656366b2255eace0ab30666b6ef785c168d47aa40d4663c1ac171f3476a827a2

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
Size 7.8MB
Sample260816-kffdlatxcs
SHA256 656366b2255eace0ab30666b6ef785c168d47aa40d4663c1ac171f3476a827a2
MD5 16786d3881691932c5afcaf77b6ed66c
SHA1 8002d556b39a21085e14b14eccc9ceff93a46743
SHA512 b200981fb2c1cb24d001b95463efc65fbfa8ebbea75251b1820a322723678ce463f21f08f73ad88df043d8041369025f9d3eb22873a27a92c3c5e1a3e5bbfbe1
SSDEEP 98304:dDNC89EF0yd7wyYnVz02/ZZmbZFu7dXfrLTI4O6xcsPTfPSE:dDNCQMrdxB2/XmbZ8d8fDeTi
TLSH
T14986094162D58064F1B22675697A2AB1467B7D215F38C8CFB68C6D1D0BB36D2E830F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
960	elevation_service.exe
5908	elevation_service.exe
1796	maintenanceservice.exe
5832	OSE.EXE
3920	PerceptionSimulationService.exe
1316	perfhost.exe
2360	ReFsDedupSvc.exe
3312	SensorDataService.exe
2644	ssh-agent.exe
5736	AgentService.exe
3164	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a85f1f81e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe = "11001"	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2271ddd592ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad430e165a2ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6fe94d9592ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c83ea6d9592ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c03bbdd8592ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e62e5155a2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
960	elevation_service.exe
960	elevation_service.exe
960	elevation_service.exe
960	elevation_service.exe
960	elevation_service.exe
960	elevation_service.exe
960	elevation_service.exe
5908	elevation_service.exe
5908	elevation_service.exe
5908	elevation_service.exe
5908	elevation_service.exe
5908	elevation_service.exe
5908	elevation_service.exe
5908	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5516	2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
Token: SeBackupPrivilege	2360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2360	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5736	AgentService.exe
Token: 33	3164	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeDebugPrivilege	960	elevation_service.exe
Token: SeDebugPrivilege	5908	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 4720	3164	SearchIndexer.exe	100
PID 3164 wrote to memory of 2368	3164	SearchIndexer.exe	101
PID 3164 wrote to memory of 3788	3164	SearchIndexer.exe	103
PID 3164 wrote to memory of 1540	3164	SearchIndexer.exe	104
PID 3164 wrote to memory of 992	3164	SearchIndexer.exe	105
PID 3164 wrote to memory of 1508	3164	SearchIndexer.exe	106
PID 3164 wrote to memory of 4460	3164	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_16786d3881691932c5afcaf77b6ed66c_amadey_avoslocker_darkgate_elex_glassworm_luca-stealer_l.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:5516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5908

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1796

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5832

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3920

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1316

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3312

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2644

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5736

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4720
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2368
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 3052 3068 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3788
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 3024 3032 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1540
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 3024 3032 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 3052 3068 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5bbd54a48f3c41b83137945133fb6521814c65a2f36724eeae5878194d3a4f61
MD5 26d08c2a46abb5bcfe294067433a288e
SHA1 fae1aacbfb82d91da770d010f301ed20791790e7
SHA512 1a3aee93f0135aad3da70ae23e8c2035cfaa149ef63df053a5eb9694657106dc3ff6cf7bb9940bf0713f2de31614f0764eaeac9d969fe6d0dc402d7085ecadaf
SSDEEP 49152:db+632BuPkFKRrdE6ohrstBhuXjfS4LWxnTsPTfPvviE8X:j3q60jBMsPTfPSE
TLSH
T1FDD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 c3cc2115765d5d1c5588a360deacc5ed7373d1d8c33b3fb4f4909a6b9ab4eb22
MD5 7819d76d7e2e738fa866aabeb6517a1d
SHA1 1572596e4d1710e034f4fc0666a788ffce34347f
SHA512 b77ce967fbf75992ccf00bd0b3ee45c6a700847afebe1f7588f3dc059e161b76d9d39f4c8f97b4efca73303f655db3edeb1647742bbba029327a082297044bd1
SSDEEP 24576:wXYfDtczAIsX/IhEIEVpJLPeeviE8XKS:HtcJsPTfPvviE8X
TLSH
T12005F12D73E409F8EC67823DC8E28502EA32B8558760E69B03E4D9655F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 9faf27b6981adb25b83722f072c0a8bebdb8ce381d9c6af9936360a18e5d2152
MD5 53fbf13c4f02a7d8bd4b8ec4e0503e28
SHA1 221cf38e17a5ba9f0d7fc378338716a95cb505f8
SHA512 11e3e3600fec7cef2b66973ffa8b2f6c33953993783390940b8b2470f217bb8616dd3610d3c783db3017e00c4d6b088d7da13249fd46c70e4dedd15055d04724
SSDEEP 24576:50Le5ji0hmxNrMLsX/IhEIEVpJLPeeviE8XKS:5Pji0A7ysPTfPvviE8X
TLSH
T137359E1AF6748335D073C0B9C5D2A68AED7130865B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 824fcc5f5fcab14eea8adc0eb1840b974b4e91791b0930c683f4c4d5badb422d
MD5 42b302aeed13501b49ccb9d11a1d720a
SHA1 322fe87d18dcf13de13a460c25052ded80eb14eb
SHA512 8ea6e4253e169be9ff199024f60b127577e49761b1a8782b6f220aea719e30c5b25267abad0906e6c36b378280d764417896be8e55606f189bda600ef132c311
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWr6q8wyuZsX/IhEIEVpJLPeeviE8XKS:T/ezSC6vUzPviHjyesPTfPvviE8X
TLSH
T132755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2c54b047688de27a35bfbb636922b87a9d1fcc1fa02362b21bd7da8893bdf794
MD5 ab678e550e3ccf1fb38509f35d3ce25c
SHA1 faf49402d9dc9d9f0e609cf4857edc82445ae6f5
SHA512 9bf80b7571a0f6f7910f5676edad8c6cb8be9412f9d4305c924841e895c7ab74a4bc507baf25ef6787a8ce4b4ec8afecbb0ba31c9b29c8205bab5ac9e820f039
SSDEEP 24576:rVbqPb88hv/l+bcsX/IhEIEVpJLPeeviE8XKS:rVO88hXl+QsPTfPvviE8X
TLSH
T19E559F66F5B48331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 023224a814b91ca86f845970f6d131842c724ff96eb7c9ef9c7d9325c0ed0f1f
MD5 16d66f260bf94a762e75ebb1421b6648
SHA1 35e1466e55970369dd7b48bb894e8fa7709ad18a
SHA512 28c21028fe692c59671e4b96026d912550137d9be82ea57fe30fea7ac09473982a453dcd537fc5b42ee75b76805ce4d0e0fdfb14c7eb0146633e6a320da7e43b
SSDEEP 12288:xj4V7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6hZ:xjfsX/IhEIEVpJLPeeviE8XKSd
TLSH
T18DC4239F66E831A4F256CF3A44E166C72E3C8C54CA506127CBA0FB69D8FC6B7E641113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 53bd3e9467112bfc76ce8d147236fbe7d20cfa91c7f7567c049283486526ba79
MD5 587153de1d6916b64b5d4c94211a36a5
SHA1 0dab420540204a78b5bebf47590920e27c21df3d
SHA512 5b4cda63b68cdb3a7ec73a827f262c864f7fbd97aba1d7377171a65cb785ca0f9eac6b562f5782f55aae6ac21849807a9df0f67cc17bfd2589808b9415c727e2
SSDEEP 12288:NeBNUbTVO86UtV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:NJIUUsX/IhEIEVpJLPeeviE8XKS
TLSH
T12405CF7BAE28FCE1C27A8D795A918640977278308F61A3CBD264C30EDE235E15E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 12e6eca3f2c04257238c9f95d7eabe104a9b1a4c2f6fc570f6e3aba3fbc412b9
MD5 74975b7a42c78735bf93e41069354708
SHA1 dbe1df2a380461d25c0ee8b177016a59457a9709
SHA512 2cb0f476f50e8922cfc16364efe75b27e2486be8cbab953c24eae0a1199a94d04b776ec04b51af42c1043a7ab438f98826dc0bfcf8d85d986d8615d5d90bc49f
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THe:xQvGAdlCEL8c/RRNw5CpsPTfPSE
TLSH
T1D7266D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 780d01616962ad5a6c9c36dc3eeb1e75ccd1adcaf6a2773a67d448557960e585
MD5 cd285494b2b811373033f85b2f0a2555
SHA1 9f8a488f284632a4732ece44ea33fa2b8b1da02a
SHA512 e133fdd63be5c767b8b09aa53e961e3fa637834885ee5d675b57181cff1e59bf2389797a8887194962a1f324604b4373720babf91feeea6590c4480b9b4e97d1
SSDEEP 12288:HAwSfxL/2Dc3DDLLmt0LDQewsAjXV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEfu:gSewsAjCsX/IhEIEVpJLPeeviE8XKS
TLSH
T15415E031FE74E036D27B0DB61B76D706183CA9204F6129C3E3E89E9D99742D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 545bc3695a334732c870c5917882abc82917d68b2c9efb8e69b5f128ae69ab71
MD5 50e79725ff79551e4ea7a01c23e214f7
SHA1 44505d1ddf7f61de877a76e334a88d77adc7b788
SHA512 66151144679d022d6696400bc24872edd90e869c8679cdba2a451e42fda96ed5e86e30081c95373b08a414aa1d296636ddcbf70be9f27f5ceef6c9c2712aa2d9
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHKeTi:4UEtQevvqc2W1cpV2RI32K2
TLSH
T1B5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 399925f6b7011e1bf58a91ba50252b1c9766990dd9fae660780c4afd071ae96a
MD5 8407335de1c7a7dd865af5e12c8edb30
SHA1 a7361e1b6d2e52939e38f3ca965ae7dd498f058c
SHA512 1486b5fab0ef8adf91e8b6b50bc5dac50f071b239b5bf3ddae0ea9bab7fe49b74268c4e9e9e265821dd2714cc89c9be5bc44538a1f0d0e8e13e18d6da25b7334
SSDEEP 49152:hCbRquA/m2yL5zTfFiV+XenmE3/zisPTfPvviE8X:OoquVjnmVsPTfPSE
TLSH
T127D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1e9ccdc8ab9a22d5803e7390294647ac3e0bb00cc46a2d08b5f2aa02bd92880e
MD5 36fbf4cac91bfd1958122d1a75f8e750
SHA1 d8c9ca821cec9dbf6d4e103217c08478bd28e020
SHA512 0b24a930acd97ed168c3db22e9316b0c0e81beb564de2a438635d085a22c345b717a125f3144554a0c2059e3abdcace58780516a16364b2f99e67e9142355634
SSDEEP 24576:qAhGL2IFoiwtA5l7S531sX/IhEIEVpJLPeeviE8XKS:qAM1Foiq5lsPTfPvviE8X
TLSH
T14A359D81E7F955D4F5B3AB7899B68171EA76BCA65E30C20F2260D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 b07f32ee41afda62da636b69cee51ef9dab12209fc7f16992c72a31b2a201912
MD5 e56e779515c5e4205ff86000f646fadb
SHA1 0c65d89d7823e3de46c56d8410dc16eab879b337
SHA512 bdcc2c6f9e5e12ac44dad8558e3e2bad48f42cb2830c44b08ee425552ab18f8a64ff9a401dfbb87c1eef38ca1d55c5a54586533fdd217bcc680420972d26483d
SSDEEP 12288:jmw5HEjsChNSBFgl0WDm+C2V7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKa1:iwuXOW+sX/IhEIEVpJLPeeviE8XKS
TLSH
T1FF05F14A36E81CF8F56786398597C136FBB2BC012A21D71F47A0C65B9F37361AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 89c73001be5c676ec1d5ac5d3dae0dc4c6b00d0e7bfeb611f713560baeb6f3f0
MD5 10940228d7e7b9d03138a9d9131e3fac
SHA1 0352404177ea175c7ce12c59f72c27153e964f20
SHA512 5fbd98ef12959725908233058ea0338ce2a265b1f9bbb43f32fd06829b8a65153500ee128a540f95343530b16f461677450b883f00c74bf0775a7be500bd53aa
SSDEEP 12288:x/Z1IyHV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:pZujsX/IhEIEVpJLPeeviE8XKS
TLSH
T16BE4128E33E830F4F1A3873DC8E14686AB357852973153CF476096699F76AD25E35322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7c3493c3461c169e48b9df9eb8a1d2a609dcc427a086fc518477e1c7e84ee8f0
MD5 b72d1ae5188f67d99e2890a49647218f
SHA1 082635c33a492e9997c9490605285a7885899ae4
SHA512 10276a7c9af74aa35515f3d9143468c004bceeea25891a67f7ef56fd84d7d3a0df4427cce0fa8b6f7fd785b1cae2142952bb8878ff8f1f92165e9f6cbf92e10b
SSDEEP 98304:LQRQyi36YOcPhLvw2gAf+PN3gsPTfPSE:6QyiKahX+PNQeTi
TLSH
T1C6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bb5f6b2929a90159119bac44041f0fe749722a4fcc841fa9d0fec9b549e2b216
MD5 e5dad0cc526a2df112e3232efa876d11
SHA1 20412f31b1705cf32615e669fe0e3c4f01851ad6
SHA512 6e5f2bd47789ef0af435519c1c56caf7e875d3dadd80cd23d5fb11becbef5c144f55f368c6a756ed8559654529513db2ba261ff05000f377b6bb3d66663a239d
SSDEEP 98304:6QRQyi36YOcPhLvw2gAf+PN3gsPTfPSE:xQyiKahX+PNQeTi
TLSH
T108667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4996a6ee5dfeeae786e0da12a9bd8454d8d6ea053cdaac5049a9ffb3dc1a469c
MD5 2f853636e17e002ea2430d4aa21dcf83
SHA1 8c51a4c1bf1a13d9fe2e2760fc4e467a8953c535
SHA512 509063457d3c1aaa41c100e6a7c99aaa19bb1ae624bd5c7d817e649c78f7377f26481e4e25f9578116b2a277c2556e20be2f6121dc296b902daf2601dd7300a2
SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0TsX/IhEIEVpJLP2:568Qg55nhceWu7PNU3/ysPTfPvviE8X
TLSH
T1BAB55A33B2F600A9D44DE1769F4A872196D17C71CFE0E3DB861172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 66c0ec21be64ddc95b1dec61bff61759359994ab668bb09d7efb183c6a82d51b
MD5 95f0b7f7a50a5d3465bb5c0cb9f8b027
SHA1 6b26c2ed34b1ad9dcc60fd93f18e0480ae5f12ee
SHA512 6ccb39de7e11f2c8625128166d73201042995bbe712b2766f2fe9d4142f78ba53a669face92debbe15423f0a1baead4eac9c2e79b1c13951b6ba97107c7dddb1
SSDEEP 98304:My5112gYy5azzVva69nLKnhZfsPTfPSE:NLIHjWhdeTi
TLSH
T1CC167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 39fe55d5bd9b282b5bdaf282bb2a382c89a86a6fd6148565838e552ff2bfff0c
MD5 0037d6766b3af1ed75b13be7afdfc876
SHA1 af90ef0129f670be2e06771a86aad6e5235ce3ee
SHA512 622c3cfe710888ef0fad2cedc4b431e352a2059c5edb4eaf01fc33d74d878f1c4f8a64e0b50a5efac399a05a4d4e3b6e63ddf985c3060af63d92a8c02a69848a
SSDEEP 49152:7B+taZ3usBWOBr4tEG20bqx0z+n217aau1gl4sPTfPvviE8X:tu6JmUxd2d4sPTfPSE
TLSH
T1CED59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 205830c0e9c9858a893235c13ceca266d9602b593ccd2c127bee2f6bdff276cd
MD5 79565eeefeb56c1556a4699df2e67461
SHA1 a20950715daa01b7969373214ca6799c2e65b54d
SHA512 ee1446b4a30abf98a90ad48bda5adccb67c90d8befeb0f3461b1c1fba04521966f4cccbffb9af8367efd834ef301d7dc54850a08e75561c8fcc15e630e8a8398
SSDEEP 49152:Q1hpsNoJpF1A6BU44CwH7R4x0sPTfPvviE8X:QmifPkRVsPTfPSE
TLSH
T1A9B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5a9824c90479372e1fb24b791485cd0f89d40adf7b34035f6fe68e337c2fc16f
MD5 444b523dca924d783edb773609bbf864
SHA1 74a130eaf5c433762a0b51651586121252ea195e
SHA512 e9ba3c1d57feabe425d34bafc057d51aff3565958d44349eefd46efeab0ce482cda1d1c36889a8d23cf4aeea0c176e0ceda7dbdf0434043198bec075811fc034
SSDEEP 49152:PSuZQIY0Be2KNRVtOnks6NMHqjsPTfPvviE8X:15dKvi61jsPTfPSE
TLSH
T196C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0330b6a433ef78066ccce43a44e30f38a28d092d05c52eadcc11a99b9a8e619a
MD5 9675d9687859ab17ca6ec071f9899564
SHA1 192ec6a4a35621ac8527d9e7194aa767b54f174f
SHA512 63e5709914985333870e806a15913765ae1519ffa4e22add545b2ed429901fb3cabe9de06330d4a7656a3400b182b356a980be01642bf238098ece27cdacf073
SSDEEP 49152:HhtSn8EApI0figXgiDn0AP5wIsPTfPvviE8X:WX2iyphRsPTfPSE
TLSH
T1B495BE13F2D901E8D05ED178C7568632EA62BC160B34B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 6770914f173106fcdc2f689dc59250602bea46da7a6a51a26e175ed8bf0de494
MD5 8abc83ef5784a178bd73da23aaec4ac3
SHA1 f7574a786776561d216ac9e3da0cbef0dbef5572
SHA512 a2c0d222e8f7c909345db4cc30c22cfcc2eeaec51831efcfda88330046b295efca8c7cfd18c8f725d33c75884539ed22d0aae25f60453639374016739706f5b4
SSDEEP 12288:twV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:tXsX/IhEIEVpJLPeeviE8XKS
TLSH
T15DC4239F65FD22A8F152CB7B84E153C72E3C8D55DB10206BDBA0F629E9FC6B76201112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 e57be29f694e407b834d9879359e0830fb771f3dcc2abef94026610c06ce71fb
MD5 226936198d15b424117b8b94850d3f44
SHA1 a46f74770dff7703db3704375bcfc4c8096294c3
SHA512 24fef3b043bf723be000079c2e73699c67d1e95a0f527fe57b69b09074327341fcd9a38b76d0ac0ce14d01794ff0f76fa5e5adaaa1b6f073380c16ad6e4025d3
SSDEEP 12288:0LV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:0msX/IhEIEVpJLPeeviE8XKS
TLSH
T17EC4239F75FD22A4F142CB7B84D152C62E3C8D56DB20206BDBA0F629E9FC6B76601112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 f2f081a4a2aed5532b1eb2fecb2ec279a4f88e703ebc6b7a6756375c7a5146b1
MD5 2f8f6c5fd64d18d535cc6411d931f4f4
SHA1 00bff485a90091abd982401feed1cce99dcf0d3f
SHA512 11e4def826f12df0ef2413db83ac2c9e53af908a9bdcb2d2881ddf1416d83191303c6a6bedd204b4f1d3f27b1da8440aeb6a7142efec7c5c5b219c29f51fcf61
SSDEEP 12288:3lV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:3MsX/IhEIEVpJLPeeviE8XKS
TLSH
T1A8C4239F69FD22A4F142CB7B84E113C72E3C8D56DB10206BDB90F629E9FC6B76601152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 4c21c33fafd82e85864aa0a9eff026844bde13c82f9c5db62f94eed3916de283
MD5 d3292946a6f1ec94e0ba9004c3e44ab4
SHA1 4815fecf1128f3cfbeaadfe2fa0e1a56f8d812e5
SHA512 e1a114cbedf3e1a68084c786e8bc10e0f6842759c931e98b2749368f4d2a12725966b8586ce820d02db14da5eaa830c3ae59e52c23da36bde4bf738f84dc072a
SSDEEP 12288:0VyV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:gsX/IhEIEVpJLPeeviE8XKS
TLSH
T191D4239E37FD21D4F052C73AC8E152C6AA3CBC54D73062AFCB50FA699DB43E56610612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 3feba87859a6796042006e3e9a21370e0994e7cdabe22ed3a92a8d006dee042a
MD5 2e4248e0de8884c7a12574b78143e566
SHA1 95444014a8f4c5d6032d0a5dba22e5ddcce38f14
SHA512 5551957b07da0461c207a34d45ecefd75331d7f125ed912cde8eb4db4566061d95061869de8a4c35aa5494f0e7534dfdf51a4fdfaf1c258d7c71033a0d140ba6
SSDEEP 12288:maV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:m9sX/IhEIEVpJLPeeviE8XKS
TLSH
T1CFC4239F79FD22A4F142CB7B84D153C62E3C8D56DB20206BDB90F629E9FC6B76601052
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 6ab233c689f47b06c8665727366ccb354d9047bd51a4e03aaaf7bd997aca4d9f
MD5 cacbf37cbbb08c40da744cfe39a6d4b3
SHA1 1c5632d4561a40e302fb382c35558f8f47be1549
SHA512 f4c2b68f4066e40dbc4560502bb06487fb8c17c323c8966817b1cf306e4c089335949aaa8b6166810adfb3159716c51fd3f8f25d817b5f59364346cd65d8c4ec
SSDEEP 12288:HvV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:HasX/IhEIEVpJLPeeviE8XKS
TLSH
T19EC4239F75FD22A4F152CB7B84E153C62E3C8D55DB20206BDBA0F629E9FC6B76601012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 9006b12c25c9a330199ab4dabf0c53d2dbcb317edea60657e027fc1443dd787c
MD5 9bd54bb82c735c3e4d08623cd130fb24
SHA1 094dabbec5c48355f68a20c5514452f4b904ce33
SHA512 128b05426f50da73c0956ce98db34067ee0effd2db2ee9bf6b9591d70c465e57923f0c3bc7763af1eb4a030758aeea09afad2d39ceadedaa2cf576804ceff943
SSDEEP 12288:JzV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:JusX/IhEIEVpJLPeeviE8XKS
TLSH
T1D9C4239F79FD22A4F152CB7B84D153C62E3C8D55DB20206BDBA0F669E9FC6B76201012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 d1f8fefe711c1ecfba272d3ac3023afedf9d3cb9ba7f38154f1a5ac3f3efa3e6
MD5 52442704fdbb93d2cb514591d90c1904
SHA1 f6dd4857c5413380dc801ca6264350870622a401
SHA512 0a5d98e372131d7a332174a18a86978e44fbe2e5385eb4508209c760a7ca19d6da0560860d2ebe215e9e1fa8701cb27ed04fc90510026f80770897e910e86fab
SSDEEP 24576:VZMMzFVSOGsX/IhEIEVpJLPeeviE8XKS:VZMMzfqsPTfPvviE8X
TLSH
T1EB050299B3A018F8EC63823EC8918946D6B27C594B70C61F03F4766B5F733A11D2EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 12a3a5c2d3dacf54a74d836f9a9baf313c1ea37519094e3641e083985dab538a
MD5 27f8dc35baa510a4f725eadecc2f3ed0
SHA1 aef1a2be155dff442eebf9bf9407ceddd13f8453
SHA512 7078df2687638ae185975b25acdf5a1853f7eade96ef64f281b3db3e6fa963867b7b86a1485c1ba6e6bd0c6a564ef74206a9ab3eb295de6a59a21b4f048b0b39
SSDEEP 12288:NsV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:NzsX/IhEIEVpJLPeeviE8XKS
TLSH
T15BC4239F75FD22A4F152CB7B84D153C62E3C8D59EB10206BDBA0F629E9FC6B76601012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 bf857cac06e7d7e0772c507910ffe137c2b59306a795088bfa17a01a52feabe8
MD5 110e98222a72203285db85a556c45a59
SHA1 e4948caf898f3dc28715ac54014a23f4fc69c850
SHA512 1004863e416cd45ff90eca323437ec2a9232b8eae6689d257f1cfa008891cc11e8ab68213d5352d592f6e97f691376a03aaf1c47dcdcf490aa2734bf2aaece7d
SSDEEP 12288:foV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:fvsX/IhEIEVpJLPeeviE8XKS
TLSH
T1C8C4239F75FD22A4F112CB7B84D153C62E3C8D5ADB10206BDBA0F629E9FC6B76601112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 5edf47fe4b398d949d11ef9db74e113e8063013a8d5ce10f0a6c07e864440ca5
MD5 af858c23887f86b78de62a2cd761adbd
SHA1 ca32ddac603b369432271dcd8061cd2895de2110
SHA512 9ce1f4797586a47a38a5043f7918f311c8b3194bc4e8d92c28a3f41c659a6454e102b3926898394e009c6f1dd52fc3ff321cf8018f19352355f37b1de0cf260a
SSDEEP 12288:myPz5L8HV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:bzySsX/IhEIEVpJLPeeviE8XKS
TLSH
T1C9F4124B73E530F8E0268339C8E21A42F735BC31472096AF57A097766E776E15E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 e135f0026580e97c000dbcbdfd6984308049d9498928a074449eb664b582d21d
MD5 58da4ad7de4eea1fe0b35691157b0f42
SHA1 3351e9eca8c7d18b5e396333f566f120e37cce21
SHA512 c81f294ba804e6b892b6b8e37da719e05f35276b91a3c932b057038e65fd62929e83ede375405fd31ef4ee771687c31bad9d44dcbf083a171d42dbb4ead7fcf7
SSDEEP 12288:2sV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:2zsX/IhEIEVpJLPeeviE8XKS
TLSH
T1A3C4239F75FD22A4F152CB7B84D153C62E3C8D5ADB10206BDBA0F629E9FC6B76601012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 5581e58fe98b5bdc32073ff2b1bbbb85f23f4f98cbf9b0112d579301095a9687
MD5 ddee5e9d2d8cc8b5287c4d08cafdf10d
SHA1 4a7a1bf3c1ff728f5834151fedb5b4fbc975dd84
SHA512 f455d49d6e93632123641c6fb542a2bc0c365d58e1cc2816f258f34727d8467fca7ba2d7106cf917e4adeb9c7cad5e0089b9404a4f0da0a7ddbae683293939e2
SSDEEP 12288:2sV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:2zsX/IhEIEVpJLPeeviE8XKS
TLSH
T10EC4239F75FD22A4F152CB7B84D157C62E3C8D5ADB10206BDBA0F629E9FC6B76201012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 a52bf1f5e17cc66e6008b5465915f6c3855a4fa5686fe9aa5c242017ecd091e4
MD5 3c20cab026e1f0db95cc68354f5f8fd3
SHA1 5d59fbba34ea5174edf5297178637d5f09042e87
SHA512 a792968addffc542fc7c61505a7784bc518a36dc3a51c3c9df5cdc74802f86fb6a53916f618dd270135585d3b7fc74e10cba47c568d52671daafd8578773f468
SSDEEP 12288:CyPz5L8HV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:fzySsX/IhEIEVpJLPeeviE8XKS
TLSH
T19FF4124B73E530F8E0268339C8E21A42F735BC31472096AF57A097766E776E15E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 7b0980c9d923675ddd393683def33af85aff6a4e4553903d4fd8a25fb03e0989
MD5 dee45ef8dc105abee7cf7a8335a56b40
SHA1 8723a35c19c8e742e04481d1566b09502b040111
SHA512 fe1661fdfc448d194198c37532938bc23cf5c3ed82f86d0212f39c0d9725b86bafced1c03585933fadddbe6e6f8c7315cc02d1f81fc5ba84447c9339536138c2
SSDEEP 24576:2T9aLl3z0zD8sX/IhEIEVpJLPeeviE8XKS:2TQLljZsPTfPvviE8X
TLSH
T1EB050299B3A018F8EC67823ECC914946D6B27C1A4B70C61F03E4766B9F733A11D2DB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 a3f1e7ebb11d0bf652494d91fc8ade47c6e133a7c56a894b627ef1b637ca38f5
MD5 ebca501f46023cd6169795faf7cc6a7b
SHA1 a1426fa4fe68365d0b55df1e5d5fc8fa00afa9f1
SHA512 8db116039666028409f53a164f4d354bdf59eb86ee2bae9a068437e727140d6fe5d73b17cc5cecac62ae01f58b6880e029d45436f65820aa8d8fb5a1e111584f
SSDEEP 24576:r3td9CHKy7GZAsX/IhEIEVpJLPeeviE8XKS:Ltd9CHKyaqsPTfPvviE8X
TLSH
T1BA25CF94F3E410E8F0B7DA3588B65502DA767C5A5B31DA8F03A4661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 fd223fd80cfdf500d3ddf17ec0b63174c473877719c6eea56a9221131b89dd8b
MD5 334a5378121fe0a63873f450fa493d5a
SHA1 beb70947a88ca8e38e29a7328ef7bca61996c4f7
SHA512 f8f2b576fc9be390c03073b340cf5febb585e1bc7ad27e1d05629be31be856dd4bdd8dd68e9eb973cfcfa9573abd5646d0745aa5a3a996003f47f0ce06ad09ce
SSDEEP 12288:5FV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:5ssX/IhEIEVpJLPeeviE8XKS
TLSH
T15AC4239F69FD22A4F142CB7B84D153C72E3C8D56DB20206BDB90F629E9FC6B76601052
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 172167fbbafd195225fccb283eafe80a6563908856caeebef5639e491882dee1
MD5 6dcb7d3aad6f9ec67db9755f4c80a8ef
SHA1 da0931ef05ab327787361efde5ec56befb7f85d2
SHA512 d95962d126d72b56fad0ca0783d46d5c326119075301e34c0042522773d83d9ad40b1899328f710ed7eae055b16957438d9aaab00d197f5111bd6b309d9062da
SSDEEP 12288:lnV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:lysX/IhEIEVpJLPeeviE8XKS
TLSH
T1D9C4239F65F922A4F116CB7B84E157C72E3C8D55DB20206BDBE0F629E9FC6B76201012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 a3dc184af23635d98ebecb8328005f86e8ff7b10f7822cb8e2ea978efe665019
MD5 ddb74ca3d4a30887dae4686dc1d1b04e
SHA1 20399ef0c8267f48fe82287ca80eeb195e0dc6b9
SHA512 088561b0b9935ac4d6fb44328c415e30628a3ae85c22a78ef24aafa218117cfe303c10677c004e57a64490f97f0b6652e5cec2406d3c914d341034730e43b604
SSDEEP 12288:/eV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:/hsX/IhEIEVpJLPeeviE8XKS
TLSH
T10AC4239F75FD22A4F152CB7B84D157C62E3C8D5ADB10206BDBA0F629E9FC6B76201012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 ca9fca438091d30fa562e09add43fa35cc5b23025155b8aef837b72a53b22ae8
MD5 05918eec8756dfb104a6f737d3cad88f
SHA1 4815b9dc20971c4f06b38132cc4ae6fdd856ea3e
SHA512 15d696e60a7e6fb0208f3af0dfb9eba334c820d1d5df721ff8b201b787c39a3000a188f983ac8d960816d74cac7f41bb908a9db1b54655065bdb75c099b53ae8
SSDEEP 12288:dsV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:dzsX/IhEIEVpJLPeeviE8XKS
TLSH
T1E7C4239F75FD22A8F152CB7B84D157C62E3C8D56DB10206BDB90F629E9FC6B76201012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 2229405236e068ca4456c80ef5f8e842938453d6f36c695d7bda187b9b485ea6
MD5 2e9b25853f368de72775ad1cb89e3db0
SHA1 b5f0aa9c4855e34ab93d2192c59a732999e21378
SHA512 adce3b7723b67cd35852ed3e128469ff7333b69c403ed7e91b6fec3d8156690d197d398964d6f1297053c01d43303e2058423a1f39e8d7cffd3d7a5edfa44a0e
SSDEEP 12288:zFV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:zssX/IhEIEVpJLPeeviE8XKS
TLSH
T18AC4239F65FD22A4F142CB7B84D113C72E3C8D56DB20206BDB90F629E9FC6B76601152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 f5cd7ccc7ace271018395c906ee1732d74235c75b76bfb38c00e0ab03a497f41
MD5 002f9e29bd6c884fe37531a76a86e613
SHA1 e8b760b1553d3a2bb90b699d36fa6902fdce9b65
SHA512 8bd47b268f27464d0887ee4a0607de7ce8cf5985c3ad82eba0ac7db18416a032235b2fe3b08be3c9f35b095f0a47ee789326d7b023e0c8255555bec4ef12cc54
SSDEEP 12288:IUV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:I7sX/IhEIEVpJLPeeviE8XKS
TLSH
T146C4239F79F922A8F142CB7B84D157C72E3C8D55DB11206BDBA0F629E9FC6B76201012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 2ae8fb2b7e8ce863770e003c8f54dfdc68165e6768fcfe0bf7053e5219b9809f
MD5 f461c7b2ec59dd21f08f661a51e75cfd
SHA1 cce86935c376f2bea3e7acd5d5c234aeb20c435d
SHA512 f47b9d2dba7e1ba0a53c2ecd427d62828ad8971532ca38e1e69913ce9fde77bfae6e5356a12fc74ce5c0ac68a31cfd6162eaa44010d90c128ec404a3d9cfd088
SSDEEP 12288:6aV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:69sX/IhEIEVpJLPeeviE8XKS
TLSH
T1D4C4239F79FD22A4F142CB7A84D153C72E3C8D56DB10206BDBA0F629E9FC6B76201152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 746a3f812c187e6a7e65b3dcf393939d7e15ac090e028140eeb7ca9aa7263aa9
MD5 b71980dafda848af0507276d2f197664
SHA1 c522b586af6918a238ef382e364c750bcf506f7a
SHA512 9bd072bf2b7849de2d2d9076af0934912955e70913b795952b1685a009194266e3ab82527724abc057e7282392dbe7b9c30fd7bde5e12fa2a897be649b7a7ccd
SSDEEP 12288:pdV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:pksX/IhEIEVpJLPeeviE8XKS
TLSH
T1C8C4239F79F922A4F152CB7B84D153C72E3C8D55DB11206BDB90F629E9FC6B76201012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 446ea2f87dff9d036b2d0923c896fdebadeb17cf8ae7a9bfc8822ccd407879bd
MD5 05f652db7cb10a953c2b22e16da7a731
SHA1 3b703c52b0ac48f4f4fd1a81655496a441b51b5d
SHA512 6d84d445de2e4e25776b01eeaa720d3e1d3f48b3f7547c75cef95169914189ea3487c226a5d8b03d4f67333a67b5f998ae4da26d4c978efc672e361d9ddccea8
SSDEEP 12288:naV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:n9sX/IhEIEVpJLPeeviE8XKS
TLSH
T16FC4239F79FD22A4F142CB7B84D153C62E3C8D56DB10206BDBA0F629E9FC6B76601052
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 b163bfdefb9d710af55a1fa5f3efd1d2ed290ad179f7279ee832130621912ff4
MD5 7a62526a9168962dd9fd3b9d6eebbc6c
SHA1 b0e8f9bd529fcc57419f671f74622e62d7c17ab9
SHA512 3a722ab2b5bf6ab68ee92aafb6096198f4fca0641a3fc83db2284bc211cdd43fedac08e0affdb74c9b294615ef8f492e1a29160346dccc846f56a0693fca06bf
SSDEEP 24576:Afwvok9RX6wkyAI/sX/IhEIEVpJLPeeviE8XKS:IMnYI/sPTfPvviE8X
TLSH
T1A735CF29EBDC04E5E1B7923C89E3464AF6B178695B31C2CF029A536D0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 64554cf108439075a8471a516a8151fe35cbd7586661ebf5313cf5eee916d51d
MD5 b724cf0a3d8a67c441d4cfdd23ec251c
SHA1 67eed5df223149d08bdc0f239e37f4f5acb211f4
SHA512 68d25213a57c0fca33cb50910a35e1a3375dd706194487078fd928ce86738072a0772045bca855b8c463cd7f58292c25f35da9ee749d04142e68c48b73ce3e6d
SSDEEP 49152:mYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0osPTfPvviE8X:CySzPAsPTfPSE
TLSH
T19B066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 40cb691eb91dbc85ee86e3468369f2a1a54d937e664ad8ab4c37e0886f3dd162
MD5 c4ed876756d148dbe9c0f2257dee71d0
SHA1 9b438f2779d215dd2f877e718c5b4dd30b1abcc3
SHA512 8e5c8f22f81a91fdd5717ad1a2602a629fb9a209f4ed4f2ce23152a6edf8ed3639bc3cc57ead5a86f933ab9c031e20ecfc6af4f48c53e34c8ba790749be15b7e
SSDEEP 24576:j47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYWsX/IhEIEVpJLPeeviE8XKS:j47JUQj4irIhCnDHUPfF/4sPTfPvviES
TLSH
T1E265AE1EA3EC01E5E1BA823885554A5AEA71782E5F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 5847a82e0c98af705f2641fa8c5a4173fb29f8091e909845f8c7a3eda2e6fc26
MD5 7a25670bf3cf4cfe570e47e4d5219dc4
SHA1 f00ff0fae95aaaed5dcc56c2cc357915d73c6acb
SHA512 638f736545b024e6f721e514537f5311c9b405cb3423cce6fc9431e322638eeaf71c0b0f56ec11be92a617b0ce4b48099fc93e0d3a2bfb4fbf155170aa96290b
SSDEEP 12288:OGsf8V7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:SjsX/IhEIEVpJLPeeviE8XKS
TLSH
T11BE4014ED29812E8E06E923AC7914681B7377C2587E0D3CB57D0F53E1F796A05EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 c97a663259b96cad5c93be1be15bbe4b5b06aa05bdca8d734200492f0c3912e4
MD5 75afac0d6fffa81ed118bb1fd42770d0
SHA1 dea8126e64f320db0d111689c61117a7bb1730a3
SHA512 dccebe3f72eee3510b044162d8671e320537ddde79daf73f5b5f8763f00456da7dd5918c93fd10875af036cb54a3fe96fee27564858d547917ea1c1fb6cf55e3
SSDEEP 12288:ZXcd+U3fhy1ygeiJz1Oqeqii1p0ORRx2HhhDc92C:ZXc8UPw6iJz1mi1p0IRx2Hhtc92
TLSH
T12D452740762AD68FC6A940321E76D6CCA7707D41FE056F1373C8873F9476668BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 4212cb57719d5b72c70e68f080a1e24c1443cf90048b12b72f32b8c51534c13f
MD5 6cac7a8e19950a62df4c511e6c6ce208
SHA1 8dbbbaee4f4267e50051b4e1c35ee6494987140f
SHA512 d7afc09f58b6d7fea6994f07fc4771fbd44d29243158f1bfef6d178187148dce91b4124828f604ab6638c6f601147dc233e97ccfd1d8e97d0779add40ab1f951
SSDEEP 6144:6NKFuFzcLnopAfuanwEiYByamkpsf4puf4DufrDu1NDl15GxI9z3hllIqKItiIOj:6Ndk8EiYBjY4y48rKNLdjOPymAwd
TLSH
T158450B41A4B7E35FC8BE90330772C6CDAB749C46B7452F0573448A3C9867A7EB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d4807752480d6342645214ca990334274072aaafdabf3387068c0baa962b3aed
MD5 4bde983103f16a98a0ec1851e1f750e8
SHA1 e66dc886c77d389a835ce2c5b1536903eaffba19
SHA512 1c29a3485c37143703f07e4e1937b659c8ab7333d90accec201a6a6e96a3093b0b916a7f51ab844d7e9665081005442a9e9c8729f345e46c0dcaaf13151f6260
SSDEEP 12288:R07kV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:SrsX/IhEIEVpJLPeeviE8XKS
TLSH
T191D4239F67EC2564F076CB7944E552823E3C8D64CF1060D7EB40F769E8B8AE69E21113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dec0b629a6a4e9bb4ea8cf8f208c5946d84d54cd21cf42c8ceafab8f404c7eb2
MD5 5623449fcec01f3691f80075fae077ee
SHA1 039d637d066fd1e9fe8d7c151403320496366371
SHA512 f51b634a462a06e13a78ae4f36a3e9b1e1db4c37bf418cc52b5c6bf13b0912fe8b83ebb9c5c7825db20f2969cb9d281219146029537ec26144179fae7dc0440d
SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bYZsX/IhEIEVpJLPeeviE8XKS:+gb4mBIBhGFWsPTfPvviE8X
TLSH
T135659E1E22EC02F5E0FAD2B88DA64417D6B278164731D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 6d6372abf23605b2244cecdf1c752dc655c5ce3331f77ea43519e2fccf017bf4
MD5 ec945507d8a45bf808fbe9585df3e24b
SHA1 0e7f678d6e403c202a712d54da41511724ea72ab
SHA512 1b1cedd7bbc4df2953abce1df0bff36047d4efa2446a7977f6e4afc6efd9b997b28e4a9e17a9ffc8444c5ee76328ffee8c40d2f6c047622e3df21c10ebaa7050
SSDEEP 24576:KG88u8FpJqH1Wzria7/mGsX/IhEIEVpJLPeeviE8XKS:x7ZFPqVha7/BsPTfPvviE8X
TLSH
T17335F16977E501F0E477D238898246A3F671B8250364EBDF07A88B551F33AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 1088eb09c58fb15e31143c8c484eebe7b2d8dca3a22bdd89e8e812a913d2a8fa
MD5 0a3edf9a0e793503a34f94c3b75641f9
SHA1 78602f6e056322ff7336f55770fa84e1864dd58b
SHA512 50e8c3e0e469ae9b720f3718afe8210c2d411661e4013516508259a3409e96cdba7fee008f33ee0850c3e244787521af064a1be5c07ba595bbdee89c67d26259
SSDEEP 12288:nHvUrBFrEjwaQfV7EsX/IhVSIHkQy/Jp8OLku3eaVfsGphMEf61XKaGoJEknnk6h:nPUr+NQqsX/IhEIEVpJLPeeviE8XKS
TLSH
T1E505E16F22EC18E4F676E17D85824709F771B8624711A2CF02E0917E4E77AE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cf2c00f99871a9ca88454a195499409cfe6a5d6618faa6b92ca8085aa7624c08
MD5 cac762669fc646890db38422740d825f
SHA1 207df79ee6919ff868f1aac95cd397500e7d5106
SHA512 4331aed122ce0056368f4381ca29f9bd8b95384f6d05d0d886baddb363b823bebf1a59ec506d5e0905ec59788bcb3aa741d0fe4c25a954940c6934ada38ae965
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjasPTfPvviE8X:8G05lO43bnsPTfPSE
TLSH
T1F8D5CF6E62EC11F9D1BBD17CC9C6460BEBB23815033556CB02A486A91F27FF4A57E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 041ce73dbf47449d7863f9584951564158e4feb8654192b8e2dff4a8e08867fb
MD5 7ee669891f3c5dc2deeee2c673820eff
SHA1 701625da209b8fde7af7ea72d1f7be26b2ffdc9d
SHA512 b695bff84535bdb3a33ecb81419c4bd867040710c43218a68d3dc140acea79c1e7cdb44a6a00bec2dbede702192d922989ec8d5406a4b16d2f67cfc2919c08c1
SSDEEP 24576:rfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnosX/IhEIEVpJLPeeviE8XKS:za5POZ39Jt2pasx2+mysPTfPvviE8X
TLSH
T10A65AF5EA6FC01D5E1B9D17DC5C3461AF5B1342653319ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4029c92edaf0ab1d3bebb215889d06172191537ef8bd7f4e51868af3f2970dcc
MD5 350f9b6360630dd4fee8cc5b672b97da
SHA1 334024106daab2ed4f264c6fee74a1a7bb014a94
SHA512 f46b261dd4f52ec55d96b0cf0e6c1a0a65cb66c15a6647840152ccddbb3479d61fcd887c67decdd2306d730d714c2f9037a5d931d9047a07448ed60f2f4df63e
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7FkesX/IhEIEVpJLPeeviE8XKS:xNc/zEOVHFhsPTfPvviE8X
TLSH
T194857B1A23E901E4F1BBE1BE89779646FA717865533086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f7026bb1df32c53ed082bb2c29767de66f03cfe619346357c94ce5d64d1b7522
MD5 a2e9249665b219dd35275e41b5d54915
SHA1 ed350c63b2b639238d9829ba6131a1018ef6455a
SHA512 6d9a7c005b55da7cd168bcc04cdb9985eb2013d0896c7acbe7ef37cdf5aa353a28841a218fceab1eba1f7f12545da721aff1ee4c5ac1cf16a04838b021d97a48
SSDEEP 24576:MtkNvNnaFeYhJNtmZBmksX/IhEIEVpJLPeeviE8XKS:MtMwBtOmksPTfPvviE8X
TLSH
T16955AF6EB6F806E4E1FAC6B5CD238512EA727461073253CB5390C13E4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 d9796fa0db7e9eca14c056735bb4c63d567c70b8db91f308df08ef0cd9c63b6d
MD5 bd6120890ab3d5496f438032554fde3c
SHA1 6f848d4588bd42d193fdffff56977efab3c0d29e
SHA512 985797080b1ae833b072a4470ab05fb2bd2ff34a22e7e01f778215c6369c60e3c1a22c9d9f9e1c6f0ad5f6c6cf7ff97d4f7789a662df047b0b6f1ffd3c0f3302
SSDEEP 24576:+D3FHshBIYQgA3sX/IhEIEVpJLPeeviE8XKS:+DVHeBIAA3sPTfPvviE8X
TLSH
T1E525E17EE69C04E4E47AC2BCC5A38606E77138A9032165DB02D0D1B95F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/960-17-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/960-95-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/960-23-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/960-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/960-25-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/1316-80-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1796-41-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1796-42-0x0000000001E80000-0x0000000001EE0000-memory.dmp

Download

memory/1796-49-0x0000000001E80000-0x0000000001EE0000-memory.dmp

Download

memory/1796-52-0x0000000001E80000-0x0000000001EE0000-memory.dmp

Download

memory/1796-55-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2360-357-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2360-365-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2360-367-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2360-83-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2360-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2360-90-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2644-116-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2644-109-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2644-115-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2644-361-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3164-362-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3164-139-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3164-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3164-138-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3312-96-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3312-360-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3312-358-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3312-103-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3312-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3788-368-0x0000018EFB360000-0x0000018EFB4E3000-memory.dmp

Download

memory/3788-391-0x0000018EFB360000-0x0000018EFB4E3000-memory.dmp

Download

memory/3920-67-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3920-69-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3920-75-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3920-343-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5516-3-0x0000000002AF0000-0x0000000002B57000-memory.dmp

Download

memory/5516-8-0x0000000002AF0000-0x0000000002B57000-memory.dmp

Download

memory/5516-6-0x0000000002AF0000-0x0000000002B57000-memory.dmp

Download

memory/5516-0-0x0000000000400000-0x0000000000BDF000-memory.dmp

Download

memory/5516-79-0x0000000000400000-0x0000000000BDF000-memory.dmp

Download

memory/5516-279-0x0000000000400000-0x0000000000BDF000-memory.dmp

Download

memory/5736-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5736-132-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5736-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5736-128-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5736-122-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5832-63-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5832-57-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5832-273-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5832-56-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5908-120-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5908-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5908-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5908-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5908-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download