8014ff57f052426d0929e8c4f8830b015d84bcc14d70b9a3be46cbc635ef875b

Analysis

max time kernel
148s
max time network
133s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_2991ef923466f96c34df1fb50c051302_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Size 2.0MB
Sample260602-2t6ldaex61
SHA256 8014ff57f052426d0929e8c4f8830b015d84bcc14d70b9a3be46cbc635ef875b
MD5 2991ef923466f96c34df1fb50c051302
SHA1 dc21302d7abcc35e92a06a9d397032d60cfb94b6
SHA512 0677c8bde4f81eca1786e870bac971428ee1278cd7daefc392e7d5550fad198ae1540f6a0d4f9237ddf2850fd74c788e8d84b524d311072406cd66550ece6f9e
SSDEEP 49152:62Lb5aH3tRORo+3azgGJtB76KAQgAT76sQuE:dkHdROB3azhwqGsQr
TLSH
T12195AE307943C1B2E4A252F08AB8AFB89569E9B0173756CB13D42F2D0D305D36F79A97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3044	alg.exe
572	elevation_service.exe
1500	elevation_service.exe
1828	maintenanceservice.exe
4060	OSE.EXE
1588	DiagnosticsHub.StandardCollector.Service.exe
4676	fxssvc.exe
3736	msdtc.exe
3384	PerceptionSimulationService.exe
908	perfhost.exe
132	locator.exe
1060	SensorDataService.exe
4176	snmptrap.exe
1576	spectrum.exe
2212	ssh-agent.exe
2156	TieringEngineService.exe
3416	AgentService.exe
1548	vds.exe
3452	vssvc.exe
4600	wbengine.exe
2932	WmiApSrv.exe
3076	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f9f53587fe8d2f74.bin	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-02_2991ef923466f96c34df1fb50c051302_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-02_2991ef923466f96c34df1fb50c051302_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_175984\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_175984\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_175984\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_2991ef923466f96c34df1fb50c051302_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b96eaedae2f2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d49877dae2f2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b02dfd9e2f2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
572	elevation_service.exe
572	elevation_service.exe
572	elevation_service.exe
572	elevation_service.exe
572	elevation_service.exe
572	elevation_service.exe
572	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2980	2026-06-02_2991ef923466f96c34df1fb50c051302_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
Token: SeDebugPrivilege	3044	alg.exe
Token: SeDebugPrivilege	3044	alg.exe
Token: SeDebugPrivilege	3044	alg.exe
Token: SeTakeOwnershipPrivilege	572	elevation_service.exe
Token: SeAuditPrivilege	4676	fxssvc.exe
Token: SeRestorePrivilege	2156	TieringEngineService.exe
Token: SeManageVolumePrivilege	2156	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3416	AgentService.exe
Token: SeBackupPrivilege	3452	vssvc.exe
Token: SeRestorePrivilege	3452	vssvc.exe
Token: SeAuditPrivilege	3452	vssvc.exe
Token: SeBackupPrivilege	4600	wbengine.exe
Token: SeRestorePrivilege	4600	wbengine.exe
Token: SeSecurityPrivilege	4600	wbengine.exe
Token: 33	3076	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3076	SearchIndexer.exe
Token: SeDebugPrivilege	572	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 3772	3076	SearchIndexer.exe	119
PID 3076 wrote to memory of 1800	3076	SearchIndexer.exe	120
PID 3076 wrote to memory of 4172	3076	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-02_2991ef923466f96c34df1fb50c051302_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_2991ef923466f96c34df1fb50c051302_amadey_darkgate_elex_luca-stealer_njrat_redline-stealer_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1500

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1828

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4060

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2780

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3736

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3384

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:908

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:132

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1060

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4176

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1576

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:388

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3416

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1548

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2932

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3772
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2892 2884 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1800
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2948 2944 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bb262aab4ee897507e33175cc7b0f0257bdffe2412feafaecb1f3e77b7b8590a
MD5 5cfc81cb182c0993e4768e94758b4f88
SHA1 8b06cd35fbe45d22ce33b9da1695aafdaad5efc7
SHA512 26adf2b7c0a56aed2ee04b316383a99a2611bd7e18167a64d5c99e048490cda2cfadff1294d349b7c3a7feffc0a6006488f6a163cd0143a95dae8687e8d2dfbf
SSDEEP 49152:nb+632BuPkFKRrdE6ohrstBhuXjfS4LWxndAQgAT76sQuE:V3q60jBxqGsQr
TLSH
T15BD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 2411cc285a1dda19d85816a747e33e1b2ce4d756836576397f255ef09c5490b5
MD5 456e49b21207eba74e571e073d7207e0
SHA1 49c9fe00b45929023fecd93ef2112294d72eded8
SHA512 fbfe853d967cc6b7c69b1e01c511740fead82cb61547d7381ad43f619243365765a75caaaba82a6992c52143e23ba5bd0ae8672ce40b2888657f6495f8629a9e
SSDEEP 24576:hXYfDtczA4AfYLH8AcevDN0FImbwQuq3Wia7gD:ktcHAQgAT76sQuE
TLSH
T17675F12963D408F9EC67813DCCB28515E673B8A54360E7DB03A49A6A1F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 0b2044798ac957371df164e2e6d67c68f9d56086be5a9be48f0d11647a900c33
MD5 6582a0ef087d355d417f017702dbcf2a
SHA1 5b940beb424e6469f55420c48082036954f2d2d7
SHA512 0e405d1125d107763e850c7bc054fadc93ef9fd7e8e1e1c955bc46d30154e6caa09363faf34b5dde574545800cd93291fe3d3de333994cbc9ce7a898153fb920
SSDEEP 24576:30Le5ji0hmxNrMVAfYLH8AcevDN0FImbwQuq3Wia7gD:3Pji0A72AQgAT76sQuE
TLSH
T19D85AE16F6748335D073C0B9C5D2A69EEA71308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 95c250cc0bf766b6c5a9f9af425ded65feed895b0f188035434e1916545d8c06
MD5 3d8a6bab2a36d2f2504b90816a57e917
SHA1 d73574769023d128508134e846f5ec7138aa540a
SHA512 9e5656fd5cc20165f2d756aaca582cdca8b2dcbf062675b791ba2e5984464ede2c1de7e456a994b63349ad7f18cc3a59c42f91f8717aae2a4ddb02195843b57c
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWr6q8wyuXAfYLH8AcevDN0FImbwQuq3Wia7gD:K/ezSC6vUzPviHjySAQgAT76sQuE
TLSH
T19A755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ce0c5b26f5e6b04922489239b27c2da576a9e16f9727641baf61b2c201bb8a7d
MD5 c0c9c5e284879025629c2b341bd3070a
SHA1 80371eff227251dfbb86d1628a56945ce198a748
SHA512 5c70e582a0b0d8b73e6cf6d6d28501fbbfba3dff882b2416cbedc69d353a632c9bcb57dfa43d0578b846a36f7bd21b2a59072121cf5dac32e2abff1b65125f8c
SSDEEP 24576:6VbqPb88hv/l+bcAfYLH8AcevDN0FImbwQuq3Wia7gD:6VO88hXl+gAQgAT76sQuE
TLSH
T152559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4b00c196666df526c8caa1c449f5b1d875ca60b8149b3257f5a27bce8e35e892
MD5 73d5e56b2a099e6c74e94166befdaccf
SHA1 ace04d89c4621224342cf216a33625f76f394ec4
SHA512 105872411d72c5e4c04eaedf8560ba5d475a6df6c4cd6210922fa70d580446b0f593826bf8b9dcd9e2d8cee5cbb44a0489eaad8293a4e963b4d6f4b980d53099
SSDEEP 12288:yjJAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:yjJAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T192552357464C30EAFEFBD1369CBBA5B963D1BCB8824597AA04463BCA793D408D0D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ac3b3c89070b19005d52103d1be9e4a1a4f4b065ca1531e7843010c1835ef0dc
MD5 5b8dd71f67584e1e6073af707c81cbf7
SHA1 7902924b72f02414dae46a427cc843c3304d4050
SHA512 ff5de2699b802dcad79a976e8bebc3dd805f85fd2de2373a2d027c51b3659c7a94ec505dc1c300e33f84221c09de9a591b7d608f7673f905cf60de2a4061b58e
SSDEEP 24576:WJIUUAfYLH8AcevDN0FImbwQuq3Wia7gD:WJIUUAQgAT76sQuE
TLSH
T17F75DF3BEE28FCD2C67E8D795A918600D7B278704B52A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eeac8ad464b3d3b540b47197f45a715cdbdf3ec77c652c8d0f68b55f7ed15746
MD5 361631e2ed92e664ebbe7d807af3a180
SHA1 81df194d2ee5872812f4718c445601a3cc544bcf
SHA512 3e58d6bf90006cb7b0fc8d1664a376fc70535e39f2104652b7bfa2021b3c31abd52db6b55ffa214134e82d30f091ac4e4ed59f8039d885ab5e64d33cd19e0b83
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THD:MQvGAdlCEL8c/RRNw5CsqGsQr
TLSH
T1B1266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 a1278e973936e49e19a92a4211a8dae8daa7fcd0f9da9b1489cb193cc5146a8d
MD5 cd824604d013c3fb091a9034abd6f569
SHA1 c2d17be13d1b0e4e78b7ecf3f85e4e0eb0881d8d
SHA512 de11fe2f5ec33ba010cb0701f4d99a24670aa814375ffbb2889f42241d459125cdc32820f0a4887e6d79433f556ab124a722ca28ad477a5984e55d16eb9f6472
SSDEEP 24576:YSewsAjGAfYLH8AcevDN0FImbwQuq3Wia7gD:rljGAQgAT76sQuE
TLSH
T1F575E031FE74E036C6BF0DB61B36C716146CB9204B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2ed7b6d4da0dda8bd4bf589695e26fa03e54547259795a09580c096ae5257378
MD5 a634de896d19008c838b082a1eafb956
SHA1 f6bb98779010d8b6b8604c0451194a72c42ef5eb
SHA512 6d99dcf780c2cdb98e32b5abf97882eca367ca28078ab24613c35d89ebd0ac7cdfe182d9274c0f8c7f75263fe77df9f7805fd9c33a2bdcfc89c2e34b1403599d
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHVj:BUEtQevvqc2W1cpV2RI32
TLSH
T139474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8027b0f92bfb8ece0ca46b0c3806d30fd8a1d249d26e2f4418b4da60682f7efc
MD5 147a903dd961c8308e55af1fa87d13cc
SHA1 a19a9d3b2b7574579119fd5e743c6ff0fd18c90e
SHA512 ce8edff4c289ec5af377574544a32047331c5f3c38b58b68236833fdf3c948aaacdb7dcb35145242934f9b2fb3a5cb43d43866cb884e55a2e79004f2343eea6c
SSDEEP 49152:bCbRquA/m2yL5zifFiV+XenmE3/zmAQgAT76sQuE:EoqHVjnmIqGsQr
TLSH
T1EFD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 37b3847bafa69bc00f25b0a36cce03f344c9f19e36be28ed9b40609688dcaaf7
MD5 9279b32067a29162a3af9f2e1ffb1977
SHA1 c1bc34d56599701bef7038878282967ae9e94539
SHA512 d824f1b318a76038ce49ca2eea19972e4c8e4bbbe38bbbba0ea841274a081264321c44826b77e1fc86e61777bb5f8e63fba98dacd5ee58cc9a6b1897f3d7579b
SSDEEP 24576:JAhGL2IFoiwtA5l7S53jAfYLH8AcevDN0FImbwQuq3Wia7gD:JAM1Foiq5TAQgAT76sQuE
TLSH
T1E1359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2a067da79978269efc503b74cc0af6f91f8f9186a85b90614660f3af5d5aa928
MD5 7ad6556680761f862aa89c8112c9643e
SHA1 5a5e19f96ffe1a0be6a0ef8f7098b9b1cb91716f
SHA512 62fd0381f920785930f567a239968f7a99f2b8fd11b9c3ae4a42c6bccbdd291afb953c1ee3106ee84228e5191c4278d6394099b55ab1cd772cbca770cd03171e
SSDEEP 24576:awuXOWyAfYLH8AcevDN0FImbwQuq3Wia7gD:awsOPAQgAT76sQuE
TLSH
T17165F14676A81CF9E9A781398597C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d116f34f597bbdb05f4b19970aa68d70afe4ea63332745750905b671dd28de4f
MD5 84fe82b7d1eecf2930ab4ad5b894e8e9
SHA1 2d5d8d3772971576c27f3966e97f991ba8ca5f88
SHA512 4cab74383fb0c1fb734101eba3581b8330997146ee37cbe312f3de7d2ff9e9d3d3cb84cd89c59d0576b2fa11a94b146113a4fed01194696ecc3e3b70e6ef23a6
SSDEEP 24576:jZutAfYLH8AcevDN0FImbwQuq3Wia7gD:6AQgAT76sQuE
TLSH
T1B155125B239830FAE5A7C139CCF25659E3B278A6532283CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fcdfe0dbee2ec915319949552e1aa69ae847971537d06fb34721c15e64b2eb8c
MD5 48e5968b8360fc6590339a7c9584e36a
SHA1 474e864f360eaf224db0cfd984e0dc5aa1be9aa6
SHA512 7b027799d8d801eb07308866203cb22e4e0d22e69892eea1d91f5b7711d3b00e6ea11547fc130a25e82a1e1c6f739bfde0d25b2ca7bd47cb8f2e070470e5399e
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UX:yQRQyi36YOcPhLvw2gAf+PN3lqGsQr
TLSH
T1EC667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b356ff7c3b7f19b4bf24971ecbaa0a67f4bd0225ba159ae9d426bec25eec9abc
MD5 9307c07eec5ed96b12881ebb973be6d8
SHA1 aa19cc881a68bbc8073e31d879211945dd833602
SHA512 0d915b932e04b99e63c248574cb3de0059e993f9eb99a531e161949d7e26f7aca0237d1503dc620e60e455b13fdfaf63fc0ce9fd24f91b85d44811fffd880be8
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UX:+QRQyi36YOcPhLvw2gAf+PN3lqGsQr
TLSH
T130667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5e98883e60f82000ca299f25be2abd3de97cc369a306046b2528d941b92212a5
MD5 85786292ea759314c2238947625e2d7f
SHA1 998f2d913f1295734d748303c05f343f1b4c93a1
SHA512 b56f11bb5c2c53d9e2538dd80d7ecb56813e96c2f4168b54bb9ef83723398c3e14936cc5c0fb87a739391b31b3988010a88e89a035745ff05ed361d09e619b49
SSDEEP 24576:hwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0dAfYLH8AcevDN0Z:t68Qg55nhceWu7PNU3/2AQgAT76sQuE
TLSH
T1ECB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8505720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 128557d609fd96023e69af670a314dea368aab50614bac7eea44c90458c5b4e2
MD5 b6c440935a97601b3773bfb686edcbe3
SHA1 fef9429e9b67706b9ddb176ada28cf8d95341ba4
SHA512 16ce9c96817ae085b7e6c4f9a310a7e969bc482c76650faed3b78fa73a7cce88a6f53c450956265ec4e3e885c4c36db7e9a40c697c0223646a2be982e1efa62d
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99J:ny5112gYy5azzVva69nLKnhZSqGsQr
TLSH
T112167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 179b00fab513dddff9c2dad7b2b5044386d2212681e571a4deddad00ed945389
MD5 68283731666b5c901817318cedd7eb8a
SHA1 3393f5bb1719d4e76763948e700cf0ad0ced4a10
SHA512 6cb63e645562ef1c3cfbe94214b38c7c13dd74e29a7dfdc4091440f0d53767c3d7dd8e89c693f4e097107ffd0c10dcef18a0e2ac241c53f56783952c0d82d660
SSDEEP 49152:5B+taZ3usBWOBr4tEG20bqx0z+n217aau1gloAQgAT76sQuE:vu6JmUxd2ddqGsQr
TLSH
T1CBD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 171f5aa5fa93f7416f4892aa9ceeb867f6aa95e21a198da6f8297396c087123d
MD5 9ea56cb16cf6f05abc8269a2094e6c0d
SHA1 e8ac7dba134a8e880736a327673b38230892ad19
SHA512 c7633e1fbb110f4a59a3f079244daedd487f3114eeab9ff260fcbc737f29ad2f357f937683f80cb333a1fddfe4b19cb34b4686cc3180284b760c9a516de14b8c
SSDEEP 49152:K1hpsNoJpF1A6BU44CwH7R4x0AQgAT76sQuE:KmifPkRIqGsQr
TLSH
T175B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b21c1eb2d09a3a48ab9b8c75e26c57e70d36b1eef899292ef0be5879ebc361d8
MD5 c8312f771f98c127d9de1e284f23420d
SHA1 954c5c1c729eaa5749976ac6b7f5b7f21df4ab51
SHA512 cb8a49c14615ba61ac2ec59731f328f7cf68fba6b81c174b485cadee63ee08a01e02d20516169f2459b317583fc32cad47e604e059e0addb02118a9d82a82438
SSDEEP 49152:ESuZQIY0Be2KNRVtOnks6NMHqtAQgAT76sQuE:W5dKvi61WqGsQr
TLSH
T132C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f652cc89a4b1ae279f733f43d6fb2602b3935a885ea18c4b975d8c6fc295552b
MD5 b3c9df4f90cfa664d3d06226879fc1c6
SHA1 a6e0ddd3f5c8908fedabdb28f968203aac72ff24
SHA512 fbf848f61d2b58aaf27d5348d685589cc37583568726e51771350af84c83bc2056e15603321e2de700ab5e94373eac7c696ed6790a90d7108471600d8a58ca7d
SSDEEP 49152:QhtSn8EApI0figXgiDn0AP5w4AQgAT76sQuE:BX2iyphUqGsQr
TLSH
T15295BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6236a2d0579403569bc85d12150325f766822e8fb59f21a900fc1bd831863411
MD5 1cba14e99a5a7cc18ba2e27fefd6bcb7
SHA1 6f33c024ff96d38eec0338ab70350438d173f26f
SHA512 9b0ddad17012a9afc104bc4c260c16d6e6591806b0e971ed4ae6c24dc125d399a3a54d8e50104c723e87b624e2654e5fd3956cf8062105d6d1031f772e6d823a
SSDEEP 12288:UBAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:UBAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17355235B594C34EFFCBAD1368CB7A1B9A3C07CBD9346539A110E2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 55dd0b597bd74360a12d44285ed0e675f611256321268faf03b7c5c5348ebfe4
MD5 fd1307595927f865982fde06884e728d
SHA1 cec153719a8edbd7db33ec289a2056be9c0fa49e
SHA512 9d8d64a69d7f92f32eb6eb27a69726e38d516649335531c907b42e4e72431c3b4c728f5aa97415eb4a8272db97db43f75059fa22364ab6f42dbca43aafac1533
SSDEEP 12288:m6AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:m6AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15655235B594C34EFFCBAD1368CB791B8A3C07CBE9346939A150E2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 34d128c443c641c79fe4ab9bed8022a3df14994f850280d50c74012b8ab15316
MD5 6479017df81f1f68a850a0050064b392
SHA1 9b09a9d7d249f2c40aa06ad135e64aee250bfaf7
SHA512 1049537fefdf045c29e8439ffb299b7a32365eb5d35dc5490c79377c7813e5559bfb6f6c3d7e768ce827dd85a06a4f50d7163e1e4adbe77ca65dc491416e9c1a
SSDEEP 12288:YMAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:YMAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13155235B594C30EFFCBAD1368C7751B8A3D07CBE9346939A150E2A8A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 27e8f8897cb8aeb713855d03fc0faf48017b550bc5d60eb9d412aba2669c22b5
MD5 007f59885e8ade58ec6c4b1e5b07871a
SHA1 c74d607470ed70e86dbe69103016f8d29c8de39b
SHA512 4981987c773a9b88aa8b98f6d6b04646415e496539d3d80caaa54a57465114dfddf1a9240dd8712adb8b47c614e317d9cb9cc0cd47f003100f8ec88ab6f7854e
SSDEEP 12288:2VDAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:uAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A6552357165C20DAFCBBD135CCB791B9E3E1BCB9931293DF06051A8A2E3A248D1B4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f85ea1692bfd8a8b1ddad41a4a31e2f903d1c7448201c1b57de7e3cc105bfe11
MD5 4335886bcf6bb2abf8ca98652b5914e1
SHA1 f412a73895a736ec300b8456075c2e665b958915
SHA512 84b4fc114c5167a1f5dfbe78c6454702dccdda43dcb597d9e43b782881e6f43a2a6c06a57f217092e3a031c19d0d6ec4451e663855bd30509aac23bc29c7342f
SSDEEP 12288:jLAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:jLAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1BA55235B594C30EFFCBAD1368C7751F8A3D07CBE9346939A150E268A7A3E40891D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6374c1e8ff7328d8a655bda5439341b0c1d0cc089f845a0840577ead55958690
MD5 6753d8b540adf3e827eb013e88a31a15
SHA1 700452bd186932ff4d0f187a7f0d2ecf42bdcdbf
SHA512 b572de99d6fdd1f4eba65fc08d566cc9be93fe5704501c13cb86ad75903669d1c60455744e18a8b9b5698f3d615b92945d9672f96d72f833554f45a3d8f8abbe
SSDEEP 12288:LeAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:LeAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1AB55235B594C24EFFCBAD1368CB751F8A3C07CBE9346939A150E26867A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 86e2a5008e8e35167131068dd6bab1a5d97701fec5cde243812b3c04c64ca4fa
MD5 98ea7a79c21c7b6fbc3d7235c594bd8e
SHA1 7f8b8fda48e23e0be2e9d81418816de218ca707b
SHA512 e7ecb2c2832f7b12d04621f33e7deddf6268aabfcfde7d7711dda587444a4703db3f721c8c286e8537e2125f7968b2acaa90d9b0ec00770d7afc517ef1eb80e1
SSDEEP 12288:MiAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:MiAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A355235B594C24EFFCBAC1368C7791B8A3C07CBED346939A250E2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 4a2325fb37121c24f0d9ab51a1754c1bf8643fd62bf894f8aeaec8c7d670c48f
MD5 a018ea23475ea639c2b4ae893b5f4e14
SHA1 b0cf80417f70b5292d7f41224d0ca34ce5e9fd15
SHA512 fcd3017053a6eac524032f1075085cfccf2d781bc5bb71d9348f6747a9b1d7000a9aff99d471b259338201cfd5d0c6452aeea14245c27f5caf43e3a73f3a9048
SSDEEP 24576:CZMMzFVSOaAfYLH8AcevDN0FImbwQuq3Wia7gD:CZMMzfuAQgAT76sQuE
TLSH
T16B750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b956468bd5300ef4db16cd144d9a3df64148b2a8793b92e9f02698529a807dbc
MD5 6583c62f0a5a5d3a5cb0f0ec632c4930
SHA1 dcf4803e165a1ffa313e88c7ee0a82e341973e5e
SHA512 205f4cbc6eb342769bfcd6faa2679cfd8bd4ec8e4f2742a43a8d30066230f19fcce134052d84273ce54f6179be54839f8e3470e89c56a874106663d66897b466
SSDEEP 12288:k9AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:k9AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11255235B594C34EFFCBAC1368C7791B893D07CBE9346939A150E2A8A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6c096f0499e72d94b1e964ac5d6eac2e25c035d4a42acd44d80c84b02dfbf5e4
MD5 cf9be35e2895dc668ea38597bbb42ff0
SHA1 edda3f534b43506018bccb59529bc6808929188e
SHA512 9176253fa5ca1e2563ba23cb35ecec0ce72ad2ee90bccda4cfc6c3f76fa49b7aecbfd37d9c0dea0bb176a9b2200ccedbf75b3579bad58d60671101dcdaf6707a
SSDEEP 12288:bZAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:bZAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B755235B554C24EFFCBAC1368CB791B893C07CBD9346939A150E2A8A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 883bff12dd407f9ef4b61fc1835b0c7d3f9f03c561a6502a7dc757fcf1bc28a9
MD5 a2dec20d3f39e04e7568746d2e6306d3
SHA1 eadc0f4d637f8dcb07777a13baedeb356ea23a49
SHA512 b6456f437ceb2ba756ecc50090d61ddf1726b3094b3276de3d270b82c841b0b2f685b9a0a48a3a8d93b9ca417d918578a15d1295374980aedd214fa7a00fc34c
SSDEEP 24576:1zyWAfYLH8AcevDN0FImbwQuq3Wia7gD:1vAQgAT76sQuE
TLSH
T19665020763A530F9E577D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2c30dcc88c5ea1b0ac0cc7197cce2a7fa057916c18ef96b4a0921d0d8c0ffbe9
MD5 183a86fc3227b2a4e6f57a7baabceac8
SHA1 9490bad9b7f6ca7f77a25f47f2c37e8af3ef4689
SHA512 ca7a6dcdccd1e8564978c95e8158fbad2848b7673c1b16bf7f4109d6ba2aa36156b83541ce498063c79838550e34573e4d682390d67690622fed11dbb223374d
SSDEEP 12288:n9AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:n9AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A155235B554C34EFFCBAC1368C7791B8A3C47CBE9346939A150E2A8A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1ea42f364fff0e7dd2b5a34c1425a4623342a67493a17b248401b5f0dc76baa3
MD5 9320680580f0ce357ce2912c18f30b44
SHA1 407db2d74b4f65dce1861f1a67ea1a869b5ec669
SHA512 9c26cc6132f22d3f25134646ab92540018b6489b18ebf35d2c9c4d452aa69834f30bd30d06512e3220371d8c93953054bab6e50bea47b3fbf8b80ea093999ea0
SSDEEP 12288:P9AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:P9AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F855235B554C34EFFCBAC1368C7791B8A3C47CBE9346939A150E2A8A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 df877702c34b2cb0dca6748a205ef54fa1c66f5d14bb984afd6f4b24dcbfcf1a
MD5 33833f722a5b23d7bf9bb4ed25f53d80
SHA1 29b6794be922a1d4f4cc3cb7797a2988c3479ec4
SHA512 c3c88a91fa5bfdd9ab54221216ac7972e4a7db4b2f43e04ce191fc379e0193a8e909d6e731047a2c43303d044cebcc0f1045e9be531e72baa1b2da20ed94f316
SSDEEP 24576:OzyWAfYLH8AcevDN0FImbwQuq3Wia7gD:OvAQgAT76sQuE
TLSH
T14965020763A530F9E577D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 66990a9e5db8db93a7a54a40b5edbba9ef436e67b1f1019674eb0678a668b7e5
MD5 02fb1d005633f9b8ab0b624da17270e8
SHA1 e320dba6632c941d4bb261be57acb28e74d8785a
SHA512 fd9c3152fcf2fbd6db19cc692f7340f945ef77c3deb4c660e515f4aa3e1888af5882365d739a7c5350e42271c70b1788961f4d79514950cae3595452d76fedf0
SSDEEP 24576:mT9aLl3z0zD8AfYLH8AcevDN0FImbwQuq3Wia7gD:mTQLljXAQgAT76sQuE
TLSH
T1D5750195B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 23a33a186e3e513644128c900c84ed6ffbc16f10953e201f619da47742777c44
MD5 ea802c865ecd496fc96e9965d0be3dff
SHA1 ec04f8d8de113a2e84818bed9ba75b8ca37c68ba
SHA512 11ce370c861b5133cc0fd2ec5cb471e6933a97bd5fa9a11aed135ecd0843e1f92013858805977e88e556f31b38907186f79407a812d7fb52310c05a1adf41fdd
SSDEEP 24576:A3td9CHKy7GZQAfYLH8AcevDN0FImbwQuq3Wia7gD:Ktd9CHKyauAQgAT76sQuE
TLSH
T10685CF91F3E810E8F0B7DA358D765511DAB67CA91B21DA8F03A4265A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 cf76d8f09dc978b41fe8faf22f889db10ca00154f1448fa1f2c1b42e5f81226d
MD5 c579da7f97a4160fdd00dc7a88b957a3
SHA1 b66634649f1fdc0d29ffcb0d8bb53f93c1b721b7
SHA512 2dca02047c07f01d0629bb0309a102a2951fe9dc551598863025976115f76abbd8f8b42e4f0eed71cbcb1b7183c8a18611486457226921ed38e5a44bcdfdf3b2
SSDEEP 12288:TsAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:TsAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14455235B594C30EFFCBAD1368C7751B8A3D07CBE9346939A150E2A8A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 bd4fa18b45be613a7904eb7223c265cfa601dce21b3897fab98732a5e5ec4a5c
MD5 8eaa94d81f10ab6a72bbfa1a2239a5c7
SHA1 e6564eebf757ffce114268af5fda9cd4db66adab
SHA512 0e6368ed1f99d1e0ecc857ef741b7e6fc0c2df66ed80c24b4ffde2fc3b258e1be406f0e8399b07d39a935f916d55c76ef519ebd7e46ca71bd1694233ac35cb03
SSDEEP 12288:c2AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:c2AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E155235B594C30EFFCBAD1368CB791B8A3C07CBDD346939A150A2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 4496a721a5c3902af42ceed0a511b964c204b2677379d244b8ca4d9a6852c7e0
MD5 bb1fea6001249b621784d5fea57ef620
SHA1 893c2cea8b3e060312c838d00aee0aae9ba613b5
SHA512 ae94004024474b3b7a3671f600e65b1ae1d05f84785c40b23beab2276b9c2e052b5f742bd93db4b4f8e15e7a96d041ad0d1ddc1d1b0074036a81d53d94b7878b
SSDEEP 12288:J/AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:J/AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12C55235B594C34EFFCBAC1368D7751B8A3D07CBE9346939A150A2A8A7A3E408D1D8C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3e278c52d9cfe9fe448ba90a7993fb073d91e590b1ea70f78f35d06b6725e560
MD5 f834d918d087d0a69b7f6f1f924c1ea9
SHA1 e0ff2710c0b54a02ac7c6ad863f3c625df0c6a6c
SHA512 541ab0dbb48eed981f6bbae28bef2033954ea3e8ffb624c8dc858af39f1c9dbde27179efc08239a8633312904cab434ce3b7f8091f73d2c2c37e1eb1c60d2794
SSDEEP 12288:MGsftAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ktAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18F65011AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4aba4cfdef78b159c66093585f4a7b5eadec38aeb7e41fc1d7c3016a4b815c3a
MD5 cb67fe756f526d0cd1c793f5d6018854
SHA1 691ca905b5b3876e2dfb7b065ce02429d7ef1abf
SHA512 a278b5eb39bec52189404f3c395c958fc6f352e9c40a27fd5c89ac82501cc2736303e4286e6bd8158138128cde363c88502a2d8c24d48cebe639d304c6d0bebe
SSDEEP 12288:NfpAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:NfpAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T120552357864C74DAFCBBD231487B91386399BCBC870592DB640A27CA793D8C8D9F4E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ba55c1fb1e5c7ef032b5eb4caa1ede83597fab4df5c4a4e3e8f7e141351b939b
MD5 f7a5f3bad03af3e265962d2ec20fa5a0
SHA1 da0970d9dc71bb7f1d6ba022369ff1e4bd31121c
SHA512 b00ad840a841118bf167ded99bc6b525fcbaf9ace30b0ed9dea61c05520de4d0bf7eed90e21c20dd66e654347ceabd2d4e2107a06bb3647baf66d8df15aab320
SSDEEP 24576:T8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTC5pAfYLH8AcevDN0FImbwQuq3Wia7gD:gRZwQCyiHiQEaiPnM8pAQgAT76sQuE
TLSH
T1A585BF1E62DC46A5E0BAD278CDA74407E6B27816473197CF0191C27D2F37EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 317a37fcfe8ab2460915e1f21e85fff2366a34e56a1d357efd4e098d08f3969a
MD5 330d095df694cee60f6eb62a84029c52
SHA1 b2657c5ea993c7ad935f6637f87d97c97a329bbe
SHA512 2a68e528e02b69c629478267352741754188e400a91d55ce7197f30c636daca38767e328cffba14218acf1ac293e731b483eeb9859d37d4488bc646c24b24fed
SSDEEP 24576:CbxA1UGPpAfYLH8AcevDN0FImbwQuq3Wia7gD:CbxA1UwpAQgAT76sQuE
TLSH
T10655122F569C24E5F5BAE13988A28119D371BC2A531193EF108183BE1F3BEE89C75F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 74942902e121e20bc6c37a3bc5bc9d7f192efa4b3319843632a4a553f1b1e9c4
MD5 a91adfb902285343b6844c1136a96dc3
SHA1 49c62ace7096ab62c4d29929eb1f9b288c7a6652
SHA512 3014a4ab20093caa4c20fce099e3c94e04cddfa28c26904e83d28008ac386f2cacfa4dbf6d9b29c83fec789a26adc4b44fadae486db8a8d8ce70f5855f088b06
SSDEEP 24576:/jsmP0yHaqrVqHra44KDzMsrnCpAfYLH8AcevDN0FImbwQuq3Wia7gD:/jRP0yHfVqzlAsrnCpAQgAT76sQuE
TLSH
T12F45BF2EF2B910F9D8AAD136454107B5BB71782D1F209ACB0170C634AF1AEE89F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 f4c218c0265a55070c27b076e9db6cd0ff56619e1d9d715f733c4f25211cacaf
MD5 539d5cff0de260bca10f0930c5dceb2a
SHA1 438dfffdd6684a74e7b103a17e96466c49e28891
SHA512 74364bb63eb89d176fb946ccf4b1aebacbbaa0554fb9370980a895281d19cd2656c431ec75c211ca9161993894e5bccc877224969b801b6b529d6fd31a83bf01
SSDEEP 12288:bBpAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:bBpAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14155235B564C74EAFCBAD1364C7B91B863C07DBC834693DB140A2A8A7A3E499C1F4D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 7c68d41cea0bcd58b9db945277e753b37758df894c5693c2f5cb7a58e0e6d4f7
MD5 5080f5b5cb8ee9639c371e53af673b79
SHA1 b2ff485e51521a07407065e34cf54369bf8b661d
SHA512 6987a51d47c820271d7d8bf4aedba0d54892661d16471b00e63bfbf60b1928a6f19acaf6e8ec3111bfa1fecd7e00071ca1ea4fdc924e6382713efac6605c7068
SSDEEP 24576:crLBUTTpAfYLH8AcevDN0FImbwQuq3Wia7gD:crLBUXpAQgAT76sQuE
TLSH
T15775F155E79410F9E87BD13CC9B68526E2B2B86D0354E7DF03A84B551F236E18E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 72cf793c8a1fce7b4268e5bf49c82087a6ae6bd566c97e140903ddbca9521242
MD5 49b60562b9afb2be5517b37affb78715
SHA1 a97c4591058822660664abb5ed24433491d6ccc6
SHA512 ce2a0c75ed2d74d8ac5949cd53d9ce10817757cc3020c3b09f839bb693712d4191b0a01aad131be0e6582d5caa98144310f632ef9435f420df0a16bc73e5550b
SSDEEP 24576:02YNH2pAfYLH8AcevDN0FImbwQuq3Wia7gD:02Yt2pAQgAT76sQuE
TLSH
T19B65F12F52AC18E5E57BD13D8AD38219F2727866131193CF05A0837A1F27EE8BD39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dbcc408d99c08d3a6971a3da3729dfbacde50047c15519be705999179233e0b3
MD5 ab39f8701760ece5fb0f852f043c0dd7
SHA1 d779d83626ef20863122a2bd8d6ae9de792eb854
SHA512 afb38b9b0053921da41413c4c0217b89b4e7172ee77757626816715fc87248e73b5b1361bae70e0529e7bffeb61e869e9edbcf5e2c13b2cb7e2caab5c641b695
SSDEEP 24576:KnXoJjNYH84VVSNAApoEOQ66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKk:KnXoJJYH84VVS6AmERJas+cHBjSSKHPU
TLSH
T1E765BF6EA2BC04E8D5BBD13DC5C34506F5B178661321C6CF026182BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ba4ad3b6188e415e37d6816debe9d619736a982d73a4cb96eb4461716495fea1
MD5 db779b2c3291bf2f051ba807ecb970a4
SHA1 bdf23824c2dd422b8fdd576bd72a968376af2f29
SHA512 b0863ba62b6eb6caa740a315621404d0f5ca2695707872f4bb20fd3fe49a1078255dd937b38a3d7342ff0b1afa4131cf69fbc798fe39232cca53246d79ff00e0
SSDEEP 24576:1v7Xbxd9Tuycf8M/TYlSuxrr2PCopAfYLH8AcevDN0FImbwQuq3Wia7gD:1DLL9TuJ0M/TYj2PhpAQgAT76sQuE
TLSH
T177858D5EA3EC42D8E4BBD6BD85B79046FAB2B855173081CF0251856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 c0a70782f526aa335bfa5c62a44feed6bb32e3a6a86b0bced741474d285357fb
MD5 81485e76ee65dc0793e32e09bb3703e8
SHA1 f4a3be6281a9984e815679b21ccd8e22bf4a81d2
SHA512 e8395f5fddc10137bc6cc3c06800732190e5e7a3f8daf8ccaa346e06118280d8762f22f96c046daef101f037f631dc335f37c1606ffd30018c540d95d9e60c28
SSDEEP 24576:UegJgpwJOmPOHWAKR8ZguIGyPsxr5Vin10wTpAfYLH8AcevDN0FImbwQuq3Wia7E:UngOJOmPOHcTpAQgAT76sQuE
TLSH
T18D55BF3FA7BC15D5E07EC13D8A968916F6B1782603255ACF0160827E5F2BEE46E39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 986cde2a226d73f401a8bffbfa9e71d95d46036ac15f0608ef0d01e7ae676610
MD5 462553c38fe0d9539c5056be033465cb
SHA1 4379d207e7246e56d0f6400bdaf56d60cc42584a
SHA512 e5e684ccffb4b9d8f148e3e8c18768d6249eafe2b166ca7672b91a552b6c88363b49315eb461790b0574f8eb9fd53e3cbd2c78cee6597bfb0a29600ac5f62e1a
SSDEEP 24576:JLJnJiTk3R3waE4JrOhpAfYLH8AcevDN0FImbwQuq3Wia7gD:JLJnJK8R304lSpAQgAT76sQuE
TLSH
T19675D02DD2A810E8E4B7C2B4815A1766FF71347C2B2169CB19B4D5353F22FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d423f6c393244bf272d21439035e06f54e3241ea1d16e4027c4b31c817371cf4
MD5 3abc2476efccc615b6f24d4f3aea9f2d
SHA1 5e5aab5383ff9cae473aacf365d308aa9836c8ca
SHA512 e60eebfe423669d41221d2e03c178b10c746dddbee91c58985dced9e9f299ed9276d3019a21a537f11eb79e5a6cfade2a1e266846e177a0b358568f8c0d43139
SSDEEP 49152:89mqCzDScAZmlvTcFg8Ph69pAQgAT76sQuE:+bqGsQr
TLSH
T19B955C05F7EB5298E8B3CAF1C96694159B327C509B34F7EF0A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 e4dde92fabc88160d91cf2e1e3f33004cb8ca8db62d40130fb209bdd7d1a1661
MD5 dd167c94bb590dda1f741fd8e2be1f88
SHA1 926ffc143e525855f3536884bb87813dddf058d1
SHA512 d3faa8db0c7ce22441255a186d93b4cb4d2269fada75cde8adff0acf345cc0287094874e02e9cb27235b01ff5e01a24d26ab51c9050845b9d596bacf5bfbcd24
SSDEEP 24576:9lYJeXm5jUuE+AfYLH8AcevDN0FImbwQuq3Wia7gD:9lYJeXmRUuE+AQgAT76sQuE
TLSH
T1D655125E269C30E9E57ED03988B28568E3B1B4B5530163FF01D0C2BA5F3B9E56E78E50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 4f5c8f2367d0015241db762aaf2604e37599ac0004458f196b5eb6d7f7c0556a
MD5 e8935a503ccca64155591ba7036e5eed
SHA1 427716d5eba0efcca7508a987441c2ac4e9e8d02
SHA512 ff4ca2f089eaf11fa98ca7e045a5d1ded1e6907f6c9470e16ef9ea30912ced964323e434906f71b46538190fe6c3c663b79b91194456fb80a4196e528773cdb0
SSDEEP 24576:z7tyipAfYLH8AcevDN0FImbwQuq3Wia7gD:z7t1pAQgAT76sQuE
TLSH
T13D651206639860E9F9BA8538CDB381B49B75BC748B0193DF1091B73F6E3A6D4A570F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 edbda25f8c8c630fff89be6e0245048745e0a9fea1c66a4456caf348d269b09b
MD5 c91be7c4cd1b7051956ea1d7f786b40c
SHA1 219add38f7419fb4b9d28508e710fc41b065b8c2
SHA512 5c919d1bce859dcc47736618d410dc69d0fd0ecbbb4500c88c5473d4bf6504b44d6fbfe362a730ab1646c193d8cd618422907410ab6d70c27ac7170abd1f4c77
SSDEEP 12288:pPTpAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:tTpAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17355235F024C30EEFC7AD135887755B863E17CB89301A2EF1085AABAAE3E484D1F4D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 fb4f9fbc3ddc9cc368fb78cb8435146b56b985b6246cb111c250bbf903c0a6ba
MD5 c6d51334999cbd7206ce3568b60563ad
SHA1 1981ecd3550944352a5d83a14c2851a5e44646a6
SHA512 93f0458ffe13e0a9d1f8698ebd74147ddab4e922f346a9db6cdb8c422ef90cb6af8d194c7b4f6e5d346c962dd6a0b3437e143b09d5c5ce52cd7c776c8d8c784e
SSDEEP 24576:vC+TyQIu93VAumZr7jmEpAfYLH8AcevDN0FImbwQuq3Wia7gD:v/TfIq+YEpAQgAT76sQuE
TLSH
T13A558D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C17D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 61f1cd23b0f8dfb1c02ea791cfd4d883361a9f5eeaabaa4936082293901077e8
MD5 ac4ef7dc6e4b6e4c6a0e1ae00fa2bb5b
SHA1 fa73547754fa6bb8963fca4dceffef54004e1106
SHA512 449cffb0f615d3d53ee4afaf5f6807c2a81c18753ce82f6c4f867e278921a45284e378f7a9fc5e59607e57f4005c917242da930dd76df4a622b7d84b3ed934b0
SSDEEP 24576:PLQikZnpAfYLH8AcevDN0FImbwQuq3Wia7gD:jQikZpAQgAT76sQuE
TLSH
T11665F00FB2AE10A6E4ABC13C88964166F6B37474430263DF0290C77A5B7B5E9BD78F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ba523a9569df348e68298f0ded6309abc7c5ba15ce9497715686ac78878ebefc
MD5 137b7eb4a73d9fc38404a7073cbd8766
SHA1 09801675b3251a62e17795446a8c845685f5f506
SHA512 47845724d1101bf4874e4acc768ca0d70c952a4ec9844e4bc178b2c95f6b1aea0b6b3fd3872c1f0be4b21094764b1eecb40c692d7250ad2da757bfb80dcce8b6
SSDEEP 49152:WpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPipAQgAT76j:jpC7b4+80GTkMqGsQr
TLSH
T1E6A57C3DE2B810ADD8AAC375C5461665EE71382E3F2055DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 31211ad472485a390f14d051043762296402b6f8bab6b65d3d51b13fe81e8380
MD5 881ceedff5830e4e6cf4594f0300b3a4
SHA1 d31abbeb36919d67ec8af5ea9df8681f9ba991e4
SHA512 5486a38f894123ccd4bc5758ed6d2a57a0bcddf52e73d147f1febf3c33422829b09864cde785d6f0ea2bba45ae72ed2591276ba66d7812e5f6dab72b1f1eb979
SSDEEP 24576:KSAwJPE1IDAo+4Kt+l4413AUQ9AfYLH8AcevDN0FImbwQuq3Wia7gD:KqPCIo4Kol4KQ9AQgAT76sQuE
TLSH
T1E855B02AA7F956F5E17AC774C663C611FB727822133163CF4290817E0E269E89E79F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/132-304-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/132-302-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/132-296-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/132-414-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/572-36-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/572-226-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/572-30-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/572-29-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/908-290-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/908-288-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/908-402-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/908-283-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/1060-426-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1060-516-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1060-307-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1060-313-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1060-315-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1060-518-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1500-46-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1500-40-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1500-47-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1500-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1500-227-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1548-521-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1548-391-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1548-388-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1576-337-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1576-339-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1576-515-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1588-242-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1588-240-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1588-343-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1588-234-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1800-535-0x0000019317AE0000-0x0000019317AF0000-memory.dmp

Download

memory/1800-536-0x0000019317AE0000-0x0000019317AF0000-memory.dmp

Download

memory/1800-534-0x0000019317AE0000-0x0000019317AF0000-memory.dmp

Download

memory/1800-532-0x0000019317AE0000-0x0000019317AF0000-memory.dmp

Download

memory/1800-529-0x0000019317AE0000-0x0000019317AF0000-memory.dmp

Download

memory/1800-533-0x0000019317AE0000-0x0000019317AF0000-memory.dmp

Download

memory/1800-531-0x0000019317AE0000-0x0000019317AF0000-memory.dmp

Download

memory/1800-537-0x0000019317AE0000-0x0000019317AF0000-memory.dmp

Download

memory/1800-538-0x0000019317AE0000-0x0000019317AF0000-memory.dmp

Download

memory/1800-525-0x0000019317AE0000-0x0000019317AF0000-memory.dmp

Download

memory/1800-526-0x0000019317AE0000-0x0000019317AF0000-memory.dmp

Download

memory/1800-530-0x0000019317AE0000-0x0000019317AF0000-memory.dmp

Download

memory/1800-539-0x0000019317AE0000-0x0000019317AF0000-memory.dmp

Download

memory/1800-528-0x0000019317AE0000-0x0000019317AF0000-memory.dmp

Download

memory/1800-527-0x0000019317AE0000-0x0000019317AF0000-memory.dmp

Download

memory/1828-63-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/1828-58-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/1828-65-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1828-60-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1828-52-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/2156-363-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/2156-355-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2156-520-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/2156-361-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2212-344-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2212-519-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2212-351-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/2212-345-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/2932-424-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2932-427-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/2932-524-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/2932-418-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2980-0-0x0000000000400000-0x0000000000641000-memory.dmp

Download

memory/2980-26-0x0000000000400000-0x0000000000641000-memory.dmp

Download

memory/2980-8-0x0000000002500000-0x0000000002566000-memory.dmp

Download

memory/2980-1-0x0000000002500000-0x0000000002566000-memory.dmp

Download

memory/3044-169-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3044-12-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3044-20-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3044-21-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3076-573-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3076-432-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3076-494-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3076-510-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3076-438-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3076-478-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3076-431-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3384-278-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3384-281-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3384-272-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3384-390-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3416-375-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/3416-369-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/3416-378-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/3416-368-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3416-380-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3452-400-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3452-394-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3452-403-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3452-522-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3736-257-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/3736-264-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/3736-367-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3736-263-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4060-67-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4060-73-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4060-228-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4060-75-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4176-328-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/4176-320-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4176-326-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4176-512-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/4600-412-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4600-523-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4600-406-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4600-415-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4676-270-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4676-252-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/4676-246-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/4676-245-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4676-268-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download