560bfa6d352f994f977b5a0bc17de43bc4b31b454917e9095a27421b17b774f4

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 02:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 1.4MB
Sample260709-cyd99acz4z
SHA256 560bfa6d352f994f977b5a0bc17de43bc4b31b454917e9095a27421b17b774f4
MD5 072846ff38ed57bc0064017ef88966e6
SHA1 2be26b31827d0feb7a0e510db2318fcd7305dcf7
SHA512 7e0a05b3e1395bf92733d46a34165f406ad2298f2a9a200fea568570cfc5966d0a3bbebb13840d06df355c579b358e3b2e9fc62aea5fe2c83d234c2cf6952fc0
SSDEEP 12288:v0aB2WqeumB3m/fZ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilR:pBVqeumA/mSnnrFb4PM4MYgLxEVyGLn
TLSH
T1B265012576E180B2D5F72A3058F497B49A3EBC319E34D6AF6394066E1F31A81C971B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4696	elevation_service.exe
1440	elevation_service.exe
5580	maintenanceservice.exe
1184	OSE.EXE
2660	PerceptionSimulationService.exe
1644	perfhost.exe
2416	ReFsDedupSvc.exe
3056	SensorDataService.exe
2604	ssh-agent.exe
2020	AgentService.exe
5508	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c677e407ce3e03f1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048f206b64a0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009664f2bc4a0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd837bbc4a0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ca7ffb64a0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000fe2682bc4a0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ecad8e034b0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4696	elevation_service.exe
4696	elevation_service.exe
4696	elevation_service.exe
4696	elevation_service.exe
4696	elevation_service.exe
4696	elevation_service.exe
4696	elevation_service.exe
1440	elevation_service.exe
1440	elevation_service.exe
1440	elevation_service.exe
1440	elevation_service.exe
1440	elevation_service.exe
1440	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2772	2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	2020	AgentService.exe
Token: SeBackupPrivilege	2416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2416	ReFsDedupSvc.exe
Token: 33	5508	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5508	SearchIndexer.exe
Token: SeDebugPrivilege	4696	elevation_service.exe
Token: SeDebugPrivilege	1440	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5508 wrote to memory of 1020	5508	SearchIndexer.exe	100
PID 5508 wrote to memory of 3028	5508	SearchIndexer.exe	101
PID 5508 wrote to memory of 3880	5508	SearchIndexer.exe	102
PID 5508 wrote to memory of 3540	5508	SearchIndexer.exe	103
PID 5508 wrote to memory of 4228	5508	SearchIndexer.exe	105
PID 5508 wrote to memory of 2816	5508	SearchIndexer.exe	106
PID 5508 wrote to memory of 1352	5508	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_072846ff38ed57bc0064017ef88966e6_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1440

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5580

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1184

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2660

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1644

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2416

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3056

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2604

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5508
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1020
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3028
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3540
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4228
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7867769cb700725260d607b057e21c0a0f7677faf53e6bac9054e20133c69720
MD5 b5cec00cbb4307c463aaa7f77c0c6fbd
SHA1 c8166819a5c285f8de06e2b80daa0e3659527dae
SHA512 0168ba6c924dae9da25f63188d42132efc5dce0bf92b291574ede268dd50e3a4d654c148cb8c7608225ad88f81238277dd374b722450c474b9d6192396588cda
SSDEEP 49152:Tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnsj4MYPVyGLi:x3q6HjB2VW
TLSH
T12FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 248e8af798fd4395702ab7c2979701b43459555eb201f16468a7d7914d73197b
MD5 3f8bb9d588a3d6f5aed39181a708a119
SHA1 8aced5278fd72b91864e3160b6aaaf9f6f683731
SHA512 b88ca2246442a9062fc5523f2c3a8572b40f9f8af3b22a66c35ff7a8b7bd99c5a89b629c925f71e978bdca6d03f950c253ab15ae5f0c4c0a1eb82d140fc0bdd4
SSDEEP 12288:U1XLsswWkxy2lRq2czAJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9E:yXYfDtczAOSnnrFb4PM4MYgLxEVyGLO
TLSH
T1A665F12977E408F9DD6B8278C8A28555E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 9eaff4a759623ba9def776e112864a4932f333e04a7d7e6ca256774b6db933ad
MD5 f0b812530534a783cd1277364e61bd49
SHA1 80f0e28ee2cfd56ba8364f23192a4bd21a45307f
SHA512 510a3d604281cfe3873a6f5e3cb5444a1f976735b8b0991d2d578bb3b811549a84d8ef2a390ef6d1624bbf467f2cccd78a6ec2cc5bbb9aae4c11e711f6074284
SSDEEP 24576:L0Le5ji0hmxirMLSnnrFb4PM4MYgLxEVyGLk:LPji0Acvj4MYPVyGLk
TLSH
T179859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 296db368f0f0fcab81b14da2da84a16fce3e23db7d96a5cb1c40d0a7ca8a717c
MD5 5f9a80c608dc8405d858e994c07ecc37
SHA1 50c1d5d999069dceddfafa2ae4acadee4584b223
SHA512 da87bfc2335c3ed2b701076ebe28ad573a45d274d431d9f440c5526d5800a889bd34c960124fcf6bb14e10957b838c000b221c1e294728c36e8a39fa76efb7d6
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWE6q8wyu9SnnrFb4PM4MYgLxEVyGLr:C/ezSC6vUzPvxHjyrj4MYPVyGLr
TLSH
T1C7755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e8ea00a12a18c6504c5ab18d48128fa48d509c7c92c14df0ce2b05426fe6f4bb
MD5 a2bbed3a343f589051be5d8d0fd42a5b
SHA1 4a8a9c87a544f158753cd7a8d8e447d38e99289e
SHA512 615e0345b6de94f33cb07fdb32e03ffe80f0dead79571b26e69321be80bf6bcae64d863bf7bdfd6ae1c8ae8a8ce0ca0de2f163f2794cdad49ef8e47b8ffe55d6
SSDEEP 24576:bVbqPb88hv/l+6CSnnrFb4PM4MYgLxEVyGL0:bVO88hXl+gj4MYPVyGL0
TLSH
T1C2559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e25d3c3bc094976ec5153e0d29f3d03a15bd74ca8090f045c289361dd9ffd8c0
MD5 a08a0d95bf556843e5d0ac04d687802d
SHA1 a4448a4f56b885dd45b4dfac22ad1a956161d978
SHA512 00f57112f56ae52310306d7e8dc906cec4ea6140f8c40280acc5dc2dd857a9dec0dedd5171f5243538775714e14aa3a5c532d1da39b5ae8a1acb4fa43e4c530f
SSDEEP 12288:URU34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:URfSnnrFb4PM4MYgLxEVyGLM
TLSH
T1AC4523A72BDC10EACFAE15B0D1B96AC8E6057C61F875B20B6751785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 240010aa73dc3d470db523360482f4717b9ae14608a601e7d6706dbeeb693c20
MD5 cdfcf52f450c22bd50b76c48db1e6a5c
SHA1 d208fd9a902fe373f3444e5689c4bd1e65c0f4d4
SHA512 aa1aff318cd043a5ac98349055e4e29cda615771204f2c867d1f07f5cc53f0e04fcbe45f41af414637d19469f5064c58bafbbe1cc67027bf8e002ab20ab43e06
SSDEEP 12288:zeBNUbTVO86Ut34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il3:zJIUqSnnrFb4PM4MYgLxEVyGLh
TLSH
T12E65DF3BEE28FCE2C67E4DB856918740E77278308F62A3CBD165820E9E235D45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bde250a444f45496fc6e312d695edcab2e0c156a447547a166abdfed586d8acb
MD5 8ee0bfa9e1e70abc607fbcadc52c3205
SHA1 77450b18193743dc621df24704446da79e0e7e65
SHA512 1fa6574d89ddd8873707d83884d71d2db3429ce083d167366c9dd4bbc482178027fb51925dcdc20b74ee6a06d8b2cd7a35c6155a606a25db00f0e8ac2a337a86
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THG:NQvGAdlCEL8c/yRNw5C3Vb
TLSH
T136267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ffd9c0b116d01f73a832297a446a3c706a6d6a69675abb8d1da70c39599643e7
MD5 26262694bce6377ea5fd94319f585aab
SHA1 54a86d69dca4a0c6e72a194525d58265d132bef0
SHA512 2935ea67c3204698b35cab0adfb4b4f84b51b3019794457b07566f3cc7b2e1fdc66fcd9691d05100400b1d9719d23deaee445de7bfb63efa0c7e358e58f98fd5
SSDEEP 12288:yAwSfxL/2Dc34DLLmt0LDQewsAjT34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeA6:3dewsAjsSnnrFb4PM4MYgLxEVyGLp
TLSH
T10775E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 98911d9067f9e6776c8f1858fdb0b4550b7c79ea9d757c006ee17da167bedf49
MD5 4223d56d44282b1609003874b4add4a0
SHA1 129a24581730339f3ebe578358a30f8de10309c7
SHA512 8ffb67f9b467fc9f9e6151c06ffe94d65918f1f1188f3215609f4ec2057a831e0c4eeb7054a03eff4cb281125cb59334a77c811bd7deb2ad852c810dd2d8770f
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:eUEtQevvqc2W1cpV2EI32
TLSH
T13D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4a05273d183e1d05cebd36ab0a0ca3670fe2640166165d032040340d0293dfe1
MD5 080919f750f07734c7d93faa160c5c09
SHA1 1a9e596c958e87b1a89baaa11044f072070b7b88
SHA512 dd0b6723dcfb49a86134c058d4a7761fca12dbf8cf06afc6d5304820ef5c114cf75dc4115d8a55295755104e3a5d1afcdf8286e46d0d1a958b6c202a872e7807
SSDEEP 49152:/CbRquA/m2yL5zQfFiV+XenmE3/z/j4MYPVyGLY:YoqtVjnmjVU
TLSH
T1D0D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8120a1be5c479ad18fab854c62de0913ad6bfa6656ffee764a387f7ef3f61cd9
MD5 77c1e5c6c93ba72435ea009c08e94b5b
SHA1 a6465beb0a065a13e6fee5b1a7d9ff3276e34028
SHA512 c64c4a5634a598a500d65ca752ff615701b4f1d7b1cb3dfd0098fb900abeac609de684c8b9567c9e3c5607bdf47fd5989f06d42c5262f94aea7ac3d7ce9a6616
SSDEEP 24576:1AhGLJIFoiwtA5l7S535SnnrFb4PM4MYgLxEVyGLg:1AMyFoiq5Cj4MYPVyGLg
TLSH
T1AA35AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8fa869bcf82894dce90a8292276f92ce681c47b1d2428640263952a8ddb55608
MD5 aa9c679b30411efd2c33ab35344f74be
SHA1 122be06140368d56865e17af4362042c2f94884c
SHA512 2dc7d22bc81d9b568b1e4941721b575385ac3d5ad6e4ef5fff8aed6b306886ce922f35e05548260fafc14b048b9b47de4ad35c2b1756ff4115a3eccffbfabf02
SSDEEP 12288:Jmw5HEjsChNVBFgl0WDm+Cm34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqS:EwuoOW4SnnrFb4PM4MYgLxEVyGLc
TLSH
T11665F14637E81CF9EAA74238C597C535F7B2B8122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 14f542911d62a089921821643dcb23b25a616647e5fabd33815486d3923a3089
MD5 6ed978f0a4709a3bcec822f40a7a2667
SHA1 6d6035814b36b2dd60b4a00f2f033447f31a65d2
SHA512 a09028f0c02b541daff19cfa01260b515fafcadb265947af9ec139c719047964f4360a8f214254128e4816e41f56cdd336f6b0c6f04ce4b0fdb6aff27867b471
SSDEEP 12288:BBZ1IyD34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilp:vZuTSnnrFb4PM4MYgLxEVyGLH
TLSH
T1285512AA37E820FAC6AB4274C4F55688E3327862B77293CF1650655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 927f2ba1295d889ff3607bbe4e840b694ea07027dc7ac06650badc8ead79f2c8
MD5 cf76aa739ceba941e92a6e94f2b3e323
SHA1 4248f408b68b9c9b094557944eb8695f27ac19f6
SHA512 05636c7295ed9830403239cbd4a9410eaa04746099be5079cf36ec819ca6e6fa21143abc29367cbe697a60cedde2c007b3d128e730b653e8cb69901e38e2aa90
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U4:uQRQyi36YOcPQLvw2gAf+PN3qV5
TLSH
T1C6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1a4a2e8cf292f18e9f593e117c7d267d63894aaeedc6b74393313fffad3659c2
MD5 3de7a932fcaae61e09c833ef02c06b09
SHA1 483467147c37532b88dad76774137247973d1db2
SHA512 7ea46e4a9b63c373e117c06b02781b6dc21c369ddcda16ac2615ead62027edb18ef9f4c0b735f5f427ef192c36a791215898b28ec92778531f399aa65e39c62f
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:HQRQyi36YOcPQLvw2gAf+PN3qVg
TLSH
T1B3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6b9f730acb75e00e6320026e06ab86d80aa8fb0aea72da44e2d598cbc50411ad
MD5 c17007bdf4f3df0a4a2a0d9ace609444
SHA1 b058ea963c16b570587ec2ff9326ebb170d5c257
SHA512 e61eb033419b629b751d00c157f5e7c5fd8c08bb3886254d2ac4cf64d4f53649370ab09a60ea16bd8442cb976ab1b1764436f7799218dabb60f2fd05d28e8f61
SSDEEP 24576:ywvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0jSnnrFb4PM4MYgZ:M68Qg55nhheWu7PNU3/vj4MYPVyGLy
TLSH
T15AB54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 baca8ef51603d37221d5dd8514734c974c7189a6e8fb2e5e412d1d0eb04ec2e6
MD5 b056d79753614f53dc1bcd44587b98f5
SHA1 c8fb03ffb7012a223044c92e23c10cd10e1d7220
SHA512 8e2d2c8c95bdf51286b413d0de641129a3058f205c30035593ee46eb30f193ef53ef46621afe97eda135b50274bb69a92489843125b5bf35031034c2950d2cb7
SSDEEP 49152:u3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99d:Py5112gYy5azzVvL69nLKnhZFVC
TLSH
T14A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 34873570800683e735122f3cba70d8d27bffc879aa6084c157720d7b99a58462
MD5 a90a06a81159ab1c4e814ab4d5ce78a4
SHA1 35a7fe1732fc9a1ad9a4084291a4dc3d09f77a22
SHA512 41f5754139a380f0546eeb473ddbb09e05f8153a697d1b5f0106a5d2002aa380ae7da3add74bb80bbf33df50b3031af99037665502e5daa779810bf130e13368
SSDEEP 49152:mB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl5j4MYPVyGLO:Uu6JmVxd2diVC
TLSH
T1F3D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 49566819718fa51fb7273424cc830becd2fa98039adf85d8d6d0fc1b23552323
MD5 e128a0fc060a5925482d8fbf8b0423bd
SHA1 99a613eee810e37b381177f9c51b65e9cea3fc6e
SHA512 acda2fdf75387a114616d6dd775a6a3995c873e1ce09dafa91f7a9596ce9b5460e6600ca987a5713779ef143d03a138a52bbb692b33cd09681187c420d40ed11
SSDEEP 49152:81hpsNoJpF1A6UU44CwH7R4xFj4MYPVyGLZ:8mifPbRjVV
TLSH
T147B5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1228f66e2cc8d575a8ed90b93a299660eb841cd14423a52f72f3e58caa25e997
MD5 46e565a27c8335609488067cacfaf059
SHA1 5e91f49de8839dd063b48db01df4ab6cf72db4c1
SHA512 12927496d0cdcd9e78fdbb0427f25de6c702a4a48d0af6c87e3cb627d7d4b17cc9bfed0d9729936236b3944539f1107f5135a034ab429dd28cb126682f716c0b
SSDEEP 49152:KSuZQIY0Be2KRRVtOnks6NMHqcj4MYPVyGLs:U5dKTi61JVA
TLSH
T19DC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7581a0a8013f7b62f5193054ef2c1b164e4802f291f6062bf78524757d39d4ac
MD5 0fbb0fcc6bd347e6a25a10c46e952faa
SHA1 053b6e0b6d4872ed0d65abe3907184fe3a53f122
SHA512 ad1b9e3e4f5b82e4c39cc42a51679c6da48658f795c83a48b525eb661b769b8216ba6d1e402468badc81f8b05491f1b2d566cd9b2b2f1c6c4366c1c141006b78
SSDEEP 49152:6htSn8EApI0figngiDn0AP5wpj4MYPVyGLB:7X2iyph/V1
TLSH
T15995BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7b0c344da67090166b85f697696130941999cf99e27323029e9d3a9636d46ec1
MD5 ad38ce7b6b2c28004f43439743a7c3db
SHA1 efab0713123a6ac73a1c64803e96a408478b138a
SHA512 1624ac0bf9390e4202892aca4d4b52356732ca90d2f5cd3eb9d0ca7c55aa61faeafeee7875fba05b14bf2f3bbeb99c845fef6987dd6b6c6c7cf7890037040026
SSDEEP 12288:Hc34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:HnSnnrFb4PM4MYgLxEVyGLF
TLSH
T1D64523A62EDD10EFCF5D16F0C1A966C8E2097C62F976B20F774574173B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5441e1d7439f0297f87709df6c8ed86cf46e8748fb3ec7d946c5d797ee896f8c
MD5 49eb1c419098e2008519ab55245475fe
SHA1 2f33653ab3bf88e6706039ef7fdcfad465817b0e
SHA512 e0128df5dc7706aea95774868d1b5d247240fa086f584d1f67370f5429cca9efe05ee1944e5a39f176969e31e4901544f24ca5b27ceb7f3e6261b92210360a94
SSDEEP 12288:fv34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il1:fwSnnrFb4PM4MYgLxEVyGLb
TLSH
T19F4523A62EDD10EECF5D16F0C1A966C8E2097C23F976B20F7B4574173B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c4f60d91a1b60a9efb8542f9aecfa6038b26b0a8ca54cffb75a531e4e81d2f9c
MD5 4c954939679a9ac49b0fc66c3651d3de
SHA1 80773924f69622496dc6f259dfec60ab1f7379e5
SHA512 eed60e3ca2e7b03cc3fa7912b6cac0d21fd9769b8f22639834a3afd9e94f9f4c2bfb7332116b7d361ae5759bf5bce43e2b6c4c130aa8e592504e45c871ae61be
SSDEEP 12288:pV34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilj:pSSnnrFb4PM4MYgLxEVyGLF
TLSH
T16E4523A62EDD10EFCF5D16F0C1AA56C8E2097C63F976B20F7B4574063B3B20D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 84ef3feadbe856788676b7ae4a92763d903a54e99c472e50dec0e234153d6a6b
MD5 6848865aac562c47163fb4a683674a72
SHA1 7d401eb96213adc8c4b4fa62d76e9cf7bbb7457d
SHA512 a939e1d82a4c73a114a14b6d1e3a647fe179e1a209dfa682243fb77af71b2037702c3264afbbbfd87ddd711ac945842dd64566a58b5beeedc90da3f0fa522489
SSDEEP 12288:7Vq34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ill:zSnnrFb4PM4MYgLxEVyGLX
TLSH
T1194523662BDD10EACE6A96B0C1B556C8E2257C61FA32B35F6740381B3F373489C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 fa0680d49ba78ef26cb4fa917d109541545fdedf2f641db42e9f7e625329fa9e
MD5 7ead010c26a7043a473f2714b0316bf2
SHA1 704b87b2e28721fff404c58db6327ecdd5d4ef8b
SHA512 4bd7d3c8e8e0f0d4b44bb9f562c6d4960b1dc44555a6f6b4aaa82d60a979cebab35ac6af39f4c5f794e198639080d3bf36e458287dfad6233a7cf5aaad2c0b9b
SSDEEP 12288:ni34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilA:nxSnnrFb4PM4MYgLxEVyGLW
TLSH
T1374523A62EDD10EFCF5D06F0C1AA56C8E2097C63F976B20F7B4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6edcd88c7acf37449306d3511058892486dc11cd1d69e8f6d66c221a450a9df4
MD5 3d24c333896238ca2a36ed9116a03bb2
SHA1 8af8b0b5fb5d816ca109bb0c5f835b7174390032
SHA512 f342c1a144ba4e214e47849ca5858e5690e5e9b7fe12f8d252b6b295ce639e254fb296e2192d3194e0fdefe2bef924f5536c144b3aea997214e9bac0ced46fd9
SSDEEP 12288:R734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il1:R0SnnrFb4PM4MYgLxEVyGL3
TLSH
T12D4523A62EDD10EECF6D16F0C1A966C8E2097C63F976B20F7B4574163B3B20D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0d0bf4a5d3bf04c2ae41976f9889e8c2fe8bbc33b195bf22298af22ca6f0fb8e
MD5 dc34d31e3e90db1f90b2df168446641b
SHA1 b1f6da1be03959d979a6c65efd1b3e3cf6797c95
SHA512 3012b79d2bcdad4ccbe6089cdb27869fcaceb5fbe853e1b8f34164cd5bb50f5d1bdabc6bc1b286863da4c58e7c9e0e540555c37763e7248851b26cd53a9893e2
SSDEEP 12288:lH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:lISnnrFb4PM4MYgLxEVyGLe
TLSH
T1754523A62EDD10EECF6D05F0C1A966C8E2097C63F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 5e59d9247ce962a53b54a6a135d52241757372c9d8bb424eceb73e84d76bb323
MD5 780e914779c2ae59f0e099feee335272
SHA1 c4698ac95df01883add03208e750b72e88c334de
SHA512 0690cb3a77b276af61a3e8ea32e51edea3529520064c509b642b1db1049b32e549b58ebb1a61481ed3422c26f4ef7d377c9994fe6a17d40b2753d0e360f21cdd
SSDEEP 12288:WiZwb6zzFEoS2cPvyP34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2N:ZZMSzFVSOQSnnrFb4PM4MYgLxEVyGLY
TLSH
T1CB6502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1aae36f2779c4dd233891b228e4525b026f4de4bdc81df370db5c6fd44071a70
MD5 ebabe204ad7bcb3005355a949cbed311
SHA1 49ab80ef396d5fc35bd8ccbf94cd876bf13940e5
SHA512 72faff5717d30df4a4524458a124e861e1c7eb8334cd18bfee1291ad1c2332fc9d6d03a80e904a72d84f2e06a74600c7b78d0a597d1dd75295400b197b7c9edd
SSDEEP 12288:Dw34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilv:DDSnnrFb4PM4MYgLxEVyGLd
TLSH
T18B4523A62EDC10EECF5D06F0C1A957C8E2097C63F976B20F7B4574163B3B20D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 fc343109058dab577966a14d364b19c8b9b3699087e47b678debe559ca17884d
MD5 e17266781befd11125db61e62eccc069
SHA1 59d51887642e26a526f51f8facfd6fe76693e8da
SHA512 55d7a3a79213207df6dcf97b3e084f93a580922f80aa829e9b576c54f9d04c93e755f37121ea703a53968139a79f4e5fef0103834a64a6ff65340982beaf7984
SSDEEP 12288:4E34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilf:4PSnnrFb4PM4MYgLxEVyGLh
TLSH
T1BE4523A62EDD10EECF6D16F0C1A966C8E2097C63F976B20F7B4574173B3B20D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4cdcf15fa6eb9bd6777f6cadc3e17b490a7bf90c98779e02f53665b4cd66d5b7
MD5 9927414597ff6ac0a9f60c2aaa0ce340
SHA1 5fa0d809f2b31620ac76ce3b541a15fc3ad79cb1
SHA512 3e6891fc06b4809b6948c42fffe941c689824bceaa47f39e352422e027cfeceb228d9210de7cc028199cb4f155856c5fff1bb1093f7767f4d79b825822fa7892
SSDEEP 12288:ByPz5L8D34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ill:QzycSnnrFb4PM4MYgLxEVyGLf
TLSH
T16355025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3b9302bbb0960f26be9f6f6c817640b99fa5f9c16b8a192b87b6c44145ffc5e5
MD5 7d8cbcd663b8b366422cd9b49f99778f
SHA1 afd125da1ffe24148ba63b181e2b18bc1247752b
SHA512 b6cd414270b728cb28897efcb5b3a980a4f55d9bd1348344ef4b28c882c968f0028085c8f06d0811cc2fc6f208330a5150dd522f031697b1411170ffcbbf1832
SSDEEP 12288:Cw34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ile:CDSnnrFb4PM4MYgLxEVyGLI
TLSH
T1684523A62EDD10EECF5D06F0C1AA57C8E2097C63F976B20F7B4574163B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d67b4217a37d03d7180867b6a046537c724cc8a462ad5ecd988d5ded00d03a6a
MD5 2d53dce21ea307c054cce69786f9dd16
SHA1 07c1aa3596112f533f63c80a43c673287bd11adc
SHA512 c24c87deec0a7f180c881702b4b9e68b59c0d68e8bf0d9f17c598374b98945a3e7bea50db54d6b978567734391be85414cfe4d9272617e25978735f363961839
SSDEEP 12288:7w34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:7DSnnrFb4PM4MYgLxEVyGLh
TLSH
T1564523A62EDD10EECF6D06F0C1A956C8E2097C63F976B20F7B4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 9d4d2ff48dbd66c69baf8d35562619c183e47098a28feee522b0712dad079268
MD5 bcd0a24fb6a9797f914d2ac88e8eabe7
SHA1 688809725627877b8bb286927cd0b51992d60ec7
SHA512 19348607d995a8e970b8a99533bed7665caaa58806ad8468b35ada9e3d3418de8a5b68a3d0bcab3d4781de3cdec09ba2d4943b7437f5e7271847668deeabd3d1
SSDEEP 12288:6yPz5L8D34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il+:nzycSnnrFb4PM4MYgLxEVyGLo
TLSH
T18155025737A530FDC67A8274C4A21A45F336B8329B309A5F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 cb07c550f9f9f4e479aeeaed7e51c95d90ce0733d33451553fb8749d919c3d15
MD5 122a1c2366282e908d9546d6bc306503
SHA1 8c26ad875f0ed1ccde31610c7e175c4c3204c08e
SHA512 7dffffe20186217ff6b6c8ff05892dfcf486d520f7c02ba9256a755d42c204975eaa229e1ecbea323ebf07805e40dce76694140d97b9883ca49ebc121e2e1a28
SSDEEP 24576:mTHaLl3z0zDiSnnrFb4PM4MYgLxEVyGLl:mT6LljWj4MYPVyGLl
TLSH
T1056502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 3853cd04127d0cf0901f8f9e86b23b92ad15db2e5d470b2c064026d8a7aa91d4
MD5 868baf7c2076c06514bfc51c9c584f30
SHA1 be84000b8761a4047b17640ef69aafcc8f0c8367
SHA512 911cb38cf30f8c307adba2a1fa77d0b780f64ede735248a853061f009fb6ae9a3e9a06d7b426d48e2dc315ddec35b9effa15ae2c9cf02678d9ca58493eb03c1a
SSDEEP 24576:P37d9CHKy7GZWSnnrFb4PM4MYgLxEVyGL7:f7d9CHKyaXj4MYPVyGL7
TLSH
T18575DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 202e9276714dd425d2bf4c8ccd2ad1cd7e2b56f262d355986aa8fb89218644f9
MD5 3287d402c94353f0998f133697b691a6
SHA1 5a3773d6fd7b49d4a2229c1e51ca6669c51adb2e
SHA512 86fdbfdd06ad52a75e30372313295fef1878151aa79d5d91144504ee9fdc764568af5a0745930b745ca4ae889c268584d03773a460791e13df208da534842e71
SSDEEP 12288:V134XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilN:VySnnrFb4PM4MYgLxEVyGLP
TLSH
T12A4523A62EDD10EFCF5D06F0C1AA56C8E2097C63F976B20F7B4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 1c375f74cf71bfc9ed8c93d36aefe3959f5d1f4fb685ff925678c86ed3b18878
MD5 5fa1b2a65381f1889bfbebab4784c8fe
SHA1 e69aeb8c18def6b08a9f99d17dd54fd065097752
SHA512 36d9a55485386610c81181aeb839dc4b976c1322c2104efeb9e3349e18fa50f392a609885ac7e025d83f6f2eb4cb976c94914577992dda2886093d3a95750ed3
SSDEEP 12288:Uj34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilI:U8SnnrFb4PM4MYgLxEVyGLe
TLSH
T1A44523A62EDC10EECF6D15F0C1AA57C8E2097C62F976B20F7B4574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fe3b3bf4ac3f28d1d221db7cddd0acf5474040a26163d1c6da6e2a2a39d3ebc2
MD5 929fc5f289881d959b8ecb88a742fd53
SHA1 3b2595fc877bb602f8a41ded5aa2fed47830e7ca
SHA512 ab13a884379cd9ed376fb776667e047564df5cc78471865519a610a4ee5689292c91dafcdd3ae0fdf7c774123e29489c852c7adb04e362074b0274bca606d9a2
SSDEEP 12288:We34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:WVSnnrFb4PM4MYgLxEVyGL0
TLSH
T11A4523A62EDD10EECF5D06F0C1AA57C8E6097C63F976B20F7B4574063B3B60D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 55348adcc4407019bfb0648b19a87cebf8ed98174b5131b5fe0eb2d43ffb1c60
MD5 f39748057ade3a4e15b7c4c6ce14b9e5
SHA1 f9ac74f9172ddbd37c545ae75b904d053d8596de
SHA512 168336abf8180a81d472e6945849553ec1fe66de4702c6d5f837de0b49d81e6b6d8ad0f57f1efa20d2d061abe135d7af1cbaaf2050750cb31c3cb509aee7779e
SSDEEP 12288:Hw34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il1:HDSnnrFb4PM4MYgLxEVyGLn
TLSH
T15D4523A62EDD10EECF5D06F0C1A957C8E2097C63F976B20F7B4574063B3B60D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f859b347fea1f1a926c3b7b09caf18c930b4e2b2392d5e6696f97a53f685024d
MD5 e618c5796ebdf952731e9cdd37db9d9a
SHA1 53a71f69dab65e4d4d04ebdfd8b1e1b416317334
SHA512 416b94668e7fa3c96caaaa4817a56f0ad4e0608be53e069dbe7489d8245629ac604b0c42791d9f90f4739f28aa8e9bb2a97107e7ff639b5ae912c9d03739e80a
SSDEEP 12288:s134XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilO:sySnnrFb4PM4MYgLxEVyGLo
TLSH
T1C14523A62EDC10EFCF5D06F0C1AA56C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c47dca4d439af09ef8c552d28fe2dca24c6331ff9a4b480b283a337aea921349
MD5 716b846aab51b3cc662487c42d75d788
SHA1 6ff8a673fafb63271c94d9c8246691a5af9af58c
SHA512 1ab1123ed1a681feb7a542bd29786afbc979b1847f2b5af44971f7ffcbea99a6a7ec6fe87f3d47905391a6e46047daf6b2c8732c5d8d50ee8c6d10ecdeffad02
SSDEEP 12288:7I34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:7bSnnrFb4PM4MYgLxEVyGLA
TLSH
T1364523A62EDD10EECF5D46F0C1AA57C8E6097C62F976B20F7B4574073B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 8a698c9529dc0f58e683206f45fdf9cb28e8ae001702f55f7f93c6163719e6aa
MD5 67d58ab3cb10f31ff0802a0e38e9d266
SHA1 b7218a098f3535045afb4c9aeac2829c1cebd90c
SHA512 d1965e081634dcf51c561a65e1ab0c5cec626b89754929f32db30555fac19d9c157afca26eda1ab57095aff15c73259e2e2600e53cd96fe848d3caf4f705f6d7
SSDEEP 12288:0i34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilR:0xSnnrFb4PM4MYgLxEVyGL7
TLSH
T1FE4523A62EDD10EFCF5D06F0C1AA56C8E2097C63F976B20F7B4574163B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 1dc3940c7e769f1e171291af7e8434c894917597da3eb4981b5bae185893b6ad
MD5 7f223cb42e0506d2d51f16875dca35b6
SHA1 9d2969fc069db5e9b408e23d780306987561d6f6
SHA512 627e80f35cce5fd2a62ac6cfff460632aae72b0d94b56408f3980155dd805cd27198562868b08762e4c3fdb07d887cd34a7eb80d679e4dee50069d528f34f4c5
SSDEEP 12288:Hd34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilP:HaSnnrFb4PM4MYgLxEVyGL5
TLSH
T1B14523A62EDD10EECF6D46F0C1A957C8E6097C62F976B20F7B4574073B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 e8a5833940fba838318c821a2104c46dd06e8f44e40c8bc82ec6923a34863355
MD5 c3e114ccc74d55054a55a7386581ae0e
SHA1 5e9fc640094ea4e4fa894ceebb5336f6a8916574
SHA512 b47b33b5c72bc4d58a99c8854e66a32e2bbaa769a84b390b7d0f2be23fa3027cd445d9b8c6eca0dd9346278d584d1b4d4eaac13ca99c6daa719ccebf2bcb75f7
SSDEEP 24576:/fwvok9RX6wkyAI/SnnrFb4PM4MYgLxEVyGLo:ZMnYIYj4MYPVyGLo
TLSH
T18385D029EBDC04E5E1B7923C89B7460AF2B178695B31C2CF129A536E0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 570024bbc24ced71738a227fa01fd4d8c7c11f9f5aa11ffeecc201117cb0966d
MD5 dc5a0129da8e5fc915429a0c2906bc36
SHA1 794460fc572920216ec24417f7bd544673919d65
SHA512 11d5c53bc26bc0ba161a643b4fb8d4f46c63570f1a7e94f8966757c9e83f261b4d58bcdf1652b4a33cd99de4da16c9f4456a09046bb65a2c37ad93131476a780
SSDEEP 49152:AYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Jj4MYPVyGLX:uySzPKVb
TLSH
T15A066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4a3770f6b8769283ef4603a10d797a79cb10b29be793695e2602c59ccbe55bc7
MD5 cc35c2df58e854e4cc2a4e350237a384
SHA1 374bcdcee2f0ee84412719047e90d32f44e426af
SHA512 a78169f53a6082bbe5a94ed86e689e6f2c9f04faf9773f8393f0e23166bd085071bc0afc171d27d8831f1647320d904434a6ff09efe0f84af18cc6ef05ccb67d
SSDEEP 24576:/47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYASnnrFb4PM4MYgLxEVyGLo:/47JUQj1irIhCnDHUPfF/5j4MYPVyGLo
TLSH
T1F765BE1EA3EC01E5E1BA827885154A5AEA71742E5F31C6CF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ee9255ec172fd0c8bcc16955c041f5ca91c77dae4ca42505ac45fa6c01835b04
MD5 0c35f806435018a969d7fe4deceb710a
SHA1 c875d9efeb0f1ce3f045cc0c4761158a66f61ffe
SHA512 1a7fb482b2c60131db7da70b96643a4e0c66d5a83ce66705781c97e04c930da7f748785cebb12e89e083e34062d3a081e60f7d82e59b036d9f4fdf839c2974a5
SSDEEP 12288:QNsfA34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:xTSnnrFb4PM4MYgLxEVyGLo
TLSH
T17E55F15AD29801E9C56E6271C3565A84F3237C2197E1E3CB67C0F43E2F3A6849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.4MB
SHA256 7b8aeb969071d164daeec53da90fe9fda191ede043d114030a64d0322e21e436
MD5 be5bd644f16c8e4986530932df67df4c
SHA1 b6e725b1f5959950e31c5922cff68fc27272c4de
SHA512 957731fab9a66e6b0d58b8d737a01ea5a3487c3d1b16b620eaeac07f326fada7e503949ccc384ebfd91161a821a98cb5d3af3a79162b011522e97cd79a053d0d
SSDEEP 24576:eVdUn94a8oQqbFAkb8OCAnwzoskgYif8XkGYBeIBjx0zE66Ew:oK4a8oDFAkbBnif8X7YBZBjaIH
TLSH
T1A6652700B626D68BC6AD40725E36D6CCAB70BC41EE056F0773C84B3FD576658BAF6281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 12KB
SHA256 77bac7b239546bf8321ec60bd1aaa350ed7dc1499fd8ea7c270dd3ed65971115
MD5 84952f25dfbcfa9f286ff7499fe0dc4d
SHA1 72bafa1e50d336b40c3832c13c517e94c768c518
SHA512 1e3585e77d2141515956de42e5898e3379585f1384236e5e93daee50d3d99c5bdebd87d1764ebd9a5019ac882313c50e2229ab4f7a7c43e89668054c4b58a055
SSDEEP 12:KQdWEEEEEEELcEzBRMtrC0EEEC3UTSEn8tJ15Rv+vsMlE3UvWHP/q9RSXHWkEEE:KtswCqOS8sJLRms0sk0/q9Ry2
TLSH
T19042277CEF505A60DBF27931C086BBE50F32E01C6899938B124D21382E052D48C3DF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 3a4e51b355ee40c82c947cdd24c8f72fa61af82749b89570fc9b320f7ec4cd0d
MD5 1566258cc14b2c14c24ce51704c5d009
SHA1 260163bf0e95679effb0b5042182ae5b08a5bf30
SHA512 8099269919244164a010a0736209358ac31c0f0fbc3ad08500e46a22dd37a78742928941601f9f840c71a41f422366ab59dea5db95bbdb7dcb98474c31d3ce5b
SSDEEP 24576:4vMq4qlqqcNRRRURmizDrwiWnQnBalnYEIx:4vTc+aix
TLSH
T18C553A00A4A7E70FC9AE50771732C6CDBB745C43BB452B0573488D3D98ABA6EB5E62C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8fd8bb7a3237bbf80b8a000e7c4d0909edb73ece8204c1f79bb2a6d15b9de22a
MD5 8a213dbdfd0fc89985913b24b4887c06
SHA1 50e1b25d2ad0688ce302b9986544e972bc177d5f
SHA512 7503b414913ddc4d385a8ef5db9d63f063b78dd8480457e40fa49237eb00eb391eef11146b33a314e54e62eb211041dd5ee162d1522ce4f43acc20ad4447b528
SSDEEP 12288:CM7Y34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilE:/rSnnrFb4PM4MYgLxEVyGLy
TLSH
T1AC4523722BDC14DADE7D16B080AA9698B209BC31FF61F18BB7407456363B68C9CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7364e8a55c31251dc77ca578e649120266e89593ca3a9048592f26942208addf
MD5 6854d3303110647146d4e5c30c91724c
SHA1 ecb493e4eb0fb99993e0b0995dc2c3e7aeb7dcbf
SHA512 c9d217a9878c155bbadc131be5b8c4ddd9e10f301b8c7436d7de2813c6d604e5815099e1a849da69d48bc28dac712ccab586224047df24f3346e0d33aa6402ce
SSDEEP 24576:fgb6bmBIi49WNNFpg1rSvFv7bY9SnnrFb4PM4MYgLxEVyGLj:fgb4mBIBhGFTj4MYPVyGLj
TLSH
T1B365AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 fc086b8a22fa1c071a50c329428d41f23123a6ef5a56e4db8523d3045da02c0b
MD5 1c0f228912e4201f4385c3ccf0d6add8
SHA1 3669dabc0df9d2651921bec49242f85a2f543c50
SHA512 12868fad308f99772fa7cbaa97c97255de6cf0165e7d113f670d946c40b86573b6db437542b872909cc52113d61b759fbd298b3e3351231346697ac4c1e83366
SSDEEP 24576:xG88u8FpJqH1bzria7/mQSnnrFb4PM4MYgLxEVyGLM:U7ZFPqVea7/Oj4MYPVyGLM
TLSH
T1F785016577E001F1D47BD138C98646A3F672B8211360FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 97c1114592ef01859651adb73f94a9f32260c9ea2a7ee17856555210fe7c5c77
MD5 c7a9bf71b833ce72ec8ac2dd990c701a
SHA1 9332ccae4bf1d94179aca05a734771dbd042bc12
SHA512 f0f88c0e63a9a4faf71187a5f7d10016170d3fe09062fc99422982e45f84bd3ee54c9b34f4e0b78319356bd1f4b82d775b55adf446c7ad4731a9f90d56d847b9
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjnj4MYPVyGLL:GG05lO43bNVH
TLSH
T19AD5CF6A62EC11F9D1BBD17CC9C64A0BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2a86af3c664bdb6e96570d210b2c5c89fbb22492217622791bfb6014d3c5c57e
MD5 4dd2bbb87f7da8f8022a57313d3e9c2c
SHA1 05b290b00c6f8498217dd44b3e529e4ed951f613
SHA512 5ff81721a1cf264c2e53b166aab6f99e2acdd7e98746397263b6813f29cfd5226725443b334831e54904a8d05a9c41626bc97c20771eb3610a2a06dd503c4f60
SSDEEP 24576:dfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnuSnnrFb4PM4MYgLxEVyGLw:ta5POZ3+Jt2pasx2+mvj4MYPVyGLw
TLSH
T1AE65AE5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 274b72d7657190bbdb2062c955ff158bd5a7979747b4749cfc16324c4454a7ef
MD5 24246449c981386ce4e0b38997b15136
SHA1 bae9465993639ab8387be6ac5deb12683dd77a4d
SHA512 8d9a39706adb314616facf46c72485474ece9b9804b5ee56b2dbe0dd339dfe0b3564d450bf19d253e22e015e00f307bed979adf66190eca54eaa4a0f39807311
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkYSnnrFb4PM4MYgLxEVyGLp:PNc/zEOVHFuj4MYPVyGLp
TLSH
T1E2858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 03e335eb7b8d1e5572aa3e4692b2011e6ee3df0a39495421f79ab692f25cb152
MD5 1669ab1cb0d2025f568c8f3adec6da0a
SHA1 88d7f007b38e702de3b33013dede9c36b28117ee
SHA512 bfdb5dfcacf1cddc82539461bd3ca11048908d538c0a101f1bca9363ca0ef86694f6f421cb08e7c774a412c6476f0975c0f3ed37713d24dcd2e2f44cd3aac696
SSDEEP 24576:U8kNvNnaFeYhJNtmZBmaSnnrFb4PM4MYgLxEVyGLR:U8MwBtOmVj4MYPVyGLR
TLSH
T15F55AE6EBAF806E4D1FEC6B4CD238512E6727461173293CB5290C13E1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 3fe5e36c1e34cb4d6447fda6b95ba13b2c9014b7d4af1c6b353cc673c8003341
MD5 fc44c31c91e35a91507f79c745ad3ffa
SHA1 79e4ee67d03d0bb5788ea7c0f5c19e941a7e61ab
SHA512 5e24468cf3029dad5283d3de74d80cfde4f4f86e1173cbd0291d96989d5530725624fdac8c9c03d8ba15c06aa19c7396e147bd125867afca53349154d407ea5e
SSDEEP 12288:dHvUrBFrEjwaQr34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:dPUr+NQkSnnrFb4PM4MYgLxEVyGLt
TLSH
T18665E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 49f6284a75fa11a3561cff8eca6ae6c040f0886299e097ba208f8f9b9ed4ebe5
MD5 9127ea1f8e30e2686040c75e0b312c68
SHA1 0f906770c9612dcb719b47e85f0c0af4997d8072
SHA512 06da5d6eee9f6dcef9195428800da9117f359b2b33cea916e88795d4cc5f285dc9f5286b5bb2ff030379e5d74c27eca4a71822f80404d478fba065b5cf62f620
SSDEEP 24576:WD3FHshBIYQgAHSnnrFb4PM4MYgLxEVyGLz:WDVHeBIAAAj4MYPVyGLz
TLSH
T17D75E17EE69C04E4D57BD1BCC6638A06E77138A9033266CB12D491B61F2BED46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1184-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1184-55-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1184-168-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1184-61-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1440-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1440-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1440-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1440-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1440-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1644-84-0x00000000007F0000-0x0000000000857000-memory.dmp

Download

memory/1644-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1644-79-0x00000000007F0000-0x0000000000857000-memory.dmp

Download

memory/1644-251-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2020-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2020-136-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2020-128-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2020-134-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2020-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2416-283-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2416-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2416-89-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2416-95-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2416-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2416-381-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2604-121-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2604-115-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2604-313-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2604-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2660-204-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2660-67-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2660-73-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2660-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2772-6-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/2772-2-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/2772-77-0x0000000000400000-0x0000000000605000-memory.dmp

Download

memory/2772-8-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/2772-0-0x0000000000400000-0x0000000000605000-memory.dmp

Download

memory/2772-322-0x0000000000400000-0x0000000000605000-memory.dmp

Download

memory/3056-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3056-315-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3056-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3056-108-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3056-299-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4696-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4696-20-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4696-14-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4696-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4696-22-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5508-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5508-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5508-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5508-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5580-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5580-45-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/5580-46-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/5580-39-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/5580-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5580-50-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download