dc5c76b3fcc78dd80a4e237f4bd87601e6b56f0ad0d47cf32bf5a334c4525824

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.6MB
Sample260710-vramlads8q
SHA256 dc5c76b3fcc78dd80a4e237f4bd87601e6b56f0ad0d47cf32bf5a334c4525824
MD5 dad9167735374a0e46f06bed146e7d35
SHA1 3a0dd1dded1a3fcfa9ae89865a0fb95d1d5c5239
SHA512 dee4805317a627d23c349952f440854563f416b3b8eb930ec6e3c8edb95bde3bc14e6a94ca85e607e14e871b2c847c15c53db02b91cc7b5cb18675cdd26544ac
SSDEEP 24576:amerSL2r7VN15u6s6xRTrSzcVvoKFLgYHJWwl24C15rDY:a77VN15ds6xRT+cVQKKYpWwl1+NY
TLSH
T11485F112B4E2C072D9A202704DA9EBA5567EED700B6149EFB7D03E3F6E312D15732A17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6048	elevation_service.exe
5920	elevation_service.exe
1924	maintenanceservice.exe
1360	OSE.EXE
4240	PerceptionSimulationService.exe
4204	perfhost.exe
2388	ReFsDedupSvc.exe
3164	SensorDataService.exe
5560	ssh-agent.exe
3368	AgentService.exe
4188	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1e2333ed8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000cd9f7a58f10dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000d3344688f10dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4a0b66b8f10dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0fa53668f10dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ee45a678f10dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003754b7678f10dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e42fb9a58f10dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
6048	elevation_service.exe
6048	elevation_service.exe
6048	elevation_service.exe
6048	elevation_service.exe
6048	elevation_service.exe
6048	elevation_service.exe
6048	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeBackupPrivilege	2388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2388	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2388	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2388	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2388	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2388	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3368	AgentService.exe
Token: 33	4188	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4188	SearchIndexer.exe
Token: SeDebugPrivilege	5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	5744	2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	6048	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 5304	4188	SearchIndexer.exe	98
PID 4188 wrote to memory of 3176	4188	SearchIndexer.exe	99
PID 4188 wrote to memory of 3256	4188	SearchIndexer.exe	100
PID 4188 wrote to memory of 3396	4188	SearchIndexer.exe	101
PID 4188 wrote to memory of 2784	4188	SearchIndexer.exe	102
PID 4188 wrote to memory of 5992	4188	SearchIndexer.exe	103
PID 4188 wrote to memory of 3548	4188	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_dad9167735374a0e46f06bed146e7d35_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5920

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1924

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1360

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4240

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4204

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3164

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5560

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3368

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 2932 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3396
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2784
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 2932 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0da2763946b7abb1e93d6666ae0e8061607491d00651103dbd40fd8aa002a4e3
MD5 d677fe7157a1d6ad629bb23f8e7dc97d
SHA1 ad2e34cad8d904487e257396b413e20293bcc825
SHA512 029a7f0cbe087c82e6e6017fa0ea762f57db86a937af8b48fd0783bd30b0f5f1689ff04b915ace47331c30453d506bf48b3b7464ce4cecb6c9be3af99f254de5
SSDEEP 49152:Nb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn0QKKYpWwl1+NY:T3q6HjBzKYpfg
TLSH
T1FBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f8a41560ff4dabd2421c2d0ee17aada97ec16d957fe00f14151aed4f5eced31b
MD5 be9c849035d206ce3499c6e6be95469a
SHA1 a38ff056e2131e882caaf4f50d1ce6e78424d68d
SHA512 290f29157a8f8e1b33a09e2cdb20486764ee6ae8ae7f6d1d3973e2f80e4bc58aaa5e8bfff086d04fe38d004e13ebaf0cc52e793214400b691bf2dce2a370c5d6
SSDEEP 12288:j1XLsswWkxy2lRq2czAXJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rd6:5XYfDtczAXvoKFLgYHJWwl24C15rDY
TLSH
T1FB65F12973E508F9ED67817CCDA28402D633BC5547A0E79B03A0A96A1F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 6e64137c662fe89a17ff96e22bd3c77e1936b423f86d71c733c814b259641396
MD5 5383c534a7c83a972d186bdb87e912a3
SHA1 a90ccba1c95bacb51e8e3cf85259614fad7d09ca
SHA512 77700b1e47e0d405153cd909365468b51ad7d270a9aec42489c34d0b02949c116f9d1bd2442dafe994593610ca30d83230b8600b3e9fd57cdc78e5e2aafec357
SSDEEP 24576:K0Le5ji0hmxirMcvoKFLgYHJWwl24C15rDY:KPji0AcZQKKYpWwl1+NY
TLSH
T1AE85AF16F6748371D073C0B9C5D2A68EE97134865B308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5c3246c8d35242f71dfc1f393519f53a4249726da08837ea927f38ea7f58c87d
MD5 7923c5de462dc23d8c50fd16d9e406fb
SHA1 1f61d82123fefcbdb30711e0f542d41571d42aac
SHA512 523f1f5a71d0f30a82439db7100b1e16b928425ebb0dede15018973ea783325703c3b9dd8b08cb20c659a92258d2aa43476182ccc0ba7c52cd92dae69939c6d8
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWE6q8wyuCvoKFLgYHJWwl24C15rDY:s/ezSC6vUzPvxHjyNQKKYpWwl1+NY
TLSH
T177756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b21a503c011b9d9f38d1afc9030a225bc0d8b33021954202b1889fb2d8309fd6
MD5 cabc7975d6d7e55c0b4e0a48a2c22128
SHA1 45b0f8f13d05baca257b0f3bb4f44a84975108f6
SHA512 18b1322be5fbf0ec81b05a08ef5ef025238b59a893b3e367c9e81b41e5c4ac4957916000311058a86a4f0503bb186e16c758c3634c12d67853c22fcabe5d302f
SSDEEP 24576:zVbqPb88hv/l+6DvoKFLgYHJWwl24C15rDY:zVO88hXl+QQKKYpWwl1+NY
TLSH
T186559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e69fe5a353de9965ae9f8d18a730ccaf994b43bf2163f4b3513061ca69a5d74b
MD5 3c3fa9dfe6e6e265b7b8fd0e39f9ec34
SHA1 a38805bdbc5976c987e8c044e60b2b7adc767bf2
SHA512 7aad0256b944841864f1adf18741f3ac5107396b56fb2946d225b0ead528bb163d05043dd509a3e57d9f07c15554fd41c7c3b311e1f4ea06d0d17b2f2a4b3d28
SSDEEP 12288:URIJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:URIvoKFLgYHJWwl24C15rDY
TLSH
T1DB45230771ED80F0EF5A0EB5BAEA64478131CF0858C84A57D4117ABF28B7EE8B71D159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 8bf8052f978ebf5b062ce7507b3a3b76b3a207b28eeec56c67621364518d5215
MD5 0b023a314801620e947d6d7b7a9d0733
SHA1 862cd07a2485de38f493a46fca2f46be08394c86
SHA512 d5f4aee7cce204dd3f4010aa601b1590476ad5f7d6b65fb9c3c90e660867540f652ea15b7bd7387d293e4585d29647ab3eed1b5cb3e139d29de88efb859b4540
SSDEEP 12288:geBNUbTVO86UrJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:gJIUrvoKFLgYHJWwl24C15rDY
TLSH
T10165CF3BEE28FCE2C67E8DB95A918600D77278304F5193CBD165830E9E235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0da771bf10311086f138bdbe6e01a12e2177dd3c167008e5572998745b05c7eb
MD5 f3aceb25f1e5ca97bad97a13f0717641
SHA1 6689ab5fde9b5a6f74cf2e898682772fd8c26600
SHA512 2d9a65991349da0b712c4400bf17e62bceb90029d3f9b18c92b68cc6c482d82e18104e15f5e5fd7b2bd45c077e60340572c974bafa5308e321c12c4945cc15c1
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THP:BQvGAdlCEL8c/yRNw5CqKYpfg
TLSH
T1B8267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 6e54aa75f16a455adc8fe45bbf5451afd5c11fbc068593affc0ccd4c6bbe107e
MD5 32e32dad539afa322b6bb39ed4a7f018
SHA1 aec202c8ffd7232e81c78bc72b3d906d164965b0
SHA512 0c9722944c70b05f3a7df01a383a09dbb65ad3bd14cba3ca13d718719071505eb7165427caf9ad11fffa3bb19712bf25e8257da0c0b3b79343fda937ab21c4f9
SSDEEP 12288:mAwSfxL/2Dc34DLLmt0LDQewsAjJJlARaGdf1IrOrNhyRfLz707YH7lk9wl225Ck:7dewsAjJvoKFLgYHJWwl24C15rDY
TLSH
T17D75E031FA74D036C77F0DB61B26C706543CBE204B911AC3E3A89E9E59706D22376A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8fabd1f6ad01a2b98bd2b2cdcf8f430d3b9f193e22e4f1eccb59b8c2f9b07db0
MD5 d54c4a19dd5fe913a05fc7d4c2a66b5f
SHA1 aa016550928733b7f081b8ed441afd2a892119f0
SHA512 ea33a59ef11b6bcb3460cb63dda5495d70b8ff695ecfe249b44f79112a79d6ab851a2d5517a594432cfd53fdd2cda3029500f0739e3cabc746e3e48f122e5c37
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHVI:sUEtQevvqc2W1cpV2EI32e
TLSH
T1C6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 07c81ddbcf038804886e5ac92a27611a8b425710dedeb85019a7f29aa9e34922
MD5 a296aa1fba169777c7c081a83e2ee9e4
SHA1 548e614a34d0e5bb7d4a657b8602f07da9835b7f
SHA512 610ea88359a3a96ad22644ae4f3335bfc5bfb629ef835158f6c4a19739c7f57329cf82a758ea90cd190c72b3a7ce21c85ba9e412c435fb6c50497552434251ee
SSDEEP 49152:MCbRquA/m2yL5zQfFiV+XenmE3/zpQKKYpWwl1+NY:loqtVjnmeKYpfg
TLSH
T17BD58D0976B8C2E4D1F6C77886A2C647F37178154B3497EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fb57dbb56d7749eb0adff1749cfe359287d1879422afa6c2c1e93d9e14ccfe93
MD5 236a937093cb01cb430cfff62ce2fbfb
SHA1 5cfd4621766aba9ed70a7c8033d09fe22109d633
SHA512 992b9ca58cafabc62e96032fbc602740645577118276ed969a2d57f43174750dfeab9e5d05f444860ec1f2d18f13a4ac49ee82f12f473058cb0bcba35eb583a1
SSDEEP 24576:YAhGLJIFoiwtA5l7S53WvoKFLgYHJWwl24C15rDY:YAMyFoiq5mQKKYpWwl1+NY
TLSH
T15C35AE81E7F945D4F5B3AAB899B69171EA76BCA65E30C20F2150D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 03808084a41315aa0202fb80525b32b885152ee3d87d99ea4c437de08fbdd1a3
MD5 16f53b500a142ce0afbe195b210489b6
SHA1 fb1213ad31f2e45f3aeea14bf9b9da63309bf083
SHA512 8c7d908900ca14496a34a594d734bf318ed782627aa3063e59ccd2db38cfff01e74845f2262d86c6492ba177005088299410c1bbaa045efd7d563c1fdcff88e0
SSDEEP 12288:Rmw5HEjsChNVBFgl0WDm+CiJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb+:MwuoOWtvoKFLgYHJWwl24C15rDY
TLSH
T1AF65F14A72E90CF9EA678639C597C036E7B2BC012A64C71F5760C65B2F373616E2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9fa7f53d009becf1a242400409a65de9034e45e63b1ed7889ca4a34d66732964
MD5 24bab892d73d48ad1bbbe9078716e3d4
SHA1 a6c5f5468746c82a8b56820315fbafa2f22432a8
SHA512 2ec6accf90c59229e5ad7365da24e08219199326cd916ca1c091cb529f87dfd4819091bbaa2c92e76b5b9d4503154451d77772c261ada5f24ac000829806d8ea
SSDEEP 12288:bBZ1Iy5JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:1ZukvoKFLgYHJWwl24C15rDY
TLSH
T1E955124A32E860F4EAA7467CD9E55506C372BC1627B443CF512162AF2E73ED52E3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1e88109d341e2f8cb2eccaf2f52e5b675e974826e62b810a40fad23239b89710
MD5 aa8f20a352614a05f5de3b6ef3430003
SHA1 aeebd298c457903388c0011d9542c13e139fb016
SHA512 c2623efff0ca77e41eaa331ee2b54e5da3818b247b99ab913240a8bebb43d765a426ac1414337964aff2873c3380bb136732f566796cc226f556a3478ce78595
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ur:1QRQyi36YOcPQLvw2gAf+PN3fKYpfg
TLSH
T141667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 599e526ca960089bd2f91b610609f3dba62554c67928ca37818d2340f36436d8
MD5 420a769577a89b7a82b2d73e2274aa89
SHA1 794a5dd20dad93ef4512fdbcf03de69135f29edd
SHA512 d9f6c290742e1c43eb35bb929fc456becb3030ebc7261ed9a6f3ce49233cdc457ed9989282dcbb717d790c695191a87ed8defbda7ae62d1e723a76f511e53b4f
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ur:1QRQyi36YOcPQLvw2gAf+PN3fKYpfg
TLSH
T18B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 31ce4133ec2150b3e0b197791c7f0474ff4be0543ebc32c3947c8bcc80d9ed97
MD5 a4c047139d385c6706ec4dde6d43f3cf
SHA1 f7b06db2fa739089ae93b44190bb6897ddac61c6
SHA512 1f6fb6970046291c9d28efbcb00762fd2b6847f3bfb58ad1b161b09c75e0167ed565e0d92a9fd78ac6b5657fa4861bc343b4514e168edce6fa96b2ea6f2bef15
SSDEEP 49152:q68Qg55nhheWu7PNU3/ZQKKYpWwl1+NY:YthWRc/dKYpfg
TLSH
T1AAB55A33B2F600A9C44DE1769F4A872196D17C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 148c25f44938a695cfd0ff9ffb21ab6a2c21ea6e6af2a789d8dae19f8b4de065
MD5 cb6dae427af40a9d4994a5aecb811df4
SHA1 f719220820859f0aef4fe1b57c5062dafacdbb2e
SHA512 bd7df5c0df2d8ca1cb531358474e3251da35ec3b051b533eff97f92156c4c3793d74e97c4f7833dd6c019b162c4f955ededf97977913743286c46501e414b1ef
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99B:jy5112gYy5azzVvL69nLKnhZcKYpfg
TLSH
T126167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fba571ebafa97b2525b884049a84d5e3fad2a47d6900dea9d61d8d351595e353
MD5 d2fe706d0e1c4afff01e25578c14f0a6
SHA1 cc67bfb3c95c1cf73367392a29d58bcece406873
SHA512 312695b62f24ff1e2a37e21bc1686f75c00647f286e4f756b7f6fbd1a9a96427e2378831e098a7db662219948164543dd1ced2cb5552c58cd68b8ab55672faa0
SSDEEP 49152:5B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glnQKKYpWwl1+NY:vu6JmVxd2dXKYpfg
TLSH
T183D59E13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1b7e60ee93d35833ee672e6446263b536dabe1fa0ede10bc4aee66ca40a85a87
MD5 08f95743d3e6af09e4f2fd19cfa66348
SHA1 1b456e2bbf7c3c47c8d822f8c2d0dbd5b409b9b4
SHA512 cea087a6258e8d2fc1953ee717bd01b5b06cb2b3fbcdf336c15df02e4c3b907dbb14765c37e0914b5450695e3cad705bc4347ff1a38a585544781abd48f8aa1b
SSDEEP 49152:a1hpsNoJpF1A6UU44CwH7R4xLQKKYpWwl1+NY:amifPbReKYpfg
TLSH
T1AAB5AE13F2D901E8D05ED17887569232EA62BC460B34A6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e11a32c8d4ab12adce60309d314baaf1ef906b60b3b3fc7098fd94528a3cc651
MD5 abe9d655513c8a803e5bef1d2af73103
SHA1 36536a267fab31413031fb1be3426e30a9be7362
SHA512 ef2bf069ab39ce50308448bc41774cd4106b831667c6b33bb1c639ed13142fbeb375aad3d71d4178e4ffef5f1e90b88e76f771ea59c0ff0f714de0c884629bdb
SSDEEP 49152:JSuZQIY0Be2KRRVtOnks6NMHqkQKKYpWwl1+NY:H5dKTi61YKYpfg
TLSH
T118C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e6a3f39961a25cd5313193c919998883171ce06280f660a0d07c28d39c3f17ed
MD5 99bd5b2067531fc798bea74ab690358f
SHA1 37c79a613210889f1eaac360255de2d8e11ef7d0
SHA512 00b2a1cb7fa9161593ef1477f52845e877c438f7f9efc351bf4452a0b5c987afad6c50ad49f61dd4e18b5bd12e3f9beed556e5eb8527d9e7e52b8738e101a8c7
SSDEEP 49152:9htSn8EApI0figngiDn0AP5wXQKKYpWwl1+NY:sX2iyphyKYpfg
TLSH
T16E95BE13F2D901E8D05ED178C7568632E972BC160B38AAEF0A50B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4f084343095e82315e3f8cd7cc2e17be610f72a7ba46bb18dfeddeeb6308b960
MD5 f573c0ed98448b51bfee086647bd91e4
SHA1 f931408a85829a72bcf2358dadf48b5b0fc1dcce
SHA512 78cb2b1fbf6153e445147ed834774e08fa2cf3f6491cc98f46b76e3c6859b354d925bd849faf650b6c488a1e47882fd2fa5bdc1667860c9a5dafb605f7828bcb
SSDEEP 12288:3QJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:3QvoKFLgYHJWwl24C15rDY
TLSH
T1F045234B74EE81F4EF054AF5AAD66047C1349F0AB8C8066BE512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6347d801cfa9000059794fcccac031f44c14aacc21cf9f4f2db6f076557139a4
MD5 0341a6e79dbe97438f188324c722d9d6
SHA1 7dafa50655d8c21a3accc7e5ba1dc71888c7426b
SHA512 b98f26a163e496ce2eaae77074fbb27678a9bc38bf1e3dbdca1229877793cfdbc609f6391fa9313b5c4dbc0e4c7e85711557c305f299ae34b96284c120a58651
SSDEEP 12288:dlJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:dlvoKFLgYHJWwl24C15rDY
TLSH
T10645234B74EE81F4EF054AF5AAD56047C0349F0A78C8466BE512B56F28B3EE8371D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c94a84639b1a64ad7489b782b98a90b028d0c22fe5746a87770ce571e7d61329
MD5 693e1557c721a0374d9df4c7c2011c85
SHA1 d5443638356e599f7536482d361009e72c8d29df
SHA512 459b9aa6f7bf1fd6bea3d0bbf76222242b3414beff363c26275cdd400b142b826b699d67bb5260ac7ab34dd04d4c92d62236cccc797f6c8633b6323099a90556
SSDEEP 12288:iTJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:iTvoKFLgYHJWwl24C15rDY
TLSH
T16445234B74EF81F4EF054AF9AAD66047C0349F0A78C8465BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 8cf960a7b631efb4f0c7e6f17b5e298c8a95f360bfef7c7fd19e8a34335c9ad9
MD5 38174bc4dbf23045d2b780cbb4d11a08
SHA1 88c0deca8b48fdb805d01f358f7149f016f1d4de
SHA512 234cba03665e019c4a65f4966cb84009d17c6086954c5e0eb75b04df76c62537061adf713ebf88d833820f15164796424b5912dfc7641b7d10e7676b6e493091
SSDEEP 12288:FV2JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:2voKFLgYHJWwl24C15rDY
TLSH
T11D45230732FE41E0EE16C6B9D9A65003C271BE59A5A4479FD601356F1CB3BE83B3C668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0051ded1fa612953ec82f0d0f79f3282f2da37be83bb731844ffc97f5647c6aa
MD5 89c468f8cff443a4124dbf9930230374
SHA1 ad94e0174a9b846e79b635420aa0a5d93544f9fb
SHA512 c67c0017ee6d979b0eae7017b54355039d32a590123d973356ca9b96ed09e1a0d6d53473fc8a6547c3815f32f3c76bc4659b352f3c8da68fd672e841efbee774
SSDEEP 12288:4OJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:4OvoKFLgYHJWwl24C15rDY
TLSH
T11D45234B74EE81F4EF054AF5AAD65047C0349F0A78C846ABE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 211fc63fc41b7a577e93851ee2be61fff4858fe21e7b350f1df3a703e9af18ff
MD5 cc4bc477fb31cde80886e7d9d4949bfc
SHA1 a6f7ea8273916855726303f819243c4c94cac291
SHA512 4aca6be03b7b46976f363f01d8de821437b010d3fce3d1d427a1b24fb5ddd77f618b4c289b2d7c1609208ea36f32420a8dd4f99f7970e133c12d98a7471d4883
SSDEEP 12288:9xJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:9xvoKFLgYHJWwl24C15rDY
TLSH
T15745234B74EE81F4EF054AF5AAD56047C1349F0A78C8066BE512B56F28B3FE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 185c46691cee9dab49dd0bfa13e4c0ca15683f3debc75e76a85296d50a08d897
MD5 4fa70b734f4bff8d097924394e56c573
SHA1 87fc8f5d868fb92d7315882aa23834bf6b1fca0a
SHA512 b364f3a1331a22971889b0f69fffaf136c774c2c3f78cafddba998037dba07d4e3b667cec00733ccdcb12a279c9b594c917e7203fc523f82d9069199aaa33659
SSDEEP 12288:q9JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:q9voKFLgYHJWwl24C15rDY
TLSH
T16845230B74EE81F4EF054AF5AAD56047C0349F0AB8C8465BE512B56F28B3EE8371D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 4ae1ab8d0e47bdfcc56f837f645c0539fd460a887a547dc4a1e6443ecef63023
MD5 c67477431cb56e35adf6759adc0401cb
SHA1 319896d8792d1c35b0200efcf7c3e5434108d474
SHA512 75688e156ba79f07d610ddbdf1e92c7adedb3a6f5d7dcc5044576d9a5d08fc21597ef0c14935156a0d2f42dbe5243346dec0274e18541bfd90a12e24285dc2f5
SSDEEP 12288:jiZwb6zzFEoS2cPvyFJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:OZMSzFVSOFvoKFLgYHJWwl24C15rDY
TLSH
T16565029573A408F4ED67823ECD558806D2B27C1A0BA0C61F53A4366B1F737E11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 338c469cff0738b6f2a80e15ce6dfea4cf2bf0b103999928bda49fbbc24052f8
MD5 5175ebb5c7284d14cd51a2203934491c
SHA1 06a69eb94b533e6369c3744f36b3179a72326f38
SHA512 b62679ba0464ce36e0572c38634e7e88c7b2b51f03547f5c18f208bed00c64631c3a553a41b25a5e0af17df43b46bc055349bd311b32b0d662f38730f404cdb8
SSDEEP 12288:sUJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:sUvoKFLgYHJWwl24C15rDY
TLSH
T11A45234B74EE81F4EF054AF9AAD66047C0349F0E74C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 51867e74210eaefac101bd712812cd876b6ed9affe1c4549b9c91d96c6e63e16
MD5 e0d8a3d4757bb40632895e0593924afd
SHA1 c1e7a53e32ef0189cbc1a8d76257b2624669c77c
SHA512 f3d050e25b0ec48aa6182f7cfc205201b690f350a612756070721298ccccd3e7e4eecdbd9b6ab61f3baaf3a3b8a2dcdc076bd4d8b5c64679bf0a2d71154d4076
SSDEEP 12288:74JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:74voKFLgYHJWwl24C15rDY
TLSH
T1CC45234B70EE81F4EF054AF9AAD56047C1349F0AB4C8469BE512756F28B3EE8371D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 990b9445aafc8ad8b338e3c524f0a9e049516c4577ae74da1ca7a0825787ca77
MD5 b1a0f2df1707cde796b2cbbcc071964f
SHA1 7100e5b90e3ae158d91e2fa352d8d4a1f51d6039
SHA512 6075efdd0726ec65c1f28b3cff5a17bdc6c8b8f8154580a66286d4d0b8f233dc7fd64e1aef8a5e5545fe12ceb7c7fbc62b9c3cec2d07c80d91408413ce5ca36f
SSDEEP 12288:KyPz5L85JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:Xzy5voKFLgYHJWwl24C15rDY
TLSH
T13555020772A520F8D6268279C9A21902E371BC3657648BAF5760577B2E337E06F3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e19f22cad9ff8d5be05540f4802508efc92565e1f2c19bc015c2fbeb5c37840b
MD5 e4b4210061fa71fcd9410879ac22a394
SHA1 639a7c1f4d2e367203819e5507dfb7fc06c3a5ac
SHA512 88146ae8944647398338bb74fac32d90594df4b6dfea6374ca9f54eebf67db0a2350498c981847e2230b4bd2e3ca440783772b1afd497ed6a637f5bf22d4a988
SSDEEP 12288:uUJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:uUvoKFLgYHJWwl24C15rDY
TLSH
T12F45234B70EE81F4EF054AF9AAD66047C0349F0A74C8469BE512757F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 cba9be6fd01347df0e868761bedd7ded338d6c1d39bc3dab4e3607d76ed58e9d
MD5 b6fd7d6144bd7baa6099b1c84c00dd51
SHA1 546252f33ddf3387c072376c3332be3b6094a98a
SHA512 8dea0899156fe24ff138c458f8aa7f15f8771c3932f130a4fabfc93c7c1dbe508124d4d28defa594f0fef2781f27fafb5bd00f75cfdce93e20178f4e2b4635fd
SSDEEP 12288:GUJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:GUvoKFLgYHJWwl24C15rDY
TLSH
T17E45234B70EE81F4EF054AF9AAD56047C0349F4E74C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 10b18bc8c43511f7dfe7145a43635fb15c6568f884e4d6cf06b15fabb5dbefc8
MD5 f6965d674ed4d7c4287a522c9a3ec3f9
SHA1 65563b14ea81159f2b7d54179ecd9a7c44adb9ef
SHA512 e67904b4bc47447ee4720fc9c242c01f614a78ec17e05f7e8f4e273a60ceb6de1f710d5fc49f36521116e1674ca7bcc6a62a8f5062ad5428f3c31a7e2046b1cf
SSDEEP 12288:uyPz5L85JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:zzy5voKFLgYHJWwl24C15rDY
TLSH
T10B55120773A520F8D6268279C9A21902E371BC3657648BAF5760577B2E337E05F3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 25f311a81ee30b2a0a46a824845420b4b129aa5f4527ff80f29ad05032a64173
MD5 513ee5b6e28ce8fd8daade12db5e9643
SHA1 8bc0337cb8d8b1dda8285bb088417ff2959f69b1
SHA512 d17f8063a2bfbe5e5c0418356a48009ec316db2b2c2559ee52cee87c68746a9a2b86f560aa85e22a2543f672964af14ecdc4f6008913b65b2964a6a18ffc862e
SSDEEP 24576:4THaLl3z0zDjvoKFLgYHJWwl24C15rDY:4T6LljCQKKYpWwl1+NY
TLSH
T1CC650295B3A008F8ED67857ECD558806C2B27C1A07A0C65F53A4366B1F337E11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 bdfd4be52dc8e9f8a05e5d0357e31430205f5cf44c3e9c8f381266431b7c989c
MD5 c9c3094c5ef90498107b42f4b1474a51
SHA1 4f3f0d69e9dd88d2d8e232a3dc8aa33377bd9e03
SHA512 bb226d133af657128772c27db4c4e743392a2626b2559ed650412b6409378bfde4e657dc7a30488949bfe648adfc0732e417ceb63c36a7a5f92fa210851e064b
SSDEEP 24576:337d9CHKy7GZ/voKFLgYHJWwl24C15rDY:H7d9CHKyahQKKYpWwl1+NY
TLSH
T13B75CF91F3E810E4F1B79A35CD765512CA767C5A1B60CA8F03A4265A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e1befccdb26aee7fcb88aab8070bc5a4aecc0c5142c812cb88c9f6aa5cd13f08
MD5 450eb3e6995e6c3bf45f5ecbb6547ef1
SHA1 20c4005a9b6632fd9ee25529411758346ae53701
SHA512 dec462589d6fde58bcfd12633a396166fe73cea3868af60137c8c9987b19987e2e9918658df270576f72a0a8b6d6be9e8d596a56eadbece8836804a94d2794d3
SSDEEP 12288:TzJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:TzvoKFLgYHJWwl24C15rDY
TLSH
T14045234B74EE81F4EF054AF5AAD66047C0349F0A78C8466BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2ff28c77f0b280000e54d9e1b8b5cb15fcb439d7a7ba272a043b6483aa42bec0
MD5 b8408a3aaf95b7a3ea85397d7afc074d
SHA1 b07bcf6a88a9d25c6e4b0bc6bb4e91499032c28d
SHA512 7abe2eab478790b0163d48d59513f61ee5b5591bce39b51b8054dcace377625b5bd3381990bcad1071391a75a71df4862f05a2bd57f76ac0f530772445030ba3
SSDEEP 12288:jZJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:jZvoKFLgYHJWwl24C15rDY
TLSH
T1D345234B70EE81F4EF094AF5AAD65047C1349F0AB4C8065BE512756F28B7EE8271D16C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d91be14ac135877a8c2409e0f9799ca035bfc7ae8dd3dd4982c7fe662a1c50fa
MD5 f435b0269efe9a43ab6ffd451882abdb
SHA1 85a0138ab88e56fe9af340c228a033f4cb986e66
SHA512 262708bbae423db9d6d8b94f0ef4f3be2f622fd483d2e0486e7ff2345c122c42fc59dc2a121301227062329ee39d91c0ddc6bae32fb21ebdd5c3d531c639206a
SSDEEP 12288:gaJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:gavoKFLgYHJWwl24C15rDY
TLSH
T13045234B70EE81F4EF054AF9AAD65047C0349F0A78C8469BE512756F28B3EE8371D0AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 707e07bb3396ab9817c450bc51e7cf8b9784815b24f4b4e3374b94cdfe9c24e4
MD5 b44ac993a50187f8b706d307849fa45b
SHA1 9e64afc1a50593445f3708c6bf6a7c31f7620d33
SHA512 1bff0252f88c0d0e2f2f89d504ce2f8a3464209252c58481933e6a8c7e717433ad17c7c0b0c87dbebc16851383f568cfc6bc812653faa42a3a5bf84103af6c25
SSDEEP 12288:aUJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:aUvoKFLgYHJWwl24C15rDY
TLSH
T1D145234B70EE81F4EF054AF9AAD56047C1349F0A78C8469BE512757F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 6542e74ea2b44761aab3975724fea7ab7a19e583c380bd0d2a1f4015ab5f9da4
MD5 6b6f5e86f926041d5477cce6f9366405
SHA1 ac98532f582bafb607387c374d952c90b91b3c0d
SHA512 bcef8e2452a1be87f9870617fbb70aace31573053333fce17eabdde5eafddc6cfddb8d51e5acc4bb239de4cf7e0a33bfc43edd318da12b6c8c06894a334b0c9c
SSDEEP 12288:LzJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:LzvoKFLgYHJWwl24C15rDY
TLSH
T10245234B74EE81F4EF054AF9AAD65047C0349F0A78C8466BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c449f4337ed530d7857c2d62767fce19f96ed5f9b1a450510ce0446b1693be1a
MD5 94a0772bb3a12177f80861949acd7d48
SHA1 c0f6051aa3e00abd5792e0cc20ff64d0f3f6b53e
SHA512 8b20a34e9f07306f4b968c00ff0f7383823972412442f63ecda4888dccef711f6be23448461aa73afd73e4b90364e4934ee9535e5a025a58d96c1a60b117547f
SSDEEP 12288:SsJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:SsvoKFLgYHJWwl24C15rDY
TLSH
T15945234B74EF81F4EF054AF9AAD65047C0349F0AB4C846ABE512756F28B3EE8271D16C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 93faaa0dcef41f23b69fa2e8bb6e604008a2642f98ce665aa298f6a5dcfd884e
MD5 9c6a7382284f823436bc348d9155d368
SHA1 607df4b99ac0a59982301e42f4f5502bf02ee7e6
SHA512 b7c929f6dfc6ba257e0e76533feced7d6b9337c6788d90bf16efbcdda6220aead413d8eb48b2a9d937aae85bfe761d846e0ebdf1d143fb41e4adac62c5f9b000
SSDEEP 12288:3OJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:3OvoKFLgYHJWwl24C15rDY
TLSH
T1AB45234B74EE81F4EF054AF5AAD66047C0349F0A78C8465BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 aee412b3b3f206a3470af75c5a1bee3bd173b212acbf9d34ee0cd40dfe1328d7
MD5 0e73463df44bfaa536e8f46126d9aed4
SHA1 6006611804e90089816622883f60a7b42652dc10
SHA512 b135e957b85f5facbc0bf56bad5def545ec5e2ec06885388b93a4daf41b08ac8ed775807ecb32b5ba8053a8adda20e4dfa79536f9c337003b5341d5542b547b5
SSDEEP 24576:Lfwvok9RX6wkyAIovoKFLgYHJWwl24C15rDY:tMnYIoQKKYpWwl1+NY
TLSH
T1BC85D029EBDC44E5E177923C99B7460AF2B178591B31C2CF125A53AE0E33ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1eb43d9f750f467f57a8310f10363c680cd29febc7f5ddea954b036d2c3b0274
MD5 ab99cca36c2160e8d9622300192c6f69
SHA1 8ee99707fafdf6d7f56892c5206079eef16684c6
SHA512 eed364ba61cff965687a2bb1446f6254a00b8e5b1287291e68eb76cf494425df2b4bc524d163a5f50a98062bd39f9dcabcbedf8e2d335ada7f10d42b3342a4e2
SSDEEP 49152:9YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03QKKYpWwl1+NY:9ySzP/KYpfg
TLSH
T1C0066C57A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b331a26ca1aaaf667068cde95cc619417e2b020b3bd950a3c2f9780c18656e72
MD5 4eb5daa26b469ee3d2e27e8bc026717e
SHA1 db5b1f343bedb2980c8940e1ddb8c96e4267b507
SHA512 840ff11800a6805a353e26ddf98e3fcb09868c245eaa8c5d0c15eb87acc7abe9e0e6262bb9f934b6e065f9746d66a46239b2a8e3d6468341d1c9937277e66e66
SSDEEP 24576:H47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY1voKFLgYHJWwl24C15rDY:H47JUQj1irIhCnDHUPfF/nQKKYpWwl1T
TLSH
T12865AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 37780c3bcde4f14a037be0045acdaad3804eb9bd0fa3912d99febd2df213c4c3
MD5 db3a8b2d8e90fed6b0a26ddf80bdf373
SHA1 6e50c57dab345fbeb2f72917a1906f74339b607f
SHA512 dcaeb99234af2449734e983bb0f272b2a4d6c2a66f07e2b1856314b977f72a87a287efc5f15384d54f736dceb18104f04773da47bde115695612869138102e80
SSDEEP 12288:fNsfkJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:8kvoKFLgYHJWwl24C15rDY
TLSH
T1E155F10AE29802E8D56E5279CB965542F3337C2597E0C3CB92C0F53E1F76AD46EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 c8ef9bb8f3daf96daeabab376957e8b2cdc1a8c258967768b6b174ddec3e4648
MD5 0ce61180c3563383d035b4528ca63dfa
SHA1 61ff65fe8a9156576c5b1ea79230cb9d459d00de
SHA512 3ccee3bdab508aa766712d3156c2b02e8d613a36fea11a3919caac7333941d2e426f18eb5bfaabfef7185ae622e7ed4a45e5656f0d5a3e9cf745183f15d8cf70
SSDEEP 12288:YeB0qU3faHSLvPEr4T9SoHElkhrwvfBJwMrvmEpq9FDeo:lBPUPaS24T4QkvfBJwMrmEpq9FH
TLSH
T1D03539007666C74FC66940325E32D2CCABB07D51FE056F0773C88B3F9576A58BAE6682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 6bd4a9cdd4688477eb3a6ac3f80224e58423c1935173384cd126f2a6a4913a97
MD5 dab5e10bac89f0b0756efa45a4ff8108
SHA1 37f7e244af45c0d2a64496f8bea87aebf8d2e394
SHA512 6994309a06eb48b3f486721bed166b7e1e604024bfdb7fae28ee9dda08265bf1a858c44c026dbba838879105c6a56bf1b7b9529a3f6462d8325b883591a41329
SSDEEP 24576:3UV3uRDIVmXaH/mI9z5yZ9WNb4gTH1S19wVz:3UVhVmXaH/mI9z5yZ9WNb4gTH1S19wV
TLSH
T11165E7406537D38FD1B66072472A9B8CB7A4EC1777056F22B388493AD86AA15B0FD3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 54d5d9356ecb1e0b6342e65e822075a3ac409b4d49eb0be5baf1b4f3207ae0bf
MD5 41b57a6889b0534e99c123d485292497
SHA1 e2574dd997a8648efe2ce2b6a004e4a7a287c49c
SHA512 e7084fd31e103ee1a0f750526c41fc680335ea0637c283ba3a2bc9f3f7951fd8a88cbe91785c5c281d86c3473e82c7396ca81b1de70f1738cf2ea79e5ae1e218
SSDEEP 12288:eM78JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:b8voKFLgYHJWwl24C15rDY
TLSH
T1F545230772EE85E4FF294AF4699A50138129AF195F8442D7F40176AF2872ED82F3D21D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6019581dc977c0bdab5dcfa018596c809768d04bb3088c9650e5d1f8024d5584
MD5 5fa2a003dfe5c76188fdbde1142ab166
SHA1 340a0d39ebdeeffc20e4fb4488531bff0d928fc5
SHA512 d70da30a3b65a4c2e7c2c89a387d0e8e4d33ac30dfda604fe4255a60ed7066a574530e85282bb0776bd7bd9fc9de65c8cfa2f5d8d76695eb8398d379eaabfb76
SSDEEP 24576:lgb6bmBIi49WNNFpg1rSvFv7bYCvoKFLgYHJWwl24C15rDY:lgb4mBIBhGF1QKKYpWwl1+NY
TLSH
T1E465AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 155baf908e9f8b02da89b6b37e9bf2416e8aefc6ced58e88a50b4bf9cf7f67bb
MD5 07a0823cb5aac6dbf547ed51b8cc759d
SHA1 956141faba78e728133a39c87066c65ce0c9ab26
SHA512 6d6bbd93675dc370b7b04b2fbdf3ae63e57750db034184bb0e6eac4dbe068f5356a71c9f3fceb7912997e6a946cbb3e2ec204a21bc6f38c51177f7d3b7cb957d
SSDEEP 24576:dG88u8FpJqH1bzria7/mFvoKFLgYHJWwl24C15rDY:w7ZFPqVea7/6QKKYpWwl1+NY
TLSH
T1AA85016576E501F0D47BD13889864663F6B2B8250364EFDF07A88B561F23BE50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 82122df8278bf3b94e1bce93d0fbe3b5cb32402a1d7f4c84867dcc1954f676ff
MD5 a0ead37e2779956764bb662c31ef5a09
SHA1 fa14197a05810de032b0a9324f2f7223a699e843
SHA512 5ba7bbbf09703def98ee259300478cd63dd3d134d2f72f3d898ee73550b47b4e0a528386eb0c02d329c92807551cce38be960d8c3903201647dc7f3f5ec00a24
SSDEEP 12288:9HvUrBFrEjwaQhJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:9PUr+NQhvoKFLgYHJWwl24C15rDY
TLSH
T18665F11F32ED18E4E67AE17D89828609E371B8621751D2CF02A1917F1E63EE87D3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 34c8c802432bd83e7b4e5b0cd11afec97ffbbb275e0c673be933927773c9a0c8
MD5 cf41fd24e280913dcd046067b8a15ace
SHA1 f040174f6beb9b887877d60fe553592110979318
SHA512 cf622e10d9e85c5dd2307a8ea653cb10c2d010ba40bf9287ff5cb5fe160475b5db8e9aaae3adf44d994f083f9d37e5f1bcb85c2931cdb5d9a23cfce19c56251b
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxQKKYpWwl1+NY:yG05lO43bkKYpfg
TLSH
T101D5CF6E62EC11F9D1BBC17CDAC6460BEBB23815032556CF02A486A91F27FF4667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8213ddb0f6f72da216106ea69e75e99ab5da13caffc522e9354719356169c87b
MD5 a683fd41e4f9c4d76c0f5bd3b874cd9b
SHA1 0a3a0dc63f48c95eb99d665d96be54efae8d8d4f
SHA512 f9fd8bac10de7761296461606931dc00e1e2131ecc1af572e86a49da6950897b23492ffa66574275c3b5e7655cdd8063d9726bbc05ad02b08f968ef92194fb45
SSDEEP 24576:qfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn3voKFLgYHJWwl24C15rDY:ia5POZ3+Jt2pasx2+mZQKKYpWwl1+NY
TLSH
T11865BF5EA2FC01D5D579D17DC583861AE5B1382653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a403a2fafd8d47116ed6a4606bc6ca1ab08f36b32a4d4afc0aa9e5c8abf02b6d
MD5 682486210430b97ed9d9f5c6c3261e47
SHA1 fc8c116e666d9af54bd6c6366d1d71b4b626c26b
SHA512 df9b56e7a2738417747b89dc44db0c4489530366414d6e1bf325ebd08d4993f41c7e1fb962a9bf3f3d79f63aea468185f0b8b42ab4b557147466294fe70d5d04
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7FkNvoKFLgYHJWwl24C15rDY:vNc/zEOVHFaQKKYpWwl1+NY
TLSH
T17C857B1622E901E4F5BBE1BE89779546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ffa6c70f1e317236f725fd7bdab346012556ba0717895116e0691472330c950d
MD5 43643b204e2a2d13690bd7ae642997bb
SHA1 f9b5e5c418718a0f79706b511cf43576b57d9200
SHA512 5577d6f2b06f6086a281dc7b8788e3bf9663b9a4237fe332e2b0e7a7c2d51cf17f5ec3398e906320c4cb50744f97b372a9100383518e5866b91355a2e46c7615
SSDEEP 24576:H8kNvNnaFeYhJNtmZBmbvoKFLgYHJWwl24C15rDY:H8MwBtOmbQKKYpWwl1+NY
TLSH
T19A55AF2EB6F846E4D1FAC6B5CD238512E6727861173253CB9290C13F0E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d32457f76354db55328a02a9471da01a6b60cb79b19ef3c2fb934747d8416eb4
MD5 2060e4141a26b5804b819ee34e23096b
SHA1 7a3ef358c7f00708273aac283be0d1cd76e7b915
SHA512 979d9e5d031c811d9d399d8a533faab54c23ff91e34c9c6b3ed607ed1153c9e09550fb26c25ae370d753389873d3e2ac991793f394f738b7f102499b200e0d26
SSDEEP 24576:AD3FHshBIYQgAwvoKFLgYHJWwl24C15rDY:ADVHeBIAAwQKKYpWwl1+NY
TLSH
T11375E17EE69D04E4E57AD1BCDAA38507E37138A9032156DB029091BA1F6BEE43D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1360-60-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1360-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1360-229-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1360-54-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1924-37-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1924-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1924-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1924-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1924-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1924-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2388-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2388-326-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2388-289-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2388-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2388-95-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2388-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3164-296-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3164-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3164-101-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3164-107-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3164-311-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3164-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3368-134-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3368-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3368-126-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3368-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3368-132-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4188-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4188-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4188-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4188-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4204-278-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4204-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4204-84-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/4204-79-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/4240-66-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4240-259-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4240-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4240-72-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5560-121-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5560-120-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5560-310-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5560-114-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5744-0-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/5744-1-0x0000000000D00000-0x0000000000D67000-memory.dmp

Download

memory/5744-64-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/5744-7-0x0000000000D00000-0x0000000000D67000-memory.dmp

Download

memory/5744-6-0x0000000000D00000-0x0000000000D67000-memory.dmp

Download

memory/5920-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5920-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5920-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5920-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5920-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6048-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6048-13-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/6048-19-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/6048-77-0x0000000140000000-0x00000001402E9000-memory.dmp

Download