3dcd8458ac6771a3bd6615fce05a0bda1470e711cf90b7b1c6f795b9f0062f16

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe
Size 3.2MB
Sample260730-aevf1sha67
SHA256 3dcd8458ac6771a3bd6615fce05a0bda1470e711cf90b7b1c6f795b9f0062f16
MD5 5bd243418235c18aa709715cecd4c3cb
SHA1 d7901f2e7ec087d5930f855f5ff06495abfcdb18
SHA512 0a2a16f433a9e13e02476582695252e74c6b42233b5ccf57d4859873b37672eeb51b9d65611354618ff835f818fd2271d5e04358ca73fbc87f91124754818e84
SSDEEP 49152:WT5KdQcqomqoXu5nEMcSVr2sRSxT1MlzrXJhBHkLNiXicJFFRGNzj3:WTrv7q0/xjsnC7wRGpj3
TLSH
T1ABF5B032B782C0B5E9B301B2496EA75E146DBB64073449CFE3D41E1E6F306D26A3A717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3912	alg.exe
3112	DiagnosticsHub.StandardCollector.Service.exe
2688	elevation_service.exe
2952	elevation_service.exe
4764	fxssvc.exe
760	maintenanceservice.exe
3200	OSE.EXE
2472	msdtc.exe
1180	PerceptionSimulationService.exe
2948	perfhost.exe
4844	locator.exe
4604	SensorDataService.exe
3300	snmptrap.exe
2356	spectrum.exe
3688	ssh-agent.exe
3592	TieringEngineService.exe
2240	AgentService.exe
3936	vds.exe
4576	vssvc.exe
2436	wbengine.exe
3604	WmiApSrv.exe
1864	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d3e24c26a19fe9b3.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe9c57c6b71fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de3b60bfb71fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000471978c7b71fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b5e9ac6b71fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4fb97c6b71fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079feffc7b71fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d16267bfb71fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3112	DiagnosticsHub.StandardCollector.Service.exe
3112	DiagnosticsHub.StandardCollector.Service.exe
3112	DiagnosticsHub.StandardCollector.Service.exe
3112	DiagnosticsHub.StandardCollector.Service.exe
3112	DiagnosticsHub.StandardCollector.Service.exe
3112	DiagnosticsHub.StandardCollector.Service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5036	2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe
Token: SeAuditPrivilege	4764	fxssvc.exe
Token: SeDebugPrivilege	3112	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2688	elevation_service.exe
Token: SeRestorePrivilege	3592	TieringEngineService.exe
Token: SeManageVolumePrivilege	3592	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2240	AgentService.exe
Token: SeBackupPrivilege	4576	vssvc.exe
Token: SeRestorePrivilege	4576	vssvc.exe
Token: SeAuditPrivilege	4576	vssvc.exe
Token: SeBackupPrivilege	2436	wbengine.exe
Token: SeRestorePrivilege	2436	wbengine.exe
Token: SeSecurityPrivilege	2436	wbengine.exe
Token: 33	1864	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1864	SearchIndexer.exe
Token: SeDebugPrivilege	2688	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 732	1864	SearchIndexer.exe	124
PID 1864 wrote to memory of 3868	1864	SearchIndexer.exe	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_5bd243418235c18aa709715cecd4c3cb_darkgate_elex_glassworm_maze.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1472

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2952

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:760

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3200

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2472

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1180

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2948

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4844

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4604

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3300

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2356

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5040

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3936

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2436

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3604

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:732
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ae9770aebfedcc70e26dd6270c0d114bb985dc61995e222be578b53dbc31aea1
MD5 6647a0e1593a8c7f7299383af245f936
SHA1 8add6dcd42d21cdcf9d7755ad60f85696bb04765
SHA512 76ca97f61200be67946608d340b46dc963166d0d64075b54b3789981296469f4f837a5006108217146612a1a3ae60b78537e65d3248ff8aa9b07219feea4548f
SSDEEP 49152:sb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnsLNiXicJFFRGNzj3:W3q6mjBP7wRGpj3
TLSH
T125D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a433a3f3d4f45a115aca0b3af7ba738ce179db223583047e89ea9ed7919324df
MD5 79b0564d79f72d83848f3bc2f6892f27
SHA1 076c4d1bd4a95f663a2cabf3030bfa23f7c44f29
SHA512 ddf26bc7588e4830abdca287805de65df7d7068dd908f8005e00fe229bcc090b64f375d76417a3b08b2a0e06568d3d91ffc37e17896fc4821e9e0af86fcc2790
SSDEEP 24576:3XYfDtczAb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:itcGLNiXicJFFRGNzj3
TLSH
T14675012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 2f21f8d088f45eb1e48ca3f41cfb14222834923e712585e695817cb54e9422f4
MD5 5366d563f7e413bef5ba6cc3fc4a7fd8
SHA1 980fdd02b655c484230bfc090dd6ac4773e66551
SHA512 ab173c820fb76c86fa76b7a90bf39021e676895451d1badbc59c716e75bcc1bfec096a1229f7c4ed65b698e561a635afaacbdb26d08045d55cbad46db09c3234
SSDEEP 24576:o0Le5ji0hmxhrM0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oPji0AzRLNiXicJFFRGNzj3
TLSH
T14A859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fe6421241d8c8dc7fd1158087fa1851a7408bebb6e3585595f86348bd294d39f
MD5 8cfa4d03614eb1f66b5cc589684e454f
SHA1 9d980724b72efd08158d803f81eb32c08f4ac1bd
SHA512 2a919626884795fd9d9e60d13234cd3a0c779ca0f183af16413fd425bcb6a600565cba38b8949f0a82e25d28784e5697c9869e9c9c4da8d71fafd2ef7998123f
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWj6q8wyu2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:s/ezSC6vUzPv+Hjy9LNiXicJFFRGNzj3
TLSH
T12B756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4984073617117663f2f23fc95e836c2a57060e78a04d9a0102464b45742dc71f
MD5 0b58abd658f7d93bde4de1510e2797bd
SHA1 605ed65208aa217ebcb87f71d15203777c399815
SHA512 9d3d341101b6b8800e022398cef07d41c4a92f32b6a2439753701b0a6b5e939f707f4c6afc9c2497094cabd6ca80b162a2fb2ab0fc7867da31bddb6a2f140481
SSDEEP 24576:AVbqPb88hv/l+B//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AVO88hXl+xLNiXicJFFRGNzj3
TLSH
T1E8559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 74ba2547581379a05b7b9a6891b96bdadcd3033da34b9efd8b06c1acac26148f
MD5 703f389c6101815d8803f749357dfda3
SHA1 74ebe44891ae47884afc5ca97b336495c5caaf45
SHA512 2389810efcb2cf360eb19dd86c13e1e8979a9861cfa0c9b5eb8c322c01d92647e4d0966d3e464600a54e7c103c28a28f9abe2fbd1211b4a788ac961a36b5ef19
SSDEEP 24576:mG4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SLNiXicJFFRGNzj3
TLSH
T18B5523D3468864B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 e6e12f0adade79ac7d5574f705b71baf4facde72d34fd4de0baef73683b425fa
MD5 2a275318b51653a87d921fdfd8ff2f89
SHA1 966fa9c73a51525748497cf4eb13b5e35e4d5c65
SHA512 ce7b4e1508b7cb5a06ad770cfeda7488e0468192a4b52d166b56dcb155651a3cd70df25507f26722da51c3e1298a71cb12440c09ba2fc920e7cb4e260a8a289f
SSDEEP 24576:PJIUn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PJIUnLNiXicJFFRGNzj3
TLSH
T19F75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 93a2762187ddc8964d8c1e8d1aa70ce47b25378b71ac5b3a42a1a52a0cab0c0f
MD5 c58c312debad22473183fe9c9ff9590c
SHA1 ee7c1fd52d80d159f35016536288b36cd51217e2
SHA512 463200b6bd517cf54129bda7c96152fe87317878a6222828d903dd0f616d520f91b3177e997a91c62c19858efabaf5c678c059fe9ab5899d9e6835f811bbafc0
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THj:AQvGAdlCEL8c/WRNw5Cm7wRGpj3
TLSH
T162266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 c07be12e3d95b5e9a67e88ace67dd6e1ea182d6d8555f12ca5620921ede9cab7
MD5 c25ff5bd8b264cfa619295cc770b602d
SHA1 e40113efa364b6913bce951280d69389bdb89444
SHA512 72eb3307b4bd2826679ca3a3dcbd25105bfc689957f3689e4ca6e447983757d2f6fdd218ef89a10acb4a8c98c2fb8a85a44447f582cd1fcccdad1abf4cc5e1a7
SSDEEP 24576:ifewsAjB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YljBLNiXicJFFRGNzj3
TLSH
T12D75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d2d8d83712ee6cb26252ccf95715cabf5a1e03869ba209f3a6f98fe8b54edfa7
MD5 4eb2559940bf15957fc124cf8289dfe6
SHA1 1cdfb8f9c251b457603d67e334e5f7db5f19c47d
SHA512 5ed9a629b5170bdabdc47111d1fadb112a57fe19a3ee67b1c645a975ad169dbf5c5753e4c63356f85fc7c5a52c253ae80b8b345c4abebc41937141377f49b9a1
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHNF9:eUEtQevvqc2W1cpV20I32z9
TLSH
T193474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5bf0d255ce26867a1e222bd01ce269c949cd3bb52ff6a044ee6da11d7db99250
MD5 0748ec800c9451ef0b409ad47bd1dd1b
SHA1 ab34c6627b4d53161460b3d4d91c3a358a474b27
SHA512 c19a01e7275675edc9b71f47f2a07ef3dab82458c094b4560385eb8fe72c5d09683b490adec1223edeb5acdd0e566c0f82ea25e38a435a90a766b92caf67a00e
SSDEEP 49152:XCbRquA/m2yL5zLfFiV+XenmE3/zhLNiXicJFFRGNzj3:Aoq2Vjnmi7wRGpj3
TLSH
T114D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 366ad85222605cf2055fc86a3c7729d34a1d04f5c34c6d76e0b25124e9a84ccd
MD5 bf594d07c1a73519babcc99f6f5d3d23
SHA1 5e8d558e3c7a0b01f0f4cf95f59d82cb499ba35f
SHA512 b18d99e6f54579b87067635c16b729c625c9a61eed9813dfce6d9241f6473def26dcbf805c0856010e8910adbdd50ee7567d8d0933c264ee07ecddf1b8f1fac5
SSDEEP 24576:MAhGL6IFoiwtA5l7S53C/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MAM5Foiq5SLNiXicJFFRGNzj3
TLSH
T135359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 fd77a987c823d8e28aee404a5c4d9c194a7f40705e2ec73bccad934102958ff7
MD5 c62cf008664126c6ceda24dc5b4156f7
SHA1 82d5fb79e97a2f22898e25b09d168c37232ca8be
SHA512 692a336ef6db68958b231876642788028f9ea24c3834395aebac9ade0e4017f7dc4e2b447f3a41bd68b56addf16cc6fae257f7b80eb80b17e9e0e85707e75ca4
SSDEEP 24576:YwuROWd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YwSO+LNiXicJFFRGNzj3
TLSH
T1C365F18632941CF9EABA41398657C035F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2654c90f7ccbcf460e5675dc4d90b7d85362c155372ee22dfce5790aafcf279d
MD5 98713858080b6a814e780ba592a033ad
SHA1 056dd6ef3869f3e27d3beca6e4b09f0381673afa
SHA512 d8b2080df4a3ec69b1aee30c01f818bae87565a4fbc6f0f82b00ab8166e7827043e64842a34d44f9f6312cb5186d25bee7765aba07d9d3d3c9fe513ea2cde3f3
SSDEEP 24576:TZuc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lLNiXicJFFRGNzj3
TLSH
T1B755129622C420F5E2BB413DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e69d4c4d5652d199a53e45567e542af85d1d2d8b99c22fbbf1546f90d5ab0ed2
MD5 3b4d621568e9aca828868f6492cfe700
SHA1 19b11b71a515531bb793667ca078724ceefbe544
SHA512 ca7d761e2fcaa45a088a624dc7c8fb768ad06c39113206f592e98fd31edad553e578666aa312b5696ddda7b66b9d052428cbecbd1e1535f9e6cca82aa7e0dae8
SSDEEP 98304:NQRQyi36YOcPDLvw2gAf+PN3D7wRGpj3:kQyiKanX+PNnF9
TLSH
T1BD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c1e08c50590cb1127c549e7f12f640cee4958aaa7d09fd97ceec87b71c595f77
MD5 48bd27d0d972b0fedc9cc6799763b517
SHA1 455b480c180f0a63dd33730447869aff17dc8e6b
SHA512 22a89087a27a6ddcad35a70fba8cc1bf36f5693af1fb129a288c6218a789e15c19fabb401ab35fd9f48850146812864eeab3ca57142c534bc8953f9727265855
SSDEEP 98304:qQRQyi36YOcPDLvw2gAf+PN3D7wRGpj3:BQyiKanX+PNnF9
TLSH
T113667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1f22e81eb44832e4066e42e51de2aaa6b8d3cdc27a6e15318a5b7dc5e215b101
MD5 5828ba427b4d06f8895177ad549a9051
SHA1 12b4e4007eeed05483ae28e283f7ed2f6eacca9b
SHA512 052577fec44e5d45cdeeae6359c95ef9cce028d1f563a0c3f2d20cad539d2e37f00738aaeb4e26b9a884b70118a1b62dc47d78e17c22afa2d78edfcafadf68ec
SSDEEP 49152:C68Qg55nhkeWu7PNU3/RLNiXicJFFRGNzj3:AthTRc/R7wRGpj3
TLSH
T127B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bd2e6e3d42ee361ec21a0d82658efa464189e7e14a7ed9b8b544d25cd79e2fa4
MD5 027988ef571f1a0d7ad3f084d61a9753
SHA1 d9c98952102e05f2806db239ae349baf0672adeb
SHA512 ef0ff3eb7ad0207298266a6438ae31ff2ab38906a37d2b6227ba2f064510d17b2a7e0ded283542d77c0c89186bc3a952b1c5bbb05c09745417846e09b6aa01de
SSDEEP 98304:Ey5112gYy5azzVvU69nLKnhZ47wRGpj3:FLIHRWhOF9
TLSH
T1D6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b444963f27bd4e19799335728f6662785de2962ea8a3a7bb7468d6d2b0acbe9d
MD5 d2a072384db9542e6f65083263b292ab
SHA1 c6907f4ae33353cea6ad3af3d327b2181a395b4f
SHA512 4219c081fa4128090f4321641f68d95cd02ed661e151f628a84586a1d23fa53735b082e0f7d463969d06ac4c9546a11a4301d4cd7515616a65cebd47249c0a52
SSDEEP 49152:/B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glrLNiXicJFFRGNzj3:Bu6JmIxd2dr7wRGpj3
TLSH
T154D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 371561be9a987ca289d59ea5c6d69b4da595e3f3c6321dbad99e3de8879a5998
MD5 a66c8f2ba95a97681b66fe70352f7600
SHA1 339c40ee2563086f17b79b784eda40405e23757c
SHA512 a53aa746c93b962076563d507f6e0120792c1116ebfadae75ac78bcab863c3974c38a40434ab5d9d87370bb51f11a269889e240ff96072fe736c3ef28acf4d87
SSDEEP 49152:T1hpsNoJpF1A67U44CwH7R4xHLNiXicJFFRGNzj3:TmifPqRi7wRGpj3
TLSH
T1D1B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5cc8b22579439fbb36da102de8994d76c3c63ea8413fa414d6aa6593833fdaae
MD5 8f3722c145bcb73d0603da03afd08e1e
SHA1 0a4c5027e8956114f0179a1a08491aadb982962e
SHA512 7b636e48360577c9d1a60dba2de3f59f0858957078970de3ac09c564e550f50450cbc355cc242487aa6c9476844d0d06b989a53bafb3923610db35ea808a5461
SSDEEP 49152:hSuZQIY0Be2KkRVtOnks6NMHqcLNiXicJFFRGNzj3:v5dKqi61c7wRGpj3
TLSH
T129C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d93380235867f96d29d1de89d0beff4168778f614cf96312764ae12651b81dee
MD5 d58f370e78b5a5b3e80f9ac2f768e7eb
SHA1 fcd42943f7b9b7c80d5ea90f5a6c94b78b719a6c
SHA512 88a3b67b69b893b3c46e51140f438c60dfbf331d35ec8948fa70bb43d9ae8a9aa5f62bcfe2bf404bdf5c115df845bd7b2255cb0578981083dbe7f1a4b123aa8e
SSDEEP 49152:ahtSn8EApI0figjgiDn0AP5wbLNiXicJFFRGNzj3:bX2iWphe7wRGpj3
TLSH
T1C195BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1e6594ce840a9d6e92ae1d4e71601f33f8d20e55235645cb3137f8b2c8f0b173
MD5 23e07e1de6a7d6c2dc536251447d53e2
SHA1 8c213646093668c1f672a6db918ec32ba33a553d
SHA512 3f685ab2b3f6b1347e6bc50c5d8d93390092a609cceb511ba06b72e00c4ef4c94453db96677ee166f29e2c779f5d25f279f54b5aa41fb61b8fb97dddf7db6138
SSDEEP 12288:bWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1025523D3548955B1FAFC0039C6754428F5882E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 57209f101046e289017df9de4586956f3158b4bb1d5f5d6d22c9e6923f23a88e
MD5 8c2ccc47a3468ae96f4ad0720943be84
SHA1 e38ad3839e25606dc39752418cc8662259929cf5
SHA512 3bea88d93b185cf93b17069ae3c9752571958674dde3cc8e99a4d3923cf4f437421f4086d997c02b4c38c52d20cd5c362d082df6da754b853ca8b8d9f5843639
SSDEEP 12288:RJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:RV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B05523D3548955B2EBBC0039C6754428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1f6aa683bc1063ebae7faec5517959a72fdc183811b2bf705af7363aff1b8c38
MD5 ad7439aaed714301efe2b4e16dfe78e5
SHA1 8f16fac6e024b05e6bfa686f4f9c326b915dcdb9
SHA512 8913ecf94e8bc477fa41c99ac807161ee22d69577d69b5a2fd0e5d2ce842da66e5c07378d5e9f2737bf5410995a7370c5c6357d82cdee09fa262f13ddc12d8a6
SSDEEP 12288:bbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EC5523D3548955B1E6FC003AC6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 8f1a6ef5e4fbffb79722f0f24bf87eb74c96c5806523d6ff7998bbac4d2f2721
MD5 4f787aef0bbdc41814ad7e66a35562a5
SHA1 c7e9645d8ef9e256637bef0fb7ac689674904f59
SHA512 5ed345c0f0276ebca0ca91c3174da30c5d9592beed0997d11cd235679168f292c59ffa9365f780c30f412db9ffea7816e055279b569417ec408932bfd766dca1
SSDEEP 12288:2VwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CD552392168910F1E9FD8039C6764424F2A47D6CD7325AEBD3003D1E5A74FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 728d034cc3176714964f0e397ccfb36a9ac24c97bc237fadf32c3cf6a9003be9
MD5 28e9325c5b63ab9fefee783875936d2c
SHA1 8b9e85b4ce57159694c2f7d94971c6808b2dc32e
SHA512 9eeff6c81f0e01f67faa2024939f0b5a65ab1ba6ebf677c742519be7982a0c51bb8bc326c8e3d1683072f79c1908b2cb8ec1842c633a37fdcda260b259598959
SSDEEP 12288:vIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:v6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1525523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 93c3c0ede11355fdd597e93f9963133baad5b6e37e91e123999ac0f0f9fa9dc0
MD5 88a5a76878f45871d2e2ffffea6e19d7
SHA1 cd922c4644683d8a50407703d346c10945d54731
SHA512 9fb5466b975d0982f2fdaa4313a9499f65ce8f0081f27ebc52ae2d06c138423f7167bf4959bdbdcb06ec0155a8c7f909605922d658b82fa64557578f30fe2cae
SSDEEP 12288:BliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Bp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1235523D3548955B2E6BC0039C6754428F5882E2DEB5658E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 802c849a0f98ad340af8dfb1f0fe4ae206a0364b6b6a183f4da26a20ef938579
MD5 c014774e61ba345b4e9268c14aeaa568
SHA1 10cd33e3d3c5840ef0f3f4f5ecb277d3c47afdda
SHA512 31cb6ff6c734b964b65b282be9be36093f31e1f37ad7abb1580f452927596166bc37bf1bc239ecb46c23bb071e1dc5adcb0c9ee948c31ff863dc3a5ab4d0ea53
SSDEEP 12288:rBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A55523D3548955B1EBBC003986754428F5882E2DEB5659E3E2083D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 9bf8038adb14fa9728a4db4a3ef8fed4ffdd3a9445d8c2b9c795cb736cdc39cc
MD5 3d0f39c8e3b03a9a97c494249b43c238
SHA1 3e3ad32bf82888368c9909c86752217a96ca56cd
SHA512 ef23c9e8be6c2fd6729e24f33b9c4e2454a479559bccc724514bde15b1a7bb0fc74d4475569cd23ec68f167346bcccc5b4acda9c828c4cca591b0c294636341e
SSDEEP 24576:dZM3zFVSO1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dZM3zfZLNiXicJFFRGNzj3
TLSH
T16C750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8a42fda03cbec2f57d568c7bca7511f326ceb2ac4496b0c12afea4af25fccd52
MD5 59585045feaa6d20e90ca642c9f261ec
SHA1 a2016f95e5a7e6ff763d0fdb43098d3533221554
SHA512 f028ae6bf6462b3337b6ecfa2a465e2ab1ac9c7e1b53c679bf80cb3b24846f293d27936a453bcf7ec97833303ee0b9d2743c9490eb34af6d247c2c4205786e09
SSDEEP 12288:eKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:eM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C55523D3548955B1EAFC003986764428F5881E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 34a98714aa8ed864a9c6ab94c600814087e58fbc2a691cdbbad5acad63f4a05b
MD5 f8270d324929f52c459471f5abb3482b
SHA1 d4c959590a2281ac5415c19c5820a90178afa4dc
SHA512 9013f1217a430d2580b331de19f3623ee7d3d056e071b8106c95cd530aede41536ad03a5721b6074e6a41a22db5af0ade1a6620142118d0c8cea73d9e4e38da8
SSDEEP 12288:xeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1515523D3548955B1EBBC003986754428F5882E2DEB5659E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e002ee29dbee7ff561ac6dd44a30fc2c30299c2a0a236fb806dbff33bfb04450
MD5 1613b869430908b736ecaf622c99a2a2
SHA1 83cc0760adae0584ba0cb182c1ee90b79e9b581a
SHA512 e6cfc1864039076dd338bf49f7ef6b68fce8d8fbf4c9064f481a49dbaa10ad616258c616638f49c01a7c51b718939d05f933046dbea7d9122c92dfef9667d3e5
SSDEEP 24576:dzyx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:deLNiXicJFFRGNzj3
TLSH
T1C5650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 95e26a802486199f37f5d42c7ff5690a6844bd88eb6a7fc6a048281e92709530
MD5 fa166a8610f663068c12e3831d146553
SHA1 4a21b127f5c33933b8499161db2a04d0fea6cd58
SHA512 213ee03ba6c5be03704184d849966fc17647b68c729c6afdeacf9db136b68bff0c7fc811768f1556b8dc1fd2f048930c93647299db35de8f4519b10f2eaa77cd
SSDEEP 12288:HKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11B5523D3548955B1EABC003986754428F5882E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4d614296911187e24c6b962e312c6482343f29aec5b2ef8b3eb0d76a4a8574f9
MD5 5b20772551487e065f70ea6229331bb9
SHA1 cda88cf68c413113b45e55e73919a8ef266a89ae
SHA512 c14c3d401cbb1ecc1837e0ea93c8c293ed14f00ca55103d3b04a354771e1228ca83db7fd417f23a395092413dbb717d5cca8829ad2a3a39db71eb35aabab0987
SSDEEP 12288:9KiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1065523D3548955B1FBFC003986754428F5882E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 31706a230b72cce37405e0a94305266bd05645395fd97a52c50a9944edb10add
MD5 5d09dd60ef337f3f7a5e2bc54baf4bce
SHA1 a9e41af254b2a3825268e25908c7356d25aa27dc
SHA512 d478e2514a9ca8e7e367019e25203d8c109faa6f2b3e970d2f3a4c4d8ed36f9366b06c9dc0e7dfd4dcf342b7a790a822752af8a2cca52645743b67d8e7da7132
SSDEEP 24576:tzyx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:teLNiXicJFFRGNzj3
TLSH
T1F3650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 89342bf3c46657d8bcc8d6dc6891a99837ac138c765d4fdf9b4951be9faad25e
MD5 3a33bfa80a841f43798826d05cbee463
SHA1 efb37b2010722d604ce779f3ac0bff48308a4efd
SHA512 057841b5402a04883f5f9998e1a6d89c7aa51ab9bbca1c51c0e42222470b127915ea2fa10607055c5c460c80332d0c1f2db752eb98a1cf53fc374bff3da490e1
SSDEEP 24576:IT8aLl3z0zDf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IT7Llj2LNiXicJFFRGNzj3
TLSH
T12B7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 b6a760906feada024d52f61541c35e5d65c0749ffcd75687af52beb155b6da86
MD5 6568fa0f606349591350adf23fd88a1a
SHA1 45f7f9ad19dda8ee2153698fc3f7091e3e101f3f
SHA512 facc3e1eb84bb21b40fcb47672e17aef4132a95e8d42715078e4a9eda00d8c9787e5091e168d4436fe99d392eef4942aeb70b315a310ef6b8aa191dcc1118209
SSDEEP 24576:t3rd9CHKy7GZj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Nrd9CHKyaZLNiXicJFFRGNzj3
TLSH
T18585CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 69909cc4e9883098997ff9d75ef2c7d3b8ca71eccb90b0abf5ff68956bf640f9
MD5 b6105107ef03d6284bc9d54530e76d28
SHA1 fa62929356cddd05c15a3e383f46651a75bd46a4
SHA512 5572f3191a8e29a6a5b8e84e385f5de8616d3cbfcb4efc2f3973ef14c8b1b72550760209a983a0f0e5d8ea134b2c3311580d7eb046ae90c28d11b481e49f7f27
SSDEEP 12288:27iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E95523D3548955B1FABC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 43624268d5cb573e9126faa00db0fdd6e055f815b5b2921a43fda3da9a39a2be
MD5 643d8540f55e668369d89cf7606e503e
SHA1 4c8e70d7361eb60705ad99308c3699a33fec2285
SHA512 25ee9471f17068c27b927ab9814d6ecc9adcdd946bfcd8e373114eafc890be9744c727285a2cda3554e12e4414d02e04226e379d034078a7ac6ea96712dbe43d
SSDEEP 12288:QNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C55523D2558955F1F6BC003986764428F5882E2DEB5619E3E2483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e69407e6823e9121faeee667851e07f30174493f7000a3b5f8cb7c57a95f1488
MD5 f97af0f5a7abbca1b81a52f76c68eebe
SHA1 061cfcaac93e43f43f1b89a66e3e0c8e44862302
SHA512 e1e8b5824ad42ba476a39899629c870ca30f38048d409f282751802c2c433896e6b0ae9c3fc566023d2877b36ff2c7c30219dd37407ccf19cf43d7e3aceb834b
SSDEEP 12288:KEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1215523D3548955B1EAFC003986754428F5882E2DEB5658E3E2483D1EE23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 994daf5614f29328fa03bc7c10b00f6c9f05f521061ef9a7590059e573667f92
MD5 23fcb3d05087185878ad24295f2afc6e
SHA1 d65765fce53665b942f51d2ced4c4ba10b5a8cc5
SHA512 6764facf5c26370945e282f6cb10cde7be2854cdff8bbd86f246d806333825552de22bd20a4ceff5c585761a52cc6cb01e049281d49251542d66926d2261419a
SSDEEP 12288:zpsf6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0c/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15E65F15AD28802E8D1AE5139C7564900F3633C2987E1D3CB92D0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dcc102cb9af92ee68901855b3e71fc2f61953a068191f8e0ede08946a9081c6b
MD5 7e0a0836f865ebbe04e9ce548d23e349
SHA1 a30f9c692fc97325eb97b107feddf7025d7759af
SHA512 cafc8fe2b20b1066ab56db53e00de22d149ec3b3dc1404efa1bfd053ae4b0d6cb27ce85af78d210fe3d9caa893130f4d71897a1de47276aa4ee11108ecbd20a9
SSDEEP 12288:SLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Sf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16A552393568C55A2F6FD103986368438B54D7E2C9F5598D3E2043A1EA238FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5974077050ea1c22d5a1f41c1ef72c135fe1d9aae3c8fed07713f26c935b82d8
MD5 7850fe4efc97e427865490db0c99675c
SHA1 39ab29328faabafbdd3ddf635198cb8b8efe7854
SHA512 5ffc597f19a4844e203197e5c67d34c7387e16936701a523eb18988c5740030f46aea2b8c1ac8a4f9b13979afb0b0a28c18c33a3c665763207ddf54489a64282
SSDEEP 49152:pa0h2GEkuAe73q3pp46zwwQ1LNiXicJFFRGNzj3:pa0hNYG4JwO7wRGpj3
TLSH
T1E085AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 d712ad36694e10ca292bac39ca468fb8fb260cfd6c9051a840628da896e3fa09
MD5 22d538d831f88e2f0668df4d6114f461
SHA1 b20a351023351e21b88641d831322a37c7896631
SHA512 21d9d45c5ed71823c68eab8b42fb5fffe650473a5b3393a739025db3916bacdc248102a8e6dec9950b8b9ae695b497407ef421535a317939442f54102166a30c
SSDEEP 24576:LhbHjPd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LhbHjlLNiXicJFFRGNzj3
TLSH
T15C5512BE129C20E5F6B5903D85668409E370BC29172197EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 af5f718dd30505bf56e30eaea5a03a9216523ebc65b80744b881dbe2eaadab5e
MD5 2f64fb46fded11e16aff8e4baefe465b
SHA1 08f7ee53a4ac54c8a23cb7fa6d496e7bf2c41404
SHA512 9ddcad3e01c9ddce41bd9aa72693b0d46accec63fd5fef561449c06cd534c9c6a5017f3f63423363fd60a3c35f5d9448809e9e4e875556e3cac9801f3a745e24
SSDEEP 12288:S3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F25523D2518955B1EAFD003D86764428B5842F2C9B2619E3E1543D1EA27CFEFCF38563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 34877c7dc0521169208b9b9ecbbcd112e81de3cc35a7bff0d082530f7249d8e6
MD5 753097945a7836b59454f98511abfedb
SHA1 a63f103b30cdf9a79976f2988926c11da839f507
SHA512 0cf4749fbda6e318e965db76b01f863f2af0a58f8b03a79639e032d421d30d5870f4f74f13d27f88c029b3c9c49042c5458be6764ec19a6ecd82e35a9cfff033
SSDEEP 24576:pAL3UTA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pAL3UULNiXicJFFRGNzj3
TLSH
T141750155E79400F5E97B813CC9728916E2B2785D0364E7DB03A84B6A1F237E68F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 ed90f664b942d0d5389abf15482fbecf163cf6b8a3fdd13a712d222753a89055
MD5 9f63b2b43af560ff2c97960811ba2075
SHA1 07d9058f6033cc28ebb5eb46e0ed8f14fe0582a1
SHA512 b506a696698ac1fd9a4c511a961e2d2b531034f8490f1ee609fdab33505f47bb88efac8849cebe4af4ed4bb1a7d0ecb1abf2a556662e27f4b30fe91ab9281e85
SSDEEP 24576:QO0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QO0LNiXicJFFRGNzj3
TLSH
T16855126A32DC10F4E579503D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6f623fa39cb0f57b789cd3b65c884a3cf76fbf11aeb380f37946d6822fbed2ce
MD5 4ae2287d2ceee366c8c2c3f92a65385a
SHA1 016a53d394159c319048cb474668f8d6310e02f0
SHA512 ffcfc787d440da9ee7612f7bb3b080602a1b74303914b18801d4f52c60f8dffa1371eab7db6d7f7b2166df23a06786385b1b5eb331d55d0e6121610753988039
SSDEEP 24576:m7NM9YqZqmWMUkPjZM48Mv6bEhsv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:m7cBWMpPjN8DbEhiLNiXicJFFRGNzj3
TLSH
T16465AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 77805cefc28955db4f1e352e788bdcc08ea67399326a862f719f607f4469a4ae
MD5 93a90dae1f82cb08122a34ab42de7486
SHA1 2e4fc5e17391e3f465010850226295292750882d
SHA512 cb45ad667d1425eb25a297a6350a79fe4c47c5f014efd946837e505e41fc0c1b952f193a72c0a7c298beaad5bc3dc019edd4304297eebc4b06de3ea6ee82f9cf
SSDEEP 49152:mF2YuHNETovAvNYf8kmPLNiXicJFFRGNzj3:n6BCf8k07wRGpj3
TLSH
T1E4858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 b8aee2fa8c18c11a208b844824580ef9beed09a04a7d4975a3f2975c28cdd8e1
MD5 8b6634ad6a2b4b14b6ee70b0e2e8ea97
SHA1 b7a666da2ef72019bac5ab5ac8d72ec8db14992f
SHA512 ec350663393242bf631735763144618a2e42472a94404d15c52e504397c0e220db317debf19cbb1d1d48ee0ff2639215664919917d7e1028e8166c069f77a18f
SSDEEP 24576:+AFs06+Omlf8NXEbTo4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3Fs060loXuVLNiXicJFFRGNzj3
TLSH
T10065BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 09910982955529ab676a70aab849f45cde4fa2f63912e8d87ff9a951e6f329a1
MD5 c3865b8b8c1024b6b90fdcda95f0ab83
SHA1 1d51df93de7587a4fcfa5dc812a46e86358c481e
SHA512 139b77cfc3751e48fca5f973804788d2db7cb52084f683e0546210e705a07d7580790750c46d7243ea74c98a1c2ca674f901b9119a2322248a4a84ec98ba9f7f
SSDEEP 24576:GJnJ5D3WXV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GJnJ5DGXVLNiXicJFFRGNzj3
TLSH
T15D75D02DD29810F4E4B7C274825A1A55FE72383D2F2269C724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e3fc00dbab95a3596942f1ee6a34bfea726d9816fc96bd7e284b864163de4d56
MD5 ab389e101199b2b4e8d9244cd3bd435a
SHA1 a31f1659758bd3dca83758eec9bab01f3d854137
SHA512 be7daab90500b3bf1d810455881fb1f0be7c89343a4e5fd1e0ad95847f031072c3b19589051242354064c52d67bc1ab30aa9742d0d6fd1ec0bdc2dd824524e31
SSDEEP 49152:Qg06DIKdwc+eQnSt65aVbLNiXicJFFRGNzj3:xx7wRGpj3
TLSH
T149956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 16680dbf0e868d6b227e1482cc5eeb0293383082e898ce7b98d5dee44b168970
MD5 f137ef9e8f6bba110f8428f016444d5b
SHA1 04093ffc12f4ecb0b613a686d3b9f1c6d11bb139
SHA512 15f9ee6d012b628445cb41552725b07f76b04914d0ec351fb48a39d868eb22b6323ed14bd49a0fb09d7efe9128b574684c3dde2279407531139eedbb53b1a2fe
SSDEEP 24576:Jni/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JniLNiXicJFFRGNzj3
TLSH
T10A5512AE278C70E5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 6ddae8e4953c1fed544ae77eb9f17e9e667dadc12641c798c812e42f1781751c
MD5 3e434915b700935c8b9b47ce2f34049b
SHA1 98452052a2bc903f124dad21e9c6b3b0bb73cc65
SHA512 e3b394c2a4978e934489ef45d5ae65cad46bc65b5710302d27874f5bb5aa13d99e779d6340961152c2de918b5503797c9ceb82147bd75f3ecd9f8e3fdad5a74d
SSDEEP 24576:OIyy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OIlLNiXicJFFRGNzj3
TLSH
T15F65124553C860E5E6B9013CCA774064AA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 ff268757a35bdc4036776600aed4668ff77407c891d6b803529e834d72653333
MD5 8b9f1a4a781b31cceb6892852766b17c
SHA1 ebfa2d7ac56d2175bbf98116051955926f33a811
SHA512 de87a2391a61875e8daa167236f905833f2fa55a6329c84875e759296d93e80c0e9eda78c0bc56375a65f09a71cc12b831ca133009e0b989fc1ee0c495e8fad9
SSDEEP 12288:7yiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DF55239A118964F1EABD003D86354828B1943E3C9B1628F7A1947D3ED339FDBDF38952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 137c66e04f9daa3d51bba6461dd1588868013ee1b2c04f7ae87f6c543e4afaf5
MD5 4775a7d0c928a0ee054268604544bbc5
SHA1 64d8b1be40e4375c88b8c6fdfad646ac8a859f52
SHA512 4881af341fc7e3877c64affd0dec7d391c2ad1e535bd411af0f83bd19589d9f71ab711baeb9e8081bc3df2da5da5de552bccc3222a0b3c37db9fad42116ec71f
SSDEEP 24576:9Q9MxZKdcz9dw3n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9VKZnLNiXicJFFRGNzj3
TLSH
T1D9558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 1bd5fb8fabaa9216081160827f5e9a3871d76a2fa92b4e7b06359b5413ad2c73
MD5 0a6f8b04dfb1730c0711ac7b8818d317
SHA1 52c4b633322d28dee54cfe6852b12d024cdc9bdb
SHA512 3ea139180554aaa21e05c6bf7857174dccbc97c72921ebfee922b79d4874b9522d5b9c3ad5c08ed0c56ef2cb6810f5122ee47ccfde056cc31d16cbe093bff546
SSDEEP 24576:ayocDApm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nocDApmLNiXicJFFRGNzj3
TLSH
T16265E01FB76D40A2E176813C89858204E7B3B4345B6257DB6191C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 70d7537dcf39de9695243c383eaffe10b3e41612815a7885a13097c669401943
MD5 1497805731fbf455fb64fcc443deb39d
SHA1 b4f10fea1eab2f2b540fa68452632666fda85cff
SHA512 5ab4b52302007bdcb94f3cce1e00788eca85dc920be73b6a6eff10f6d05640a01e13b4ab05dffbf4125e241836837f97a0f73e7c5761fb233953cfa126514000
SSDEEP 49152:NWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKmLNiXicJFFRGNzj3:t0zuNIA7wRGpj3
TLSH
T1C1A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5573cd5ba76402ea4f7bbdc4602888aef201bc79beee3ccd27e2297e33450450
MD5 5f8f9c3d409b8cab87f6a623024924eb
SHA1 d4a03d8128c73fd49a97ba7045dcbf7286e16a95
SHA512 d833a7c986fec29f36d8119ea2fa9221e3b7bb640004f30bc010d75d14667457d94e2fc411be3abcc2716b6adb06edfa4f1d9ac6d40f35346e03fc78b674fa27
SSDEEP 24576:M1QT7EcpfxR+N5AWAz3ooiYzjMqbi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RTDxR+N5YzTBjMnLNiXicJFFRGNzj3
TLSH
T1DC55B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 57f4853e101d6b1677857eb3fbd0381912b716909b3838a2bff9cead31689f1c
MD5 229611057277a5addda463470e8e30b5
SHA1 66526eb4f09b0dffbeb3aea24167d6e5159425c2
SHA512 84684c773eb8f5538eccf4454cbe84d2cfb9dbf69e31e28790b1c586581637a76d750268fa72f98f7d4359526b2af6bb9bd625ea5cc14b8e82d91b107e720a8c
SSDEEP 24576:Y3YgnJcRTk4yti+R5dBR/V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YIgnaTk46pBR/VLNiXicJFFRGNzj3
TLSH
T18845B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-207-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/760-65-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/760-71-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/760-75-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1180-319-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/1180-252-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1180-260-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/1180-258-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1864-372-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/1864-432-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1864-333-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1864-388-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/1864-404-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2240-312-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2240-413-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2356-287-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2356-410-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2356-293-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2356-286-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2436-328-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2472-315-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2472-248-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2688-50-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2688-41-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2688-49-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2688-239-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2948-272-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/2948-266-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/2948-324-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2948-271-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2952-64-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2952-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2952-240-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2952-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3112-21-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3112-15-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3112-25-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/3200-78-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3200-208-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3200-84-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3300-284-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3300-406-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3592-309-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/3592-412-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/3604-331-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3688-299-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3688-411-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3688-305-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3688-298-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3868-418-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-448-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-452-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-453-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-454-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-458-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-459-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-460-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-455-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-456-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-457-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-442-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-443-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-414-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-415-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-416-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-417-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-419-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-444-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-420-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-429-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-428-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-427-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-426-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-425-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-424-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-423-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-422-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-421-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-445-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-447-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-449-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-433-0x0000018DE8A70000-0x0000018DE8C89000-memory.dmp

Download

memory/3868-436-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-437-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-438-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-441-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-440-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-439-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-446-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-451-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3868-450-0x0000018DE7EB0000-0x0000018DE7EC0000-memory.dmp

Download

memory/3912-24-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3912-238-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3936-316-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3936-430-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4576-320-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4576-431-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4604-407-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4604-280-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4604-332-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4764-94-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4844-329-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4844-276-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/5036-1-0x00000000025D0000-0x0000000002636000-memory.dmp

Download

memory/5036-8-0x00000000025D0000-0x0000000002636000-memory.dmp

Download

memory/5036-38-0x0000000000400000-0x0000000000740000-memory.dmp

Download

memory/5036-0-0x0000000000400000-0x0000000000740000-memory.dmp

Download