb2d921911106873a242fe436778bc60f6af49c493a8b5167b98ae4b1fbfee7c9df198f689f2dec100e6081713116a978052efedefcaee7680f43e3
SSDEEP 49152:Eg06DIKdwc+eQnSt65aVALNiXicJFFRGNzj3:1i7wRGpj3
TLSH
T1D2956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 e95f456f08e4e1f45b674d03d6976f379ca8bf253d45402002efdebf60117a8b
MD5 21a6b55c0e0133f47d58d4f9c8f3d550
SHA1 097c4a56178b4a18e40ab206c451e753ce9a6db9
SHA512 4a59929fa66e1b7cf09ee1a37a34bbbdebb754db0f513f8095c3ab9699bace62462128fb0165b442dc60880b1661323a28853a9532fb7c66c961570ff276620a
SSDEEP 24576:GnS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GnSLNiXicJFFRGNzj3
TLSH
T1955512AE278C70E5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 d4dc8244aa17d4b8511a4e288ad27ec814eb44f3ccd214f0a00525a213ead88a
MD5 f47f52b5f676c7289f8262557d36ab49
SHA1 4d096d15d5f24138c297efc0349d8be52ca4b6a4
SHA512 e75a5f696b122e731ecea386773d23826b49d4be4da87f12369987890bc9379dad130eabfc192c65c9a511b1266fd72fe78828179f7d288500b2100b12176156
SSDEEP 24576:jIyx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jIOLNiXicJFFRGNzj3
TLSH
T1D165124553C860E5EAB9013CCA734164AA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 bd5e8867949454a81b13720e76f15a7c7020345b32fc85e950edb8e186be8786
MD5 1e1a350eb32d30a7ba264fad7f9ab77b
SHA1 6387c6df36647c7a3cfe6fe482570214d5a6cc21
SHA512 3393ce006282a2be46df05da06125e65df6d8decf8207d192c5067ab3bc5cb7897bc284518457172ddf7175f64f01ae281ca0372051eaab9e853db41f5d7385c
SSDEEP 12288:7y7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14055239A118964F1EABD003D86354824B1943E3C9B1628F7A1947E3ED339FDBDF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0d183fe2b16b2fc8d0b5d942f1b263a7ca7f94541861e1c40e96b0fa45658f17
MD5 c3d232d29ec3a372e6ba87fc738fdfc4
SHA1 1997aac6eeb4c13ba915985c0d143449314f1b20
SHA512 e6ed6107bbb74dd73e7b3b6c5aad4faa1588928891208a5ed66159e36c87fbd932a0d60b6158382ab1b6b8f81f3aa30b061eb9f9d8e1850ebf5fdab18c8d2c4d
SSDEEP 24576:1Q9MxZKdcz9dw30/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1VKZ0LNiXicJFFRGNzj3
TLSH
T1AB558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 41d91b987e59f14c313afc0233e44805c3ad0674fe9e6f7f573b434fd1ed3081
MD5 22c7ba2788d98503c1154c58952d1abf
SHA1 2ffe516b2300cf61079ca3a898369eeeaf88ddce
SHA512 5266c5bda43ac2c46e5496cbf8a01dcfff6124521513d4c71d7c52fa7c3ab7c53086d4d2cda6a796ee78a899f69592d851749f24f29034ac3e874a178211af58
SSDEEP 24576:FyocDApt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YocDAptLNiXicJFFRGNzj3
TLSH
T1C365E05FB76D40A2E176813C89858204E7B3B4345B6257DB6181C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 00f950f003f1d10e52374cecf98d4377ff9bb2536cb3a416725a00ac00aaa533
MD5 15d384ddf47d4a1896bf0870ec214086
SHA1 ae6e407136e121da7551cceb0db3185286de7118
SHA512 aad769a251e236420657ca068672d805e1a91320e215df6f42953f81791f4c52f731425cb51670f304e9fd892331676c3c66fc30a754476a1996ed267d0a5ca4
SSDEEP 49152:WWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKtLNiXicJFFRGNzj3:g0zuNID7wRGpj3
TLSH
T1BBA57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b316025d5ea1f0b672200c7c1958140b05121b6d342b2f1c2097aa431b9adf90
MD5 a8423b03cf1f6b502fea322e7ca56ffb
SHA1 bdd0c270b72fd2847c107c5abea920e4145c90ac
SHA512 a312243ca44616d81ef5eea881ace939a0d606ec015708bd48b603b61bd3957864ee97b9ff7c21d0d4fa224c19dc5bc839e276ab8e5e9750afd8f78b21f03a94
SSDEEP 24576:z1QT7EcpfxR+N5AWAz3ooiYzjMqbS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uTDxR+N5YzTBjMXLNiXicJFFRGNzj3
TLSH
T19D55B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/744-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/744-231-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/744-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/744-120-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/984-507-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/984-320-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1184-72-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1184-125-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1184-66-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1208-506-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1208-316-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1824-300-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/1824-406-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/1824-293-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/1824-294-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/1928-407-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/1928-304-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/2088-271-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/2088-323-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/2440-243-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2440-238-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2600-257-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/2600-251-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/2600-247-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/2600-315-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/2904-16-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2904-229-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/2904-24-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/2904-25-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2912-411-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-435-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-448-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-451-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-450-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-449-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-447-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-444-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-446-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-445-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-443-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-442-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-441-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-431-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-432-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-433-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-434-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-436-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-437-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-438-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-439-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-430-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-427-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-428-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-429-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-426-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-415-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-424-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-425-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-416-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-418-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-421-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-423-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-422-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-408-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-409-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-410-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-413-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-412-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-420-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-414-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-417-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/2912-419-0x00000144F64C0000-0x00000144F64D0000-memory.dmp

Download

memory/3320-13-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3320-228-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3372-61-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/3372-74-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/3372-80-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3372-55-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/3468-328-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3468-440-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3468-274-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3592-311-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/3592-242-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/3700-402-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3700-278-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3780-457-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3780-312-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3904-405-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3904-281-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3904-289-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3904-287-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3948-30-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/3948-0-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/3948-8-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/3948-1-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/4560-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4560-42-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4560-33-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4560-230-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4672-338-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4672-329-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4672-400-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4672-354-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4672-509-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4740-309-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4740-307-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4780-324-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4780-508-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/5104-267-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/5104-319-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5104-262-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/5104-261-0x0000000000400000-0x00000000005EE000-memory.dmp

Download