dbfd0a22a1c2a6e0035107011ce2e3a0675f44aed802441bad3ebc83266b0c2f

Analysis

max time kernel
148s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_aae52ed481a79b064e3f393d959239b1_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.8MB
Sample260528-tke33afw21
SHA256 dbfd0a22a1c2a6e0035107011ce2e3a0675f44aed802441bad3ebc83266b0c2f
MD5 aae52ed481a79b064e3f393d959239b1
SHA1 bde4b2d47ef653f7be95d22980931a7eb58d1db1
SHA512 8920bee3ffd5a6ae2463a3aeef69f127707f2efae6ad2f051e6ef8917b52402e396744f2eb2d5830b0a07418395db899570c6343c30b830e6a4844109826efaa
SSDEEP 24576:Ij/QugDwp7wRt8bk+ks+VvwnXtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:AXp7wRt84+kjVvwnXtdnYz5d6JgCg
TLSH
T10795F0217AF6C077D9B341304D69D720256EB8314FB289DB73E8662D1E35AC18B32B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2056	alg.exe
3412	DiagnosticsHub.StandardCollector.Service.exe
2304	fxssvc.exe
4256	elevation_service.exe
4180	elevation_service.exe
4412	maintenanceservice.exe
4608	OSE.EXE
3436	msdtc.exe
4864	PerceptionSimulationService.exe
1336	perfhost.exe
1792	locator.exe
3024	SensorDataService.exe
1132	snmptrap.exe
3708	spectrum.exe
1448	ssh-agent.exe
3040	TieringEngineService.exe
1732	AgentService.exe
4148	vds.exe
896	vssvc.exe
3796	wbengine.exe
236	WmiApSrv.exe
1008	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-28_aae52ed481a79b064e3f393d959239b1_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-28_aae52ed481a79b064e3f393d959239b1_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-28_aae52ed481a79b064e3f393d959239b1_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-28_aae52ed481a79b064e3f393d959239b1_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1893ca9ffc4568d2.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-28_aae52ed481a79b064e3f393d959239b1_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180031\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180031\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180031\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_aae52ed481a79b064e3f393d959239b1_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001af60d3abceedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b480f839bceedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7150d3bbceedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014b4343cbceedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3412	DiagnosticsHub.StandardCollector.Service.exe
3412	DiagnosticsHub.StandardCollector.Service.exe
3412	DiagnosticsHub.StandardCollector.Service.exe
3412	DiagnosticsHub.StandardCollector.Service.exe
3412	DiagnosticsHub.StandardCollector.Service.exe
3412	DiagnosticsHub.StandardCollector.Service.exe
4256	elevation_service.exe
4256	elevation_service.exe
4256	elevation_service.exe
4256	elevation_service.exe
4256	elevation_service.exe
4256	elevation_service.exe
4256	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2108	2026-05-28_aae52ed481a79b064e3f393d959239b1_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeAuditPrivilege	2304	fxssvc.exe
Token: SeDebugPrivilege	3412	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4256	elevation_service.exe
Token: SeRestorePrivilege	3040	TieringEngineService.exe
Token: SeManageVolumePrivilege	3040	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1732	AgentService.exe
Token: SeBackupPrivilege	896	vssvc.exe
Token: SeRestorePrivilege	896	vssvc.exe
Token: SeAuditPrivilege	896	vssvc.exe
Token: SeBackupPrivilege	3796	wbengine.exe
Token: SeRestorePrivilege	3796	wbengine.exe
Token: SeSecurityPrivilege	3796	wbengine.exe
Token: 33	1008	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1008	SearchIndexer.exe
Token: SeDebugPrivilege	4256	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 3212	1008	SearchIndexer.exe	106
PID 1008 wrote to memory of 1520	1008	SearchIndexer.exe	107
PID 1008 wrote to memory of 3848	1008	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-28_aae52ed481a79b064e3f393d959239b1_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_aae52ed481a79b064e3f393d959239b1_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2056

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2944

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4180

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4412

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4608

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3436

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4864

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1336

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1792

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3024

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1132

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3708

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2740

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3040

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4148

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3796

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:236

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3212
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2916 2904 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1520
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2952 2948 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f45e1d12dc53d130f8f7c484f33f05ef5c4d6d2556efcaa3687d95e8a0dbb9a0
MD5 f902b34dbaa333fd15a82623b978d1fe
SHA1 409434efd31df8c25f7c9c6a8038e9cb9dde5803
SHA512 c840fad40659585d6aa68bff381b018329739b6171679b11717fd071f764419eac759e053ac2fa2e50b8e89174b1577900d69c2e30314e65b6f4b7fb38dd2d62
SSDEEP 49152:gb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnCtdnYz5d6JgCg:K3q6mjB+z50GC
TLSH
T18AD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 66967c043af2db396cc049b5c1fbf2fc1ac731f4bf5400ecd9c4ec19f6e3a31c
MD5 715c9caccf316554b6042f52a8e9c5b7
SHA1 f139aff93fa112f8f4940a08e0631a4b97900246
SHA512 77e60ca1c383c2962ecee29f4a3f03a6f8d3b14a23b0049aa89dc79761b5a45fd6b8ad7a32aaefde96ef12684b449350909438f8886d7b21dbccdd3fc5f34ae8
SSDEEP 24576:vXYfDtczAFtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:atcAtdnYz5d6JgCg
TLSH
T10885016973E408F9ED6B8178CC62C501EA737C5547A0E6DB03E4A9254F336C85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 f5a6bfa829010549db460ce8e437b552808e5f0026440080c109a3e15fb1fed5
MD5 cf595a0ffa6bf22e3cac1e57663ad5c6
SHA1 ef76451a0165763b2dfc6d7ecccd8db1a133feac
SHA512 98334b366f32f6a18b1f613cdc9afa22316266ceedf89f3da3889173a7115c6bfe03416dffde479c034df1fc2fd1f21f500d6ac24849988a5df9e43903534282
SSDEEP 24576:h0Le5ji0hmxhrM6tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:hPji0AzntdnYz5d6JgCg
TLSH
T19195AE56F6748331D073C0B9C5D2A68EED7234825B3089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0f815c4535c8bb91f985d69c9a723eaabe80d4b83bf7918ac694ce877fa267bf
MD5 5f8044be92826b79ec6b45dc9c98a1b9
SHA1 02b8e2d4a8d77fbcfb7a846e19a8f08dc4aa4740
SHA512 45da132e6536b16bc9e9ef52d5fd8c3808834f00fa2707ebce9bf5db118935170be0bd237f3cecad5986c62275c0424896318cb56a6e1f527ec66ef07624e216
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWj6q8wyuQtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:O/ezSC6vUzPv+Hjy7tdnYz5d6JgCg
TLSH
T10E756C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f6213382571aefbe39cb09e028c07a669005ade2fd7899401c30031342d38c84
MD5 f46a68a1630b0118622ad10b5c83bb8d
SHA1 f84218f24a587a86cf30e84e055880c2246b7140
SHA512 87a6b9f70536c10d52fccab875a7d7391f21eee8342fba18e6e156475e3fac02275e37a3f045de032d3a541e17279c6f3551834f798a04c771633fc673c7159f
SSDEEP 24576:nVbqPb88hv/l+Bhtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:nVO88hXl+HtdnYz5d6JgCg
TLSH
T11C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2E77BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 1009d643fb3b250bbeeae3cfa29a85aa5badcbb94061d90acbab29e0c910f7ee
MD5 d7e23260e1d9238df800847eedbe7147
SHA1 8f472c5c90cbd0729d2a60e3fb98ed16b3d5910c
SHA512 45ff83a10721e1974fa453446be83104b2589ece0493a597d72ae2cf82264000051a181278b64ff91048299a3e175a68d1f610bbafb99716f29e36dff06e1500
SSDEEP 24576:/G2tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:PtdnYz5d6JgCg
TLSH
T15B6523D3A65C44B5DBFF85B1D80ACE04665D6F5988EA88B7E2643659887DCC0C338B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 c21fcd2de1f9c5c6e33958c3d38e4d75790b6048366186caff1e8ff07b54d796
MD5 70aeab019f5c75522b2e4651d4ea3409
SHA1 038ced71e6e662fb725086bdb415ed9c5f16dadf
SHA512 13280c69f0f1a15c1f4473902f2a9af3d0da9dc583ca5f42796bd0c153f80e16cce9f3627c3cb1ff7731e58699026a73296a9088d5f6aaca2bf44e348dc86a17
SSDEEP 24576:pJIUZtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:pJIUZtdnYz5d6JgCg
TLSH
T18B85CF7BEE28FCE2C27E8DB95A51C600A77678314F6293CBE164920EDE235D04E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8e0c611887c3ecece2cd194e123ccca19262bc89d5a860ab49f571ec37622584
MD5 e9cd256e1f01406869aca5a8ee8257d6
SHA1 60ed3128eaec0bf95bf05fca6dac090feb6e9d84
SHA512 4581749932f3542ef1b20605f28dc363d42ce16698e5a18b5aadf22937f567d4ef4d9bfe5edac7262acafa747c880241ffb3f0de62b0c7f90151db8f22eba632
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH2:tQvGAdlCEL8c/WRNw5Crz50GC
TLSH
T1E1266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 e6c44f5f4b3211b501ccb631f44c4b3db5ff74b7efca629db03c3c3244767453
MD5 b22857b903210c73a7aa31e19eac1e32
SHA1 dfbbe34e143c8801eb16407d07beb9a469ec40b9
SHA512 9e9a957208241b9df171bfaa1b0dfa7147ce0ebc94e6863e0d758f727b018fde6f8374a43b917895dd7df13d86ccabd9c7cd939579b3b8553a869f7395c6ed1e
SSDEEP 24576:FfewsAj3tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:Zlj3tdnYz5d6JgCg
TLSH
T10C85E071FA74E036C6BF0DB21B26C716146D7E204FA219C3E3A85A9D59342D22376E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 43d88a31410933034c43991e3533c7710826d4ae0f22587fbd4d302ab960ea75
MD5 ee2f5a816850e5e0cb21a654f770458c
SHA1 b4ae78b3a69ce8485dfa1c94d81d5329c3202598
SHA512 11fad4488cfc591da150f51a4f14e37ab04a6905795f00b2efb43f24ae27b5c7c345f18d2f189c5b85c4998ba7a18d8fd4dc6b7c448e08ebd56d9fd27b060782
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH+50:bUEtQevvqc2W1cpV20I32+
TLSH
T11D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f82a877c739138133e30ff18f1941a4701d460af0e35a13a8b6f6080a0cb5870
MD5 7a091c2c53bcf531b4b59613bb2d5d16
SHA1 635717c1d034591a3fa74e795e49ad52022a44e6
SHA512 7a191b69326b72495de99f5a083ac3d220f5f8b161e2b5bf7e4d4943a100138554c9cad0d18c6df523f5b716f5caa7f32fe31f4ad16e54386be67a79c19fc77f
SSDEEP 49152:1CbRquA/m2yL5zLfFiV+XenmE3/zXtdnYz5d6JgCg:ioq2VjnmPz50GC
TLSH
T1FDD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1d64a85113544f6add8e5cc7be8c47fc830d26a61ea9f43fe9e3d5b7621bde3f
MD5 c0084c9203edd0fdfa2ca3c886126025
SHA1 8e600190c66eced2901326b8fc88bc7011e58a91
SHA512 c60114fddb6032c1ecb1b41931f42e20d508b04080b03eee709e91a875667cff4151e06f71d730213c7f3158400893007c67e2dc84fd2b311a7aa71a93fd5d84
SSDEEP 24576:YAhGL6IFoiwtA5l7S53Etdykir8q0Hsw47opM6g9+JVuOUj7Cg8:YAM5Foiq50tdnYz5d6JgCg
TLSH
T1BA359D81E7F955D4F5B3AAB899B68570EA76BCAA5E31C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 d972210b2f36c5d645d72a16d85530c9f235e39bed012be3fea252b138bd2905
MD5 a4c9421d96d7f21a2f9343b6001464e3
SHA1 8d97653cd94da6434b938a8c9a0b3f0dada354bb
SHA512 4ec4b648db41021bfd40d618eeddfffbd8f0eb2e820c7acacb7818fc1ff1ca21aab7edd506175b0787891be65b5a1a153e7f177716af322ef1d3e2f6cb415876
SSDEEP 24576:kwuROWbtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:kwSOItdnYz5d6JgCg
TLSH
T13675F18672A80CF9E9A78239C547C535F7F6BC022A65CB2F5360C65B5F37250AE2DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 bca485615cd3028074bf3a2b64a1944434bd225d8b45f62904410527cbe3aa71
MD5 f10a2a9c5680e1a8cee9173a308b0f41
SHA1 9de4cd86ff78027a9013718c0e369deddd6e0ddb
SHA512 16cdd7210f745352f4af778a615222bd18e4e2899604a7a8127d48a17ef3dc6250b7f24d13f140feec16911a62e1c59dd8f973a5cfe3ce93f518d89df2c2e687
SSDEEP 24576:fZuStdykir8q0Hsw47opM6g9+JVuOUj7Cg8:vtdnYz5d6JgCg
TLSH
T16B6512C633E820F9D1B78278CC958A04E7B67C5657B683DF626422695E37EC04E38B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3fded08bbf06a13045d5a27f542bc74df31f6a054359a3d2eaf8985170c45497
MD5 33e35273016572c3d17b45fa8eaf167a
SHA1 1d8a9ac6e0b646547d58fc0cb9d0696e754526fa
SHA512 de3d36fca3b1b4fab25e078c18f063a6db3a9cedb9b5b6e68f1aea46b7e5ccc8f84af793e727beff9f4cfe166fc42481dc2ed939045f39f23417b5edf461ae76
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U6:cQRQyi36YOcPDLvw2gAf+PN3az50GC
TLSH
T178667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 119d584c12f2a4a65f4ad85053eab6964169a90ef707fc222f8a5e2a86c9c56e
MD5 c99d03c6a7d4e7bb5606f606fe356e88
SHA1 cb30d3fd786abd5f2ee5a36901f3006fc6be545a
SHA512 55964060c2021a1159794b78ce2393d6bfa55e5db957f1f9cbb3359f975d167854b6d5ade1d71f95bb59b7f50aba44fc162687782af501dd8ea5b7e7f09fc586
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U6:gQRQyi36YOcPDLvw2gAf+PN3az50GC
TLSH
T19B667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 93e0945beb3cff689d9a03235639a28a11792d5ce1c7b7d711f3d2f78f7d191c
MD5 08049ad8b5848f73bcf2bdf731243bde
SHA1 bb179e9b89d1f040d752780c478727b9f6efe81e
SHA512 3e5693a285fa7357318f6d158ec1d921110c605d66100acc3fa256732219ce5193352065abe2a60125bfb3dfc9c704689a6dde7068f9f06af8a6c33efe2a1d78
SSDEEP 49152:q68Qg55nhkeWu7PNU3/ntdnYz5d6JgCg:YthTRc/wz50GC
TLSH
T11EB55933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e10b79ef08b385239e60ed95b33133fc011129bc2f309badac9463c125301f20
MD5 551ec3256e2db4b88ad5384defd97963
SHA1 eb16c54c9e8adce55041c53647b8f37ef7cc41b1
SHA512 ac942181097b177a9f9b5c51115ea6478b4bc1d237690468721968ffa13ab505055e402f2a7e49adc3abd191f68d6675e81647ff236fe51c029c8d3894b331d5
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99I:5y5112gYy5azzVvU69nLKnhZVz50GC
TLSH
T186167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 10da3c1410afb63fc32ae55e2c3dc0fc3723cff5d2f6ada619dcb51cad8076e4
MD5 2641ead1fd14ab741b9c0330ef74b016
SHA1 1a444f3fe1f230cd151756772aa008415725b9ba
SHA512 6af9641f61d5c77e51f953e333462cd2c7d76e793cd38e98777a492660d26cb049b58c4d2f99904e9ef98fae59d54f0943d5d6aca68130c0064441664143fd25
SSDEEP 49152:DB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl1tdnYz5d6JgCg:1u6JmIxd2dCz50GC
TLSH
T100D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2e90a6329f630e473c5a2b35f505da8f08c1f115709f75cb2a345016241a31fd
MD5 6ec0d1535bc69d348dfcdf0af4a8ccd9
SHA1 1a30a2563f4a8187fea8f97da32b4922bb375054
SHA512 b6e34fe1a7538e637f8c86f4bcaa93207fe66f42c9dda867e66c0f06f1fa27b78ee69aac6ca3f274bb27bd563aa8846f7941c081ac5499bd659f7cef0b33f988
SSDEEP 49152:Z1hpsNoJpF1A67U44CwH7R4x5tdnYz5d6JgCg:ZmifPqRPz50GC
TLSH
T1CBB5BE13F2D900E8D06EC17887569632EA62BC460B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 aab4db2593f0da50adbeefbd878d6696bbae08b19d8e25107520bf6aa74286fc
MD5 d3ed9ae8bb158037bc1def22bb039926
SHA1 8478787448a9128ffa7ab6392e91cc7d122cbe47
SHA512 32c2dbd996bcc756b3a96904667fcce3b9163404abacad0c31d1cba296d972814d431cbc7006e155642531d77f2668050fdc157a40412acdb6037c8e964c7c46
SSDEEP 49152:3SuZQIY0Be2KkRVtOnks6NMHqStdnYz5d6JgCg:t5dKqi61hz50GC
TLSH
T1C1C5BF03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9b6d7bbdbc3d768341d11feb91840c03a4505481cb001fe8e0d1272fad406c5a
MD5 8e98cf2f3bafc63eeaf61c72751f506c
SHA1 a2645489e60bf3fa2dfb77d1cb15e08e037ae38b
SHA512 59606f9a08cbfb98e5a4b1c298718fbadf4f888d8ed978dabe9db6700a8e34f58a2f89d36ff6ceadd91432e955560dea6bc8f429cdc53a30029c38d0b6814487
SSDEEP 49152:2htSn8EApI0figjgiDn0AP5wFtdnYz5d6JgCg:XX2iWphDz50GC
TLSH
T1B395BF13F2D900E8D06ED174C7468632E962BC160B39A6EF0A90B7561E7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 dd2436eaa6d93647e6c488e7b595944ca90b38947fc4a58d1708ebdae04ab43d
MD5 9a134c8de86ff9b435e93252a4511178
SHA1 104f10c7906c802f0489b3fd4cce63b6ecb39a82
SHA512 88cc92033cfde1329b9808c65e6a14f57e958392791c9d6ec02fc3bffc48ecfc6d6fcaba4c9c88fbbe3f78322b9b1108fa4365663fcbccf6894ce794fb9114f7
SSDEEP 24576:GOtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:NtdnYz5d6JgCg
TLSH
T1096523D3B59D45BAD9BF81F1C80A8A04658D6F5BD8EB84B7F39832158879DC04338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 6345b02bff159eb9f286f258e05230a58bffad7eb9d3c4c11a4853d874526e89
MD5 5135244bb232656dc972b473376bdfb4
SHA1 fa2a546d00ddecbac1f91c6c3512a725d3a03804
SHA512 922b87247f062eb0e9816a74bd9022632cffb29b3dfecc63638f319479fbfacfebd04a42830a3ff5fa13d261ec5dd27b67bdda4090b0056f46103728bc3cb358
SSDEEP 24576:XDtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ztdnYz5d6JgCg
TLSH
T18F6523D3B5AD44BAD9BF81B1C80A8A44659D6F5BD8EB84F7F39831158879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 e814ec005a5448633a464bb3293a2fb3e09af61bbc1ee22e733095682646c838
MD5 86a3ca9e6a7a3f2540e41e92f262e16a
SHA1 de6eaf42b5a1693d4c17bfd37d6894a04529c562
SHA512 54244c75b64a83d51601639147cf781281b060a8cc8c3e3f0000257fcd7aadab146f7a8333fce402d8865191204de6c6eb275b8a8744613ead65ea5c1271eba0
SSDEEP 24576:7Rtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:dtdnYz5d6JgCg
TLSH
T15E6523D3B5AD44AAD9BF81F1C80A8A44659D6F5BD8EB84F7F39831148879DC04338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 98ca43e7966c8a81cf42be2f1e23ee096188916a8999bbc92b0729eb8895729b
MD5 0fce5dd56ef31913a57e8de24e760653
SHA1 92dcb367ae7326dc905d8d2cf27d69659a959e2e
SHA512 74ff3c5de41f774152060a57f033c973d376ce79c7c0d4c1f273782452135b7cb847be663f34d07591638c48a1e05fdee32262f2e3b2a27d42980f88961f2d3a
SSDEEP 24576:etdykir8q0Hsw47opM6g9+JVuOUj7Cg8:etdnYz5d6JgCg
TLSH
T1E66523D377AD40E5D9BBC2B1C816C604A6ADBE5ADAB684FFE35035194C75AC04238F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 ad490a090cfcf7d74a7aae509605a4fc117501c0e30c91a7cc2e5661f9bb0ec0
MD5 049ee8b446c1890ef9f2b3f044bfef87
SHA1 0d29a44f74e1f63a56c2390b1fb7b0152b8194ea
SHA512 b0c72006ef3ef2a72d31422894209637c4b28aea1b473d57c45a70005bea2478dceee05f4a1cd5850c9fde4328abc3273a09a03ae0c65f2a86e964c597adf3b5
SSDEEP 24576:zstdykir8q0Hsw47opM6g9+JVuOUj7Cg8:YtdnYz5d6JgCg
TLSH
T1B76523D3B5AD44AAD9BF81B1C80A8A44659D6F5BD8EB84F7F39831148879DC04338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 4f8f26b74c57bd0c8d20d481e5ec7445a30344580b40b4ccc96ec50feeed64b1
MD5 8d25787130d12c48f8fe14dcc9157339
SHA1 8688063a6d4b2250e381864ef0e0609ebc4e6218
SHA512 1e78675d0986a1d2b29d15d8bd5d413b50266591db2a3320c13b5aa7e641de51c4261e613f8637a980f42a00fb116226728ceb310901019c9a2f218d6146ed07
SSDEEP 24576:SPtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:WtdnYz5d6JgCg
TLSH
T16E6523D3B5AD44BAD9BF81B1C80A8A44655D6F5BD8EB80F7F39832158879DC04338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 a8eba0e0062fcfe24e0ecff0d4740873084de557195f76284c919ff00adf4f6f
MD5 5edd9538d27324fcd21b92643d9ab409
SHA1 6d3e93065283d3659165d07a1563b797e1e49ebc
SHA512 fa6edbc2f657b3938df04dc1b037a2ca4033818f1886b1b059ef5298aa6a99df106c7a2def19ba68999f395530c80f7693792076b6311fd26e76d17269a1b403
SSDEEP 24576:8Ltdykir8q0Hsw47opM6g9+JVuOUj7Cg8:GtdnYz5d6JgCg
TLSH
T11E6523D3B59D45BADABF81B1C80ACA04659D6F5BD8EB80B7F35832158879DC04338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 d546d1bab2e6af01564f311b8e451c355124224111b009e4017f97353a34ec77
MD5 bfeaa87493b6e5c5dfae9fdac6b939ba
SHA1 ab0a17de4431d03ca02b2508e9a90a3b953ea10e
SHA512 8023722c7869fb70542a67137f5e54d4e7f106ebc3c75ecde086d104f50155ac686de450970340cc38efeaf2a2ad1716f89006f40ecf78a0ac675bfa9f43f248
SSDEEP 24576:BZM3zFVSOjtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:BZM3zfftdnYz5d6JgCg
TLSH
T19B850195B39418F8ECB7823ACD158905D6B27C5A4BB0C56F13A4362A5F337900D3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 b299195fbd2dad76835c6d96c4973ab6bd5f17eb41ba9ec30b3eb51d13dc9d78
MD5 d758bddf3d75a7e00a576fc97a5faa42
SHA1 a89ebeece58d69652fd62b633699027fe01bb09b
SHA512 33f6b6057d2164b29f6038e59108f2ef4bbfe731f4e445834aefe01276cc3e39c25385117cf3eeca2d55fb89b6c7a2ac13e63446eb4b58d07a2c2f9c9e8ff3ef
SSDEEP 24576:Fitdykir8q0Hsw47opM6g9+JVuOUj7Cg8:UtdnYz5d6JgCg
TLSH
T19B6523D3B5AD44B9D9BF81B1C80A8A44659D6F5BD8EB84F7F39832148879DC04338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 cea7a23762cf372655ff91e936c67520481802a2c5cf560b1a486dc7e93337be
MD5 26547584c58a6e49f0ab12af738c1a21
SHA1 e65cbdc3ef40a0f263210c95ff7d7d5fc2924a22
SHA512 9c0a7bfe7db84817386aff374fa034e52e738b134a0738af7ed3f976d810349fc6a2c156345c70dcb5bcac50deb7d2ed4316b9e5ef478c652d442fc60bfc700a
SSDEEP 24576:lGtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:YtdnYz5d6JgCg
TLSH
T1316523D3B5AD44BAD9BF81B1C90A8A44655D6F5BD8EB80F7F35832158879DC00338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 d5dcfd7ba0a05a6833e1dead09bbc9b83477febe983a67171ac792be4d8c6aa0
MD5 6b39264d9bb20eb6993aa51b7f5f915f
SHA1 c6f2290533e23f777b3ad9f73db71c39add49507
SHA512 d042d7be1b82e911c15ba141d4275d690ba9dcfc48ac74212372ac4418c98fe05700affe8cd2bb594fd419329b18139d724fab0b91a35294344f687fe56c7f6d
SSDEEP 24576:BzyHtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:BotdnYz5d6JgCg
TLSH
T1E775028373A520F9D17B8274C8524A01F77ABC364B7589AF63A427761E376D04E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 8b3fc0bad1b722800452157806e028372f45e94475fac2adb8c781c4bbd507ce
MD5 90e1895c8afc9f634387465f7d9327e1
SHA1 0ab2d6401d8cf2f1fec3f8f68a17f97c8627daea
SHA512 a1c0a3a1fc0f941db23268a94b50f61b629bd67a7698a9d71e071c5e76e996d9d02d7171f21f26c8560ebb65b941240a7311d54fdf461870868a4f3f546e9f3b
SSDEEP 24576:ditdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ctdnYz5d6JgCg
TLSH
T11F6523D3B5AD44B9D9BF81B1C80A8A44659D6F5BD8EB84F7F39832148879DC04338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 009fe90147b107e7bc8f5f3a9a2f9f721464935da5d2df9c4919a7c4a0097a6f
MD5 01f6a75ab3d82d5ef6abfc5e44204d41
SHA1 8baa390e4e45fee3d8b684a48953b42140ec97b2
SHA512 cf65923b9767e60eda526440ac315798d3b321ee1aef3f6a74530e6e9089789f7177d4e8ed21ebece6b2e0d2767aa872ae225b44283207887d18a1d4e843eb58
SSDEEP 24576:jitdykir8q0Hsw47opM6g9+JVuOUj7Cg8:+tdnYz5d6JgCg
TLSH
T1FB6523D3B5AD44B9D9BF81B1C80A8A44659D6F5BD8EB84F7F39832148879DC04338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 9c8c370ab8b59a86987d46ebba701bb43037a0bfdd0fb2579e6dcda658752f76
MD5 01c1b07c7ec68e910434ab8b46c74325
SHA1 3ffdaeb5f72719e5fdaec0a4b5a1930117c39757
SHA512 7d4f0dbb53889881db7db5d14120fd44ffb8487c6fae668bdd9003a5bdbd524bac1d2e8cb3430a7ebeb2872fa16dbb7f8b717b3b5d749b9ecebd1d15640d1d8b
SSDEEP 24576:0zyHtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:0otdnYz5d6JgCg
TLSH
T19875028373A520F9D17B8274C8524A01F77ABC364B7589AF63A427761E376D04E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 70c0fea26ee93edd8f8291c110dcb630d7b4b25095658f2b5eeafd41b5bc4304
MD5 4bfff3e30fbdbb5876fce450c03d8f08
SHA1 8001c0217affa93d02d143a67af54e2e85e3679a
SHA512 18b8ebd5ad3f7504e40f2cd9f2149401236b9ceffb8b1bfefc5d116fac9708d4c1297902d4cdea10e91bfc8e301d2ff4eb92a3451b2de965d03cd1a28dd3db4b
SSDEEP 24576:bT8aLl3z0zDBtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:bT7LljQtdnYz5d6JgCg
TLSH
T1698501E5B39018F8EC67817ACC168906D6B27C5A4BB0C56F13A8366A5F337900D3DF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 532d11035302a7ea611673ee2770759217374726cc12fb443b14504b890e0e93
MD5 8aa34c9679537a7e723184570b3d3cc8
SHA1 e3398c6d382fa624d2a82e9b88e9d16f74444ce7
SHA512 03f9208a02160a6fe09ec783b6bc493e6aad8223fe0ea29c2ed9a0b31a6e49e0b6eede4f144c26e009550dbac73ef9711bde6e4837bb8142a0ad1621b0425f14
SSDEEP 24576:M3rd9CHKy7GZ9tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:2rd9CHKyaftdnYz5d6JgCg
TLSH
T18195CF91F3E814E8F0B78A35CD664511DAB67C5A5B71CE8F13A4261A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 28be0a866cf648d9de61e6686d171d9b551450afcd0d3d2c50d928c818a9d4a8
MD5 7a0f7febaef439e6382e0fed4cc57808
SHA1 bfc1dc189d34081abc8b5bedfea35e42670918f7
SHA512 e860690c816f31637c376f997260fb4520fd43321be49898030ff267054f98b1b194ffed323a07753fdc95c4e88c878209d2749d6f8e9a4e84bc6f7950989708
SSDEEP 24576:Hxtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:RtdnYz5d6JgCg
TLSH
T1956523D3B5AD44AAD9BF81F1C80A8A44659D6F5BD8EB84F7F39831148879DC04338E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 74330add0f3d9c5a25e2a3a950cc28c669a0dcad6d8519382d54acdf6ae024c1
MD5 f905cf5c055aeea750c4d62cb143e353
SHA1 29f537bf4ebc52ebc32493b641b83a50d26fbd01
SHA512 ef1e289b1ec4fe62afcdf88adfa6bf79be0311d003f12c3da03d9c819fa1ee6897cf0b2543f312acd6a9b735463d0946f8ccdbe4be7a08b576964c6f6a80b986
SSDEEP 24576:RStdykir8q0Hsw47opM6g9+JVuOUj7Cg8:ItdnYz5d6JgCg
TLSH
T16775F15AE29801E8C06E5175CB468A40B3677C6587E2C2DB63D0F53E0F7AAC05EF9B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 56d77ffda9acb928826f96845345ac908683e67f2d01cabd2729abce57d57025
MD5 cce509170152eea829c8314980c95cc8
SHA1 4d78679cca955f56ae8b6b569680b6e60eb98076
SHA512 5f4f09ab0fdefcde1f422cf04bf394733aae97a747864eb7cd4b0efd5fbdf572afe1a76169d938599f16ec87b1216d948bf9adcc830b876ce4cb35b8dc23f2a8
SSDEEP 24576:S0tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:S0tdnYz5d6JgCg
TLSH
T1F76523D3A39C44A5E9BF86B0880AC614665DBF699FEA84F7F24432599839DC04734F0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8cb97d394a2e76252eedd80d2384fb6850804695d5f4b4ce3c0f6a9b1846e931
MD5 4ea76ba81f4b3adf2c00c868b09de971
SHA1 038ec8e3364fbc706c66167beaea706044909537
SHA512 ede5d3f4b220e5218a90fa99de22a5d5c163f0a72389ba47abb51befe20ed116a030911ce7d8a420ecbf99ca20e79aaf276535d5f6582bce5ba6951a3aa483f3
SSDEEP 24576:Y8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCCtdykir8q0Hsw47opM6g9+JVuOUj74:JRZwQCyiHiQEaaPnMPtdnYz5d6JgCg
TLSH
T1AA85BF1E62DC46A5E0BAD2B8CD674407E6B27816473197CF1290C27D1F37EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 3ecc913ea2fb3941b4ef82886011408392cf9e6f0f2c0e7d3388be9b70a5c7de
MD5 42f4412a66bc0d5fdb9b7ddb8e0740ea
SHA1 5a92e3103be0fa448a2f41f6200eeccbb2f60644
SHA512 a6c5873f874c76d89fb6447e471fba97b62f2162c3c7fa4f07751bd3b65bd9006e4ff7cd20a4c3115a76e7a20fc27015a33ec6884a47afb57be98835fae7e3bd
SSDEEP 24576:9bxA1UGZtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:9bxA1UutdnYz5d6JgCg
TLSH
T1347512AE62AC14F5E5BAC17988868105D332BC2A577183EF61D0A27E0F3BED44D35F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 559a84f5e824597441f63a5be9bc61f9ca21787b341d03cb1f258b7a232b4a18
MD5 e015d6c3d8c9bde4c5f0813ce4309f3b
SHA1 d4ff3f40ee3f664c6ada09a26d576bf7a57c7a33
SHA512 896f3a5aa8fa8d1d6c7fafaa492bf69c6215461f11e10c80172f2b8188072ccfb0632771e20112f4db146ddb7a0c6bb4899abd75235df02fc1b640c493c9384b
SSDEEP 24576:76tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:76tdnYz5d6JgCg
TLSH
T19E6523D3B29C44A9D9BF86B1880ACA04665D7F1A9BFB84F7B1943215887DDC04338F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 dfd33e537b268e1d34b7911083946528d0dfbaaeb1dad323e48e434c1a9fdede
MD5 258dd4c4293feb353617d8e822f07d65
SHA1 76eaae24baf5195eb8669e15d4092da30310dfd2
SHA512 145c688bf009cde5885a199bfc882cb40d1681da6a424c5f63368d72eb0dcc82d3eb4ea194d3c9d0893010efa4e7c7fe302f29f4433b722d97ea894de965f833
SSDEEP 24576:JALBUTQtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:JALBU8tdnYz5d6JgCg
TLSH
T1C2850155F7A400F9E97BC13CC8668A16E272B85D0764E6EF03A84B651E337E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 d8201452a18eddc27b7aa66d257c40f9ca70712fa5f61b5c1b590567df43d773
MD5 5098412c9e0ca6af9270f7886b1a5945
SHA1 c2293c3cf8b1e41ae684d800562dde605176f4f8
SHA512 507c7b090e18c732400ed7e0662fb3250b2181b2f882df5595d3ca9d3dc64235560a51fbfc9baeac51b5564ecd4504efee9af6ea5f5fa7ecb02c54f860ac9478
SSDEEP 24576:UfYNHdtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:UfYtdtdnYz5d6JgCg
TLSH
T1A075F16FA2AD08E4D57B9179CA838609F2737C66175192DF01B0827A0E37EE87D3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 957cd5562886c10fb736ac9791b4d899e228d0ef82850c904dd1dd96bc9a7bef
MD5 a594b5a4b6a9733d11b20a88af461b68
SHA1 2fe52a977d90ad2d26d9d3e5030d6864931bfc54
SHA512 2404c85eda04ad5dbd5369df2c23cd542e2d1aae90706bf162d48fe0f2d2e72298e1c380578fe650701e54946fe962d1297fb7cbab2e6185c3b03fc6199a4620
SSDEEP 24576:wnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKE:wnXoJJYH84VVS6AmETJas+cHBjSSKHPP
TLSH
T1D465BFAEA2BC04E8D5BBD17DC5C24506F5B178661331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d952328f17790174cba2d1aad1f8101942745a1e687df218f6a58408196314ff
MD5 ec9b6e94dd87783cd352454959ef11e9
SHA1 df239a3d3d9ce0913ed7e3444dd186eb9fc94c7d
SHA512 197153c32776804afa93e7b753611799d49d1b442919832db951f5dd8dbbec68e8c772e7a08a03e210ba6bd32a6a518df76f7ccec5ad8b8f55e3b17d81f2497b
SSDEEP 24576:Mv7Xbxd9Tuycf8M/TYlSuxwr2PCztdykir8q0Hsw47opM6g9+JVuOUj7Cg8:MDLL9TuJ0M/TYW2PatdnYz5d6JgCg
TLSH
T1FA858D5EA3EC42D8E0BBD6BD85B79146FAB2B855173081CF1290856E1F23BF0593DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 333406dc0427865947586e0e043f68bf72b5ecaedb60081a7339174eeef72ca2
MD5 072133c9ec4ed477465022ca306fa91f
SHA1 e2d372190806aa8ab39b4e7e80ac5b3a3321bacb
SHA512 47f3ad5fe18dffc73aee5b5f55456895f09fc011f252ee779848d3b89e9e29c0ebb19c678e82bdbab4bed43ff79c0665d14a1667be82e6fcbe86ddc1a732e271
SSDEEP 24576:cegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wQtdykir8q0Hsw47opM6g9+JVuOUjc:cngOJOmPOHkQtdnYz5d6JgCg
TLSH
T19D55BF3FB7BC15D5E07EC17D8A968916F6B1782603255ACF0160827E5F2BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 31990b95fb4f60ece33c508e4f7da6eb1d77de7519263ad1324df929200355ed
MD5 84489b97dc262dba38193ddee283586e
SHA1 5d78bdb1c4a17a6518dae637a177da0bac8a04b6
SHA512 19c6dba2c4a04ee4bc22286d4e3a07aa5dc3c1fe545499aec9f2be9a0100765c8a863f2f7c0d0a7a96be31f67d571f0d52ea8df674f560b8064bbbc0392e9bc3
SSDEEP 24576:RLJnJiTk3R3waE4JrOatdykir8q0Hsw47opM6g9+JVuOUj7Cg8:RLJnJK8R304lhtdnYz5d6JgCg
TLSH
T16D85E06DD2A810E8D4B7C2B4815A1B56FF31387D2B2569CB65B4D5313F22FD0AA39F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3c0a148e1e311ac59867a570020d34a153bdcaa9f2fac8444c59c2cb256b6dfa
MD5 2ea8bc783690f960cd48559c63079f5e
SHA1 0144ffc3a8433b4d758b627c36051842ac97c548
SHA512 eceb8b7d8edfec26d80efcd5862f338df987c88741635dc7fe115f8084b0d175deee3552447e1585d1ef99a84961c1dac238dcf3519a3591b485ff3b5ebba3ce
SSDEEP 49152:b9GqCzDScAZmlvTcFg8Ph6OtdnYz5d6JgCg:/6z50GC
TLSH
T1D3955D05F7EB5298E8B3CAF1C96694159B327C409B34F7EF4A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 197bbf45fa557f840266b26d32bff4041e249dbaa81765ee2b65fdcaddabaf9c
MD5 e817609ca2500ba19d21e21e1e3b7b37
SHA1 9cf4329a8bbabb7c4afc8010c2176eccce6e2a3f
SHA512 1d5d8bc67bb1f6a0d2eb7a569ba5c55c08ff01c925bd5654ed7854857086b3a3fbf6407d508752eb8d0ab508df1c4fa386edcfa3526cb0f12a1473cc56b6d3f2
SSDEEP 24576:8lYJeXm5jUuE1tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:8lYJeXmRUuE1tdnYz5d6JgCg
TLSH
T14375129E76AC20E5E17F8075C8528A04E375BC66579253FF62E0E2798E3ADD01E38F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 d0d2dfc85f85bcb9af514efbf9436cee038427157361f1a2f2fc43eda12ca181
MD5 6eba0d04c5483572a8f838b09712a3a0
SHA1 cea07e2d3158e652c1ae5bec754ee5963194e94d
SHA512 43505986466233f48c9d9bfda74f5db2ea7feafb0347b4bfa5b3ccf1b76c461c4486053e15030b9191f337582a164858a28b4db55fc4c081bed3d2a02d34e86e
SSDEEP 24576:jVtyRtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:jVtWtdnYz5d6JgCg
TLSH
T1B9751282739850E8EABA4674CD1382509B7DBD259F6581FFA1D0F33E5D36AC09634F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 60a74b1496a2a167c89400293e8578145c4e5f35639780ac4d59c30aa8065d53
MD5 629f969c47d024c38683f8116e3d1b29
SHA1 570886f0e7ec6adeaad59357e3f6843f8fdf1c77
SHA512 ed1f8c8e49b768da512a2bf4000bdf05af0028ddce8b69ea686b17ec9324b7024545b64bebcdc86d0d5bcd98ef85667abe3364743652aa5ec96b01c915d674d1
SSDEEP 24576:rQtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:rQtdnYz5d6JgCg
TLSH
T1DB6523D672AC50B9D97B85B1880A8A00665D7F399AEA44FBB1E4B235CC7DDC04334F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7a83046639a2497b8cfb0541a2d2c7399596687988191766548f82ee1e1d8d33
MD5 47249ed26683dd371c7768d2bb89eeb5
SHA1 7702deb3d74628b462d4b3a5e5c9d685a2884e15
SHA512 d766a2f15b39fb1a5f350a134ee60b9ec1deeb67c1e8a9849b9d4f80eac4b0762ee4781ab410b7ae8a3e28b310e573eacfbfc84d21873188cc942996986b89f6
SSDEEP 24576:4C+TyQIu93VAumZr7jmHtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:4/TfIq+YHtdnYz5d6JgCg
TLSH
T131558D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C17D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 c795437ce33770f19cf5898ae7a0396d9110a0111ddc5eb797aab3fb239ff20b
MD5 d192e81feb924616d5e05448b86d23a9
SHA1 5d12127c2dbbaba9b2b6f47419e6a29a06d20ce9
SHA512 54ba917918a2a8391703ea5f1a6265e6a8804be22d4ed137864694f78309f77eadd6055e425ec2c9c415924afa3b539058c0d350e6cf54b85c6320166b21d4d3
SSDEEP 24576:eLQikZstdykir8q0Hsw47opM6g9+JVuOUj7Cg8:EQikitdnYz5d6JgCg
TLSH
T14275F14FB3AE00A5D4ABC178C8458201F6B37835576262EF52A0C7794E7B9E97E38F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a52931011d76dd0df0ed5a4783fac96589c2aeac762123aa483c89dd0f7b4e3d
MD5 25eef8c2eb6964f4e674499ba8a8b1e7
SHA1 303f8000dfa90f8745737a4a16ce6cb03cab2a1f
SHA512 a753ea97ddeb841fb86a67b3f1feb3ce15ef8449bcb4c5ea3cdc6dc22a6a46b50361fbf350e628a3d0588115057fe60109f18654bcf0a8c63e2bbc5a8a12cdc7
SSDEEP 49152:3pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPRtdnYz5d60:8pC7b4+80GTkVz50GC
TLSH
T124A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d25d9e0c1033a2cbc57df018fa183bc89c0f2cd7c1b92a6a0c99b2d8400d6df4
MD5 6e563f03ae562eb689fd1caa89f7cb1e
SHA1 e4534a5d7ab6ac85c76b3725f360f7ab7b3d5b8b
SHA512 8705046cddfe198bb876c1d77322366e4432ed3e5e7d352e8c2562c1712040d5304ae1d7d840557e80230e2cf35e5be55536cf12eeb3633acc0b8489fca3e5fb
SSDEEP 24576:MSAwJPE1IDAo+4Kt+l4413lUQ4tdykir8q0Hsw47opM6g9+JVuOUj7Cg8:MqPCIo4Kol4jQ4tdnYz5d6JgCg
TLSH
T1F155B01AA7F946F5E17AC7B4D663C601FB727822133163CF5290913E0E269E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 4d27cdb08dd857b001236af70f8c97ae252bac9f6879598529fba9ea4f2f402f
MD5 c2e236b3d857783751565f2dfe612074
SHA1 d619ade04fc62f31169617d2d1821b505b0dfaf9
SHA512 7c79e452581a12c9e72443c169d978488041ddafccbb037259799861ed4483d36d051a65d3e473e2780ae340ea9e27fdeaf5c9dc6b128f55385bc7c6667c9542
SSDEEP 24576:SjsmP0yHaqrVqHra44KDzMsrnAtdykir8q0Hsw47opM6g9+JVuOUj7Cg8:SjRP0yHfVqzlAsrnAtdnYz5d6JgCg
TLSH
T10E45AF2EF2B910B9D4AAC176450107B5BB71B82D1F219AC70170C634AF1AEE89F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-328-0x0000000140000000-0x000000014026B000-memory.dmp

Download

memory/236-438-0x0000000140000000-0x000000014026B000-memory.dmp

Download

memory/896-420-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/896-320-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1008-471-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1008-338-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1008-394-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1008-332-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1008-378-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1008-341-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1008-410-0x000000000A1A0000-0x000000000A1A8000-memory.dmp

Download

memory/1132-280-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1132-412-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1336-263-0x0000000000860000-0x00000000008C6000-memory.dmp

Download

memory/1336-324-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/1336-267-0x0000000000860000-0x00000000008C6000-memory.dmp

Download

memory/1336-269-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/1448-416-0x0000000140000000-0x00000001402AB000-memory.dmp

Download

memory/1448-302-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/1448-296-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/1448-304-0x0000000140000000-0x00000001402AB000-memory.dmp

Download

memory/1520-449-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-448-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-441-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-439-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-440-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-456-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-457-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-459-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-426-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-432-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-443-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-444-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-445-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-427-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-458-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-446-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-447-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-462-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-430-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-424-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-422-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-442-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-433-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-461-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-435-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-436-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-429-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-450-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-431-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-455-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-451-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-452-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-423-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-425-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-434-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-428-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-453-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-454-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-460-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1520-437-0x00000222E8230000-0x00000222E8240000-memory.dmp

Download

memory/1732-310-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1732-313-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1792-273-0x0000000140000000-0x000000014023F000-memory.dmp

Download

memory/1792-327-0x0000000140000000-0x000000014023F000-memory.dmp

Download

memory/2056-232-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/2056-21-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/2108-8-0x0000000002510000-0x0000000002576000-memory.dmp

Download

memory/2108-1-0x0000000002510000-0x0000000002576000-memory.dmp

Download

memory/2108-32-0x0000000000400000-0x00000000006AC000-memory.dmp

Download

memory/2108-0-0x0000000000400000-0x00000000006AC000-memory.dmp

Download

memory/2304-69-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2304-35-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3024-276-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3024-340-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3024-417-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3040-418-0x0000000140000000-0x000000014028C000-memory.dmp

Download

memory/3040-307-0x0000000140000000-0x000000014028C000-memory.dmp

Download

memory/3412-234-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/3412-15-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3412-24-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3412-23-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/3412-22-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3436-245-0x0000000140000000-0x0000000140263000-memory.dmp

Download

memory/3436-315-0x0000000140000000-0x0000000140263000-memory.dmp

Download

memory/3708-415-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3708-289-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3708-291-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3796-325-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3796-421-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4148-316-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4148-419-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4180-236-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4180-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4180-55-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4180-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4256-38-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4256-44-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4256-37-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4256-235-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4412-67-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/4412-87-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/4412-84-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/4412-65-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/4412-59-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/4608-80-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/4608-77-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4608-71-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4608-237-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/4864-319-0x0000000140000000-0x0000000140273000-memory.dmp

Download

memory/4864-256-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4864-250-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/4864-249-0x0000000140000000-0x0000000140273000-memory.dmp

Download