d835887ddb20eb96310dcde678d8670c5bd294a0cd6fda637bf1cd3ae67aad3f

Analysis

max time kernel
148s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 1.5MB
Sample260522-vz2faady7w
SHA256 d835887ddb20eb96310dcde678d8670c5bd294a0cd6fda637bf1cd3ae67aad3f
MD5 03a9c75f614628bddfb1af29e2373d51
SHA1 6ee35f1cb15fa640c4a4d03cca0f26789e460e21
SHA512 73214027b6833e7afa0b78f1887e85ef622fa85f85704fd8095308d7772736d573374499e0e8f9a3b8729dcb52b86dd56fb6cac80aa38628a73c714fd066df41
SSDEEP 24576:q1XgAnx52DNPwZ2WR3Yijg/dBQR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OXgAnH2DNPwRoiM/dBqLNiXicJFFRGNf
TLSH
T1DC759B71306E4BB0EA98A071393416755879AC085713F7B392DDB9A82131F9DBE34EE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3272	alg.exe
660	DiagnosticsHub.StandardCollector.Service.exe
1116	fxssvc.exe
1640	elevation_service.exe
984	elevation_service.exe
3160	maintenanceservice.exe
2400	OSE.EXE
3996	msdtc.exe
3264	PerceptionSimulationService.exe
4064	perfhost.exe
4916	locator.exe
2908	SensorDataService.exe
236	snmptrap.exe
4720	spectrum.exe
5036	ssh-agent.exe
4588	TieringEngineService.exe
4408	AgentService.exe
840	vds.exe
3564	vssvc.exe
2216	wbengine.exe
3348	WmiApSrv.exe
1192	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f3f6841efe8d2f74.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_175984\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_175984\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001cfb795d10eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ffff26310eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e372466410eadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000afae036410eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013cde36410eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026f1476510eadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
660	DiagnosticsHub.StandardCollector.Service.exe
660	DiagnosticsHub.StandardCollector.Service.exe
660	DiagnosticsHub.StandardCollector.Service.exe
660	DiagnosticsHub.StandardCollector.Service.exe
660	DiagnosticsHub.StandardCollector.Service.exe
660	DiagnosticsHub.StandardCollector.Service.exe
1640	elevation_service.exe
1640	elevation_service.exe
1640	elevation_service.exe
1640	elevation_service.exe
1640	elevation_service.exe
1640	elevation_service.exe
1640	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4464	2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeAuditPrivilege	1116	fxssvc.exe
Token: SeDebugPrivilege	660	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1640	elevation_service.exe
Token: SeRestorePrivilege	4588	TieringEngineService.exe
Token: SeManageVolumePrivilege	4588	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4408	AgentService.exe
Token: SeBackupPrivilege	3564	vssvc.exe
Token: SeRestorePrivilege	3564	vssvc.exe
Token: SeAuditPrivilege	3564	vssvc.exe
Token: SeBackupPrivilege	2216	wbengine.exe
Token: SeRestorePrivilege	2216	wbengine.exe
Token: SeSecurityPrivilege	2216	wbengine.exe
Token: 33	1192	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1192	SearchIndexer.exe
Token: SeDebugPrivilege	1640	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 4584	1192	SearchIndexer.exe	119
PID 1192 wrote to memory of 2756	1192	SearchIndexer.exe	120
PID 1192 wrote to memory of 4044	1192	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_03a9c75f614628bddfb1af29e2373d51_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3272

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4084

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:984

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3160

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2400

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3996

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3264

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4064

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4916

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2908

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:236

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4720

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5036

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4104

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:840

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3564

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2216

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3348

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4584
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2856 2036 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2756
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2596 2812 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1fb33036c5268d639af018d1f98c421949b5c819298264794ea898b5a0a8d0c3
MD5 f5938b86643f9f5b497ca4089ae61b38
SHA1 1abe3be74e3a0a6abee854014ff0880c3d2425d6
SHA512 5410adb2ace42742b4bed484b61ca3bf46513bc4b65378c337756ab5e9ab7ca872cea4087c989300efb9824a0ff12ecd358e7a9c9cc29a1aa2af972c87d2cae2
SSDEEP 49152:ib+632BuPkFKRrdE6ohdstBhuXjfS4LWxnzLNiXicJFFRGNzj3:E3q6mjBU7wRGpj3
TLSH
T19DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 2301abbd04d2923333d731cfc776fbe78b88ce2ae9c0df5c76c22d07125e1497
MD5 ffe23cefb6161e40fd5a5be1298588db
SHA1 8275d536a062c225597cd5e71ba4c253cd015dd0
SHA512 8765a9441df1cc3964eef0ec81ea18f87e1f0aeac68a88326997808b48350bc60cb395067ebc2f1cd4a3635ea8fa76895555a049b47cdee79b785ec0d98db11a
SSDEEP 24576:jXYfDtczAI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mtcNLNiXicJFFRGNzj3
TLSH
T1CD75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 6399e26d7e9f735b07798964280eacd9290df6cb297163fa898cea8e20851e2f
MD5 42c2703ab43c39d9b01346a9ed440c88
SHA1 263c4b446c57103a43ae60b73a9aeaad051dfebd
SHA512 edecdb9d7cedd8274fb06b25e7d7ae2794cba81f77e5e0933e453793da48a6c94bfff53d58b99072bb013946648fab620ae0c867d1ef4c505262f74e8e51cdb4
SSDEEP 24576:C0Le5ji0hmxhrM7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CPji0AzuLNiXicJFFRGNzj3
TLSH
T111859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d830636ad3860f0655ee93533517334701c9d4cd29b69fc32da5a6bdb6dc2158
MD5 8c52b6b6fa08e52b30700013c396a9a2
SHA1 153fb3153ce4408d334300139f62002fd044ebee
SHA512 21f6581bdc358ded2091ab908fbe5a14e38c8f295165a4c862ae0185eb07f5021dd15f76ae009c72dffe88006ccdb64334dc28f423bae6a290b920b21692b12b
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWj6q8wyu9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz://ezSC6vUzPv+HjyCLNiXicJFFRGNzj3
TLSH
T1AD756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a0f64e1fd456d510be7a218082cf2574eb60a7ac3d3e6a95f1def75ca0437937
MD5 0b5dcdcf2dd6143d9099bd0314cc20bb
SHA1 6efd71366016130d4401eba000ab915da39a932d
SHA512 02f1104ca38886450f5c5cf8fd98efe7f84c4e5c6befc0efd9a7a2a57685d080aa795f70ebd17abb131153f9049e49544c5227e8929039956813b109faab0f39
SSDEEP 24576:yVbqPb88hv/l+BE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yVO88hXl+OLNiXicJFFRGNzj3
TLSH
T106559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 78f6c1084b08f1b6efad2dd768ebae32d2eba9263daa44b47fa083f587556ef8
MD5 c0433b1a34ee3e086e92631b37b79cce
SHA1 b8f9055ca150178f5bdda3e41d71d5368dcac8b2
SHA512 353c669fe1a7663031536f7ab1df3d2286f016025cd78dcc588e6fff543f2fc6d03ad63109d11b18e8dc5cc6307f131cd2eeba53db4e14a47279133fb0971e91
SSDEEP 24576:JGH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ALNiXicJFFRGNzj3
TLSH
T1F85523D3468855B1FBFD003A867A5828B6845E2CCA595DE2D2543E5E913CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 250594d13f14d549522491d487e8698eeae10580c0b4c26745e91acb0c4a36ad
MD5 2f3977019526cb0a2c7ab83f0c3dc4bf
SHA1 7d176bad4fc7148e257e7307e909a64831f41259
SHA512 7b4f617aea3e2b0ca64794ac757aa3eb60dc36ca54616f1b8387a9b6b8e52afa73629986d77e312eee7d5808214fa3feea1e3b0a8f8937df60a368e31b4065a4
SSDEEP 24576:9JIUs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9JIUsLNiXicJFFRGNzj3
TLSH
T1E175CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 064fd9c0e6527f2c857546198d9d77d36bd6f7335a39a30acc81e5d170f0d206
MD5 c3402ec97afdef408f96db9e1cff7f2e
SHA1 d3b36732ead0700da0a60d751e2589d692e5ce80
SHA512 b57d69c8e9d5bcc4cdc64b732566d0609235ee90264c306bf68fd4c9a617c4cc02dd41ad72f1d05ba778e386dd4e742625f72848145d40ef4fb1907eb189d6fb
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THC:TQvGAdlCEL8c/WRNw5Ct7wRGpj3
TLSH
T17C266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 0ec3155e83582b8fd32e59b0655b0bf3e537f666cf3902f2d0454a448fd9c2e1
MD5 3a1b19169a1b0a399c18d07d8f5b5651
SHA1 5e422502560fda05bb94c0fc6ef41e49a71c3a29
SHA512 58e28470263b36145693fe967586decffec36c251e01ab6f0d30d65088a25efee26385d3f36b7907c4e668097f21afc3ff3c639eb3f8bdda9b1c2d8ed1400cf2
SSDEEP 24576:lfewsAje/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5ljeLNiXicJFFRGNzj3
TLSH
T16275E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 140943cf8f9f3615e81129fe5f3457d28df1ae5bb56f989302f3d9a061650d58
MD5 e194dee3e1844b655283033ad5df80c8
SHA1 51c4b1795e58852dca551a063be3a304f20f6466
SHA512 e805d75321e58078236daf0ec45191df47f58cb170f40ac9e1e66047205c76d2a36ff767466b218915b07eb0df110beaa951fd6514f84bbb3b3a206f12dfbea4
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH6F9:yUEtQevvqc2W1cpV20I32+9
TLSH
T106474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 830128b35498c11cc10634bd6eb63133290c9d03b15f41603e42a0d5e513261d
MD5 783207d1b9bf3c91f383995e52fa9053
SHA1 578b5bac080782a29aea7d81c25645aa170c209e
SHA512 86009f33d61485d66faca72a2fafcb3567765a786958b53e008dabce5c36a7676edf9e1b8d3a08780da9ee7e3c49d98e75d3654df12b2db24f43ff1795242855
SSDEEP 49152:oCbRquA/m2yL5zLfFiV+XenmE3/z+LNiXicJFFRGNzj3:Boq2Vjnmh7wRGpj3
TLSH
T1A5D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d6576dfb974fcdcd4218047759ca76de0cef16a8bb95ea3055c28e22dfc89406
MD5 ca86fa74b378455cb488e8775f883cea
SHA1 2cd96c0abad4f643765aa3abecdcea04c59ff205
SHA512 65442637f4d05bcac6171493c7c202a21488278bf41c271c96cd6ca8f9bd7715c2876c7822be6de782e50895bea6630477bee889588d34820d1a7e1ba02d22b3
SSDEEP 24576:dAhGL6IFoiwtA5l7S53B/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dAM5Foiq5RLNiXicJFFRGNzj3
TLSH
T118359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 0b693d71b1a084679f92666ce0d2ee05a768711e753c0209d8fbecd6b870661d
MD5 9459bf860d8137d046f0eb9cc244b2f7
SHA1 da002da864a88988b5f1ed3bc94abdfa869b92ce
SHA512 9ee12b46ab42a7c0e4a4b9e4bd69775900c03f3794ca8b4330124ed3cdbbc21d1985b220f5fa03840791fdc950531ad9a842fc9a3f35ec73505eabf569956ae5
SSDEEP 24576:dwuROWi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dwSOlLNiXicJFFRGNzj3
TLSH
T1AE65F08632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 09d464eb331ef6aaa6cff7a9293bb9e2aebe04c4c6ee833ec2660248a1460f52
MD5 f0309629e4fec00b3c738905e223e336
SHA1 07622ec9ac6ff0507bfeb954d2416a642ddd5f04
SHA512 bf021955d2485afd0fa87374cc1960ad009bbdd574b5e2b4555d30c74a55ec385973d17f6aeedffab19bcdfaab2c002f1d040760399c3e76d2cb89586a9ea6d6
SSDEEP 24576:gZuj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tLNiXicJFFRGNzj3
TLSH
T1BB55129622C420F5E2BB413DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3eea59f107c42c20c3e3c59d2595ede49476afe6cecb00ac5d9fc755b0cf8dda
MD5 d4f32751bb84791036f99a813d2dde1d
SHA1 0298bc3f8e99dde0a81a8cbde1a1cc47dc1376b3
SHA512 23a2a246b1df63807b9d818dec4defc005ae8def444465259479a2d0e1fd3ceb716915ec9b044cefb2f4ab61bb3acda81e9cf69042f23626b1646c5159f99ff5
SSDEEP 98304:qQRQyi36YOcPDLvw2gAf+PN3Q7wRGpj3:BQyiKanX+PN8F9
TLSH
T19B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 deeefcd956ad610b7ca6d891890e475c3f667e0c639ca0b648adb34d8fe57d59
MD5 32ad2fe19d4e35e8c11799f25d36d9de
SHA1 164829993e0362d512c89f97cf0cbcecde7a13f4
SHA512 0898211aad06dc97ed2c5cdf0237784979c7171f979880b93218bccea73ac31fd6c638fbb13da83e8e13e62b50f0ae2b03894bd7053e4c4815c5504103e2ed3b
SSDEEP 98304:4QRQyi36YOcPDLvw2gAf+PN3Q7wRGpj3:vQyiKanX+PN8F9
TLSH
T17C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 da11248bbfc69424dad88314e7e3112107355880fbebe8c56e8906389d7da945
MD5 cb6a4e9da0fab19b3c593569011210b3
SHA1 a3ac256fe5b04677743c864b841ff61b616783f0
SHA512 f2e0958ae7012899b4aa69f51c4d5e78b3f53f495b60a6308f9502488d233cd96d8613fc3a03e1337b2a7509e3fb9b81cacd6580f3e261269daf02836ad8a68b
SSDEEP 49152:c68Qg55nhkeWu7PNU3/uLNiXicJFFRGNzj3:WthTRc/u7wRGpj3
TLSH
T192B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d5ccc280cd1b04f15d70fb4d4b8bd47d069023e6e79b143e7b50c8b44e563f65
MD5 b11494465e6824cc946866f151ac169c
SHA1 83e32c1d1d495a06d7a10372596127e1da6a89a5
SHA512 a27cdcc60e34ef6a108cd02dfb147aee88907a1fc4d10b13b94ffc382d8549f972bb0c3c5219121c99ca525b1a670713edee480fa40ff301b9b357b348d77f01
SSDEEP 98304:3y5112gYy5azzVvU69nLKnhZH7wRGpj3:KLIHRWhNF9
TLSH
T1E1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2ef2539706ff1c773af0033048a8553b7d18f4b1288ed232ba7418a39c2a233b
MD5 78c551e320a173485f8a0c61e9958065
SHA1 b11f5bec72cacf489c6860b88468d8fc5f1f4c0a
SHA512 6f0a5b1f18d355fd42e8cb646581445573ce365721d73a3fd5fb32bf14738f4dec0b430e463a3ca2012e418ffe4670413fca1c4c1ca706fda90f7584ee03458f
SSDEEP 49152:4B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glYLNiXicJFFRGNzj3:Su6JmIxd2dY7wRGpj3
TLSH
T1F6D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8676f3f5a9ee29a1096c345f2d43aac34bef0fe5448e95cc15cc273b1b67019f
MD5 9f0266c8a12c220a035a170ac356e2b2
SHA1 bd8ac51ff310956de5f07bd8855b06938e5db55c
SHA512 c48ed2ba77d439e8f040d471734510599add71892f1ca7d5e58ce78ffd149267cf57bc7e472f68cc08743505ff9d1251d3afeafc0530e3c8f7615fd910525b03
SSDEEP 49152:p1hpsNoJpF1A67U44CwH7R4xMLNiXicJFFRGNzj3:pmifPqRh7wRGpj3
TLSH
T132B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 74d168649a355037dc7698f747b4f1e894b19a10ebc5cf8a03f5c992c5177d59
MD5 00e55578500260e7615ba2f062f7cf9a
SHA1 7c7b8010fe3725ce60cbe9990a98c0884f13cf83
SHA512 be3bcb6ce0f528fc3b78b09b4777fcf8f236664de0a04264e922d516046bb639f320676694646bac3ea89fdca62d9e2fb2d3f0a2a8ca191dbfd7da20103146aa
SSDEEP 49152:3SuZQIY0Be2KkRVtOnks6NMHqjLNiXicJFFRGNzj3:t5dKqi61j7wRGpj3
TLSH
T1DCC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6d748ab0c852c9e1a85790763f750ee5fb3243e640d989cc5e21885fc2305169
MD5 66b77771659c96dd0fc339e2b03e092a
SHA1 cb6cf97e53db3c8368ec2d8e19adb684d716d50e
SHA512 a3beecf2022fc4a907b66deec9eb72a9ac453a3c85aa5f551e4f87f044fd391e78c1eaf77807f027801f52e53d5f852be5f5131de4ed8b332bdbe884406c6676
SSDEEP 49152:nhtSn8EApI0figjgiDn0AP5wILNiXicJFFRGNzj3:2X2iWphF7wRGpj3
TLSH
T15295BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a8dd59685e93f16308a398cbe7d8b0f68957394a5c0f177ae280ed31c2b908cf
MD5 d0f128219f4367e5032d175c197f6d64
SHA1 5bb8b43ca572b447fc1411797c7c233719813dfd
SHA512 f53ab4cd16ed1298b5eead5b3c184534dbcd61c388d21d90d2f85ebe53104b9b1fd7b7c42d6664775341b09fb571ebf5ff24821ee204b48c2c31b5b1ba96ca73
SSDEEP 12288:FbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:FP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11E5523D3548955B1EAFC003AC6755428F5881E2DEB5618E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fb58717fb15790d93f201c4efbe7545a6478e646ecafc6de29ddf1b49245241d
MD5 b4813bace0bbe5c530e6f6415fcf625b
SHA1 2dc352dc7237e7b61ffb7c9852949dab37b2f299
SHA512 da2e76eaea82d0fd175f71b3fa9e779b12ae013c0694aa4853ef02a03098a254332dd9682bb93f091017a99bdd6dee6dae86deb1ff45a510a655083fed779280
SSDEEP 12288:8IiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:86/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1115523D3548955B2E6BC003AC6754428F5881E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 150e6036575c82ffab1fe48f615b5375addd075cccd1965e91e8f9ac10380b03
MD5 b2052c709329bf270d59324016320edb
SHA1 3bda394b54b301f833da458ded4edf2bbd701435
SHA512 2420121dbb8274d2893f6fcbc1d3a68e6f1e48790d7b4ac201768f1e4ed27217e7789dd988d5a4f1b496fb724ea44ef18feed556bb18319b10e9850e309e473d
SSDEEP 12288:iyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17C5523D2558955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 06e65c98d527120709a89af00d841819153c80691edbfb9af037fb0e4fb09b5b
MD5 802021b7aa5873523aae600a0d80c150
SHA1 22cd6151a448cbe4aea6b11d37b1534a92904e04
SHA512 148537846116245b7b943dda96fa035191286b4673bace950eba7bd4c8cea32487d08e97836f99d8d7c0d7afcf9c695c5b8234457b4a3da6b4f31513f51d0658
SSDEEP 12288:eV9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11D552392168901F1E9FD8039C6764424F2A47D6CDB325AEBD3003D1E5674FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 38315dd111e06f00d7bb23a8562a7a1c2eba8c5d2f033560b3f9f98249f4e48c
MD5 36653edbd203cfaa25e9d8e08a16fb55
SHA1 6efb9ec2c6bce113a16115942c906e7e799817fe
SHA512 c98163dca5c4771730e94842f0ee7bbf28abe47cdffe22429eb9acdb6c5773a782e06789076d555f3424d18f11d1fae502b4fff3dfc2deb550889011738f1ad1
SSDEEP 12288:D1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B65523D3558955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a687e1248afdc35f56eb537ff3c2abbcdd1653a33355cb2c15d6622711a2df86
MD5 815dd5b9666eee390ac8b6847db30cfc
SHA1 8eabe14abb75b312ba323a45f0993b199f4d3271
SHA512 09b74b2b3ee355b697fe7c980c1326c3747c67e4e67099e56e28d420a2c985b1d8e9ab3cb754d08a0473b6b48c9be4952846fbd1d4c52cd098bdd7b4fc377e69
SSDEEP 12288:AciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Am/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14C5523D3548955B2E6BC003A86754428F5881E2DEB5619E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1dac839d66abbdd4cffcddef0e16b2f2e5a3a9bacdc3474b2eb42d7bd84ce7af
MD5 19b6ea9a4a8ba0cd346004e11cefcdf0
SHA1 8bdbbaf14ddab663dd38e7f6ccaa638228efefc1
SHA512 5f5ed86cbf8accd481ce3554a90ac1de1ed9634ceee5970c547f884b302ee803977c376a92285cc728f2859f204ff74f5a2d8dddb37d404bfbdb469e70639436
SSDEEP 12288:ogiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1425523D3548955B2E6BC003A86355428F5881E2DEB5659E3E3083D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3e175b566771ca1ea6818a45edb3c300cb404067cd890ae85be2d13de56b1b73
MD5 1820b4124cb1417b4ab44267af3e6cae
SHA1 5753d8528ecd3f22a1cc9f1010f283447ef602ec
SHA512 38acd98813f443d9f1850aad3baeb0c6bfa0d1a5a8b955dce744b57cfa48416419359e67bf048a64708ad7e894ccaf36dc31acd2c9922c27f64a38a6d9bed911
SSDEEP 24576:LZM3zFVSOa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LZM3zfWLNiXicJFFRGNzj3
TLSH
T155750295B39018F4ECB7813EC9258815E2B27C194B70CA5F13A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3531effba96f424721452966059f5cfda18b1985c654988ef8463d1bef133ee7
MD5 7f76573c98395e6e3c468dadba326257
SHA1 e208b0fe74656fe39b3cddfdabf591b9b4d9106f
SHA512 9210eef010701c935ad22f19aa946ffb8450c8004efbe7c2d1d66848f8d53ebfcd42a973058c62248b6902a3531e3a50a30264e68e8ee4f130c96cf6efe70470
SSDEEP 12288:BniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1995523D3548955B1EAFC003986764428F5881E2DEB5619E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b9286dee69686a8c77cdb1654304da6ee894625c9787f91bef2762ba82c30482
MD5 7dd6ddd865715daed5ecc0b04cc2d6cf
SHA1 c58912b82fea54cfeaef16beca1a92119bb2dd88
SHA512 7d20daab7d445acee74b8d0d586dcca8227ce732e83508ac44af73a7b8c72c86d8f53d4a3cf6224d706c91d97ac5fbb2085389bae307c1c2fd151c860032c6b0
SSDEEP 12288:SDiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:S3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E85523D3548955B1EABC0039C6754428F5886E2DEB5619E3E3483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 9e4c7c07b08243517b528eddad286173865ef97e080c9f21c17f6be8bf063e83
MD5 6dc6368532f5ab4d517906491f34b730
SHA1 abaf121f0d36cc7398578ff76482bd6c630ec653
SHA512 24432e2a56443d95b3cc543448c11bb0dedfc6d14803d3c5017a8bf28ab88967d96458fcead6000adf51e959d3b452110316c848d974bc5d983665a1b4ef92f4
SSDEEP 24576:FzyO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FFLNiXicJFFRGNzj3
TLSH
T1C4650247629530F9D17A4139C9620911F3B17C364B208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d088e73ae6c3f1af554388ecdbc909982e36ba41bfd01197417480360ca7c50c
MD5 310c8c343f1a09b4f1f55ed07b8dec90
SHA1 fa5030495fc2319e5f020d8d87dbbbc74c3111e1
SHA512 5fba07c1200ada25f60286e43080077737e928a8679baf1fa5aa8cc301f5ac095e664a5defb27018ae275e4db72cb7ed78621370f7e40be6e665a18560c85019
SSDEEP 12288:wniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A65523D3548955B1EAFC003986764428F5881E2DEB5619E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3e8825ccf57b0e9dafa8a9340c07fcbbbc2323d46394e638066d8307e7d11615
MD5 6b9da18c8b95c5c8173e4dd935c09f11
SHA1 db4aa0a5de1e6c0f71a4c153912d68f2443bc832
SHA512 88eced80520ab76914b755dbb34076bbedbfd301c53f554a0ee301d0f8ddd9ad244c6eeb80e2904a35d07f9f7259e444a4450fdcdabc155f50251dc972909268
SSDEEP 12288:QniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1045523D3548955B1EAFC003986764428F5881E2DEB5619E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 01a96bd77c626535abc93eb225608bf126912ed0e2c3b2291e9f1fd5ebe7add3
MD5 30730ea5802351e7c19e6a6b7b1bdded
SHA1 9110993352c8b6c41e14f1d6c3aad8eced5ed491
SHA512 a525f0e0c813f2e8cf7257f27504279fa4ca962064da74f9ce82aed041de976cb1f5ae2d1de835f384cae2f29a1c7aca46d122dff3b5307969aac926ff95335b
SSDEEP 24576:vzyO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vFLNiXicJFFRGNzj3
TLSH
T11B650247629530F9D17A8139C9621911F3B17C364B208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 15e0527619b83d5c38fd66875d72772868429ab9f0ceefdc681a1616f86abe65
MD5 8fbb144c1e7a981b1a389f74d48b884f
SHA1 1606e033dace26d47c1a455abd17850c16ddf21a
SHA512 13622dfb4bc2b20e07e090c69a7384f202a2d54b33295398e3908129e4f261c5c645f26fe7922a41f5b145ec79b3a4455de4d2d06ff9a8958e09701d217570b9
SSDEEP 24576:wT8aLl3z0zDk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wT7Llj9LNiXicJFFRGNzj3
TLSH
T1FC7502A5B39018F8EDB7813EC9258815E2B27C1A4770CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 e1d1cebd24fb14e95af2f21e6a9ff56a0803d87cf46c7932139aa4c7646dc0b7
MD5 7f2ac671fa5013553d11223f95faecda
SHA1 9e233e0ba24db5fa59d0d231fb0c2d6a082b6c37
SHA512 0fad36276655b233e8d2ca691e04df548ac65027becf9629ba56306c381da9c5fb5716c5b13799eec7f97cf6c8ba154b19573529e3a72f671797efdb4f92ca2c
SSDEEP 24576:n3rd9CHKy7GZw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3rd9CHKyaWLNiXicJFFRGNzj3
TLSH
T14985CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 ce472de12591a89d287849c256b2e3aa1749bc1dba23ba7dedddc792c6c7fce1
MD5 06d8033a1a9a58de8a8021782c5c8d03
SHA1 1236b6fc8728942ce138a35244ca6916904f7c1f
SHA512 2c22833dbf93c07d89b60ba5271fe3b33d79379d204012018578af00d2df02274a0a32fefd230270b6f4b691328c01fd4ed2aee85193ed90cb643abb3f1043ad
SSDEEP 12288:fpsfXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A865F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 980b9e11988512a94cf1f9403d5524137b535ffdb98fc3b78235938f239bf4c2
MD5 8565bd171699839a2436e2597d3052b8
SHA1 379bc4c3bb9c1c7775f2211e22533aeaa44d729d
SHA512 0b679e1e9e16c61a8c277b8d216588a4ec4d8ec51e9b20f2046388be44b0f081582f0f416a5e1e7d3b51dce325c4851dd0f6bb91b690598a1d0dddca48d71577
SSDEEP 24576:gKP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gQLNiXicJFFRGNzj3
TLSH
T1A2552392528C59A1FAFD1039857A9434B14C7E2CDF1598D3E2043A5EA238FDBDF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 dc5f6b5698b3d2ddbc4ee7c23a6d35b87f6145485656d9b204350b662797c341
MD5 be87037df50c2129b4f00c47fb67c91f
SHA1 0c053b802270f7ec045ed060a4af904930fd702a
SHA512 1943af24e047dc8794d1e57bc4a1fdf7eac744423896b935ff0f342b79ed2d38c7fdf32672dfa8b1334ae5632847817ac6a7bc4c00fab20c64a5f081f3aa8f98
SSDEEP 49152:lRZwQCyiHiQEaaPnMLLNiXicJFFRGNzj3:X9xvPS7wRGpj3
TLSH
T11585B01E62DC46A5E0BAD278CDA74407E6B27816473197CF1290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 a523c22cf6613519c428af48c5fc9f7d6efd82cff8df98e3da2f879da1480cca
MD5 54bfd400eeb33bf3d71c6de45188d26f
SHA1 06ab2fad4e60356cede4aadffb1f47da9305e000
SHA512 65d9aab1b1fb24785afb3750af937623c345a5844333af1346a2ea6da3f34269d0a0e637da02b85d751491f50a0bd360cc95b1ee2d339e048eca7db3b4afac57
SSDEEP 24576:6bxA1UG7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6bxA1U4LNiXicJFFRGNzj3
TLSH
T15655126E129C14F0F5B9903D89A68005E3317C2A572197EF6180923E4F3BFE99E39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.8MB
SHA256 aecb86b0dea3134a8a18f1311eb45294fb976cd43c20c09921545fdac57c7064
MD5 b9118e9ecdc5d5af3f71b1e6d19ba073
SHA1 a72481618433d934ca1fb728df305e55776a8011
SHA512 bd6ae6f2f5d7384984ea5401a80a6dd85c8abbc9ff2401380d4540f1a2f2edf9ac137235bfea343bc880a5a49eae597649b040d3d667ea0ab16fd6e5e1bd75c7
SSDEEP 49152:XjRP0yHfVqzlAsrnmLNiXicJFFRGNzj35LNiXicJFFRGNzj3:Xy27wRGpj357wRGpj3
TLSH
T1B785D02EF2B910B9D4AAC13645010775FB71782D1F209AC74170C639AF1AEE99F38F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 f26663b66a7ed6f9bd8c24b70bdada44c92498fe1331a51e61bcec56984de7b9
MD5 367667dcbcabd44f458116a3f0c88f56
SHA1 053edd1b72326865e643e4a5cb9b0ed60fa21c2d
SHA512 314f58b207db1e7260eb0666d642ea58221f441988427ca9333fb894a664e7bfcfbf93b6403c4a28a9a719c5b64d526967ad16b4c91d38348486c263ae84a7e0
SSDEEP 24576:lUP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lWLNiXicJFFRGNzj3
TLSH
T15A5523D2518955F1EAFD003D86794428B1886F2C9B2619E3E1543E1EA27CFEFCF38562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 f772c8cee1f10daea7ab0ccfc1135e1092d79a415d1f21203fa7223b079384d1
MD5 76327265b608ce207ab12be4d6de7235
SHA1 a916ea8d855d2678430ec354fa70d93517bfdf82
SHA512 281fad16761cdd6d8d8f0778273526f346ae17616d04a44f0d747f88c2797d221e0952118fa51e989c372bc643ac77cc2043779896c475469450188e225e6531
SSDEEP 24576:ZALBUT+P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZALBUILNiXicJFFRGNzj3
TLSH
T189750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 230bf60bf53c5da67f16fd2c6597ad1dd6c9d554d05017a85662780af335975a
MD5 0a81f1dd756747a9aed21396345950dd
SHA1 5a3da438f9c12478e56619e35b84db1f7bce3fdd
SHA512 6ff17282f6af101af82ae7c40f9c677195c0cc07b2847850221b7c9748065ae68e7fc2ac875caa3f966d833f2828f97a4ddfea865c8c7a81a4e7ce5e5effbf43
SSDEEP 24576:AfYNHdP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AfYtpLNiXicJFFRGNzj3
TLSH
T1E765F12F629D18E4E67B913DCA828109F2727C66171196DF01A0827E1F27FE9BD3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d08a523cb55f3d262392e8fe77adc1a623cfdd57ee9e499b9bc87388614bc5dc
MD5 aa0c6c8b4608387a32509c07925a2f82
SHA1 6c7e6f8b4e794ac239ad642a12e155a232826f3f
SHA512 7556334bc61181a54daafad6098456f07b42c47fdaf313c3da672cfceada68a959fc9094a0db95269a0c0e77645b1a7565ea70826e24c33bc3ef038a137bc9ba
SSDEEP 24576:YnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKH:YnXoJJYH84VVS6AmETJas+cHBjSSKHPE
TLSH
T18565BFAEA2BC04E8D5BBD13DC5C24506F5B178651331C6CF026182BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d5d731d763a00b7ee139a568203907ec74dbf83f4be2a879959bfe47f6d55f81
MD5 3ece83f8e5da8f119393785606f8a3c7
SHA1 7f6c7186f17b319a97d686f341d184834480f41e
SHA512 8086cbcabeaa6a04e59e67199dca2da22ac0547b89b753fdcfc93c86bacfa08b4beaf0f127642274343a09f02d018d02c8b88a03a3e803133ef7a406100211ba
SSDEEP 49152:MDLL9TuJ0M/TYW2P2LNiXicJFFRGNzj3:PB7wRGpj3
TLSH
T152858D5EA2EC42D4E4BBD6BD85B79046FAB2B855173081CF0291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 47755f446eda3f226b809a71fd819df4fe5fbbf90deb3ace809dc16e2fe426ad
MD5 208f19ccd02026c2376abba8f6b10bb0
SHA1 6b0f3c97372c6459fa567309aa50b8f4c4157302
SHA512 6b48b17f1f406a2f91f6f3961332eed95ff46c36f8da7d087309292e5d032150c39ea4a4f34bc3c9571438412de383eee4d9311f1983fb91cd253f8946bc5702
SSDEEP 24576:kegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10w+P/TwSfVcYG3K/cJHlnFR+IGNe8jg:kngOJOmPOHkcLNiXicJFFRGNzj3
TLSH
T1DE55CF3FA7BC15D5E07EC13D8A968816F6B1782603255ACF0160827E5F2BEE46E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 630bb304010a1ea2b799e695592203195dd158fff325552460ae616c57e9109c
MD5 8827510bd16de0fb158959054188145e
SHA1 8ef41360ef4883590786dd7c61061aa262458a95
SHA512 98ef1c36675129516e551b98b02f3588d62ed42b4fad1604cb53ba43914a215586dfee52b531dc0bdee54d4b3b9ffc6a2399cf34c20f660ffaf8c1aa27db9495
SSDEEP 24576:kLJnJiTk3R3waE4JrO0P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kLJnJK8R304l9LNiXicJFFRGNzj3
TLSH
T1CA75E03DD2A810E8E4B7C2B4825A1656FF31387C2B2169CB55B4D5353F12FE0AA39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 6fecd99d5eb6857d3666c37e22ff94e5cd65927f7b7f968ceba4b853d787336f
MD5 4ec02500cf7da5dadfc165383c449bf2
SHA1 65678f81243dda855409ec497ec086a0f83943e9
SHA512 0426efeef2827ea5a7c0cbd7871f2b34a571c266185bf6e7cd0749fdaeee897c5db47ec79cdd1d3b98121171b9df79df559641cbd47ed0050d346c514382ae4c
SSDEEP 49152:V9GqCzDScAZmlvTcFg8Ph6aLNiXicJFFRGNzj3:pJ7wRGpj3
TLSH
T123955D05F7EB5298E8B3C9F1C96694159B327C409B34F7EF4A80CA6A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 dc08a1d2a9067607353966f4b07f77139dc8726e4f7cb8e5be3be695ff5d4039
MD5 e360f4128f21d0c108cf62af535decbf
SHA1 357137c2f41b6e632806447e45925d4f9fe8b880
SHA512 160d6847105a9434b4aaac66392a673f97e7d454afb6c8f594999cc6cf521003f38b12cc7700c6e57a105e09167a593adc5af99846cc799c79dd68b4ff39a1f9
SSDEEP 24576:1lYJeXm5jUuEH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1lYJeXmRUuEHLNiXicJFFRGNzj3
TLSH
T18455129E268C30F1E27E403D85A24414E371B879571217FF91A0A57E8F3AFEA5F38A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 494acbf571c2b8050dfd88a3908ce798ccd7c84c21f12e34dae2f48bd12d2bd3
MD5 8d163d9bbbbf3e9de9a5337e86352203
SHA1 15f1e29c2df144c601fa1cb2a5336932c6cd0dd8
SHA512 3204422e249f419aff642ff159cdbfa20ad12f9d11cd8f4a3655a7137c275a5b8d667e264a579cc5806174630ae540ef5ab103ff322c825a070fe9005c692343
SSDEEP 24576:UVty5P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UVtSLNiXicJFFRGNzj3
TLSH
T1F465124562C461E4EABD0538CA734064EA747C249F2147EF9190BA3F6B36FD5EE34B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 5131e6d57a066771b27189a0745197d40d38676ef9f3fbef1a564d4f7e6732d4
MD5 47665ce7262342f7b3b89a678f588cad
SHA1 94fec94fffe08f6148810748b4727105b3edc3bd
SHA512 f07c85003a74c26045a0c5eebbd4a6facc5879846092158a90c54d9c8b85366c42443874ab3caf71aec7a60f3a6cf49efa6d5feb66d2ae9c134b0d7b750a513a
SSDEEP 24576:a+P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:acLNiXicJFFRGNzj3
TLSH
T1EC5523DA018965B1EABD003986364424B1983E3C9B2528F7A1947D3ED37DFDBCF38952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d83e11ce6023e59e5f873d197a66c0057d1aeaf39311b2f82715bda0ad2384c6
MD5 e45d4257487a37a918129223d7048cfc
SHA1 ee3b5ece066c21d462b357c79a31f1a74d4c2047
SHA512 3457bd3627278c7cb8644932b84aa0edaf1eda2db06460ea119ada35f3f781c6f2fb77462c8b6aa7929a4695c606c4f2ddce9bb4d7e4281d0fd373eafc8704df
SSDEEP 24576:AC+TyQIu93VAumZr7jmjP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:A/TfIq+YzLNiXicJFFRGNzj3
TLSH
T162558C1DA7E919CAE2B6C575C8A34493E633B872137186CF2044C07D499EFE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 4eb2c824844653700210a236210e6c70910323eb43c759638811f3f0af3014e8
MD5 5db37a245b40834fc550856d1cf565ed
SHA1 c4ac2011b61cd72aaa9b150286663f895c994f88
SHA512 16875a16f948841f022dd6345a72e823f5782ce46d7d337988302459f229d2591b506e0e9961215a6390bfa0033d54af3dcd427847c9c6ddc9b6d48d79cb888a
SSDEEP 24576:JLQikZCP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9QikOLNiXicJFFRGNzj3
TLSH
T1DE65F10FB3AA00A5E1BB813C88554115F6B37834571267DF4290C77E4B7BAEABE38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a9b7197537292be0c56fcc90c95c8eae95d1874460fc2ef3bc2eae3c27566775
MD5 74916e97b9ba79e347f48cc44f515b6d
SHA1 3f2cf9fc8bcdf61b5f1028201d155ba817084601
SHA512 f67c52f121a4ce55a6e751a754c35d126d6d2da539a954397b508d5f475f9ae34639e681df821d49da698f57e926a19c29a332ece714554b46e4cb1e4783863e
SSDEEP 49152:vpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPtLNiXicJFc:UpC7b4+80GTky7wRGpj3
TLSH
T128A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9a9e71f54d8673133768b48a9d73ff575a43b2e27af0ae05fcc9c99d1cf571ef
MD5 d0efc4c603951aef39b0dbd7885527a3
SHA1 ee66e647ff3579628fb9efec792c8f3cbbf0de2b
SHA512 c3435cef60a6eb78ad4377a025d1fc78e5d4c0400344a477204f468a9d561830480fadbd4453c4f8f500792b915370672bb0ed758e81578b0f4173248b565706
SSDEEP 24576:cSAwJPE1IDAo+4Kt+l4413lUQ+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cqPCIo4Kol4jQ+LNiXicJFFRGNzj3
TLSH
T18A55B02AA7F956F4E17AC774C663C511FB723822133163CF9290953E0E16AE89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-411-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/236-281-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/660-16-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/660-17-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/660-234-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/660-25-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/840-418-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/840-317-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/984-58-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/984-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/984-236-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/984-55-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1116-47-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/1116-34-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/1192-377-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1192-341-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1192-393-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1192-424-0x000000000BD10000-0x000000000BD11000-memory.dmp

Download

memory/1192-423-0x000000000BD20000-0x000000000BD28000-memory.dmp

Download

memory/1192-422-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1192-338-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1192-332-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1192-409-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1192-426-0x000000000BD10000-0x000000000BD18000-memory.dmp

Download

memory/1640-45-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1640-43-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1640-37-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1640-235-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2216-326-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2216-420-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2400-78-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2400-82-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2400-237-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2400-72-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2756-456-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-449-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-437-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-435-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-464-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-465-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-436-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-434-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-433-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-453-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-455-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-432-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-441-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-457-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-459-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-461-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-462-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-460-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-458-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-454-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-450-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-451-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-452-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-463-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-448-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-447-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-438-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-431-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-439-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-440-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-466-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-442-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-445-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-446-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-444-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2756-443-0x000002373E1F0000-0x000002373E200000-memory.dmp

Download

memory/2908-277-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2908-415-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2908-340-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3160-80-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3160-70-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3160-60-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3160-83-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3160-66-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3264-251-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3264-320-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3264-257-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3264-250-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3272-12-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3272-232-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3348-328-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/3348-421-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/3564-419-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3564-321-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3996-246-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3996-316-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4064-325-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4064-268-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4064-261-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/4064-266-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/4408-311-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4408-313-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4464-0-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/4464-8-0x0000000000910000-0x0000000000976000-memory.dmp

Download

memory/4464-1-0x0000000000910000-0x0000000000976000-memory.dmp

Download

memory/4464-30-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/4588-308-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/4588-417-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/4720-290-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4720-284-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4720-292-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4720-414-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4916-274-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/5036-416-0x0000000000840000-0x00000000009E3000-memory.dmp

Download

memory/5036-297-0x0000000000FB0000-0x0000000001010000-memory.dmp

Download

memory/5036-303-0x0000000000FB0000-0x0000000001010000-memory.dmp

Download

memory/5036-305-0x0000000140000000-0x0000000140259000-memory.dmp

Download