4c90638aea937d43a56385858ea96033083da636bed56da3aa3eb529405a6511

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-06_edde707020d9631088126dfad3458c21_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat.exe
Size 9.1MB
Sample260606-a5b3csf14x
SHA256 4c90638aea937d43a56385858ea96033083da636bed56da3aa3eb529405a6511
MD5 edde707020d9631088126dfad3458c21
SHA1 66e9eac9464cd6cabaf75cee3573648237a572a6
SHA512 3a8ac14b39a1e4d5df36af3f2a5df82dff98857fd0dda0d48fb23188659834001a46d4e2c4680f165574a46e89f7d5e6b744f678999a95034ed4afda798996cf
SSDEEP 196608:bxd6mgg5kjjdKtEPc0FrX68FhBOncYKqmTeEW8FBk9E+f8syid:T5kjHE0Fz68r6cYKhKEW8cJ8sy
TLSH
T10AA6BF33B5C080B7D25202B0A99CBB9557FDF9700B729697AB8C361D2F718C1AB36653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2236	alg.exe
1896	elevation_service.exe
3508	elevation_service.exe
5972	maintenanceservice.exe
1868	OSE.EXE
3560	DiagnosticsHub.StandardCollector.Service.exe
5228	fxssvc.exe
1924	msdtc.exe
4236	PerceptionSimulationService.exe
1844	perfhost.exe
4936	locator.exe
2564	SensorDataService.exe
1280	snmptrap.exe
4120	spectrum.exe
232	ssh-agent.exe
3752	TieringEngineService.exe
3892	AgentService.exe
4968	vds.exe
5068	vssvc.exe
1824	wbengine.exe
5340	WmiApSrv.exe
3380	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-06_edde707020d9631088126dfad3458c21_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\74257b95ccebd5c8.bin	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-06_edde707020d9631088126dfad3458c21_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af971f3e4ef5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c01ac43e4ef5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c30993e4ef5dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1896	elevation_service.exe
1896	elevation_service.exe
1896	elevation_service.exe
1896	elevation_service.exe
1896	elevation_service.exe
1896	elevation_service.exe
1896	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4612	2026-06-06_edde707020d9631088126dfad3458c21_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat.exe
Token: SeDebugPrivilege	2236	alg.exe
Token: SeDebugPrivilege	2236	alg.exe
Token: SeDebugPrivilege	2236	alg.exe
Token: SeTakeOwnershipPrivilege	1896	elevation_service.exe
Token: SeAuditPrivilege	5228	fxssvc.exe
Token: SeRestorePrivilege	3752	TieringEngineService.exe
Token: SeManageVolumePrivilege	3752	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3892	AgentService.exe
Token: SeBackupPrivilege	5068	vssvc.exe
Token: SeRestorePrivilege	5068	vssvc.exe
Token: SeAuditPrivilege	5068	vssvc.exe
Token: SeBackupPrivilege	1824	wbengine.exe
Token: SeRestorePrivilege	1824	wbengine.exe
Token: SeSecurityPrivilege	1824	wbengine.exe
Token: 33	3380	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3380	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3380	SearchIndexer.exe
Token: SeDebugPrivilege	1896	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 3016	3380	SearchIndexer.exe	105
PID 3380 wrote to memory of 5436	3380	SearchIndexer.exe	106
PID 3380 wrote to memory of 3284	3380	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-06_edde707020d9631088126dfad3458c21_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-06_edde707020d9631088126dfad3458c21_amadey_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3508

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5972

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1868

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3244

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5228

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1924

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4236

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1844

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4936

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2564

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1280

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4120

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:232

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1248

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3892

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4968

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5068

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5340

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3016
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3000 2996 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5436
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3020 3012 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bdaa66a5b777e0220383adb264e70321c643aca08ad71f04e2614aed4af86e31
MD5 0b158f219d9e550697b0f40cbef7b415
SHA1 01d1fd5f389c4b3eced3a80d4c6a076d359b84f5
SHA512 5c68956febc6a5e459c39a8036077e7f79225f4da1ff5881606d3daab64088aeb8286beead04a4327af4c3c8a4c48ad0d16cef17e201f5a7f86fdbf17aa35839
SSDEEP 49152:Bb+632BuPkFKRrdE6ohQstBhuXjfS4LWxn0RADMzlUdS:H3q6tjB+DVS
TLSH
T1C7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 ea856e547920cae671e95b67472c349b8a455feb4f556bb2a7342f8d876e7809
MD5 4c209d6f849c3baf25d4d3e71643287e
SHA1 59468f5d93e9045c34fd72c04d0d511c4b2fa92f
SHA512 13bb85743091c52b2ac51c2fc26fab314400a41fd2c191d8cee1d1c342fd62e66c0950a0cac16df883e22b99188aac4d6a0e282c2789af78b40a7f3a4c8db6fe
SSDEEP 24576:/XYfDtczAQIqsANA8KM7MNDlG+1UCM14F:KtcuRADMzlUdS
TLSH
T1A605F13967D009F9ED67827CCDA28512EA33BC924750E6CB03E499261F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7fe0e26433661c584be36172de610babff42478fc86ff872c092df152f71bbb1
MD5 4ffcee0099cc940fbe98153cb7e4cb25
SHA1 cd89484f56b3d4d5a64ccd9b7c07e11e94ae6b03
SHA512 4ab4f0e4f7e0ac5c723430991e3600c437db142fb52d602d55af36714e30543825469423d3e2f8fe04b311f09b70e155e46012f332f44de2164d1bf6ab53809b
SSDEEP 24576:10Le5ji0hmxnrMjIqsANA8KM7MNDlG+1UCM14F:1Pji0AxVRADMzlUdS
TLSH
T19A35AE66F6748735D073C0B9C5D2A69EED3230821B3089CB4286D77C3E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ac29296ba9aa22cf767bceff308b74705431e745e38888f42c2a04238eee8dd5
MD5 122c8f724b677e36d6edd0a543f4692e
SHA1 2ccdd74278d0603e2e2282acbe3312a41def7ccd
SHA512 748dfa71d8fc094656f75213f06d60a4d9c95b34439819b141278bf9025be2a3fed34f0af4cfde310441685bca739cf9fc33b3290c3ca65e00c7321de36e6870
SSDEEP 24576:ka7/ezSC6vUyDZaqgrvWx6q8wyupIqsANA8KM7MNDlG+1UCM14F:T/ezSC6vURPvMHjyBRADMzlUdS
TLSH
T160755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 181bd8256b084265ac21cbf4a4e032f6be95f1df048cb25ecfa407c0b6cfd856
MD5 728cade4250acc912f0aa27517839acc
SHA1 34a6f0a73ad0c8e063a0852d8bc331af4669e7a9
SHA512 d0399228c3c50c28e8c67d1164e872ed96e888ad83715d9c86f51834a504c95348f768a129054d1f7b4c12616a71e795f3519591d3320fdaa67423239fa5ec8c
SSDEEP 24576:KVbqPb88hv/lV7MIqsANA8KM7MNDlG+1UCM14F:KVO88hXlV/RADMzlUdS
TLSH
T164559F66F5B48331D073C0B9C5D2AA9AEE3234425B318ACB1246D76C2E777E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e5fdb9d7943835a49934c60f64098638be39f4983c216a6f2e6a9e68379c0819
MD5 23b203a6fa83d9aa70ef4cddc47d0ca4
SHA1 1752169926af3f7d91e576da00fee72d75111f6d
SHA512 309a2f4f86c160e302ac291114a68cd45695da214dfa2a591f6343cdbd520884e8d4104569ed58f034d9f4abaf53ac7f35324fd8ae4738175f5a1db411c2d337
SSDEEP 12288:pGPYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:pGPIqsANA8KM7MNDlG+1UCM14F
TLSH
T113C423F74AC00BE6DFE90774ADA258563D02FCF31944948386E5BE1700BE9FAC1B6216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 cd0cf6befadb0ba69d258613a415fb091f08ac0b70abcde8e9edfff818294298
MD5 574fd986133714b8da6b35938b996c0a
SHA1 62ae6ffea933c4023b59899406f3fffa692b9f98
SHA512 4d2c9e88b4dca386b855e160c3f045bc50264b1ef629487d26a866b02f6a4d5c8b7fdb29780dcda9b85ab14baf3a8434258e3f279a26c36ce2fbb49891492c89
SSDEEP 12288:WeBNUbTVO86UkYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:WJIUkIqsANA8KM7MNDlG+1UCM14F
TLSH
T12605DF7BEE28FCE2C67E4DB85A918600A77278714F1193CBD175820EDE235E14E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4a36c163ae8dac6aa93982408bcc63b83b83d27114f9d6be1dd535002923a559
MD5 7d900da36532313511894bfe444d782b
SHA1 c863ddf779f89cf0d441744099c895e62e8a4173
SHA512 4bf1f7c9915cd7baca9a856da214864b0b26e6c600bfa123ef7e8fe0a3317d4d72ff952233eb293e327ed8dac45c75312e0c59d55a45e252f5433246f0c90404
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THn:eQvGAdlCEL8c/pRNw5CBDVS
TLSH
T175267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 209dd51bb28f2d4d110f01c343f07eff20bad6b831468e6bc1a22a67cba49d59
MD5 d827b504974aa0495876c6ab08303c63
SHA1 6943f028847e30a3dc0e0eb6785132a76641c6ef
SHA512 76e4aae24e01facf1166e9ee54355b5224816f58feb377ec27f311b2a48001cf06ba83885cfa5ecdf3c602668187c3ca1f55058860167bb9ab4127be07e2fa17
SSDEEP 12288:uAwSfxL/2Dc3xDLLmt0LDQewsAj6Ybqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1J:TwewsAj6IqsANA8KM7MNDlG+1UCM14F
TLSH
T15815E031FEB4D436C7BB0DB21B36C716282DB9604B5119C3E3E88E9E59742D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 db2da028ecd796007b95b94e5ba3ada3ade03ba3511bb466858b49be2d58e5ad
MD5 8058ce1430169a6af909e879ce204042
SHA1 6b15589595d52ad9b6462a1fe0bc4e402668f104
SHA512 83ca16c0c1af3bc79d7b34a1fdb85eb0290a543ecd4390a7b6ecd0319ecf05cdc2c8dd5230537431a92c3b251f645c073b765f487748dd53280cf4e2e388c115
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHm:aUEtQevvqc2W1cpV29I32
TLSH
T147474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c8a05b18172a69770dc7e6bbe0a58c50a77f1707ed5f8bbb1841a8b569b546c7
MD5 66173a36694b761dd4657efd62ec2653
SHA1 6911a89f2ad05c35dce0da4d5d5ed744125a68a8
SHA512 fe97d64b104d16fae119595bcd5e11b98b779d74d379dbdf73d60725c76b2d29d54a0899088c4cb1634a2cae827d56f7f1b05b2aedfb51da20499011a3bdef94
SSDEEP 49152:JCbRquA/m2yL5zTfFiV+XenmE3/zlRADMzlUdS:GoquVjnm1DVS
TLSH
T138D58D1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3bfd840a77d9a0c0eeb22cf82a0194fae556082b9259e7fbb6487e7cb1ceb68f
MD5 7accb093adf569b10e820c7629961c46
SHA1 de154f4f9d019483ecab84cf28173335f8cac31a
SHA512 d93f9f692c038f623eb265217e36c1085b7fc3508bceb24077d3e6ce51710d9937ad3e7f61d845df71727476ad077e2e92670660abecdfffd966b6e0c92fb55e
SSDEEP 24576:rAhGLmIFoiwtA5l7S53tIqsANA8KM7MNDlG+1UCM14F:rAM1Foiq5qRADMzlUdS
TLSH
T157359D81EBF945D4F5F39AB899B69171AA76BCA65E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 9252e09048682fefb078cb06dfedeb1053532dfe627f209cb006208351b3be46
MD5 6f143de6e7be62b5fb4c046552bd0cc7
SHA1 ed0d979dbbdea6eba0334fcbcc3cceb7449cfd9e
SHA512 6e72375f19623a35bbcb1897f69cdcc36f539772ce6016e668b227f0e14512c03c5424ea446976c82c10fa3662744ac1538dfb55ad8a86e0027acbf96c133e85
SSDEEP 12288:Xmw5HEjsChNOBFgl0WDm+CJYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mMC:2wuXOWOIqsANA8KM7MNDlG+1UCM14F
TLSH
T18905F15626E40CF9EAA74238C597C536FBB3BC122A25D71F07A0C61B5F37261AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 9ea0a768b46e0761cd11b711cf3584d2a2cb61ccd4d79429e2d060036cbb8266
MD5 4bf1654442760d3142533a0724ed2328
SHA1 9e680c9b8823326f2c7b69d7f348310e87cdfbb0
SHA512 fb8133cc6e4b6f472cfb585530e87afd3d5cfd3618d6a1d2fc5f2756edfe5b02c208a15bbb719d7c6d3f935a51a8a00c372fa0b73217e9e0d8ce3f3dcf772187
SSDEEP 12288:mbZ1IyqYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:GZubIqsANA8KM7MNDlG+1UCM14F
TLSH
T12BE412AA23D425F9D6E70378CDE15506BB32BCA3272543CF02A546271F77AE64D39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ac76bba16efd2a13532c639d4f228e7b99d65200e0e37c2864adb180f3c4901c
MD5 c125702af4a5410bd81f245bf102964e
SHA1 e82553c5a0cea70baccff536a0f0cd789ba43420
SHA512 0eab889896b7eaa4cb50db36935f6192a2268b06dda64aec5765c115cca7963366e3f8c5c20b0d5fb2b546752ca1f0df0d51cc858def18164e1731e76373f7ac
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Ur:CQRQyi36YOcPuLvw2gAf+PN3aDVS
TLSH
T120667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 331cde0cc17ec36fc8b8ce0e4af4b84fbc8b254d860ff4cea3b89827fc41eccc
MD5 fd854d983e8b7cf82e106f128617845e
SHA1 979481c88bc828167f72b1ad721df73241a218a6
SHA512 98fa8ccca5f9747a327278b8b134abc1e563238c803b40081794a2f903f5eab8b921cc009542b1751951baf4152e72ee105d4a22a237295edcb0b53dfee8527b
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Ur:LQRQyi36YOcPuLvw2gAf+PN3aDVS
TLSH
T15D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6c6fbe404efa628501f091371d169e2c199ae696edd2edd03839469630c66afa
MD5 31b1c6a20987a21a6bd963dbcc4d31ad
SHA1 234e50d863dd22a861504c61ab25f5e3d7cf9936
SHA512 c6b6df2b94617e2bb1862c17143a90bece635b6ff87557cd4db62e55afb39476723d72ad6f4b4e7c80a4fddf25aef5582e4502f5954abd5ace1753f523bdf14a
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0rIqsANA8KM7MNDd:D68Qg55nhxeWu7PNU3/VRADMzlUdS
TLSH
T109B55A33B2F200A9C44DD1769F4A873196D27C758FE0E3DB855172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d613e2ac99d10d93bd3b36240643f7977c165193596e1f1a3d292d941cf6ca3f
MD5 6916ffbb00926609a09e5c758e94b658
SHA1 bab3d786061c02ee46b52a8c921f8270c7ece8ba
SHA512 4010a56f91aa0e63b24cad90b74556939e4a550299fbb95a80f3ad2c6095b4958bf5cfd56911ecb5f86e187e9e851438344a0ee47ae179fb342feb7ac2b41895
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99B:Vy5112gYy5azzVvD69nLKnhZDDVS
TLSH
T1A8168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6c2bf26520125e8dcefd16f7bfa20d0547bcc359affd2b5a8311f90a182668a0
MD5 3cca61058260bee4bd831bbaa90df2ac
SHA1 e4ee5b0ffe8e8101180490061acff11f92c2c460
SHA512 428c6dff7632ed432274160a081896b92794b27af7173db93297f33a07286e3351de590b365fabf34faa2b67de91e385e7bfa3f5e2a75f146c16a8b5ad676f3c
SSDEEP 49152:RB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glnRADMzlUdS:Hu6JmQxd2dyDVS
TLSH
T154D59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 835f89d1fe2befc1632ece4b3187deb24d9a8133fd2d07be574c29acf66afd43
MD5 eebe08dcdc76764dc23af788ee67c8c3
SHA1 344895006ea2cbc382b6f0466d6fae4cc24e68f2
SHA512 94404f5e512bcd89a50a7e7f3a9ff68d84804f5ca185e227183bd2ac9553aafdc856a35cd2b679d2cc50d1ac8a0cf6d39f6c55bbe7dd2357d16f90b8a3fe4852
SSDEEP 49152:Y1hpsNoJpF1A6yU44CwH7R4xjRADMzlUdS:YmifPVR1DVS
TLSH
T105B5AE13F2D901E8D06EC17887569632EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 186df2e37f9d9e708f6e09e9d05a2c38f07f1d734a2b6fffd2cd204a133da92d
MD5 d8a78b57ddf0a972f43e27edb060e4f8
SHA1 9bdc24a813f4971e35f11cd77ea99d1f61d16c78
SHA512 0a2feaee889c0284542edb6f939e94e60c5a2f414d5a1f926d0fd13d4a7860b159e8d27f275833144e651fa5cedca9a02d4993de8020ee961c805085610fd15e
SSDEEP 49152:LSuZQIY0Be2KIRVtOnks6NMHqkRADMzlUdS:Z5dKOi61/DVS
TLSH
T1C8C5BF13F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 74dfaa0fd15ce87a693a2650dde7b034031c533454e6255692c86a38e0da1fbf
MD5 da9827656cd122cc6b5e795f8d32fecf
SHA1 15cf7b27a95371174d7451825fd79c2f7ee8feed
SHA512 df014681a4b0e0ce6fb08a1b9950c8d37587a79db77bd65d3ebff8ac10f3f7b31a9fd75100f09a7b225a10acc5ee18094812a332de43bec397acab17916d986f
SSDEEP 49152:zhtSn8EApI0figGgiDn0AP5wXRADMzlUdS:yX2i/phJDVS
TLSH
T15D95BE13F2D901E8D05EC178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 99cea792b6f5c2034b80c2b59b1260ffdd278a632eaccfc780e37952c2454b69
MD5 e70300258b395a543ea075c45ae44695
SHA1 9a4b342ed59d7229d71b959ed7d7b26bcb1d145f
SHA512 d28a5be7c8f6eec4bd74d2f2b7c3e1b7422fdb01627cda6949ee3fc56552881ba3baaea55443bab1927596a1b27c0d215a9b5e932421e1300cb19e384025a08e
SSDEEP 12288:AHYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:AHIqsANA8KM7MNDlG+1UCM14F
TLSH
T16CC423F749C20FFACF8903B0DDA254563D02FCF76A05409797E9AD1312BA9FA8176219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 7b9e995fa788b40636c33ad620d7b2a6b69923fc17f87d3b71edbbeb54336261
MD5 5c2b8df66d8360a5b3fa9c5a1dd83a56
SHA1 3ab8eefc6b3c59c9405bd96776c1de2e0c37e62b
SHA512 1c12e8a5b4977e90f32a2ee50be6afa03d1ed348554ebb781e8c5eee1d7a0e81d7278e004cf1567c3ab94b2e519ae1d6b1b3e2f5a35ee89166b82b1dc6b56e60
SSDEEP 12288:eWYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:eWIqsANA8KM7MNDlG+1UCM14F
TLSH
T159C423F709C20FFACF9803B0DEA254563D02FCF76A05409797E9AD1311BA9FA8176619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 82af695bb8da2b75eb83fcf91827ade6ec58668cf4e47e0658ae6c720c76a8a9
MD5 ea4e320e00c1281ef3fcdb288a6d876e
SHA1 53090a272d728bf961de933acac7b4f7eb293931
SHA512 5a09a3615b8d815a79f825e57d76acb2731678affb3d76750d23742a226297da43c1998acb85239135e07396ab395a45d8682e2034122879f5b6680f3224343f
SSDEEP 12288:ncYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:ncIqsANA8KM7MNDlG+1UCM14F
TLSH
T10EC423F709C20FEACFC803B4DEA254563D02FCF76E05509796E9AD1311BA9FA8176219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 81da20334abca3113a2b4e07dadd7f561b6a18caf637e44e5f8a0dbea1446077
MD5 18ba920a11d9e00f3b9af8b696fb3d82
SHA1 1896bc941b254a8e70c6b91de4e0556ccffe3763
SHA512 a5d5960fb080ed65c50f8fb3603e90b080dc75976493360755a9bb8c47b1a4110f9e40b114cec33e183c635ce19b181f73c7cca31ca9540c4db9249c916d86ac
SSDEEP 12288:xVNYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:pIqsANA8KM7MNDlG+1UCM14F
TLSH
T170D423B70AC50BE6CEA643B4CDB254163A22FCF36B0190DF87901D170AB6BF98575B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 79130a04edeaf896d94dfd5a6451e3e1ba2bb5a6de793239f53533a597c7c0d7
MD5 e05f3b57f4a095fda1262707bb4cf885
SHA1 572fc4fee98b8b55c752dcf56f471bf0a8d6806f
SHA512 c7c2d158c17d38562178d891d5abf7558e77d244e2714d89c7da7f5fb82c848e3e94379ae00a4f338b13ebc7332481386fe3c2f90ae315a969f5d69f41e1202f
SSDEEP 12288:RVYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:RVIqsANA8KM7MNDlG+1UCM14F
TLSH
T1B2C423F749C20FEACF8803B4DEA254563D02FCF76E05509796E9AD1311BA9FA8176218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 a7cbbf7ca896d1b28655941e86a0d3ee937fd3e700f784543a7a89d242ae4ce2
MD5 f3d9b0f3c728bec6807a46a73d752ac4
SHA1 a3083240fc0f858dc9391e78fa2adbb02ad33872
SHA512 f3f144928ff8ff40907762e0c42d7c2999aec9e94961c0619c96eb5b357cfb7958a58811dcc2fb77a611715317a09f41b94d38693bec525b036431d5b65fb2f4
SSDEEP 12288:jSYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:jSIqsANA8KM7MNDlG+1UCM14F
TLSH
T14EC423F709C20FFACF9903B0DEA254563D02FCF76A05409796E9AD1311BA9FA8176219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 ff7768c177abc62aa96057be61f99b102c7770c9d99a3fa426088a3b284b691b
MD5 bd5847279b98a180c5a86c0b0cc47b85
SHA1 5da442bd2e2b61ed56d3b6d83cf7c5d9890ddec0
SHA512 0f81f093a84e645bb5e7a3dcc67ff58fbd82f03c5daf42c9e48473fa8d27b646bec993835fbe0c79e5490b5bae9671bd6262c299f2d90b5720ba6c1fe23095d7
SSDEEP 12288:ReYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:ReIqsANA8KM7MNDlG+1UCM14F
TLSH
T101C423F749C20FEACF9903B0DEA254563D02FCF76E04409797E9AD1312BA9FA8176119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 b109afe6fdb763a4f8c89c4d40dfb30285613b5e461486249221916caa6b1d62
MD5 944a548a54425b97acb4670ed0cc1217
SHA1 ae1aa31aad4885ae1d4a2400daed4b7500541782
SHA512 3fbc9b0d760c8b1b926a984dab092203dc0be14e0d8e64bce095ca41434ae356ce254c64c756a302cd2fb915fd6e98d613f172d5c647c10bb3bac550f62240c8
SSDEEP 24576:WZMJzFVSO2IqsANA8KM7MNDlG+1UCM14F:WZMJzftRADMzlUdS
TLSH
T13B05F1A5739009F8DDA7423DCD658906E6B2BC6A0B60C65F03E436271F733A14D3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 550b8d6a759383f5d18813f6f26f95d72562e1c9c58f0d3e7cfdaa097e999ff5
MD5 ea61e7f2632e7040a98cc22008917f27
SHA1 84cb530dcc373448398e5794e93cc9878e5ceb68
SHA512 d8c421ce68b7e0ee3442f6cda9cc6414cfd0c8085421f42c0420188a23929afdb0862505f39e4f2cc97b5bc93f0f8c4f9f7e7bd4e3fba94baa28a98bd3cfb77c
SSDEEP 12288:ILYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:ILIqsANA8KM7MNDlG+1UCM14F
TLSH
T133C423F709C20FEACF8803B4DEA254563D02FCF76A05508796E9AD1311BE9FA817A119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 7d6516233af602deba59a4fff2c582df127eb936085b6163807e89b7e3fdc430
MD5 a2f3f7cf9408cfb648dc951658ecc17d
SHA1 496ffecbe272a1909ff0a40b5a43a2b759187067
SHA512 a2867c32335aaf03d78c5bb7a9f3fa2006f576ef9332b6287b337fcc7add0e57afc646947e05fb7f8914a576b78fc6dc302c540158604e08c8aa0d245a002bac
SSDEEP 12288:P/Ybqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:P/IqsANA8KM7MNDlG+1UCM14F
TLSH
T1BAC423F709C10FEACF9803B4DEA2545A3D02FCF76A05508797E9AD1311BE9FA8176219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 c9e253af86b6072ec2f5b83bfea5e13b3a36e89bbf2e09ef88a368c2c5ef64b9
MD5 7f32f76252e7d97ac81607ac709cc747
SHA1 3db5b87a952e1fa86a2af5bfddae5dbb1312dbd9
SHA512 de634a64158fe93cd0c7444c94c934f08aedb289f01c294786fdbadf38fe520b146a719ac1249ccad0dd4a8139572e9c3354fe3831f9a3857d45fdf477693198
SSDEEP 12288:lyPz5L8qYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:szyqIqsANA8KM7MNDlG+1UCM14F
TLSH
T12EF4025767D121F9D6664338CDA21902B732BC730B148AAF53A44B371F776E19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 16d1256140ec57bc7d9002c88a58d9b17040a6d81c23277b462215cc83b66af5
MD5 adf1072d53c2af3fad262eaefbea1e5b
SHA1 f4a69a86e1023dac3acfe178d45a8346ab4f0308
SHA512 75046132aef9f3b7f1162c96e0d1a1309815bf412e1ba0592008fddcd80ef287057c7722bc0d5ffa34bec9f43ef2b9ba2bb7a5cceb3a109d8397679003f18836
SSDEEP 12288:XLYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:XLIqsANA8KM7MNDlG+1UCM14F
TLSH
T1F7C423F709C20FFACF9803B4DEA254563D02FCF76A0550C796E9AD1311BA9FA8176118
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 89c9b8f7ceee34871ca999b4f3e571740b0b5c5ff80507e1d67d060a667b28ce
MD5 0cd1b2474288f8c16c1b3ce83fa603d5
SHA1 7b6769eb51dcffbc4b6322604635422289023f47
SHA512 eb90ec6569339f91ca072c23b40fd0fdef65039c2be52910dc7282d16fc1e6c68a8bc4b127bff153bfc2b9fe0624897af3c6703873530698e441cde8aea51f2e
SSDEEP 12288:ZLYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:ZLIqsANA8KM7MNDlG+1UCM14F
TLSH
T1BBC423F709C20FFACF9803B4DEA2545A3D02FCF76A05508796E9AD1311BA9FB8176119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 75f0bfdb2c05a137445776272be4af1d7555e2a45075e2955adee58ead70e09f
MD5 8cc2aa09064c3bfcbea649327e92a698
SHA1 c4ac0cb0eaefe489368fd650bcbbd3a298b08b55
SHA512 4d34b963c228f263c88967de32ec2eb52e6eeea22637787dc6ddb01b23611c2631496cc058ec604009e37b34654267521c5a3a2f143fc09e108a13836d0f5ff2
SSDEEP 12288:uyPz5L8qYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:zzyqIqsANA8KM7MNDlG+1UCM14F
TLSH
T100F4025767D121F9D6664338CDA21902B732BC730B148AAF53A44B371F776E19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 db9440d1e79bc4ca91dfba8b48de634bfc57df13aeb33bc99e7febd61723a901
MD5 a63149079e2230c4cf383e4d85248112
SHA1 f592fa7c37a2f7fc6a86d92e13c76cf70733cc65
SHA512 e8d00f2b8c0cadb4be75174ef423ee27d278452568997f7d31f06e8cf6bff7fe3c62cba4520a96ecd18e967995f3b08100f0b42ab0508b3f00d0e05b51e12993
SSDEEP 24576:BTuaLl3z0zDsIqsANA8KM7MNDlG+1UCM14F:BTdLljeRADMzlUdS
TLSH
T11205F1A5B39018F8DDA7423ECD658906E672BC6A0B60C65F03E436275F333A15C3EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 29e9ca606097a3342e196bc99d377025310335164b78a3133c7fe3951a72c653
MD5 4865d159b3d6d599a85929251db29009
SHA1 cd6d0dee630c7bf20d3c4008a9be94b35907fbda
SHA512 97fe4af609d030513b39f46d496445f391fe5726892acdc6f5bfa55520017f5f0817c0864c97cf521174609f166f2695725ca25328f50e5584e32f94635b5104
SSDEEP 24576:E3xd9CHKy7GZIIqsANA8KM7MNDlG+1UCM14F:Oxd9CHKyatRADMzlUdS
TLSH
T1F325CF91F3E415E8F1B78A35CD764512DA767C9A1B21CA8F03A4251A1F33BE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 ef1c19bbb663be12e6a29715775e50260a301baee002664af78fecd3e3b7f577
MD5 912e997005f4ea18b7ef0dc6a3ea9545
SHA1 0bdc180738392e1c03e876c4d854749c08b2c60d
SHA512 8d737df4d8f68d8c83fb8c81d5e35fe4e64b75ef427ad4ce7df60fe3440156ba6fedd3da55ce91b816583bbd5da777a75d8be614d317060886c1725b00ff5b1f
SSDEEP 12288:g8Ybqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:g8IqsANA8KM7MNDlG+1UCM14F
TLSH
T1C1C423F749C20FEACF8803B0DEA254563D02FCF76E05409797E9AD1311BA9FA8176219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b96d8b35493da44343cc7b03fd51cd05431fb3576702b1d52d0e2e9aa578f2ce
MD5 8518afbfe24540bb101dfba12b6eb8bf
SHA1 9b6b175c53774f12dce096faf4cc27b14ac155c1
SHA512 6c68ffb3bf945696fe6ebf2fa3e95df48b9a93625d65bedf87863792379b1051f39bf95f567098ea3971c12d5910ae1c251714a40ada19c69845b2adb3b706a2
SSDEEP 12288:RKYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:RKIqsANA8KM7MNDlG+1UCM14F
TLSH
T1D5C423F709C10BFACF9903B4DEA254563D02FCF76A05409797E9AC1302BE9FA8176219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 5a66a007462be6d81cca9a17d88cfc2fae46681b7f999023b7a05e53e1b8afbf
MD5 8532233f7696801ecdd3ddbc7b9c60b4
SHA1 6592e16d078972496babc46602d96191720f88c1
SHA512 ca5aea95bdf99585befd59364cce8836cf0468bba10ef03e877f7a5500050e173dd6461140c03d7412486130542156ce2660a3d1c0eaeecfeabc70469d983551
SSDEEP 12288:cRYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:cRIqsANA8KM7MNDlG+1UCM14F
TLSH
T138C423F709C20FFACF8803B4DEA254563D02FCF76A45508796EAAD1311BE9FA8176119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 d1e7db3c3416696b9f3f5284bf495e6eee2c1f585d544b486d341b9bb258caf6
MD5 73a8e897afd34f61bb47b7cf319403a0
SHA1 c145e6cd61ba1b6167a375b9f5a8640fd9034cca
SHA512 334c724da876277bb4fa57e6fbfae1e2e12a660d6518adb14b3102d7b9b5baed65cbc0ef891641b2db17c638aa355f7f2c591e2c170357aba07cfa5345c5f2df
SSDEEP 12288:ELYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:ELIqsANA8KM7MNDlG+1UCM14F
TLSH
T1E0C423F709C20FFACF9803B4DEA254563D02FCF76A05508796E9AD1311BE9FA8176219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 deb4bb2c030694699af1abeea36fbdff6e5b81ac25f9b66ca544cb62c56abb5e
MD5 064aa26a258ce0bfe3a721b18f13c4fc
SHA1 cc3b6d307eef454399c730cb23b166bbad5042f4
SHA512 875b47f4642cc125e469f3e70d45614572457c9236cb38f0366260251b8ce4f2c1d036bc33046b6897c5a54abb5986f47aaf4f6b8e0833f9653011f049fac10f
SSDEEP 12288:rksfbYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:XbIqsANA8KM7MNDlG+1UCM14F
TLSH
T124E4F15AC28402E8C5AE4274CB524A41B723BC6697E1D3CB53D0F93E0F766E59DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 1a9f01301cd04fb3eab3ef9db8f6dbaf87fc42cad1326444b8bb6896f8313886
MD5 d0e609c608d2931f526234d90f186507
SHA1 26998b80d9e4192f1bb309a25c1f523ce733f509
SHA512 8c32e0384badc1b5e551f794fb100baf6f1b591a941b2cd11c31e8bcf608fb6004a0bfb87c6d876e1c5efb2be9f7e7801c2c2bdefa6399e2a7284fb028fcf59f
SSDEEP 12288:iyYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:iyIqsANA8KM7MNDlG+1UCM14F
TLSH
T1C7D423B346C90FA6DEF903B08DA690263906FCF75F0480C3E6D56E17117A9FAC97560A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 2ccec956c849de0238126c32beba7a4790b41b208e51223dbae596a22556e0a0
MD5 dc44c1ae7ff77bea6e4b883d388003be
SHA1 fa0cb1c85c9fd776a45ef5bee8693792686b9728
SHA512 b0052530f56625282029df110a6f54f006d5b167c371bf0210791fe7125193d79b2e1f732f4b10fe1ec64d847bfeefaa769d72c6489b50b4ca8224d3996cb2d7
SSDEEP 24576:g8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCoIqsANA8KM7MNDlG+1UCM14F:BRZwQCyiHiQEaiPnMiRADMzlUdS
TLSH
T17885B01E62DC46A5E0BAD278CDA74407E6B27816573197CF0190C27E1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 e0dcf55f7a93afb46abe08d0bfa861ad38b145e2176b79e47f10c52e2670eee6
MD5 39d0fba715ac9314a67c2102268a611f
SHA1 fb484c0b5646d1777eb148c58eaf264f4bdeb0f0
SHA512 94231d91344a6519cd2398f98afe03677d622954bac77a955d0712d60653ad39d8078a6dcae3b85559288d13596c9a8f977fd88de0475044e64b1cc3c06e40f6
SSDEEP 12288:wbxA1U7KCYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:wbxA1UGCIqsANA8KM7MNDlG+1UCM14F
TLSH
T1FDE4027E16DC19E5E6B6827889928106E732BC67171193DF11D1863B0F3BEF99C36B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c8d00804d4bdaf14ca3d98bafd449e1a3e5838c8dea0820c57a4925f63bd3c6b
MD5 192a7d605d6bd383080efbfef36c7c96
SHA1 87538c956db3629b39763a7681631519da43f410
SHA512 dd6512c8492b08364d582eae923eb12415acee8c2f3610513ff400b37c232ac42967a544a556eb4e219bd165d243f21b1ca492027ee32a6d9df4818d819243ad
SSDEEP 24576:PjsmP0yHaqrVqHra44KDzMsrnnIqsANA8KM7MNDlG+1UCM14F:PjRP0yHfVqzlAsrnIRADMzlUdS
TLSH
T11445AF2EF2B910F9D4AAC236454107B5BB71B82D1F209AC70170C635AF1AEE89E35F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 ab3de9f0c489092286347557af6b82cc9941e3ed21ac44f2d162ae674b7aaf02
MD5 6f782b73c95fd214f90af946ddb1c6b6
SHA1 3ccdf68e010833b656261186b6fe51bd82db4663
SHA512 8fcba83d2ed3e6304f53acbb3b42e360cbc3cf555cce806594905d9834e5612ed700ac36240a9cc8c9817cdb9312abf4a4ab315820a874d32428890851864af4
SSDEEP 12288:AAYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:AAIqsANA8KM7MNDlG+1UCM14F
TLSH
T1E5D423FB46C60FEACF9907B49EA254163D02FCB31B0550D3A5E5AD2702BE9FB8176205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 b726c0a236851da63bd7eb25e05cc65567ecdf6c84293e464023fd3b3030717f
MD5 ddda84df45ef4b9757048ca046335cfa
SHA1 061c3814716f802f22d5adf5df5d50dfd33278e3
SHA512 58f9f2d5b65e9ac1daf642aed595203c9d60b6c3f0d4d8fea6f011323a2ef92b443e89908d10dcab672e7a8a0218cb02171e2bc86bd6888a7f2276c8965ce8b1
SSDEEP 12288:AObZA4LWO+vAYFTmYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:9tLBUTmIqsANA8KM7MNDlG+1UCM14F
TLSH
T13525F155E7D404F9DD6B823CC9A28916E632B89E0754E6DF03A84A261F737F24E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 75f0b2aaa6205ac0d8407f80fd0b08707d62850431d2b6581701caaf137acded
MD5 b918f022011670da837c03f2c10f9a2e
SHA1 55fd33a05993bfadfa2912922fea94c62b9530b9
SHA512 5fe37cf8985481fdd7d818ee6819c91819694249bcdab87880f9d3e6a912e0643d19c365f89b06b60e0423c2e18a242680639474c6ac97b943aa3a88a71540e6
SSDEEP 12288:R70Vm6IYNvUyBpZYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:OWYNHbIqsANA8KM7MNDlG+1UCM14F
TLSH
T15505E12F52AD0DE5D57B91798AC38109F633B8A6171192CF05F0827B1E27EE9BD3A701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4904a2e03bb26d1692b5ae1dbb1ab588f358842a3f48a10a6cc327095458669a
MD5 cb5740a694389b43bee06c8c8ba548a1
SHA1 c13f122c3e6657084052aaba613a90062cb70d2c
SHA512 648f6e0882e7c6279e6a05b90e698213dd96f9d57740a0eca39b0c4ee02a1d4bd565c392779df3ef13e5200c7d826973ea00deba10165d6f752fbbee10b35c0b
SSDEEP 24576:xnXoJjNYH84VVSNAApoEOS66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKN:xnXoJJYH84VVS6AmEvJas+cHBjSSKHPf
TLSH
T13465BFAEA2BC04E8D5BBD17DC5C24506F57278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dd90c892b08411863dc4b96be4a7ab3cfe8fb4ecd0e323f3cba0fca5ff39702c
MD5 f731c6e0e654e989ea860c6da68a0514
SHA1 7d52cdf0c16dc60f2e8b5804075acbd7b9495266
SHA512 248f36a8b2000282fabceecad6bbec5bebc425d0d09e399df112518e777e63533837527815f54d0ee1cd900a80156888366f5744f7a134c1316b54b43a1024cd
SSDEEP 24576:Vv7Xbxd9Tuycf8M/TYlSuxrr2PCxIqsANA8KM7MNDlG+1UCM14F:VDLL9TuJ0M/TYj2PnRADMzlUdS
TLSH
T1BD858D5EA2EC42D8E4BBD6BD85B79047FAB2B855173081CF0291856E1F23BF0593DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 6789bff18ac974f4123f7402b31f0adece0791a09428c76432ef940fbdcf32c6
MD5 b8a34d914863f0c24ff64676d76da425
SHA1 6a5b3ca9d6d8e91e124ef09e2b9258cf0048cc61
SHA512 5f589f9b79d1f382f37d0741a084c7d91c59907ae16e3ec5623d2782201356f834ee8e7641aab2dce508866f19a739c507841fd6ff485baf6ece392f0da67537
SSDEEP 24576:6egJgpwJOmPOHWAKJ8ZguIGyPsxr5Vin10wmIqsANA8KM7MNDlG+1UCM14F:6ngOJOmPOHEZRADMzlUdS
TLSH
T12F55CF3FA7BC15D5D07EC17D8A928816F6B1782613255ACF01A0827E5F2BEF46E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 547e877143bae00929ab804619fba3e7aebb54904df7d8dcc970e0311234d06b
MD5 3f60f70d579e8d990d1a9d801a3116c4
SHA1 fb0059defaef661ea0bfc0b0eb770b2640235b84
SHA512 6525668b4499669ea9765d69a88a4e2a17e7a55b85145f3a65e54f08d2f04a6d1603c38ae1809af1a95e540cba4ec2dab46310e789fa1f78898fcbf2b791cfed
SSDEEP 24576:bLJnJiTk3R3waE4JrOgIqsANA8KM7MNDlG+1UCM14F:bLJnJK8R304l4RADMzlUdS
TLSH
T1E015D07DC2E810E8D4B7C2B4815A1656BF31387D2B2169CB59B4D5313F22FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 583b99fcc50fd6e51142ca68f1f80f11996f1dfd0977cf5f801bd0c9a86ad714
MD5 793a1efe693f6cde12a31ea4ce812261
SHA1 c7e6a6a193e9bd90143062a268daa5fd57a1390b
SHA512 7cee5604579bf2967b507dd0ae316a994259f45db4bb86a149cac5ff0e57a827c37c85b4236969f31e4319e7bbb0843c7cb5ed66bfddd0787266a565ecdd0ed2
SSDEEP 49152:39mqCzDScAZmlvTcFg8Ph6LRADMzlUdS:rfDVS
TLSH
T1A9955C15F7EB5298E8B3CAF1C96294169B327C509B34F7DF0A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 258522d580074a15c55c0b520ef4f5a40099b27bb636aad608b85d8d38c136b8
MD5 9fa2f7f7794239a515ba061f1778eade
SHA1 21da5fc6ca279fa09d73f23ada3ccaf1bf58ac5f
SHA512 f42e3f2e844ef0cc37cea0f649cc3237c666014d5fd83c5c6abd888a56617c7125571af1917b0ea3085eb040e451d3614bd5159216afa1527dfd640fa084eb0d
SSDEEP 12288:7lYJeXm5nkEUuEVYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:7lYJeXm5jUuEVIqsANA8KM7MNDlG+1Uw
TLSH
T194E412AE26DC21F5D66E4278C9A24915F732F8B2170153EF41E0C53B4E7BAF65E39A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 a915611c22f31ef6a7dc6164bc76112d629349479af99dd1d155c08075ee163a
MD5 46fda8bec01d141510d1ac6886f07f0e
SHA1 12cc73a762fa9ae22abd45f0c70f20df34f53550
SHA512 1bed61679b6ae5aa700e6029edc53b1b61306c10a487cc8457cf408bea69569a26a3689a15614bab5b110adfabc5a6a611f04e1dd158468d14e60428d8ab1ab2
SSDEEP 12288:emu6kyHYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:e7tyHIqsANA8KM7MNDlG+1UCM14F
TLSH
T10AF4126613C016E8DAB90778CEA341656E32FC725F0082DF51E0FA3F1A76BE59931B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 7f28ce789dc7ea97a3d3a93bf39d69240be43adb3a20e6b705ca9731b58b3578
MD5 ba57c7f03fa38163367c54b51a32ec8c
SHA1 9660d777a205d1b9c49effc2e59808bee5dbf019
SHA512 b4270e7b8c61bc4c40184b7230c2e5e7e4cd745aab9c12a05a79e53397061d89e03e0788861e4bbf12a9506aac38c86ae0a0d4145d045198662acb462e63e0a0
SSDEEP 12288:5PmYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:9mIqsANA8KM7MNDlG+1UCM14F
TLSH
T1C2D423BF06C11BF9CF9907B48D6254163912FCB32B0450EB51E5ED3782BA9F78176A05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d961b0f4c1b2411b47a5398a8bc08c555055c434a4c3a7f9eac467d8cb05e8b2
MD5 2928665d20befb861e990fac4c26120d
SHA1 48cbbbe49d3026cbd53a413afd3c81e7e35e1bcd
SHA512 720c8c6ea6c40ccd9b84c2c69743f40ede7e88a62e73666dd9e215273f9f801ca31d145cba16e5b1888f21f37f232884531db39c811536e74b5e8cbc6f24c790
SSDEEP 24576:JC+TyQIu93VAumZr7jmNIqsANA8KM7MNDlG+1UCM14F:J/TfIq+Y6RADMzlUdS
TLSH
T13A558D1DA7E91DCAE276C675C8A34493EA33B872137186CF2044C07D499EEE9AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 52bfbee50d16888a73bb0f72a7cd1d574fc15f26467604af3f4119eefece140b
MD5 652d1284cab2c3eb19b49a1c375bea8b
SHA1 d10856554be40268d4d0327fc38fd5243f87657b
SHA512 de8d09fd19ecfae25229e3439d7acabfcfcfbf1db251bc0605a617f070e650a368e689f142b3b90802e2cf5e39884644ff2df3efda612b505c704c8b9c2ff844
SSDEEP 12288:qcyrWOstaa3kcsKYbqh+HgkgAtepnnoZM9lMRjOEZ/WJTJvbU1Ur/mM1z07SE:rLQikZKIqsANA8KM7MNDlG+1UCM14F
TLSH
T13FF4F11FB3AA00A5D5A7823C88954116FA73B871571263DF42E0C73A0BB75FABD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c44792bcf12ea79f0cb9e0b9bf901ca2c4ee9f633a40e5ffda3f35ce0fbce85a
MD5 c2126787799af4773da09706d3b75b42
SHA1 c04007097eaced59e382afdb257c311382da21f9
SHA512 047f0ec6abf763638963bcc131d817e51cd6d3166db9eb4fd845751ceff1d19a2bd15081fd967ea15b24b208ee5cc1cb2f50e2c48d011d8a854b738d1ed373b7
SSDEEP 49152:TpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPoRADMzlUdS:opC7b4+80GTk2DVS
TLSH
T16BA57C3DE2F810ADD9AA8375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/232-342-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/232-340-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/232-334-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/232-512-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1280-317-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1280-319-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/1280-508-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/1280-311-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1824-404-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1824-532-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1824-409-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1844-408-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1844-285-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1868-66-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1868-71-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1868-63-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1868-226-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1896-26-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1896-224-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1896-34-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1896-32-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1924-265-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/1924-256-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/1924-380-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/1924-259-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/2236-13-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2236-19-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2236-22-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2236-212-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2564-307-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2564-305-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2564-299-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2564-535-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2564-533-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2564-448-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3380-430-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3380-474-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3380-424-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3380-536-0x000000000B9F0000-0x000000000B9F8000-memory.dmp

Download

memory/3380-506-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3380-450-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3380-626-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3380-490-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3508-46-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3508-47-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3508-37-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3508-225-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3560-233-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3560-239-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3560-353-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3560-241-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3752-354-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/3752-513-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/3752-351-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3892-363-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3892-367-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3892-357-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3892-365-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3892-369-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4120-511-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4120-328-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4120-330-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4236-271-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4236-278-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4236-272-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4236-393-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4612-152-0x0000000000400000-0x0000000000D1D000-memory.dmp

Download

memory/4612-5-0x0000000002B80000-0x0000000002BE6000-memory.dmp

Download

memory/4612-11-0x0000000000400000-0x0000000000D1D000-memory.dmp

Download

memory/4612-0-0x0000000002B80000-0x0000000002BE6000-memory.dmp

Download

memory/4936-294-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4936-297-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4936-420-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4968-382-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4968-378-0x0000000000AF0000-0x0000000000B50000-memory.dmp

Download

memory/4968-372-0x0000000000AF0000-0x0000000000B50000-memory.dmp

Download

memory/4968-514-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5068-391-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5068-515-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5068-394-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5228-268-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5228-251-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/5228-244-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5228-245-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/5228-257-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/5340-418-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5340-449-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/5340-538-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/5436-525-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-517-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-521-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-520-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-519-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-523-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-527-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-528-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-529-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-531-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-530-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-522-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-526-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-518-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-524-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-516-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-539-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-540-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-542-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5436-541-0x000001C519F30000-0x000001C519F40000-memory.dmp

Download

memory/5972-49-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5972-56-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/5972-60-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/5972-69-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5972-50-0x0000000001570000-0x00000000015D0000-memory.dmp

Download