93f8c113f9271f458765a391dd716da39bce81c06aebc1e759485228900bc662

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-19_3f1b76bfa7b101e6b159a579403a89c5_amadey_coinminer_elex_glassworm_hijackloader_karagany_ma.exe
Size 3.6MB
Sample260919-ppvxvsfd59
SHA256 93f8c113f9271f458765a391dd716da39bce81c06aebc1e759485228900bc662
MD5 3f1b76bfa7b101e6b159a579403a89c5
SHA1 a183a4d990d3a18b1c3f760b438966df867fd10d
SHA512 c48fb556c68a565d70813980ca0b95f2d2015be65883b690462e0eb221df70c033362cd23d0c0e430f2033978274c07a7f7f6dcff0ebf700bd619523e8a2af51
SSDEEP 98304:5I4kvKvHx15RFAN4z4gGTpOnHNQc9xQrpBAigxAX:5I4kU5RFRz+9OnHt92r//gx
TLSH
T12706BE17FE418471FAC2013B82FD5FBA8D7E9610132DA9E3669539B44F702D26A3934B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3456	alg.exe
756	elevation_service.exe
5344	elevation_service.exe
812	maintenanceservice.exe
5924	OSE.EXE
4880	DiagnosticsHub.StandardCollector.Service.exe
2168	fxssvc.exe
5656	msdtc.exe
4576	PerceptionSimulationService.exe
3720	perfhost.exe
5608	locator.exe
5404	SensorDataService.exe
5220	snmptrap.exe
864	spectrum.exe
752	ssh-agent.exe
3076	TieringEngineService.exe
5320	AgentService.exe
6080	vds.exe
4108	vssvc.exe
208	wbengine.exe
1308	WmiApSrv.exe
704	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\98eafeb4bb6346b.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-19_3f1b76bfa7b101e6b159a579403a89c5_amadey_coinminer_elex_glassworm_hijackloader_karagany_ma.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-19_3f1b76bfa7b101e6b159a579403a89c5_amadey_coinminer_elex_glassworm_hijackloader_karagany_ma.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-19_3f1b76bfa7b101e6b159a579403a89c5_amadey_coinminer_elex_glassworm_hijackloader_karagany_ma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d60a6f13248dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002dd6bbf13248dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000acc1c7f13248dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000636b73f23248dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021f47cf23248dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e6c54f23248dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002874b9f13248dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
756	elevation_service.exe
756	elevation_service.exe
756	elevation_service.exe
756	elevation_service.exe
756	elevation_service.exe
756	elevation_service.exe
756	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6092	2026-09-19_3f1b76bfa7b101e6b159a579403a89c5_amadey_coinminer_elex_glassworm_hijackloader_karagany_ma.exe
Token: SeDebugPrivilege	3456	alg.exe
Token: SeDebugPrivilege	3456	alg.exe
Token: SeDebugPrivilege	3456	alg.exe
Token: SeTakeOwnershipPrivilege	756	elevation_service.exe
Token: SeAuditPrivilege	2168	fxssvc.exe
Token: SeRestorePrivilege	3076	TieringEngineService.exe
Token: SeManageVolumePrivilege	3076	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5320	AgentService.exe
Token: SeBackupPrivilege	4108	vssvc.exe
Token: SeRestorePrivilege	4108	vssvc.exe
Token: SeAuditPrivilege	4108	vssvc.exe
Token: SeBackupPrivilege	208	wbengine.exe
Token: SeRestorePrivilege	208	wbengine.exe
Token: SeSecurityPrivilege	208	wbengine.exe
Token: 33	704	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	704	SearchIndexer.exe
Token: SeDebugPrivilege	756	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 1696	704	SearchIndexer.exe	129
PID 704 wrote to memory of 1440	704	SearchIndexer.exe	130

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-19_3f1b76bfa7b101e6b159a579403a89c5_amadey_coinminer_elex_glassworm_hijackloader_karagany_ma.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-19_3f1b76bfa7b101e6b159a579403a89c5_amadey_coinminer_elex_glassworm_hijackloader_karagany_ma.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6092

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5344

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:812

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5924

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4260

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5656

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4576

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3720

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5608

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5404

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5220

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:864

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:752

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2000

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5320

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:6080

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:208

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1308

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:704
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1696
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:1440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 63a817af6a6339937c651d0c8f2680fb103144e55f755ec3b63703cc9d11fb59
MD5 f65416f5d1aaa786f258764e5290e9f7
SHA1 b8acbf2628269c39842c27b4f873b516fd202209
SHA512 44e8f2a30fa3628c75745d8cdd72d358859712429b141cb6800e2cb5e88b7ef4294ab3924ca727624b39a6e95fe8511bb0bf70e8ce2cbcf65d31f1241f5b1092
SSDEEP 49152:qb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnUKA3/KcQQxpylDeo:c3q6sjB0AigxAX
TLSH
T122D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 24fe26795bf3a313b4bb0b2fbb77611c2a82fbb52af38a9dbea8dda7f6b6b0b6
MD5 29f7e2fb86d37dd42fa9ccdd9a0953e1
SHA1 e075a634286c46543de176940c5ef87fb6321c98
SHA512 d960ae7fba18ac1f8934a942be7f1f80a500203bd845bb0a4bf30d48c10435e4dc164f9cc8983e032cf4e1828a0b52db09227ccc859064641c69e47c71d8ef63
SSDEEP 24576:zXYfDtczA5KI6k3sbIhKcQQVOORv3ilDIHo:WtcaKA3/KcQQxpylDeo
TLSH
T11185012873D408F9ECA7827CC8A28515E673BC958760E79F03A499251F337D45D3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 0c56425cc9d760bced0c4cb7c862b401bfdbf01babf8088ef645680f93352853
MD5 18eef226aa248d3a1cf38f775773042d
SHA1 ae1fe2cb02480e94aef2c53a27cc219d50bc6c6e
SHA512 375032881067860f235d8de73c90cfa12deb20d5a57f600bf0f216ac465f2de1c68c57cdd9f0f8c94391a8592bb9d41afa8e453552d0a77901e020ca980ba031
SSDEEP 24576:10Le5ji0hmxSrM8KI6k3sbIhKcQQVOORv3ilDIHo:1Pji0AkDKA3/KcQQxpylDeo
TLSH
T1DAA5AE26F6748731D073C0B9C5D2A68EE97130865B308ACB4286D77C7E67BE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 654df7d63877117b1cceee121c464b8464a9cf3d1cedc418399e99597fc7a985
MD5 f807a8544280bfa72e9be580adc5402b
SHA1 a26ad4ce9a14980dcc9a375fb556f3b973d298e8
SHA512 c6fa05b03e2373155137a1233888a57712fe492c0f011cb8b06ee24ea4674235e5701cbc8bf895e13dd89f4eb123be87d22a3edaf028af0c44c3ad436d7fab5f
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWn6q8wyuqKI6k3sbIhKcQQVOORv3ilDIHo:M/ezSC6vUzPveHjy/KA3/KcQQxpylDeo
TLSH
T1C6755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e977fbb50b15f192fd60406ec7cd4583a329b846f85f3c79931917537d65560b
MD5 9b8298b565e5f12379b4089e16f7aab6
SHA1 e57e063874b94307160fd2bf075357d988ab6fb8
SHA512 50873debfafc8a0546384813ad224a1388c9407aff4b712ff1c886e86fc7add2dfeae4549930cb8fa15b211f808ccd4c076fa15709d70eab12c8259b7a1ecb09
SSDEEP 24576:zVbqPb88hv/l+YdKI6k3sbIhKcQQVOORv3ilDIHo:zVO88hXl+iKA3/KcQQxpylDeo
TLSH
T13C559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 4175e429e596f6607942911ac9a6b5df925d0bde4b9be8c36cec535bdcad2b3e
MD5 74465973cbe3e40905ea2923008e3ebc
SHA1 88e13824163331c46ffad398591d8c83e1011aed
SHA512 9229956697f92d2f59c1dd93d177f08b65df32b09cbfd59cdc62540868fa93b0b07c55cc0a2cb679cbabde22a796777d7e4c1ac5940d4c18709fa0135ac30d6c
SSDEEP 12288:zwfmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:zwAKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1437523A6839C08D1FAFBC27485D9A7D921E5ECFCCA45C71DC22E3E524036A70D46A9C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 efe9b2c41ae71b897940734fdfbe632669a6c4aee9e165099fdd3775577c840f
MD5 8485e8b1e859ae306e03e92478e5879b
SHA1 a5f2668bb9b4d1b6ca6413419aedf38b9b87cade
SHA512 cc18f107755f5d43be990e883e53ba2d6fe9ae0922dcd220f1073577fdd2d760fc55ad0faa241c7bf215a99c9bedda6d099459ab9c39a51c4a7a4a24f7dc9c56
SSDEEP 12288:reBNUbTVO86UKmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EX:rJIUlKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1E885CF7BEE28FCD2C27A8DB856918740D7B278708F5293CBD165820EDE235E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 da8f6c3c119e9a460c527d2a79b812a33eef1a9204c6cc2982c8afe6713a4cca
MD5 106d75705d6d71aafe8d3b6505d535ef
SHA1 ee4b3a58def064b407b7a937a06ccb869303d95c
SHA512 030b1d428fc17f0c45149ea6622512e64d3828e97ac7f9aa97a5bcc2359f335db970ffa283be9b2c2035aac0681ff8029075c5052d81ce1f0e99704fbf83330f
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THI:NQvGAdlCEL8c/DRNw5CfAigxAX
TLSH
T183266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 154f3abfc7c9a220422a08d7d2ff5e889807bbb361aab7fe9a602c401f27c17a
MD5 bcaf5780d0e0dbf87d4eb8a33871bfed
SHA1 8370c8c7012b33e39669587260929a16effa8bd6
SHA512 43c0ab8a1c427100ca611f70bc4535043f89943220fa12085d4df1505858fb79ca036363ff52176ca28cd0257e2de756837ed488b137e81a48cf67fd69fbdd6c
SSDEEP 24576:F1ewsAjTKI6k3sbIhKcQQVOORv3ilDIHo:rljTKA3/KcQQxpylDeo
TLSH
T1A495E031FA74E432C2BF0DB21B66C716147DB9608F511AC3E3A89E9E59302D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 faa979aa34cb1fdcd360f76861e739de2df14d7cd9ddfa0ee2e57f145c7bd8f0
MD5 48ad8757f9df2092ea0f8556562f3633
SHA1 1a10c028324486e9b2555fc5674b56b3ac8292ba
SHA512 c76dda099c75e5c79f538a7a4fad198c4672d563db4ab1bdd3884266f5752a3c6a26fc8f0d19aba25f108d15da0727811f11b55360541ff6643c5b3a0dafe48b
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHO/gx:tUEtQevvqc2W1cpV2tI32Q
TLSH
T12B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9de1b37823debd2ef910bbd847df62e3e79e6871a4e21e202ae72cf1f91dfe6c
MD5 d0efadd3ea3eb086b6f5df30edbacad3
SHA1 a42b0eb9a5e46d36074517dcea2b33306ec768da
SHA512 07a0adad246119af3f5414928f16b8ab6c8c31ba507cade5bf765bf0e628fd447193672d8ee5dcff525aa6f5a975016f4962cb64753039f9a7f15f970ae4fb9d
SSDEEP 49152:ACbRquA/m2yL5zifFiV+XenmE3/zzKA3/KcQQxpylDeo:JoqHVjnmbAigxAX
TLSH
T13DD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2eb94c038e11be24701a8b4e26face06c5b449a525e7b36109b4b6849f7a9164
MD5 d9cf3b00c37b2f4f167ae24bab0f3c7c
SHA1 e89ebe2deb9cd5d362e8227aee1e748deba4f870
SHA512 559f5137a6e8d4f49a5c99a6ec534978cdd02dfab527f25c2bb45b01e83e968399ad3f7f610e6663a77d1af19872881f2c840d04342dbafcb683b6da000dae9c
SSDEEP 24576:SAhGL3IFoiwtA5l7S53GKI6k3sbIhKcQQVOORv3ilDIHo:SAMUFoiq52KA3/KcQQxpylDeo
TLSH
T1EB359D81E7F945D4F5B3AAB899B69170EA76BCA95E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d69d20e280aa9d01250f76a43d57ea48587355e48f9cb60178c51ef45d749c6a
MD5 ddbcd0fee212a5109801700230ca64f6
SHA1 cad72d4ed426cb3002ab629ab064c7eb85f1ce59
SHA512 04c0481979527a106fb0293e24c3c058088ffb1025ef32d5f49d9c2e5af6cebd8d7f409ac87e2fa76f91fe90e22b5ef36549811156c922ee1da553e979f1095f
SSDEEP 24576:WwupOWfKI6k3sbIhKcQQVOORv3ilDIHo:WwGOSKA3/KcQQxpylDeo
TLSH
T1B985F14A72A80CF9E9A782388597C536F3F2BC552A25C71F4360C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 5540fa0b8093f0bc42bf6fa21697e820cc7cab33b02ed56e5028261cc3d865fc
MD5 04fd4e7019891a6a70c048f2f363f95a
SHA1 23846d288184d655e56384e718a1671bcdba1301
SHA512 8cc8765c8d67b26927f1574f6357df7fc3125c8f967105b453b07d30d4a050d29c70d256a301a15534ca72463351365aef9709a58f9c437f7c77a6c114887a62
SSDEEP 12288:zRZ1IyMmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:VZukKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T11775129A23D820F5E1F78278C9E45749D3B2BCA5973583CF42291A561F33AE15C39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 534563c36f9f35d18c9e795628a8d21072fd6eef004d7a2d4829fa90e33c73a1
MD5 0363ded8983bf65afe52832f97a77266
SHA1 ca37948dbf868bfd0b993a5c64fd93e5495541c6
SHA512 0a8f8ad2e7890f79ee9d72dbc60b530904fb610d512f71e8eb1dbf975e24b27813369efc83381d0e52067d58372e13137a839551eaefa12c7a42ecfb522087a4
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UE:pQRQyi36YOcPbLvw2gAf+PN3YAigxAX
TLSH
T148667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8074014dd6c77f74da84ac6d78d73072fa533189960995c0a588e9540d11feff
MD5 e7aec53eee361d6ca7721080da5c3729
SHA1 8db53e754cbaecbab58a7e630d58c18f85ec1c0e
SHA512 f248141d75d220280665bee48f6b60af5638a74e590da6ca49702034efe8c9bdcfe2f40a6174899946bc000574490eefac43eeeb557bba4579f770466c64fc9b
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UE:IQRQyi36YOcPbLvw2gAf+PN3YAigxAX
TLSH
T1DC667C03F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d6a2d0c4274c341ddd40adbe76233c67667c9cb8bed5306533ad99fff64e69d0
MD5 67de58465f73f99feda5cfeb341ced5d
SHA1 a30714e6a77532bdb459d77ce3697a0ef0a46279
SHA512 a6f8f3871fc0c3f04a5309c1e33406491d51cd042416b3ff6cbc34783f4749cc389c66942cf6be9d6b9e4e0e6406ca732eddca673e959c232243edcd884bd8fa
SSDEEP 49152:/68Qg55nhceWu7PNU3/DKA3/KcQQxpylDeo:5thLRc/2AigxAX
TLSH
T17AB55933B2F600A9C44DE1769F4A872196D27C75CFE0E3DB851572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cfc380d90f5e6346c87893d1ec2c2d0fa118b94e1c8bac078a90b87a5e755a98
MD5 ba38702aa414697ca2acebd657e2ce9c
SHA1 209c4ae1478193cf39100cb8975777310739c7ac
SHA512 4a8eb90243be5eb090867fb54dc773686a88fb4c239558ebcf78ad301c4a157434f57f94b5025a12d29c6a464c5b007a3a6610871c8fdc0ee8820314d3a357b3
SSDEEP 49152:U3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99C:By5112gYy5azzVvt69nLKnhZxAigxAX
TLSH
T19B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b6d961b4eaf66ed8bfeaf202c6033cde9da711adc342802f720c93e09567607e
MD5 eaa1d63dab3654f956d97757e088fc88
SHA1 2ead4edff4f778e3ccf4b03080cea63fac7ae120
SHA512 411a605d6cd2629b4aac3830248af04e2696ca7220af0c15f1021e60a5aca9ca3783ea79326f9666f0993bf5c7d002a4784fed9266c9d4573ece1f01746a0169
SSDEEP 49152:qB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glpKA3/KcQQxpylDeo:4u6Jmdxd2dwAigxAX
TLSH
T133D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 696d9c11002fd56bf1f10a82f3160bbaeeb1d584cd155b064fa6bf4a9a178988
MD5 d87405a46a274534839b4bb991c80477
SHA1 8f53fdb76d55d1ccbbfac97775aba9b7904ff0f3
SHA512 063a5d0547cbfaf3dccf68c2a70b4995cf4247ac3a27fa68549c64c9505a2fdb9dd77ca1c1cf46e36e120724dc4648dfe9ef863e4ef094f5bb6da81ed9080fb4
SSDEEP 49152:d1hpsNoJpF1A63U44CwH7R4xFKA3/KcQQxpylDeo:dmifPWRbAigxAX
TLSH
T16AB5AE13F2D800E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8d2565038e5709c609c44d7dffa8b00c5aad625c7d452f6e7c54ff2e49093825
MD5 6cfbeffa65db0ff20dfb05a29a4eaaf3
SHA1 abc439827f7c2807941830f80d1f04253c2d169f
SHA512 8a72a81f21324a247209aa2386a5d4c7b3caf1f2be2cccd352c46378a437f0594efd98cc7dc806e25bf44f880ab0543693478c5e53337e9a0ad881e05d0079cd
SSDEEP 49152:KSuZQIY0Be2KcRVtOnks6NMHqkKA3/KcQQxpylDeo:U5dKii61FAigxAX
TLSH
T134C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 96f36e50a9345b813f02b4ee51c505979a9f11071788eee08b2f33c799288929
MD5 896bf9e6807ae26eab40130cf7793feb
SHA1 c7c32dfd25d4d123cd3dde9334e3497b9f1c4499
SHA512 eaf3376ba98849d93f4991898d4071acd17c2b4a3bd0994335d2d9ebd91f1002556c7026a5392517d9e32c3f374002ee20233eab55cb7bd035a78754de7a677c
SSDEEP 49152:zhtSn8EApI0fig3giDn0AP5w5KA3/KcQQxpylDeo:yX2imphHAigxAX
TLSH
T19A95BE13F2D900E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 d08241eabd01170d4e4bc3c5ccbbb853995096dd3b9fca117bb27f0576e9ecee
MD5 65a34b2f2f9edb5b4d255ee0eb263c6b
SHA1 0822bf67f28f963d87fef7f654540c0eb4c50547
SHA512 e0c7b4689bef2b47e0200cc4739d0c65a7529cd66989e05580a862a9ad38c0419730eae7db7803f07ae3b052a27402b8dc2bfe0e3764045a933ffd9682d698dc
SSDEEP 12288:n3mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:noKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T10475236A969C08D1F5F7C2B085D867CD60E4ECEDEB46831DD22F3D124277A70686ACC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 91db112d9df81a69e49f61c77d178faa5813f4dff4547529c190f00ada3fc619
MD5 5971b28073c3c2fe01a655bdc173ec13
SHA1 ee6ba66bdb166d0d32d6cfe7aecb598f3ac72245
SHA512 8dd7dfe10cf8b6244d323769c487343d7ccf1bffeb31ba14816749f674816eeaa1d4d48f60c12ea0c642ec85c60ba8ac3e35715803ae4a9ac1ce1e14ad46d7cb
SSDEEP 12288:LQmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:L3KI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1F275236A969C08D1F5F7C2B085C867C961E4ECEDEB46C31DD22F3D124277A70686ACD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 b44431b3b73c5182f1e22f0cd4f4451c4c663272989e011f3ea55e88832e792c
MD5 2e6fcee256db24e27987c0ede958a47a
SHA1 4c36e66bac73c3f5f19b6d41148f91cce2523752
SHA512 ac0f94394f5d796103e2e2ae4ae85d266b6b3c62ebaf8cfc586460374fc51ef1eb4340b96b8dc5098092514f7fb733fa50290b72fe81472d19e986f5f7d67ddd
SSDEEP 12288:mCmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:mNKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T18575236A969C08D1F5F7C2B585C967C960E4ECEDEB46C31DD22F3D124137A70686ACC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 4170c18bd6662a5fa30eaeaa65a38574a3eea8ca1b8b16a34adc3284d3fde28f
MD5 fcb25017977d11cddac2ef664c12cc21
SHA1 c93fbc79841e3c78ae6ab18db0c1966d88168533
SHA512 d521bbc2b060e2473367e3586a8c4ce3c555748bac62a0633b5be2dfc0139c67aca7ffd82de235f5b60ee966cfe2f32ef31b2c019ffcf9e5367846976f13956c
SSDEEP 12288:CVpmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:vKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1D0752356539C04D1F8F7C2B4C5E59799A2F5FCE8DB12835FC61A3D020A727B0A839E92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 0a0508da6926dba60f55e3f998c63a207fd575f397b05a41669b744bf20d756a
MD5 78746d5cad0e34d52a82a140c09b95d3
SHA1 7e3159ef1c3648bd235e1a96ffbc1891091bb28d
SHA512 efd9157edea6b9bfbbef935f0cd803ac40c4c94bb7d2c59597f030a4033e6c3d130ecbc98526e75d5003f25500e0c7567caaa18165d4f4df78a923dc00379627
SSDEEP 12288:CRmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:C+KI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T18675236A969C08D2F5F7C2B085C967C960E4ECEDEB46831DD22F3D114277A70686ECD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 87799b23333b333a808570ea2bfbd5b5b3914c4123299307939f1f1d9a0a3448
MD5 f20a28e234e28885345ca9ed7503735d
SHA1 773d8416ffd984fe6c6a8581bfffc77353877a4a
SHA512 247047ef092e4f82b792fdf93cae1e19b86a638e2d6777cdaa26d6b32085d41162ccda5d3bd4c1d81a31dc5e7b322f980a00b25d55af8f707114ea06e288e777
SSDEEP 12288:Q0mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:Q7KI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T18075236A969C08D2F5F7C2B085C867C961E4ECEDEB46C31DD22F3D124177A70686ACD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 7944be02e91e92698226dce9beacb514db769fbacbc1c9216e8f7340e284c67e
MD5 52dcd7b9135b12ec384b42a90fd91d9a
SHA1 9e515684d7abaf639e3a2d3ddb51f58f3d545c58
SHA512 054d0027b388392c5127616057d6b183b966caf256a8d494659530dbe469a56c4d9974c1f8fc5d2541de7c1f36d9e36839597d3356b5ec3179970e63ba0e7631
SSDEEP 12288:c4mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:cPKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T10D75236A969C08D1F5F7C2B085C867D961E4ECEDEB46C31DD22F3D124237A70686ACD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 4fbe2670556f4f583e6d814ba1091b7587e9feeed6447358853722fc5a9f4581
MD5 513853d66d30bc8b66dc1510024c3b5b
SHA1 dbe764e51912d27e65271c5cb64a48290198fc56
SHA512 c357df973cbc1b40ff059957c79048708513a05b7a6dc2bc26c47d2a2fd0a9be8595c365ac8eab4f01c9e64df8739d0bbcd53adf726629729513b652f083c539
SSDEEP 24576:1ZMIzFVSOXKI6k3sbIhKcQQVOORv3ilDIHo:1ZMIzfLKA3/KcQQxpylDeo
TLSH
T12E850195B39418F4ECA7813EC9559A46D2B2BC694B60C61F03B836275F333A11C3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 161ffc225a91c33541a9eda1e985b60c001fcd6fc19d7298f29c3a0cfe59ab30
MD5 03ef601f0ada5cb301dca1841f2d57a1
SHA1 f0375fd517881beab8244dfefb9f36071dae5d6b
SHA512 7d1df03f6ecc4902466912758c9719651a14e4d62651e40380f7bda13b726257bedd4eae16e3c97cba966428450315ffa7ca70c7b62fce24a01eec63813adaf5
SSDEEP 12288:HTmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:H0KI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1027523AA969C08D1F5F7C2B485C867C960E8ECEDEB46831DD22F3D114237A70586ECD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 6bba410a4073d40232ca30fdb10c1170001f73e8cd092c60ce6f8106f2d46072
MD5 da97f204ec2a164819b041e62a111647
SHA1 d8a46cfab4e654facbd6a372374b5c4f1481a20c
SHA512 a87a2e7fda2e91508277812ec40b31b060bde171d7066b8e6e5b71ee5606b470dc7daff913958eee924819a76cebf5e3e4bcb01f789e219472b823b02e4bdca5
SSDEEP 12288:1vmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:1QKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T17F75236A969C08D1F5F7C2B085C867D961E8ECEDEB46C31DD22F3D124237A70585ACD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 a3bf802dbb5bc2802311ebbab31d543ffaeaaf152a4d8de620872bacc7869de6
MD5 ceea2db8d8cb48335b7615f6e44f43a7
SHA1 da0781bbd02693ac4b9a7cbdeb9ce0b584512e51
SHA512 bdb799c117ce9fb89406e2918fd0f59997aa3afbaaf3189352c5cba24ef39ae8eeab8686ce313e3c5c5f0318dc3840a137f839ac81bf4d3c69ff06357bcbb02f
SSDEEP 12288:/yPz5L8MmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:yzyjKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1E985025773A420F9E1778238C8911A46F3B1BC7687208BAF53641B761F376A09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 7fbbca61505f676ae1843f0e2a9046bfb4259588399c0c2be783de466a46cc1c
MD5 3005e4d60f0f2ffc0781a8d9612ed18c
SHA1 0b35089fa7b7c42771a7f676737ad572a36366d4
SHA512 eb2b7d1d2238f5b1aaea17719479aeee4c4a9a8dabb523d9b0302cb399c3caef274367e28174e780b30f1719c1f47077b0113c0431b09b67f78d643fe40321fb
SSDEEP 12288:gTmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:g0KI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T16D7523AA969C08D1F5F7C2B485C867D960E8ECEDEB46C31DD22F3D114237A70586ACD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 07638c9dbbf8edbb357a503b321a2d053c780b109fb18ef70e28d5ebd46ea0ca
MD5 622d97dafcd72ad1940843b85cecf680
SHA1 ccfc4a8ec6fb148bc968e38d6cd286658e583cf7
SHA512 39bb81b83ba3c9ece00cda5b948d0c89ec0b6f0106eb0e92f5bafcf0b72d1f6107828cac9b89be728311bb1ae0e590ee19d74e81597a55e2154db975a71df290
SSDEEP 12288:wTmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:w0KI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1FA7523AA969C08D1F5F7C2B485C867D960E8ECEDEB46C31DD22F3D114137A70686ACD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 4476bb01ed15f23020b326809b9a9a213940fc4b5976a87c78bc08489fb2014d
MD5 0f1c9a4a5912fadeab0e2f6a21eae2f9
SHA1 3c1a7c8af7be93c6bb5cc79600128ccb3c122235
SHA512 e26c9740816a5256131198b9f19a70135f0d3a222c563035a92f6e24f1055ebf0316db287cc5d076769b882294fce9992432ee1cd785e1c6e064395cb48e5c16
SSDEEP 12288:7yPz5L8MmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:2zyjKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T15685025773A420F9E1778238C8911A46F3B1BC7687208BAF53641B761F376A09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 cb1d0784087532e775057d8715b3488c87491a035537bd54ef4a3f00dd72a37f
MD5 7dbd158d6e4b6c07099cc1fe82086297
SHA1 4580d27e18a1dc42a2a0409152ead1c8d7859ca7
SHA512 e72d5fdd38f3e855eba039a4d496a00786a0a44ef849ea302f1c66112215ba110049a2b9a9682a382cc4e163a95cc56ae17b6d24c65324f3ff5fa8a36444510f
SSDEEP 24576:7TmaLl3z0zD9KI6k3sbIhKcQQVOORv3ilDIHo:7TlLljqKA3/KcQQxpylDeo
TLSH
T18E8502A5B39018F4ECA7817EC9558946D2F2BC6A4760C61F03A836675F333A05C3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 b318ed0a09de4a25e13803e3acb5be673cf03cb24f94d8a101ae44d475c0b1b5
MD5 675a1b7d8e08f169dbbf8765a2efb3b7
SHA1 58eddf8862be90627b72a44a8bcc17ed5af6d78d
SHA512 727a3edac84070c39d4b1c0706552736b0cb6a36c06be3e3ecb5137da2ce76ccd1c1c7af53d2bbe048f21d1234b163a83e6f6cc34f9c212ce7c18aef2bd426b7
SSDEEP 24576:L3ed9CHKy7GZhKI6k3sbIhKcQQVOORv3ilDIHo:red9CHKyaLKA3/KcQQxpylDeo
TLSH
T1B395CF90F3E814E4F1B7CA35C9765511DAB67C995B21CA8F03A8261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 1cef04f9b57771605dec1cc740aa8d0c5f28a4cf81232fc3c67e7587d50de75d
MD5 760c53d15429223bdd306acfed4b21bc
SHA1 655668a4fe25555748bd58db3d66ea45c4c07641
SHA512 5120c9845b7390c84a82462cc0f77cf2fd77adc18f1f889f4bdc2409beb919d4ec8bc682fe0a3ae368196e63c4de96aed07539b2b20def2ee0bcdb19aec6875b
SSDEEP 12288:KimnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:KtKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T17F75236A969C08D2F5F7C2B485C967C960E4ECEDEB46C31DD22F3D114277A70686ACC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 915a0e255b2b8c4b0583154a01fe499347f542669376f320da11e4a16928db24
MD5 1857cc9eafcc7327132e5cd0d3754ff5
SHA1 faef5259b6f66874a6d1bc75ed20a7d03a04f933
SHA512 669a251a995d5feec8f398c5c825260812ff00da1e813a53e4a040a0691254dc0208d32be1f111775592824ea47d50177402521bdb42cbd5c714d02bea6e50eb
SSDEEP 12288:ysmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:yDKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T14975236A969C08E1F5FBC2B085D857C961E4ECEDEB46C31DD22F3D120237A70586ACD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 ad95dde449ea88fc4c8f249bb0644ed83f5d5124dc562372cb8e68232b3e729b
MD5 3f4362447cf012757b7d8027f27413eb
SHA1 af67b7986d148752459b0d9e716571ea583984c9
SHA512 67fb50d18d236ecc70cd069d0068aaa0c71c2b2dcb323cda2f82961212cc1d27e4a305c35ca6a5ecb828cd5348487ad3e9b66a712c609d94b71044889d21732f
SSDEEP 12288:GVmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:GCKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T18E7523AA969C08D1F5F7C2B485C867D960E4ECEDEB46C31DD22F3D114237A70646ACD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 2f7bc714703dd65e41ee33cdb5e80dafb69e9312cf1967dfbd55e9fc9bfe4ea5
MD5 04c7758c7fb2343ac69fb0381c248267
SHA1 8207005ad3ee1427374dcd79ce8da1985f28dd85
SHA512 d17f7e0fd2d7a1ddebc77aeb5fa5088abaff79e4c7d3b89a43decd8409d4be501d6ab2ba36cf98b7bb6154e6ed4f881fe7876dd658a2dc24d868cc854064a3d7
SSDEEP 12288:aTmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:a0KI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T10C7523AA969C08D1F5F7C2B485C867D961E8ECEDEB46C31DD22F3D114237A70586ACC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 af30d8a1d05239dec034b9b25bb18b6ca946753a8650b2910e51b87c6f57de82
MD5 74920e12dc9ce893df8d1431d75636f7
SHA1 92b29622b2f61a464d96cee5db838cbbbab997ec
SHA512 6c3ed28f4ab0a38f240931cd5d01c985022dbd42f934ec408d6ea848f092d2566525406e2f922a4fad23f5e852e90424290e2143621abd956465e1b500eb713e
SSDEEP 12288:b2sfDmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:ZkKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T19685F11AD29801E8D0AE9275C7955A45B3737C6987E1C3CF52D0F93E0F366A09CEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remcom.log

Path C:\Users\Admin\AppData\Local\Temp\remcom.log
Size 352B
SHA256 93780c65c2c9fe7a42b7c630eb228b56eabda1e27472d9e0d835ba8f667a15fa
MD5 07813822962e32093a5f468d1b008ce0
SHA1 03fb38c9ef685e8db07ca6224d921bfa79df31c9
SHA512 342a719cb185d37d7e999154a72623c353f477165888a92bc9458f68dcb7300e38b91c1d21c7c0b99df0d77a3f79d1456d17227f6e52e1a923e4040ed8ad24b0
TLSH
T1DEE0422F4AF58E670D5F610E10B89AE1B0663EF17289CE4D106BB442348E8BDA7A0352
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 6bba4bc586fb244b607a427cd0a0312a2f071e8e292e9d57fe07e96e69d4d03b
MD5 fc65eeb02213ff1e2ab91b3936176893
SHA1 32cab78761b1f5f918cd11d9a566f28f07f7636c
SHA512 7cd11b682d1c1f7046dbe778a06d70fd55ab3daa7477fb9052563510ffe000787244f047bfe9daae17858d4cd35007acc11cbf6fd4f1ad3e41ab1e5a7981c8c5
SSDEEP 12288:KWmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:KBKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1CC75236A839C0892F5FBC2B045D997692169FCFCDF05C25FE11E3E114136AB09C7A947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 eb1d7cad9a1adbd2afc96d2bb71a67a2dda53b6cb3a276a83d5a896886b6c915
MD5 67e68245ff296e65bc5fb07101442c0d
SHA1 93a64745aaf3b481ee46f0c4bb7f409be8c7978e
SHA512 8c8fb40261297f37fb9404d82f7ce4c1cf55b98f0ed51ba964adba459ec781310ac8a2f23a1ea2b6a4c70b0a2fa10c2f55a1fdc0794f886bc205bc2798c7e881
SSDEEP 49152:sa0h2GEkuAe73q3pp46zwwQbKA3/KcQQxpylDeo:sa0hNYG4JwHAigxAX
TLSH
T1D7859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 acacd9b2dcdac9dec7c12d6bc829e21ffdfe9397b8c46e6eb2ac4fe342c9761b
MD5 c6a2637cc736afca595433817b8c9645
SHA1 26b844d60fab5245e6dc926d822cea4c30097b64
SHA512 4767ee1ff0b78f580de70928dfb15f2e2938307781b403ac116836c222ef7289e8b9d6c7e0e806a27da75a2163378a08297f664d9c4d7139e6db1ff5fa9bcf8d
SSDEEP 24576:BhbHjPOKI6k3sbIhKcQQVOORv3ilDIHo:BhbHj2KA3/KcQQxpylDeo
TLSH
T11E75127E12AC10D5F1B2D2BC8585864AD371FC69571193EF6296923A0F3BEE05C39F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 792e0cd21c46ea3df6a82553a35dd7e46bf9dbaf9fe0dceb254179805ec13946
MD5 709a475bb11d69cfd22fb03737bcbc2e
SHA1 49ec9f9d835a27437d4f3c51779a3f2d723d4bd9
SHA512 64f012d451cde5d930a20970ad074c3c0be686489880ec85ebe2b4828e6bc6c8d17f617b7fc0783a591c0f16c50539047a364baacc9cd615391e85233570278d
SSDEEP 24576:V3YgnJcRTk4yti+R5dpR/mKI6k3sbIhKcQQVOORv3ilDIHo:VIgnaTk46ppR/mKA3/KcQQxpylDeo
TLSH
T1D045BF2DF3B810B9D8AAD136450147B5FB71782D1F209ACB0174C538AF1AEE85E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 3fbc04b545c5f211a10a2786a33ede4e11a037698b29b3b6a6a41c09ea0a6c74
MD5 14be70d8cd6d2e8a4d5659abb4fcdbda
SHA1 e8c56fde2dce19854ad4b24b6115b987d9596f54
SHA512 7ee139f5695f998deb1c2da6b6795c5af4b8481fa4a5137c3c167a9d07a8157ef83c998353feaec4bc66f08f670bc9b129346eeff82e10c17ff3506eb2c8207d
SSDEEP 12288:JCmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:JNKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T17F7523A9939C08D1F5F7C2B485C997992194FCECDB06839FD12E3D124277AF0687A9C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 94b25d1ba8f8102e7591d457d1a1e991d1e3c1528ac86dc150265d933cdde4cf
MD5 8d2c053fc0c72c7979c41b15842863ab
SHA1 556e82fdd8a0a8a3c107e7405ba7f03fd7fecc69
SHA512 00fd01cd3a271fc02b0dfcf9abeb30063e443c66e4351d5885cc5928715fc0fd6d5b5bfa64a91563260233a25726a94c4d828f05908de811832fa6ac0a52aea9
SSDEEP 24576:KWL3UTIKI6k3sbIhKcQQVOORv3ilDIHo:KWL3UEKA3/KcQQxpylDeo
TLSH
T1FF95F155E79400F5E8BBC13CC9A68A16E2B2B89D0764E7DF03684A651F237F14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 5db2b88fbda4bbd059e876ff9362943e3dc52f8a7705f9936d30918aa5b4aa32
MD5 fe5afb05c7a3d6385fad17da9b290cb8
SHA1 852765855d0bc19c05c867ae73977a129c2dbd82
SHA512 1b6402b03dae1dc648315ad90cf5a4da69878912ad9d007d8ecc1bec3c44904c3223e00b113928d993820f5f539b622a610e72b0b73145aec14e2d03ff83ecae
SSDEEP 12288:upFtjODmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:SOkKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T1B975022A33DC10E5E1B6917C89D6834DD3B1BCA5471293EF4290957A0F63FF46C3AA92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 afd0a9492deedd3e5ac2ab913e42d530a666e16bd2309a8a66f45cf7641479d7
MD5 9e9600357d6269b808aee9112eb4471d
SHA1 5b2f722d949b0363d0db5d6e7917223cc80ae93a
SHA512 c78596cff883d53d64160b3d02c6c3cab2648965f98f0dc5cc2ed978a932ab5cbf9b6020d61e9471b46aefbe940a2d1f38a2f979a608034e928baa21516a9db4
SSDEEP 24576:67NM9YmZqmWMUkPjZM48Mv6bEhsRKI6k3sbIhKcQQVOORv3ilDIHo:67cBWMpPjN8DbEhuKA3/KcQQxpylDeo
TLSH
T135659E2E6BAC81E5D477D13DC9E28245F2B2B4611B318ACF5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 12f5d71af127bf845f332ea9ec41882784bde694cf79b004656f3d606c43ed3f
MD5 f9e2db26a5bfad396a5e687deca575d3
SHA1 75dbbf91a0d6f21c172d89b464905eb0c90e13c2
SHA512 093d15003caf3d1c1233eefcdc4fd329ab14d18083f1f6e22b38d04980354dfdb56d376e503a7b8aaa220c87c2d130e10f6274e7b0c6b5397c7917f4c8594e56
SSDEEP 49152:DF2YuHNETovcvNYf8kmxKA3/KcQQxpylDeo:y6tCf8kFAigxAX
TLSH
T18C858E2927EC80A4E0BBD27D45F6D246FAB2B8551B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 ce7082bff321324caafd310320e6887af001020f50934fed2362ca1ca0730eeb
MD5 fcb77f3a1ce8919b31e783d762b0f0d1
SHA1 70fe910de2e40927283a5868297710a522237078
SHA512 60c20bb8b064bc7f6e99c8c7df5036087896665d73910771fe6399263639dd7b8b77c9ffb2177c519973f56daead68c178fac890be843f7465cd0f4f804f4eb8
SSDEEP 24576:7AFs06+OmlfkNXEbTowKI6k3sbIhKcQQVOORv3ilDIHo:0Fs060lwXu7KA3/KcQQxpylDeo
TLSH
T1AC65AF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 cc9c8410cbb90c90ed39ef9b24c9819a282d5dcce940a2fa7f87f9607c2d7ff2
MD5 f1b98fb68ecab08f75842f82599cfc52
SHA1 221feae4ed95cca75197cf76d8aee0b728862d73
SHA512 f76c7b3867599cd51535467926731b2159379920c4f9801cd56adb9f0aed8ac24f94510b8318a6fd247c4967fec68a4670640e63a83756ec7b472a3727f9611b
SSDEEP 24576:7JnJ5D3Wd7KI6k3sbIhKcQQVOORv3ilDIHo:7JnJ5DGd7KA3/KcQQxpylDeo
TLSH
T1AE95D02DD2A810E4E4B7C2B4819A1796FE72387D2F226ACB6474D5353F12FE09979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5fd6e811c2ba8e6bdd15b5745b6019aa3d2deb7a068d2bceeaa4e5674e1f184a
MD5 5be265682d96d671d9247207c43dd634
SHA1 a2412f8003f260d8aaf3aced069462a773bfb4ae
SHA512 47b7fa5501b690b26c9a30fba7c134b745c7e95b30ebf71c47cc999397245e6c4693cb91957cf918828582a89050bbc87a52cba845fbc80eebc302fa6a5cee82
SSDEEP 49152:3o06DIKdwc+eQnSt65aVVKA3/KcQQxpylDeo:YiAigxAX
TLSH
T17C956C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 c3348f8f9e6277d0db599fdb4347437896551e0b8c9cfb54033cba890b75518d
MD5 a27a2bb5c99d17985ae54565d2c037f6
SHA1 d5250bc00a7fd09fbcf72066ccf1b7fbc35554db
SHA512 6d045e7bb12124165dbb25b2833b985741f11493c0bbf7084c8356b57aad15f86c1c63087fa91013cbfd9fa7484c8ca1182153be16d63aa5f4eee7e05728c7dc
SSDEEP 12288:REP3RY4mnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:CYPKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T19475126E279C20E5E17AC17C85D08649D3B2F4B4AB0257EF42A5963E4E37AF42C3DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 c09606b9fba07787463ca58b09e0ff01fd468bec0716c1ceed426a78efe06510
MD5 a836cc62715a04dde4cc3c5a228f61dd
SHA1 c5df9a2a8f286df63d82f311946ad550b7f92ff1
SHA512 ddd84fce3aa12c0f88e93b8f2a3fe96f1b9dfb93605175a4b2bd853c446293230e0abe5edb84966ed3a9ac83721e0fc944f0781e31b7811d529f1a15a0918752
SSDEEP 12288:SjkyRmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:SIy+KI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T150851209639814D0F5FA82788AE682949674FC749F1183DF9190BA3E5F37BE0AC35F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 713e44a94a5aa4410805dbeff2e1e579baade91882106865fe51b20259bf595b
MD5 8e2a802c6d04f3f0254fa4241a898c4d
SHA1 e615e33317375436075f28de360fbcce95e94d41
SHA512 607351cc0183b2455377a1c4e70112f5cca8a9d70d4dee22e3274cda372454b4f31293d8f171f8044bc4f07e3f2441fa9cdaf6cb6ff038b7501202c78e121a3f
SSDEEP 12288:DgzmnaZUb6Uz5NyZ83ot4HZwrcgJO3RAcc11ZOVB8XZf3YRv3ze8EPrMvHo:MUKI6k3sbIhKcQQVOORv3ilDIHo
TLSH
T19275236D539C18D1F9F7C2B481D9579951A0BCFCDB0582AF90AEBD318237AF0647AC82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c2df033b4f1d3a96014492b282d83bd98b59849bd1d3355289dcf15337eaa52e
MD5 87bdb684519a8db077cbf4c95052f4de
SHA1 a7607f3cfda9b6b86304421b3ffca1068447bdca
SHA512 17fbd19cd52a552f589436e612436c68967f07782d0faf3591d7781541f56c443bdfff4d095aa7ab637a3b881f00e71faf9dbaea572103b3e9f84866ea7b112b
SSDEEP 24576:2Q9MxZKdcz97w35KI6k3sbIhKcQQVOORv3ilDIHo:2VKX5KA3/KcQQxpylDeo
TLSH
T146558C2DABE9099AE177C27595A250C3A673B4301B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 0d7d5052ac79f752a90e596a385a1cb46b75b18cd27d467336892a52cc07fa58
MD5 90fe747384700ab6ea149f806179f264
SHA1 52c0b1fef7073873960ad3a153cc1a42944c9315
SHA512 86a35a20616664d946f3870554b0afee3835fc8eed66101c8d4a39682988a92d69dac4ba697673a70c0c7e25e57cee9a2806d6ee11cf672f710e519cabc6d4e6
SSDEEP 24576:8yocWAp6KI6k3sbIhKcQQVOORv3ilDIHo:hocWAp6KA3/KcQQxpylDeo
TLSH
T12F85E01FB7AC40E2E176813C89858745E3B3B4745B5253DB6691C73D8E27AE8BC38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 274216170ef04e43776949aa8d1d97598371797d1a8126ed178b7a976096eb5f
MD5 a9e2a61fe0c3aaa4ba0ac611940b2c7b
SHA1 f9fc9e0ea1218fc274ae2d79a835d0dc76447333
SHA512 9d40f70c6c889ceeb6cb192a6c13519d2f7c29a1f64f55a2b065da86e90f6d7e9a743c250713e57e2dff2ebc7d31a73025aa3b6935e9f1c056ad37b2958f745f
SSDEEP 49152:+WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK6KA3/KcQQxpylDeo:Y0zuNIrAigxAX
TLSH
T11AA57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e069e36c70dadacd08b7df9fafd2765bb5467c6e2ad321fba9d5e5d66e56af68
MD5 e2d6de7a3620a7d2b935df3513d4004f
SHA1 b89fe64f09e9627775d97e80b8f1f7a1e7d9ef4d
SHA512 a83ee2342e01eba7f72221192f56521941bc48ceab9cbd72cad98e1f704812d5d7e75a8befd345de4f57eaf2bc2c27699073203a77ccc62abccb383a748c8f1c
SSDEEP 24576:51QT7EcpfxR+N5AWAz3ooiYujMqbPKI6k3sbIhKcQQVOORv3ilDIHo:sTDxR+N5YzT4jMsKA3/KcQQxpylDeo
TLSH
T1A055B02EA7F805E5D1BEC5798A23C512FA727861033193CF42A0C17E1E6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/208-414-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/208-527-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/208-408-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/208-417-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/704-482-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/704-498-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/704-530-0x000000000D250000-0x000000000D258000-memory.dmp

Download

memory/704-529-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/704-514-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/704-451-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/704-439-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/752-355-0x0000000140000000-0x00000001401F4000-memory.dmp

Download

memory/752-523-0x0000000140000000-0x00000001401F4000-memory.dmp

Download

memory/752-347-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/752-353-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/756-43-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/756-76-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/756-37-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/812-84-0x0000000140000000-0x00000001401C7000-memory.dmp

Download

memory/812-79-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/812-63-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/812-77-0x0000000140000000-0x00000001401C7000-memory.dmp

Download

memory/812-57-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/864-343-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/864-341-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/864-522-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/864-335-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1308-528-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/1308-429-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/1308-426-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1440-540-0x000002424C8E0000-0x000002424C8F0000-memory.dmp

Download

memory/1440-542-0x000002424C8E0000-0x000002424C8F0000-memory.dmp

Download

memory/1440-539-0x000002424C8E0000-0x000002424C8F0000-memory.dmp

Download

memory/1440-534-0x000002424C8E0000-0x000002424C8F0000-memory.dmp

Download

memory/1440-537-0x000002424C8E0000-0x000002424C8F0000-memory.dmp

Download

memory/1440-535-0x000002424C8E0000-0x000002424C8F0000-memory.dmp

Download

memory/1440-549-0x000002424C8E0000-0x000002424C8F0000-memory.dmp

Download

memory/1440-541-0x000002424C8E0000-0x000002424C8F0000-memory.dmp

Download

memory/1440-548-0x000002424C8E0000-0x000002424C8F0000-memory.dmp

Download

memory/1440-547-0x000002424C8E0000-0x000002424C8F0000-memory.dmp

Download

memory/1440-546-0x000002424C8E0000-0x000002424C8F0000-memory.dmp

Download

memory/1440-545-0x000002424C8E0000-0x000002424C8F0000-memory.dmp

Download

memory/1440-544-0x000002424C8E0000-0x000002424C8F0000-memory.dmp

Download

memory/1440-538-0x000002424C8E0000-0x000002424C8F0000-memory.dmp

Download

memory/1440-543-0x000002424C8E0000-0x000002424C8F0000-memory.dmp

Download

memory/1440-536-0x000002424C8E0000-0x000002424C8F0000-memory.dmp

Download

memory/2168-250-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2168-257-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2168-251-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2168-263-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2168-273-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3076-524-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3076-367-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3076-358-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3076-364-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3456-27-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3456-232-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3456-28-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3456-19-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3720-416-0x0000000000400000-0x0000000000589000-memory.dmp

Download

memory/3720-295-0x0000000000400000-0x0000000000589000-memory.dmp

Download

memory/3720-288-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/3720-293-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/4108-526-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4108-402-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4108-405-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4576-404-0x0000000140000000-0x000000014019D000-memory.dmp

Download

memory/4576-283-0x0000000140000000-0x000000014019D000-memory.dmp

Download

memory/4576-284-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4576-277-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4880-239-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/4880-240-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4880-246-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4880-366-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/5220-521-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/5220-330-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5220-332-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/5320-376-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5320-370-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5320-378-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5320-380-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5320-382-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5344-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5344-158-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5344-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5404-320-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5404-518-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5404-516-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5404-318-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5404-450-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5404-312-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5608-301-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5608-309-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/5608-307-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5608-428-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/5656-392-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5656-271-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5656-265-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5656-262-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5924-233-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5924-68-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5924-78-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5924-74-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6080-390-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/6080-384-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/6080-525-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/6080-393-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/6092-34-0x0000000000400000-0x00000000007AB000-memory.dmp

Download

memory/6092-0-0x0000000000400000-0x00000000007AB000-memory.dmp

Download

memory/6092-1-0x00000000023B0000-0x0000000002417000-memory.dmp

Download

memory/6092-15-0x00000000023B0000-0x0000000002417000-memory.dmp

Download