cf5fa3962ebdbd793db5e8fda28d72a636fc3e5ca880263162c1d49f531345d6

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_dad7e51c533812ca31abda4cfb6d8aa8_amadey_elex_luca-stealer_lynx_njrat_play.exe
Size 1.7MB
Sample260528-sehfkadv41
SHA256 cf5fa3962ebdbd793db5e8fda28d72a636fc3e5ca880263162c1d49f531345d6
MD5 dad7e51c533812ca31abda4cfb6d8aa8
SHA1 7ede423710c09ea649c79735ea41d2dbd91a7747
SHA512 d7f93343ce17b93093fa0d73a18adb79bbf8be95a73c23528ad0b670e43f57415992afaa6e3b6ae28361e263b2f4ab07b363eeebfdf0aa1a32a99a6c57c7627b
SSDEEP 24576:t4l9rSNSEzO8IWx/5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:SSSEzVIO/5I1AWwa2aN4ERAEjHrd//
TLSH
T12C850202B5908032F9B315374DB8AA316EBEBC704961DEAF53D85A3EDF315C0D629663
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
4012	alg.exe
4680	elevation_service.exe
1768	elevation_service.exe
2124	maintenanceservice.exe
5660	OSE.EXE
5564	fxssvc.exe
248	msdtc.exe
1896	PerceptionSimulationService.exe
1224	perfhost.exe
1068	locator.exe
2016	SensorDataService.exe
4788	snmptrap.exe
2892	spectrum.exe
5384	ssh-agent.exe
3348	TieringEngineService.exe
5068	AgentService.exe
5100	vds.exe
4744	vssvc.exe
72	wbengine.exe
1588	WmiApSrv.exe
1424	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-28_dad7e51c533812ca31abda4cfb6d8aa8_amadey_elex_luca-stealer_lynx_njrat_play.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-28_dad7e51c533812ca31abda4cfb6d8aa8_amadey_elex_luca-stealer_lynx_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8c68754dee2c9d24.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-28_dad7e51c533812ca31abda4cfb6d8aa8_amadey_elex_luca-stealer_lynx_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-28_dad7e51c533812ca31abda4cfb6d8aa8_amadey_elex_luca-stealer_lynx_njrat_play.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173093\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_dad7e51c533812ca31abda4cfb6d8aa8_amadey_elex_luca-stealer_lynx_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ffb19a2cb3eedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d455fd2bb3eedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea07ef2bb3eedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001546ac2bb3eedc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082052d2cb3eedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4680	elevation_service.exe
4680	elevation_service.exe
4680	elevation_service.exe
4680	elevation_service.exe
4680	elevation_service.exe
4680	elevation_service.exe
4680	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5116	2026-05-28_dad7e51c533812ca31abda4cfb6d8aa8_amadey_elex_luca-stealer_lynx_njrat_play.exe
Token: SeDebugPrivilege	4012	alg.exe
Token: SeDebugPrivilege	4012	alg.exe
Token: SeDebugPrivilege	4012	alg.exe
Token: SeTakeOwnershipPrivilege	4680	elevation_service.exe
Token: SeAuditPrivilege	5564	fxssvc.exe
Token: SeRestorePrivilege	3348	TieringEngineService.exe
Token: SeManageVolumePrivilege	3348	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5068	AgentService.exe
Token: SeBackupPrivilege	4744	vssvc.exe
Token: SeRestorePrivilege	4744	vssvc.exe
Token: SeAuditPrivilege	4744	vssvc.exe
Token: SeBackupPrivilege	72	wbengine.exe
Token: SeRestorePrivilege	72	wbengine.exe
Token: SeSecurityPrivilege	72	wbengine.exe
Token: 33	1424	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1424	SearchIndexer.exe
Token: SeDebugPrivilege	4680	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 6040	1424	SearchIndexer.exe	106
PID 1424 wrote to memory of 3300	1424	SearchIndexer.exe	107
PID 1424 wrote to memory of 2772	1424	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-28_dad7e51c533812ca31abda4cfb6d8aa8_amadey_elex_luca-stealer_lynx_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_dad7e51c533812ca31abda4cfb6d8aa8_amadey_elex_luca-stealer_lynx_njrat_play.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4012

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1768

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2124

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1516

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5564

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:248

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1896

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1224

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1068

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2016

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4788

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:6016

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5384

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3348

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5068

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5100

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:72

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1588

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6040
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2752 2904 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3300
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2956 2952 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 91976c4b33285d4a25a61188c19888ffaf1c8ebe2a14590779b82ceed941e339
MD5 0429b063205342084ea9b3d8d77354ea
SHA1 1b3376ca6816128cee6f656a2e529407fff42a4a
SHA512 283081234c537a9fdb93b07551efe7622508f21cdee33f314ea4fd020d1179cb14594cacfe48b845174b91e5f2c61be1b8e0603d93a7959ac2c91629bfeb40ce
SSDEEP 49152:hb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnK5I1AWwa2aN4ERAEjHrd//:n3q6mjBP6m22aNDRHx//
TLSH
T10FD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 9877fa8e5530658a62ca78b48820434aadae4b9245156595459edbed0b0bbb02
MD5 247e5e0bee965e07a5c5951c33b52ad2
SHA1 9174914466f8eab51f0a94ba51441fdb7073b5cd
SHA512 f126419b0b326c5b2090ac1b5c6cf5793660c65da2ad4a02b46e02b2921ba9b22b59a49edcbf80f73955ed6c6c3acff0587660bbe2578b7f0b26bbe0116cc70e
SSDEEP 24576:cXYfDtczAT5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:btcU5I1AWwa2aN4ERAEjHrd//
TLSH
T1D985F128779408F9ED678239C8A28511EB33BC514760E79B03E4EA795F332D85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 e8aa39b4cbc0e55d45f0dae2af4b151f7f0a074df725ebab8f4194a7ab481937
MD5 4b3d2a99297348982262cbe9246d7a35
SHA1 8bdf990948ff27c3943c50ba52f14c7c4f17243d
SHA512 af08e59fe8df98c64cabdcfd4f8ceda728104f9bee5c9b0f13e5e6fa90fdd8575cc8388a34eece8baf2ae9ed08f2f8771da5282817eafb3700064765cd4623fa
SSDEEP 24576:U0Le5ji0hmxErMy5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:UPji0AGB5I1AWwa2aN4ERAEjHrd//
TLSH
T158A5AE16F6748331D073C0B9C5D2A69EEE7234825B308ACB4286D77C7E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1448fe25878bd8e50d41fd2177cf68ffcd8333c30f6e9a9b1ede1251ec676177
MD5 d9a7f57ff0d63fd0fa6c2091b998e313
SHA1 0b92ec627bafaa6980fc28e0f318d0b51bfd1d4e
SHA512 56a90c787975d23c9517da697d83c540d5e2eeafdbc44323685f31354773fa9a1ce94bc25ff09ae779fa869a91fd724535efe7f6dff30a578301a0107c9cd103
SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWj6q8wyuE5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:B/ezSC6vUzPv+HjyV5I1AWwa2aN4ERAg
TLSH
T139756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 70e96ae0010c113bcbc8aa067b78b36b33e011a90a3a32fb0ec981858e67ab4d
MD5 5198cacda99d0ab9abe5f80f98eb1f19
SHA1 970c70d3196d27da3fb91781fe6ff8866a83e6af
SHA512 aac3d0bcc00caa37a1f9c693f67f05f675840434f77bbf6e928c192b1ad132823847d882b821bda2d92132d109c851521cd0836251f71af3f4a1c95928ddc547
SSDEEP 24576:9VbqPb88hv/l+B/5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:9VO88hXl+h5I1AWwa2aN4ERAEjHrd//
TLSH
T15A559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 983ddc3131ee0dd019c9b3c6b51091707dc3eebe8dca85ec74f6b5c1bb614252
MD5 ecdc7b301abf21862cdc47d73f42e6be
SHA1 a6949d4aedcb21fb5bab5c8fdb155730737a2fd0
SHA512 26c6f0b60cfc609b78e4538e69f22d17281e73bec0957c12f1904b5c73a3c76d6961b636d1c6a43ad1603f7df104e9911fb0608696ded50c005e8d6d8438ceef
SSDEEP 24576:p0+5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:V5I1AWwa2aN4ERAEjHrd//
TLSH
T1BD75234A971CB06BF7F3453268BD2466B777EC90DD489D2B889AFB7CC478469D088443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 ea5f64241f097fbe8b637aa54f08242092f96480acd00ce582264fbe30cc0360
MD5 45026bdd90bad2ae72fc1f94eda5babf
SHA1 6bb643df74f706b5901c1def61434c0e0413b1fa
SHA512 311853423d9072abe01ae0e64ad1d0162585cbbad549edbfa99068b9d86f823564098aa1fb4c10d69638145b92a64e87c0e41d7fc440f5ae1157c34cab93d46e
SSDEEP 24576:eJIUn5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:eJIUn5I1AWwa2aN4ERAEjHrd//
TLSH
T10685CF2BEE28FCE2C27A8DB95A918600E77278704F51A3CBD165C31EDE235E05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a3cb793bdc66b700da55471410dbf6aa98ecc971c237de05dea52a441891492e
MD5 a4521611b8af96309eceaa10628a8aef
SHA1 a905ac2913921661674f13f173bbb250b427f69f
SHA512 3e6091204407ceb6c8606d8fec457f32c8f71253e12b549a5e0e0e7bea729235f39d3e3ca35643e045b4a6585635045ccf2d154c00501eda791f1b385b1c83e0
SSDEEP 98304:XQvGAdlCEL8c/WRNw5C06m22aNDRHx//:AvyEYc/W3w8iah
TLSH
T156266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 42be1ff8938adbd7d4562b7477b9e88a6cdbd921096eceb9e653cabcd5155998
MD5 e6cc4baaeb7edf57d6339eb20811c429
SHA1 86fcd59d44d8fa32fa3197a1c0e2f8beaac75e31
SHA512 a1815e6eb2b0ce34d475580a1ec98ae2041acbf8b5fb7effde3f207a4fb658f1585e118aa6272c976c3ae808f7c1ad7127ffa388df2508350db359f68e11c883
SSDEEP 24576:GwewsAjx5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:bljx5I1AWwa2aN4ERAEjHrd//
TLSH
T1A495E031FA74E036D3BB0DB21B36D716643DBD204F511AC3E3A89AAD99341D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 863a347e6274f6c07f047ba149c43585ee5dc8baead33e52a69b9cda4a41b36e
MD5 370c1bb68f045a288ed67c0e491228a3
SHA1 330ba586827f6472c6627fbe91dcc566abeac075
SHA512 90759834462493257c5f39c31324cdf7ed7f5531640f8eebe4a0a2467a1a42aac6893f0a019838a725d0d543e1139496bd4ac42e07dd2462a381ee1f6632656c
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHlah:pUEtQevvqc2W1cpV20I32la
TLSH
T1CF474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d680fe3d0b5edeb68e8b75c4facb71f9bf71254c6ce89f43f057481c334079b1
MD5 ac3a12c21e64fc581d8a8718a951d462
SHA1 297a0eecb9ef77062dea623aeec5dfe09a5c1d8b
SHA512 b3c29a265d0b592f5505f476f49d2c0410a1d35746fabd9ff863e83c6ef4b82c8a9480d33dc966f69af31b84e290c5c7b7b00ca3819ce03ab335af29d811483b
SSDEEP 49152:/CbRquA/m2yL5zifFiV+XenmE3/zR5I1AWwa2aN4ERAEjHrd//:YoqHVjnmI6m22aNDRHx//
TLSH
T1B7D58E0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4fb694079c62002a60493ad2bb39c6502274efeec32a41d934757754cd3016ba
MD5 42d2faadc296936d290d7bc479bc1a43
SHA1 1612de9a1609bbc48f20a1f3061574c7962ef3fa
SHA512 2ddecfdd5db044a624fa4d411550f9c30ea400f233614b750f3fa837ec7a30ed192b88282a66cf3cf7afddb65bd02dc22ebc21e35073bb9b0c0c9c7dfaa9d7eb
SSDEEP 24576:6AhGL6IFoiwtA5l7S53o5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:6AM5Foiq545I1AWwa2aN4ERAEjHrd//
TLSH
T1DC35AD81EBF955D4F5F3AA7899B69171EA76BCA65E30C20F1160D21F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 02ce3d12425ca7836e267acae687db008827cd9fd97eca1d44f58bb93b03e6b0
MD5 f85ff127c2b2de430534828fb2901db0
SHA1 3c95b643462fb430c85753d78f65a9b284c56a09
SHA512 69a2be8c6e5be4cbeafa37e4cc96f6ab6900fad0cf113767ddce883200853b5768c6f7e2c682ecb6b4128051d79bb51400af78fd54d7c45cd4ba3957838a9d74
SSDEEP 24576:zwuoOW15I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:zw7Os5I1AWwa2aN4ERAEjHrd//
TLSH
T12D85F14A77A81CF9E5B3813985978136F7B2BC112A24DB1F0760C76B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 a9df0d3c3fa6a860cdd60ac1121f92f568da468deda066ebb338a7d3c60f47b6
MD5 946f0645a5ee2ffce4ab55254fe04089
SHA1 663e03d8f70f26bd4d8bd268ae531435b98b5b0c
SHA512 7dcde5e5fa7f8a6928aa7c000a535e29375b7c490bdd1e0fe36776744cff35c3f53fb8dbcf42ffa0812ea1a797b6db9a89922c18050a52f76a71271a7a5b9a68
SSDEEP 24576:sZu65I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:w5I1AWwa2aN4ERAEjHrd//
TLSH
T1F575124A23A870FAF2B38239D8F51505E772BC616B3443CF0569A7799F32AD55C38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2ff26947eded961519664bc3a6708f49fdb179d3797654f5861889be35ab417b
MD5 e45596edecde0bf84f7756b399a25f40
SHA1 1976f324a14dd1237d4bc653c7a46b751fefe367
SHA512 46551146398bef1be531287aa3568c37e18ae999db247b9053896674abf154ca1bfff94274ab5c2fb4d7b3b0e6fd2cb6e4f9e000fe9723b99aee88a7f632018c
SSDEEP 98304:yQRQyi36YOcPDLvw2gAf+PN3b6m22aNDRHx//:pQyiKanX+PNbah
TLSH
T1EF667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 73e00a9afee48c6e120f09c423107bc1d07e33b3d6cf6902fd89a2be6bec5952
MD5 fc34ec37005656f2d6c884f6ac83fe5b
SHA1 b839d9e5003548e8f99190ff6c7667be1543faca
SHA512 77b43a7dc42926c1d6a2786a2f498b6516b6ae175c76465f2725e2b189d5de45590f986b46a937184bce4dbbcff6b1b6e7c45b45dafc72bc220f3d8c471d1870
SSDEEP 98304:sQRQyi36YOcPDLvw2gAf+PN3b6m22aNDRHx//:zQyiKanX+PNbah
TLSH
T108667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8ae3867131872a9947a10e4bac1411c720f7b46e342d9b8abf64fc040b2e579f
MD5 ecdd6d97dcc79304d9028d8f9b52f51e
SHA1 528f429dbe92617bf350e50c1c5a9bde6c6ffefa
SHA512 38c3e2e4998a97ab753d102deb7467eafdbbdc9c9241f05faf364cd206bcdbd701fa3a807c05b6106c0ee09e86f09d917ead6232ac67db50c4dff2757d9fd2d1
SSDEEP 49152:768Qg55nhkeWu7PNU3/B5I1AWwa2aN4ERAEjHrd//:FthTRc/B6m22aNDRHx//
TLSH
T167B55A33B2F600A9C44DD1769F4A873196D27C718FE0E3DB8515721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 58c0c30ea2487d3ce580741d276329a24ca6f4b94a02245d3d958038d2c56038
MD5 9d9e55f235e9820ae133138c01f9c453
SHA1 8ca97d8fe53b115f54025c0b149363e9e04fdb2d
SHA512 9835e4405b2b9ee29808a089fa1d95ff2ae5ec93d44bc7e882b6774f3eb8573d362653a5053067bc069164580e1f710f15f6de8dd3adeecb0538966370bd8aa6
SSDEEP 98304:by5112gYy5azzVvU69nLKnhZ+6m22aNDRHx//:2LIHRWhGah
TLSH
T1C4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dc6ab665250bada56633d3d72d15349ba9c951fe2d5ffb61d6331b5aa5ac6c71
MD5 832b54cc12453ad1ce90495518131795
SHA1 e4ef9ab7095e9488ba1c5fbc1aa80a898a2c578d
SHA512 f2277b792fa658338bec500d854cff2e9d12eff515efd6793c194cccb8ef07490b8db114292d959f254bf9a7fa5e00ef28b292d5fa904895b8aa107e510bb5c3
SSDEEP 49152:LB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glj5I1AWwa2aN4ERAEjHrd//:du6JmIxd2dj6m22aNDRHx//
TLSH
T13FD59D13F1D901E8D06AD478974A9233FA62BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fcea2833eff173aaf892347015c9052ee15156637a13487a8a7ea0dc0a470e4d
MD5 c65c6c19404bb8756b890eb790db6531
SHA1 786c3c4c99b3100e869b1fd7e66e4b923ebc897e
SHA512 c8eeaa84fe44b2d107d517cf618c79c88b346c894429720f00da6b63eb142f4607f6f6b5c4649e7b0e421dd148d271d3b119a95d68f23014f437cc49e1ad9ee0
SSDEEP 49152:u1hpsNoJpF1A67U44CwH7R4xH5I1AWwa2aN4ERAEjHrd//:umifPqRI6m22aNDRHx//
TLSH
T114B5BE13F2D801E8D06ED17887569232EA72BC460B34B6DF0A90B7961F7BAE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b929d56b4a90242a5bcc30b1ab3bfb728caa188c104308e609342826402008d3
MD5 3854fbd8b850bdfca038623fa60c2fd9
SHA1 8703b0a0f5bd67212024922f09008e464b65dbef
SHA512 746b27e58d560bb31a2dbbf8aabf534ee8331834db7a2f2ea20d8e8ed585ac2f0353700df4e09d4ad3b453eba9fe2c5a589c87ed477a1086fc4fa95b7f00f45e
SSDEEP 49152:RSuZQIY0Be2KkRVtOnks6NMHq65I1AWwa2aN4ERAEjHrd//:/5dKqi6166m22aNDRHx//
TLSH
T176C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 33fb94bec30058344c7fd8fea85910dab055c8856c0514de5cddde9c5ffd060b
MD5 92b04824e8ad8408620a8e2389c68493
SHA1 59b2df84b86a695f68fdb5b3e6f4953359131cbf
SHA512 3c8f3b54cb57b8a80db257b1ce22c513d9426f07fe7ed54d1ed10516ce4c1a9d2ce7ea5c57876aea1a3258a6a975db7fea9238a8ff99912690ac44fe6a20fbdb
SSDEEP 49152:EhtSn8EApI0figjgiDn0AP5wT5I1AWwa2aN4ERAEjHrd//:FX2iWphM6m22aNDRHx//
TLSH
T1C695BE13F2D900E8D06ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 963f440e021b7c0f12cce9167f262bf9909fd1c58b363f84d465917bc557a1c0
MD5 553fb574c0ca4ed5862975febe244eea
SHA1 346b0b80993c780860e4e6344414db9c89ce1634
SHA512 587220d3f7ad60ea8ea7cddf2618f6ade439a152834cc154e7d728edc645444b379e9f3edda86c9855590d236427a50dfe9ab5fc237844b12a704692161ec7e4
SSDEEP 24576:qm5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:H5I1AWwa2aN4ERAEjHrd//
TLSH
T15C75230E9A1CB17BF3B3857298FD2065F737FC91EE44592B89DEF638D5784A91048882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 2f41c5e20419dd4fe5cc92224c98661dbf64876add4c1270123f6977313bb255
MD5 93599f39e6e32ad337f251634201b972
SHA1 161ed2519f74675c0e8a5a35188deb613aa3c653
SHA512 9f4edf41d7320b33e3618626c469ddac48544c8c96be59b70f7b5bd266482d3410ed63e65cb30a4ff5d7ce8f5238dbcf87276f415d8287bcec1fe771044e939a
SSDEEP 24576:ZN5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:T5I1AWwa2aN4ERAEjHrd//
TLSH
T10075230EAA1CB17BF3B3857298BD2065F736FC91FE44592B89DEF638D5744B91048882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 4a35cf0a5d3c2b4635143c6485b85539ab8f4c2b873072068c471786112085e6
MD5 98d3cfae01c3db58a5218ad2a5ce4e06
SHA1 d427ca0834ab7e7ccbfa7265aae5872871879a7d
SHA512 75154c9200c394a596416fa668fe30beefb23501420bad2473b2e3c47c4ad66ef469771d5f676340b2b71af3881339b505d9c37bfe4af59621867df4c474ef78
SSDEEP 24576:OP5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:25I1AWwa2aN4ERAEjHrd//
TLSH
T10875230D9A1CB16BF3B3857298BD2065F736FC91FE44592B89DEF63CD5784AD4048882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 ab1df448065a8a870c0ccc1741ed03138b995c18756e353e53cf3da37599b70a
MD5 521c6981e70c3089b1c54173e68d9e10
SHA1 bc4fd2eaf1fd92c6b282c8c5b9b409b8f950a836
SHA512 7bb67a7ff5ffef2fe6b6742f250042faa170eae05f8d9495e1326e29746568590d546def5e052024a1f11799403bc99c374f76fc8f023e0ffdf13417b60889eb
SSDEEP 24576:z5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:z5I1AWwa2aN4ERAEjHrd//
TLSH
T19B75230A671C60E7F6B3C275C8BA2021F777FCD0EF249A6F8995B67C8D712A85458C42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 4853abefa82f2af976251944173f5041e8907c463e1f0811aa5026d073f1e75f
MD5 de5f3e1a31222bb71eeeeb845acdfedf
SHA1 95678bfbb54ecd2182015f229a15e82608d4c71c
SHA512 136ba1e42fee6c1e98dd0f6514bf8966c8e6f930b13abe851a8a12c9bbb094eaa404ba4e946a2bf96abcd3d68d921cb62fa939a75f16e3f63f3421b5fd7c76e5
SSDEEP 24576:Wg5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:b5I1AWwa2aN4ERAEjHrd//
TLSH
T14875230E9A1CB16BF3B3857298BD2065F737FC91FE44592B89DEF638D5784A91048882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 8444ed1b9ee89f81061924acf1a7ba8e52acbc2d0e4332e26b07ae31db90f100
MD5 5d77c5cc961e5a556378f050a85ed820
SHA1 06650448e4f1e2bca673a0351096a2a43bf3c0c2
SHA512 658a236af9bba4cb98350ff2d664959cefcda49aa01a6a9075fed36a100db5019b5a9084020964917866c20000d279775408bc8aa5a7e1cbf17e0260affca32c
SSDEEP 24576:X55I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:J5I1AWwa2aN4ERAEjHrd//
TLSH
T11275230EAA1CB17BF3B3857298BD2065F736FC91FE44552B89DEF638D5784B90048882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 9752bb72f5c2f451b89197c250cf1c0ce0a6d19f48b11457ae0aa2178a0143ba
MD5 72a2b41855fb2c859c5683d2a1e88466
SHA1 b57b2a9283e51fba169b5e0a66fe2f9b6c824682
SHA512 8df4c2fdccae5596a673331912b5faab54bd9ec9404c3d387a7ea62f00441b327d04f3f0e5a1caea8df7ffdcea338d0fac465a3f01620bbb686b2c7cbbedd9c6
SSDEEP 24576:yF5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:Q5I1AWwa2aN4ERAEjHrd//
TLSH
T17075230E9A1CB17BF3B3857298BD2065F736FC91FE48592B89DEF638D5784791048882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 7f985bd55cd2ffdc8f6a254bf9a4a55f3b1fcda410bc6bdf33b8effef6fcd3a7
MD5 74efea67344cc22af2d8d3b0ff315b68
SHA1 c97b3bb34ad36a182ad312043acfe8b08dd08d30
SHA512 dd155ff77235919a7d137a2af66c0284d718a10ea8329ba2508df030f371fc98f9fcbedb8573db882f87a87b395bff8733690ab3a4b65c58dacf97fef57297f0
SSDEEP 24576:eZMEzFVSOt5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:eZMEzfp5I1AWwa2aN4ERAEjHrd//
TLSH
T10D850199B35418F9EDB3813EC8654916E7B2BC554B60CA1F03E8363A5F333A11C2DB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 5b302b8fc41bdd94da7ba2042da792f437c90fabae61d4de5d08168f6a0bf57c
MD5 12e40d130bf529cde352497977b006f6
SHA1 ebdef46b91e6ece2c60f9405fc687faa4cb99fca
SHA512 9af563af71379969e75311a244057813291e92b08b5ced43cc334735597da79be4e037765bfc34ca624a5df38f8e0db4d97f8b590d8c47daef30f21c6941fb00
SSDEEP 24576:6q5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:N5I1AWwa2aN4ERAEjHrd//
TLSH
T10F75230EAA1CB17BF3B3857298BD2065F736FC91FE44596B89DEF63CD5784690048882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 b090fd788b82865dd18bd3e67701b8fa1cdb2ea060a786daadb9d3528ef9b896
MD5 2fa8712c5724462e036493427f670337
SHA1 47f23798436d7d76be0dc670e0da7647d3e4396c
SHA512 a33693a1b20a535fc74b47b5f961389703f282cca1d865d44d5ddf6f02e5e374d5d4a7718c9abaed090b8f025706227c7a3269d560584148fea3e6c397414b40
SSDEEP 24576:Ou5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:B5I1AWwa2aN4ERAEjHrd//
TLSH
T1CD75230EAA1CB17BF3B3857298BD2065F73AFC91FE44552B89DEF738D5784690048882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 927c3560ca1ebfb941c71e2218ab56eb82358f608d33aedf0777e668b3044816
MD5 c34ad25deca9685f710ad28a34a48a09
SHA1 2bd31b316fd2774ab2be4cfdffc16c0d89791b1a
SHA512 2dd424a1fac3a78fdcff4fa8eb42a28dd9308144e027d15be337ed33ba90b5a32826a16bfee0a073aee136045505e7edda41dbb8a16d34440050dc80f5140523
SSDEEP 24576:9zyh5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:9M5I1AWwa2aN4ERAEjHrd//
TLSH
T13075120B736430FAE1738235C8A61912F772BC714B208AAF47A4577A5E372E05D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 842d7d3c267c3c0e87ab1e98ab85da12b61de60defa27209c5a7e9841e96ba0a
MD5 1bdd9429f12311c93f82df6645f85e88
SHA1 cd3f648e0bf2902b840f3c5aa482e6b3a1e03670
SHA512 fd5897aaa004e808713891e5de5670c5aef5719f01e241ad9ae87c7dbd0434a9d6cd432966cf2319cfbfb05e9bd1a28bdcbaf0f89aa7f88ac5dc45abbb8f7a49
SSDEEP 24576:Eq5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:35I1AWwa2aN4ERAEjHrd//
TLSH
T12875230EAA1CB17BF3B3857298BD2065F736FC91FE44596B89DEF63CD5784690048882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 047f80991e4ea9c313f6896a1e53ab0753065e89e714493775e04419c1998f34
MD5 461043d4b70857a58ad77a272bf824b4
SHA1 6768e836277ea4f3fc22c28eac28842bf0b5b001
SHA512 cafdbad2fb915739eddc161fe9cf34bef3002c195593f69d9a175c5e8c086bbacf851d9f6ccfe552859c86b7a818f2cebbdd5d06fe7dfd0187d837ddddfb61f4
SSDEEP 24576:jq5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:25I1AWwa2aN4ERAEjHrd//
TLSH
T10175230EA61CB17BF3B3857298BD2065F736FC91FE44696B89DEF63CD5784690048882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 24ddaad00c5c7b245400a040237680a73c10a98a5591d346cda41cbef17b7981
MD5 8ae2015e941ac0727317b10030fc9ff6
SHA1 28d0a8a2207dfb7b743d171adaebbdc3ed403807
SHA512 60876cde5d9a4147a84c42d1da7dfa62b2119bd7813fac71ab9bef1f39fca3bbc3aeb74713ad497012b97cad8abcd457514c2e9776aabfeae31e4f28db702f3c
SSDEEP 24576:izyh5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:iM5I1AWwa2aN4ERAEjHrd//
TLSH
T1E775020B736430FAE1738235C8A61912F772BC715B208AAF47A4577A5E372E05D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 2e953a4c4c78fcfa9a0d53437ddf00367dfdf9c8b33099efae66eef3769f63f0
MD5 6707aadbee43474d6f375ec3e847446b
SHA1 7f3e8cdc3a477617377391b33b3a68a1df6ed558
SHA512 62d7f094e1119416934f779eb12034b1b3e07420713461f6e1933745c3e94acfbb06dd86277c43d95af12150c724fee896b91d624d407ebc7a77a2b2e62ff2e7
SSDEEP 24576:QTRaLl3z0zDf5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:QTMLljE5I1AWwa2aN4ERAEjHrd//
TLSH
T1EC850199B35018F9ED73813ECC654916E6B2BC564B60CA1F03E8367A5F333A11C2DB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 d59cd37c2cd79cae1c7ef45ef859a728ee226605678b70669ae2f582b16f38dd
MD5 4949d69e706d659c29f6e8859c80c730
SHA1 c10fc6e079345de1bb8f6554f79a1e1527112dea
SHA512 1971991a1b0bf9fa69158527f4d1cb68109da589b4655923b5593497389d4dc62f4dbf6bd0705d9294607ab9a02c808c9e21b6e56c2c978b373859e3e78beb6a
SSDEEP 24576:43Bd9CHKy7GZ75I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:CBd9CHKyap5I1AWwa2aN4ERAEjHrd//
TLSH
T18495CF90F3E810E9F1B78A358C765511DA767C995B30DE8F03A8666A1F336D18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 e8e368bb4f73ebf31bceb0ffcfe8d580360e13196b34ce2e1269d801d761ed01
MD5 f27154f2f34f57628292aa4aa06c3871
SHA1 3dd086e41f68efa89b7c1b9d3e91343d8205466d
SHA512 0edb0d048b2d3cac99823592df8c9fbf2eb333355b2283f8483a175ca45587444e0c9cdb5e639b8245623113fcea0b0037e96ba8aff7813f13ce1bb2ce640621
SSDEEP 24576:wv5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:U5I1AWwa2aN4ERAEjHrd//
TLSH
T1E275230DAA1CB16BF3B3857298BD2065F737FC91FE44592B89DEF63CD5784A91048882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 a2e780e26a69828a72a75eb637e389f4ed94eeb74e8e2d860e8f18f48dabbbe5
MD5 a5f7d965c78d99ac7f6fe3c02bebbe1a
SHA1 a6a55c0b96f24c8c72737de48bdc0fca1b1ff760
SHA512 e3ce19d63bf29c0cf623c6e10bb1725d167aa1bb6431a1515adeef28bd2472d6da99c296b9e5415852097028fa01a8264395ebcb34d625e35b73a6ed6fd4e318
SSDEEP 24576:pB5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:/5I1AWwa2aN4ERAEjHrd//
TLSH
T1D075230DAA1CB17BF3B3817298FD2561F736FC90EE54592B89DEF638C9784694048883
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 5522dfa0e1be657057b4bc1ce1b276d871d573b772feb7a507ff15b84d8a174e
MD5 d434a959e868943bc67d282c9d05cc2b
SHA1 d4ed41cbdb5b798be81d51c2dca0e82058c54515
SHA512 ff8b08e3fcb3cfcd943df513258050acd4c86cc6b50f0379cb7a8b37ba8b5b8217d71b43b1ff822922586731614eeb6e488536d0060ee94bb5c373c052dfaf1c
SSDEEP 24576:W65I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:h5I1AWwa2aN4ERAEjHrd//
TLSH
T1FC75010AD25852E9D1AF9235CBA61A41F333BC6197E0D3CB46D0F63E0F766945CE9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 f251d46d80f4bdf1585669cdfcebc6ffff18300f14d66b3845359425e62d9d90
MD5 b38513170c8c4be597412182dba1778f
SHA1 56ffcbbd26643930543e21dd62c676d7706935e6
SHA512 caf64e6776abf916c778450cef315be8b549a19bd416a55581a84bf5382fc303f21612e7693a3afc5a633a0fcfe88d3d7bc2ff6842a46bd04f1a8204ff004edc
SSDEEP 24576:SS5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:SS5I1AWwa2aN4ERAEjHrd//
TLSH
T13075230A971CB56BF2B7863158BD2031B73AFCA0EF1498DBC889F778D5744E95868843
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 9fc0a61c387953870db9c8e8a14ec2d2d6c371bb0d20d770680b13baeb2233ec
MD5 8059939a5e0fe3d72672605a1ebc9240
SHA1 68e817bef7efcfeb3ad41e09430e77dcd6b13ee8
SHA512 0a40405c13ca4a211f326b9346d6cfafe7d6ec05dd76f1fc564adfdb50064ae7be6e344e669f19f4fd69fe71e5bc7ba89c8cc5b5d454e8e6d4c030cc70c945c1
SSDEEP 49152:tRZwQCyiHiQEaiPnM75I1AWwa2aN4ERAEjHrd//:f9xPP46m22aNDRHx//
TLSH
T1CB85AF1E62DC46A5E0BAD278CDA74407E6B278165731A7CF0190C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d2aa80aea04633c9013272c33d80dbf2df62cfbe469f6c1a70ccb01bef6f2253
MD5 6fa13bf29118b2d0df9cb77b70a8c275
SHA1 767ad01e2dc6dafdf71c1313d0e8c69a89bf0b70
SHA512 99067e30339f627e7cc075aa1231466051eaca387444192965f3cc0b0ac11455fc4468ff2ca9618b9a7e1d4919204409a5ab9871a1516c571855d0d73a930f96
SSDEEP 24576:BjsmP0yHaqrVqHra44KDzMsrnR5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:BjRP0yHfVqzlAsrnR5I1AWwa2aN4ERAg
TLSH
T17145BF2EF2B910F9D4AAC136454507B5FB71B82D1F209AC70170C634AF1AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 2917701ce91c8f129522f3d8387c45b6fd5c5aae0df70903236663ce1c3f7fff
MD5 306913a6da135d220a5dbe2ce61b11c1
SHA1 2347bba2efac35f1e92d62a8a317adf1663ee7f8
SHA512 65952dbefe6076472c10ed61c1046e1d0907208882d7d6439502b17cdceea4fe0d1bc5c0b8bfd701b1931ce86b2ad2104cd05ef53b26dff67c8016f9cf7b1146
SSDEEP 24576:oM5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:oM5I1AWwa2aN4ERAEjHrd//
TLSH
T1A675234DA70CB16BF3B3867658BD2021B736FC60EF1459E7889EF678C5784EE4468842
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 3a47bbc2442b77ce4aefb0320c4c24e5072ef60562869881e86c6acb4038b54b
MD5 9ecbbd238d2686eb6639beffaf5683dd
SHA1 0351312f754f334ed6b2be17deab7bfdc2ac3339
SHA512 26811d2553a605d64f8b88ab35b00bfab1f6978001971948a3e734337c9e078261c1f22b6aca64461714999f45bf8a3b898ecbfbb7d65f894ea2c797df5bec26
SSDEEP 24576:5LLBUTO5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:5LLBUq5I1AWwa2aN4ERAEjHrd//
TLSH
T14895F105E79810F9E977C13CC8A68516E372B8990764E7DF03A88B691F237E54E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 bce0d0719a1e8461e4e0715dc1229e7cebcb4fd49f1df8ac821f9697ee31010c
MD5 99f8dc53d427c578818a8fb583ffeb0f
SHA1 2f1c4afe891a7e657f3a0faa440043cf4f19dece
SHA512 5ea27a2c3c5c50435ab5857903d59e6dec10442edfb447193b02a0d701731a08d4f1b41ef7f8fe70f02807d493cc8dae3b092d29f0990ea6cb259eb90a4c420f
SSDEEP 24576:e8YNHN5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:e8YtN5I1AWwa2aN4ERAEjHrd//
TLSH
T1D485F11EA26C18E5E67B917989C28219F273BC62171096DF04F0C27E5E27EE97C3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1b41675302beb7e1964a0197e7439201de3d56707f2f26ff1a2c0111e700a743
MD5 9a12d7c000a2cf8dbca9ff02422054c3
SHA1 9a0a5751f5f0bfdec7e51a78ab6738cb09e3ca0a
SHA512 fba6152556ada46fc237b85f5c8fbfdfe03bc94ca0c23012767d80531e653e09fe9aa1f9e61118e191b2a7404dfee39a41d2af0125f59a5a6b93702251012f8d
SSDEEP 24576:hnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK5:hnXoJJYH84VVS6AmETJas+cHBjSSKHPp
TLSH
T16165BE5EA2BC04E8D5BBD17DC5C24506F5B278621331CACF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 587bb0f07f8db0cbb411840a161d5b13bf9178c63a3ab3fc83b9b076e1819cb0
MD5 ffbbdc8ef6bb560ad29aef07917eac72
SHA1 c94044e32c53f8fc3926a32b762c32d99654f4fa
SHA512 02d272982208ccadfe05259b557638cd40d975a2468ccc5d24affc1558c9b2cc1c907ceb4de63a5302c47b103c2f82cd2c96fe4a5d4af1b04f2c697e792cf809
SSDEEP 49152:+DLL9TuJ0M/TYj2Ps5I1AWwa2aN4ERAEjHrd//:946m22aNDRHx//
TLSH
T1A1858D5EA3EC52D8E0BBD6BD85B79046FAB2B855173081CF0291856E1F23BF0593DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 4b7533d79e5c7f18d4696f0a08dd2e6e182eebcd967a52a5256c3a40db70dfb3
MD5 a9ead109abde5787c2f823cb82368b77
SHA1 4892b3e2d4d72fbfa9fe068178419a960b238683
SHA512 f52cd1393c93675c08297a2e03e3493fcc3cce7e152fa7af92b51625b720d4c676abea5dc1c9bb9a5535bea0bf3f2171b56faa59efbdb8b959e6becdf133b8ab
SSDEEP 24576:HegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wO5I1AWwa2p7UmcvNWPEVrsowLEjHZ:HngOJOmPOHkO5I1AWwa2aN4ERAEjHrdX
TLSH
T1C355CF3FA7BC15D5E07FC17D89968816F6B1782213255ACF05A0827E5F2BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 df01fb89e5cf52b0c861704fd4c4f62933966fb90395e38845920b4719fec80f
MD5 22c1e9d0ef90f9ca411ccce50655accb
SHA1 253c4840948915c2e93e2c3f28753a08cf9edede
SHA512 9ead9a3816c2ceb0f422c012ef55654c167a7f3200d63eddd5d0d1541e4a81deb1ca59b08c4c4fdc207d95973940d3d32236815958e1cab6aaea30bae71812dc
SSDEEP 49152:iLJnJK8R304lh5I1AWwa2aN4ERAEjHrd//:z26m22aNDRHx//
TLSH
T13D95D02CD2A810E9E4B7C2B4815A1656FF32387C2F2169CB59B4D5353F12FE0A979F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a4c58b66bd52bee9e903e5d2079322dedf72dc74063b63258cebd3e37d59af7c
MD5 467dd4a82efd74f99a67a278bcba43f2
SHA1 0f28fbe1204452fcfd1c98a25ee6b8bc973a11c7
SHA512 3950aa25a6711787843cfe5efdaf0b09ba00fcadfd8771ef5fab769b6d264cd6ebed853d6debab60b461290b915baabb7b180838478bc0381e03f7fdf3cc8135
SSDEEP 49152:S9mqCzDScAZmlvTcFg8Ph6A5I1AWwa2aN4ERAEjHrd//:0t6m22aNDRHx//
TLSH
T16E955C05F7EA5298E8B3CAF1C96694159B327C409B34F7EF4A80CA7A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 1182268d4678ace6b7d678f064c6ee062cb356df0b5eeda9906b4e3519b222e7
MD5 b665c19e563a8fb513b8bd0856bf6f22
SHA1 aa75a9c128c3d8afb3430c53daefa63104b585a8
SHA512 41bd04ed5109c41adb7e681d364281b0733ed10274fbe3937eb630bbc0966b46ce3155e4a5883f7fd903f340deebbebf0e8df6833bc7443c1c24fadbb5913ab9
SSDEEP 49152:7lYJeXmRUuEi5I1AWwa2aN4ERAEjHrd//:A6m22aNDRHx//
TLSH
T12175124D766C70E6E27B813988A60514E372FCB16B0067FF45E0E27D8E769E92D38D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 0ca9f02ba72fe592a9226234d638c0bc1f089e78da2b75a32a65edfa9a6d47bd
MD5 6d3c409d66b14472b884c990d7e8dce2
SHA1 6638333c5bffbae3ba7cd3113e83e41c96259111
SHA512 d9cdb5bd96dede4975f58e921f172452b26d254dbc4b093cb3ebdfc7f87be653dc363fc27e49ef28df07a3182f3793effcfdfe5d48b968e47c8eeb613cd2568c
SSDEEP 24576:hItyx5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:hIt45I1AWwa2aN4ERAEjHrd//
TLSH
T1F0851209639861A9F6B74638D8B74160EB36FC609F1097EF44D1F73E9E366D4A834B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 1e026cae665a5927c1ca0bdfcf45f72d3ec62bf33e14bd10b2b4810e591f932e
MD5 ed9e3b7a2049e15eb090f5302245a245
SHA1 3b26abb2a15995e1569caf5c2f55f1ec37b3e8f0
SHA512 93f403b0a0bb8ca145410739d08f00b907330f64ea7b668843c9e75343d501fd07a08354971bccf789989cc518846251ce01221c2864d5f672519dd8c310fea7
SSDEEP 24576:xO5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:xO5I1AWwa2aN4ERAEjHrd//
TLSH
T1FF75230D571CB06BF6B3857558BA2461B73AFC70EF1468BF88E9F638CA790E94464C42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 00608e4e0529d5a5472821e265e7cc16c7b652d42440e49a80909b6adb8506df
MD5 151f64e3535b2d246a5c824882300272
SHA1 8870fc61bd4f83c99cdfee00358bbf252eae358f
SHA512 1e9120a42631da16cdac75e9a805b3581ec2786b7fb994d45a2610dbdc554476e1238e0e6ab2ec96ca8e916a5b5328c783f552818a3698a8e07f2daf0427f308
SSDEEP 24576:7C+TyQIu93VAumZr7jmD5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:7/TfIq+YD5I1AWwa2aN4ERAEjHrd//
TLSH
T110558D1DA7E91DCAE276C675C8A34493E633B872177186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 4ca2ab8aceff4e15ac30284b8f59b3eaa41a42790ebfd6284b7778632953357f
MD5 d56583e77978c5730686b3b53d9024a6
SHA1 d3568e6559f682735ca44fea9367e518371cf26d
SHA512 a92c12c9f0574f67cdfff10f7b7e926bd8782e386e42eed18cb7b18ba327e540cd3a19bf19401134a6ccfc90bcc1d8d0d66edbf3414a16eedb6ef801bc02d185
SSDEEP 24576:3LQikZ65I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:7QikE5I1AWwa2aN4ERAEjHrd//
TLSH
T14585E00FB36E10A6E1B7C23888954112F7B3B8705B1167DF46A0C7794BB75E9BD38A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 51dc2f5b0bb9076a73085a33c7088b1ecd7aa70d012786ddacb5b68b4d500065
MD5 f4d6736b3d138fc1a8663646f467108f
SHA1 21f3082ad4af79a9245c24488d5f8352b296b496
SHA512 dd3ccd43412f2c8304c8e6db1c80aa3bc257051ee1efd9f61cea53d24df1569473c75af282aef186a0bf5d7ecf548dcf1480c2b91b994aca6fdeea6df07e0a8a
SSDEEP 49152:cpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPx5I1AWwa2Y:dpC7b4+80GTkY6m22aNDRHx//
TLSH
T174A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 47a4e139aef77a800dd937126e60e4407ae45ce6e86579df4bc3a5a52a46a1e7
MD5 dc631f6198a69ba3c961bd741e8dbd65
SHA1 b05f2e4d18ac5fbc61777ccf125f26ee2d16268c
SHA512 216fc79a57d58a627f3f182a0c47c696adfde13425d064353f1f8cccbee86048c43004e48aad00fbc3ce6fd8b333e83b792b7fb468b4064dca3c2dfdf21d1971
SSDEEP 24576:ESAwJPE1IDAo+4Kt+l4413lUQ15I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:EqPCIo4Kol4jQ15I1AWwa2aN4ERAEjHZ
TLSH
T1E455BF1AA7F956E5E1BAC7B4D663C511FB737822133163CF8290813E0E269E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 bf9256ec4eccc511ace90ec52d0c1323ea12953cc734ca160a2312d38b8e4fc3
MD5 c9373742814f8c76ad13925a48e471db
SHA1 dff6ff6eaf0096fac753ced988471f0126414e03
SHA512 4b1ed13141c4b8ead8eb0eb7dac492046159d3f91c879563c0a397061b1f8d7260c0c7c6f789212ec0b7edda692361a0826fbd781e74a9cc37f6ceab1c75b7da
SSDEEP 24576:FbxA1UGW5I1AWwa2p7UmcvNWPEVrsowLEjHGKd//:FbxA1Uf5I1AWwa2aN4ERAEjHrd//
TLSH
T1D975121E66AC24E6F2B3913988E54106E332BC616B2097EF44D5D37D4F3AEE85C35E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/72-391-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/72-397-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/72-620-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/72-399-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/248-250-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/248-256-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/248-246-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/248-422-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/1068-283-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1068-289-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1068-324-0x0000000140000000-0x0000000140182000-memory.dmp

Download

memory/1224-328-0x0000000000400000-0x0000000000583000-memory.dmp

Download

memory/1224-276-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/1224-271-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/1424-702-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1424-462-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1424-424-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1424-414-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1424-478-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1424-495-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1424-420-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1588-408-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1588-402-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1588-653-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/1588-410-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/1768-47-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1768-49-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1768-41-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1768-227-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1896-261-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1896-323-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/1896-267-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1896-423-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/2016-299-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2016-293-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2016-325-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2016-619-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2124-60-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2124-75-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2124-73-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/2124-52-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/2124-58-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/2892-314-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2892-320-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2892-327-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2892-494-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3300-509-0x0000025978FF0000-0x0000025979000000-memory.dmp

Download

memory/3300-507-0x0000025978FF0000-0x0000025979000000-memory.dmp

Download

memory/3300-513-0x0000025978FF0000-0x0000025979000000-memory.dmp

Download

memory/3300-508-0x0000025978FF0000-0x0000025979000000-memory.dmp

Download

memory/3300-515-0x0000025978FF0000-0x0000025979000000-memory.dmp

Download

memory/3300-505-0x0000025978FF0000-0x0000025979000000-memory.dmp

Download

memory/3300-517-0x0000025978FF0000-0x0000025979000000-memory.dmp

Download

memory/3300-516-0x0000025978FF0000-0x0000025979000000-memory.dmp

Download

memory/3300-506-0x0000025978FF0000-0x0000025979000000-memory.dmp

Download

memory/3300-511-0x0000025978FF0000-0x0000025979000000-memory.dmp

Download

memory/3300-504-0x0000025978FF0000-0x0000025979000000-memory.dmp

Download

memory/3300-503-0x0000025978FF0000-0x0000025979000000-memory.dmp

Download

memory/3300-514-0x0000025978FF0000-0x0000025979000000-memory.dmp

Download

memory/3300-502-0x0000025978FF0000-0x0000025979000000-memory.dmp

Download

memory/3300-519-0x0000025978FF0000-0x0000025979000000-memory.dmp

Download

memory/3300-512-0x0000025978FF0000-0x0000025979000000-memory.dmp

Download

memory/3300-510-0x0000025978FF0000-0x0000025979000000-memory.dmp

Download

memory/3348-500-0x0000000140000000-0x00000001401CF000-memory.dmp

Download

memory/3348-352-0x0000000140000000-0x00000001401CF000-memory.dmp

Download

memory/3348-350-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4012-211-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/4012-20-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4012-19-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/4012-11-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4680-226-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4680-35-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4680-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4680-29-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4744-380-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4744-518-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4744-386-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4744-388-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4788-310-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4788-326-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/5068-365-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/5068-361-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/5068-363-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5068-355-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/5068-367-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5100-375-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5100-501-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5100-369-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5100-377-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5116-0-0x0000000000400000-0x00000000005C0000-memory.dmp

Download

memory/5116-1-0x00000000022F0000-0x0000000002356000-memory.dmp

Download

memory/5116-6-0x00000000022F0000-0x0000000002356000-memory.dmp

Download

memory/5116-37-0x0000000000400000-0x00000000005C0000-memory.dmp

Download

memory/5384-340-0x0000000140000000-0x00000001401EE000-memory.dmp

Download

memory/5384-499-0x0000000140000000-0x00000001401EE000-memory.dmp

Download

memory/5384-332-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5384-338-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5564-234-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5564-241-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/5564-235-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/5564-247-0x0000000000EE0000-0x0000000000F40000-memory.dmp

Download

memory/5564-249-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5660-70-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5660-228-0x0000000140000000-0x00000001401BB000-memory.dmp

Download

memory/5660-64-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5660-74-0x0000000140000000-0x00000001401BB000-memory.dmp

Download