f58ffd484c6ff3d6f2cb6fa429bbd0ce25fe0e4ef287199d2291fa947c31a5d3

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 2.1MB
Sample260714-2plemshs6v
SHA256 f58ffd484c6ff3d6f2cb6fa429bbd0ce25fe0e4ef287199d2291fa947c31a5d3
MD5 0ad7f922441f254c60b226998ae45d2c
SHA1 6045774cefa25b5729806d6bb71a2d88f2257c56
SHA512 f0ab6dde72fb748ef94f5169b9858a4609d597339a77de287beb811d7e5ce3e67a904085836f93a57b8f78a8348159c9d251849fcddc07ffbf818351030b6568
SSDEEP 49152:tHMqIVKgZbfMJjkY2poPYtli3kjsl82ot4+Ej2Ez+lneVqkPQETZhSGRucwHfJ4B:58EAYZlkjsl82ot4+Ej2Ez+lneVqkPQH
TLSH
T10BA5AE31795A8563CE9641B2526C7B76829CE8210F352AC763881FEEB7645E32F31C37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1672	elevation_service.exe
4876	elevation_service.exe
2848	maintenanceservice.exe
2780	OSE.EXE
6124	PerceptionSimulationService.exe
2024	perfhost.exe
3312	ReFsDedupSvc.exe
2132	SensorDataService.exe
1420	ssh-agent.exe
5488	AgentService.exe
5740	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\30cadbe62f061e.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3d6448fe213dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c72a168ee213dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000024cad92e213dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d574790e213dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a28da8de213dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1672	elevation_service.exe
1672	elevation_service.exe
1672	elevation_service.exe
1672	elevation_service.exe
1672	elevation_service.exe
1672	elevation_service.exe
1672	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeBackupPrivilege	3312	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3312	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3312	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3312	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3312	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3312	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3312	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3312	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3312	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3312	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5488	AgentService.exe
Token: 33	5740	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5740	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5740	SearchIndexer.exe
Token: SeDebugPrivilege	5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5088	2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	1672	elevation_service.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5740 wrote to memory of 3328	5740	SearchIndexer.exe	99
PID 5740 wrote to memory of 1012	5740	SearchIndexer.exe	100
PID 5740 wrote to memory of 4944	5740	SearchIndexer.exe	102
PID 5740 wrote to memory of 876	5740	SearchIndexer.exe	103
PID 5740 wrote to memory of 4192	5740	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_0ad7f922441f254c60b226998ae45d2c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4876

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2848

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2780

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6124

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2024

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3312

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2132

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1420

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5488

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5740
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3328
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2856 3064 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3044 3068 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 503559bc31406f2e4a0f85d78dce40d44f961176ea3501e42742bd70edb7a96b
MD5 9153d5c0ca0364fdc1d1674646cc9887
SHA1 ed59d43429b64221c7d5f82fc65541cabfbbda6f
SHA512 60618c1cb30c41a64bc8a5334992e0aed7b152be38bffb7022349ef90b0e40f0ffacea90f65ef6f70833973a2f815cf2fcfe4dd64f1daea50e39dc119aefd5bf
SSDEEP 49152:Xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnrfJ4klKXnB:F3q6HjBMfJ4k
TLSH
T1D1D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4a9d42ae67440e1ac2f83e6e4e64797f1a815e03bbdd8bcb2a95ec8331007262
MD5 64312876e5967c48b080f0a1abfeee01
SHA1 aa89ed85720bdb521ecfb816833af88924a0d003
SHA512 e693c840a427dd1a9132e7c58eff981f705bcd4674fb755705e1edccd8ab8cb707da1021b1cc6074ec588a58eea40923dddfe8ad66967677e42c51ee7acddf28
SSDEEP 12288:a1XLsswWkxy2lRq2czAwfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:wXYfDtczAwfJ4yL/tNCJPXUQrPh
TLSH
T1E905F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 c1a177a018be32816c8d8097aae3f57d746afd43c6af71cff0ec17ee3fb5c605
MD5 600e1a687d7605540d256d6d73df4c23
SHA1 5391fd53dff5db98a29feac232cd8bd5ead0258f
SHA512 f10e6169ed475c6589dccd27fe86616ca9d345a3a472572757ae7f6dea9ddba66b781be03b4fc62f84dd5f9b2c59a907f1660f887e695a1b3348f72de93531c7
SSDEEP 24576:w0Le5ji0hmxirMDfJ4yL/tNCJPXUQrPO:wPji0AcafJ4klKXn2
TLSH
T1B935AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 69880c8e899804323db2a2ab646b12d1489ec4d18d3d57df2b312702620e74f1
MD5 5db771cdd341dd60c6ed54f55d67e8b0
SHA1 067dfbf68a2ada734c10781f73033ebc065d9f11
SHA512 f047db2098c571d0716d13ab7228e138fbd5a44d6c07337bdea05589703088bf937f099c13d77cc10991e3dfa85ff4d19845b1bf3818ec6d9d5021b52f8378e7
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWE6q8wyu5fJ4yL/tNCJPXUQrPH:x/ezSC6vUzPvxHjyefJ4klKXnP
TLSH
T1E5756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 da14350b89bd373b9182b706628a3eaf7b1f6d61a55beee58b9a23c967fded27
MD5 123ef30895763d5069db9f652337705f
SHA1 e5c2d75604384955bdd4b6817c04c8ee30700132
SHA512 87fdeb9d1ea2a0cf2835730be742fe1636bbf2a59243e91d798e326bdda7f89ba971ea587f94401dd6cf6e5ad4d1cf16e57267ebc0618c0057359c525cf86cdd
SSDEEP 24576:6VbqPb88hv/l+6cfJ4yL/tNCJPXUQrPh:6VO88hXl+nfJ4klKXnZ
TLSH
T1BC559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 14ab31dbec6d7feedea3d091421ced32ee75836da8d48c66ba272a21a6b58176
MD5 7a4420b3fa7728b8feb0e06df5170755
SHA1 d6eeb02cdc08e234dee6f51e875b9cd40c256ebd
SHA512 173b01e23d15405951b79457c0766bb77837bc6fa9c4c2209f24e404d1f84417419df2ebf79582dc0b75cb699bafc631c6848153ebfe0f1f0afeb9681025a42b
SSDEEP 12288:pRPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:pRPfJ4yL/tNCJPXUQrPu
TLSH
T178C423E751909485DF6687F82A8CF001C304BEC5562FA2E7DE82B8867FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 73dd5f84d35f0633d4d88ba4f8b93d9fdedfaee0505bae0d9c2d1604f33ea4c1
MD5 013929e92f75276cd81fb58dddf7dfaf
SHA1 da95e034cb020974b1429bd897088f261bdcb19c
SHA512 e3a2f690c5d45e14d78af811ffae6a27200da292fb32492a387ad742457b98f74193d0984b9709eb4160149ba53d070c9ffe9956a0acd05d214bb58edba73499
SSDEEP 12288:qeBNUbTVO86U0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:qJIU0fJ4yL/tNCJPXUQrP5
TLSH
T19D05C07BAE28FCD2C67A8DB85790C200D77278704B22A3CBD165C20EDE275E51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 79b1f72451655996507de8e838053545e9b30093611d7a4e54d42f2cd02602c4
MD5 7cc680d614abf709a5333b03f8654d6c
SHA1 c582ac0dd6070798ba22056c5b4bd73f051020cd
SHA512 81f0af5ffeebc4cd813811225146e81fa80202bffa0b61311d0586229e38b990dd8c9bd5b040e2460d1603b1684d3762b46336d9b43d5da712545932d4f8b9c4
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THx:LQvGAdlCEL8c/yRNw5CJfJ4k
TLSH
T117266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 776f9f4848466ef91a464e7e9c940736ea7b0417ca663a41fcce2f569ab9a538
MD5 4218bddb0915074a73cb8470b450508d
SHA1 6b1821559807cf017b937bfce8a7e0513e5bdf2c
SHA512 f3bb7b3339aee3e8171d63a22dc0a48c04678cc579e803f6d830f4aa9b1638482840a3f231d7ac63659c24fce8be6de47bf51ae036bd8f8ebb63a88fb1f7122c
SSDEEP 12288:gAwSfxL/2Dc34DLLmt0LDQewsAjqfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWu:1dewsAjqfJ4yL/tNCJPXUQrPQ
TLSH
T10915E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fac2219adce83fe2ae15d873246731c53d9b040ecd3c4d89ff2c72e67ee1dc4b
MD5 708778c492d70cd2a6ae64bcd854c67f
SHA1 24c6ad804380428ed1d1b4e65f68c149399c0efb
SHA512 ee4ba02f765e53374a599b210a85bbe43bda598ddf67cb954455e577e27066227a8c290e0c812733b4647bd035ffac1728e9d785efb1414a1bcd5f04551e0ac7
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHSfJ4:dUEtQevvqc2W1cpV2EI32S
TLSH
T12C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f24d78fbf0ff00fab0bd4fa9ce5f80db75f1f10b925cf1d4166cdf430ff6d2b8
MD5 d52b2b30353b4468772cf028507103e4
SHA1 7c8e84bb8de6e9093fb03670f443a3bdc09fd7fa
SHA512 899cc05e22cf13a6806fae89d83a63b8375dfc9f5df27eb84168b429e9d780720b80602aa0a315fb071441e2d73bdac528846e2ede4397bebcba5f2537f9019f
SSDEEP 49152:/CbRquA/m2yL5zifFiV+XenmE3/zKfJ4klKXni:YoqHVjnm9fJ4k
TLSH
T1CCD58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1805eadbb7884a79f6515cea9a4c18841cd409fe01ce7e69825d987061f73930
MD5 47dee7b8e01591b5e93c1a1e5488a77c
SHA1 ab25a22a8fc8399533c4a3a070f7a8fa2ccc913d
SHA512 d179b9a6c055fcb84656a54fca36419dbdac7bb1db8458a0c0d69cef74101658a4689e0be884b8d080aa3511bfc65f273cc0609ef1e66adaa2bbfb732d3e60d3
SSDEEP 24576:5AhGLJIFoiwtA5l7S53dfJ4yL/tNCJPXUQrPW:5AMyFoiq5NfJ4klKXnO
TLSH
T1EE359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 7fe03e3bc5021df8b489ea770e306d08e2025a414c37c0da6c169abc14afa624
MD5 ec7588af8551d8ef492476af8e409c60
SHA1 1cbc8c0c4e867e32ce58c56b2e1e15bb5ab0daa2
SHA512 4bc703b057065cf0a94c2657fb65518670b2a1aad2ab359c983b254964318947f3fef64a3c9b9af71bfecdc392c66e4da8afe04fa1546e0303ca85b0e14c7354
SSDEEP 12288:Gmw5HEjsChNVBFgl0WDm+CZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT4:fwuoOW+fJ4yL/tNCJPXUQrPc
TLSH
T1F105F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 db727627c40efd8f674e832734ef847ceadb6a17948aeb4a93a74a53c89c2d0d
MD5 f9f01bc586ab74fee1121f7611f671ed
SHA1 27c3851712cd8acbf85bb9441ad8e262010aeb96
SHA512 8cc01542314aa11f35e5ed02223b2ef7c8cc810fa034d90d9944be939ede50a25e06bbd9a099c70db05ef8000185ae0e92d619d4d9e7ffa22c59887ab06f8ee9
SSDEEP 12288:5BZ1Iy6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:XZu7fJ4yL/tNCJPXUQrPj
TLSH
T170E4129B22D460F9DAA782BC89D4D101D3317CD2273A53CF5A51959A3FBBAC61D3C322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7cda25115011b4086e0a25860844a47acead73bdbf16a1ddfb0edce8d05dc7fb
MD5 bca85a8425c1ea2ffeb298adee746f50
SHA1 c1e879f27cd44b84a54911c7458b4f5ac7c57da5
SHA512 ee741e780a8f7c0b308cd6569ef8afa8f5c5955e648b61b974b248da4b6e3ff036e3422cbeb53a976ea6985b787cd344bc0ee58f1e6cf97f1a5edc3fd540c24f
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:HQRQyi36YOcPQLvw2gAf+PN3IfJ4k
TLSH
T19C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4a27cf2f52a8dd224bf0e0e0021238b4e06eadf0dfc17de4ddc05e3ac98d91ef
MD5 560380f4c2c0385a6181b0450cb94acf
SHA1 173cd89a712c8370a079f63033e1c7bf257f033b
SHA512 7b5247cc5bd66de899940df195c34823231afa662f5cf858240bcd7714a1047eb8acc2a3520649bc4e169c0d82ead4c6d1634c8160b6f60bace064ee88666214
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U4:rQRQyi36YOcPQLvw2gAf+PN3IfJ4k
TLSH
T126667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d277530126a6b0f9e41ab8bb066c973e453a6640e81251c464359e710ff18cc2
MD5 6ba1fc3b701c2c5fd6444d229f2d9f79
SHA1 20aa88d98211cf973d6bed58dba35301312c0273
SHA512 1cb25c0c6276f79b85f6342c04082482b898e481213fd680e5d596b4d656b431010ded8365c0dc1dda3de0f92a15d357764a8a99b6916c326d979eea074f57d4
SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0rfJ4yL/tNCJPXUD:+68Qg55nhheWu7PNU3/afJ4klKXnI
TLSH
T1CCB55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 81c43d8fe452bef8c221ecfb2a94050968c006ba8fa8a2bcadec8082b016d59a
MD5 69880c8ef63555fa12f0d2ae66a624d4
SHA1 e4bb5790bc281bfb3fe5c6b53f26f5e16e643327
SHA512 347e62fa3c6e76a8349de719f98162eb8861bcd9151f94cb34dc11420f31c932d514a2c4343c63ba058861790ad65e3e1efa5568800cf295078cf4e39efaa0eb
SSDEEP 49152:93aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99O:sy5112gYy5azzVvL69nLKnhZPfJ4k
TLSH
T11A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7082ec4bcbc3ca7b09e277dec350a0d0971f838ebb92770c1a80f47d85ff7e0b
MD5 193fa2a2864823cd6697d2b6daaad4f9
SHA1 feca9ae596916bab66307ebff1fca39ee168eb51
SHA512 54c81f1422f81b2d58278f113b3e98a932c7c8add62192b2b3de56e5a2220347538bcd87ade3db164ac000711d9aeb6956e381ac03ec339988cc09729ed8620c
SSDEEP 49152:jB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgfJ4klKXnw:Vu6JmVxd2dgfJ4k
TLSH
T111D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c2dad94df831e321a2cf8602d044823d548f7a9f051165654e17a56af2caa8fa
MD5 703779c72c8928378638a18d31edbd6a
SHA1 8edc00c1c029a9bfc03d0512ce0a7e56efb97297
SHA512 59980d529e002b74fd307e6e1ab5309972e992a55b614fd0d90d2b71e5573e1fc8601e44341050e4c47764099b847a01a60efbba9870eaf4ad0c10a59509992b
SSDEEP 49152:k1hpsNoJpF1A6UU44CwH7R4xUfJ4klKXn9:kmifPbR9fJ4k
TLSH
T14FB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 75c4d213435ea73d991669a6f4be3324b046c27f23cc2435c2d591a13adda78b
MD5 c395f0d9b74f705f25b5d955e3f05422
SHA1 f1a25c34b4f8f709059add2b6bd6410c31800c28
SHA512 627123656713d0068656784a2a651bdf04445757b52a5e16973adcf22b3a3e37d8a03171086ee3bbdb504491b4bb6344a40f050c44f7ba55d799d5e8da438c64
SSDEEP 49152:CSuZQIY0Be2KRRVtOnks6NMHq7fJ4klKXnm:c5dKTi617fJ4k
TLSH
T1AFC5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e65c75890e9fb8a355d9f0ee719168d89cf871ef9834b7e31c842f9c1c2cab18
MD5 9ea16dc3f0f49261ef98d46ce8b8ed50
SHA1 c47b63ebf57a8c37fba7353b91b55fc77935b3a4
SHA512 1277c1808085efd0b5dab2ada76b727fe6a532733c8cdb2e2372b0631880b994892da6019e955cba1d6a7349e8c36bcf0474a98a543b5268398939160144ed09
SSDEEP 49152:3htSn8EApI0figngiDn0AP5wwfJ4klKXnq:mX2iyphRfJ4k
TLSH
T12895BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 fea9fb1a7523c623f13dc726188756e4aef06a31bed33281a277bab53dd178c5
MD5 8de10af1e12d181452c611616a1d4c02
SHA1 9d2c954dfa019a32721c6c4b821ac78a0d0f16a5
SHA512 6e6575a1dee477cf7f9b9ca68fc12596b933caa9a102e2ba8fa7c7323a700cce9dac714da299c967223ceb7bd28d47628d84775951610ec593dca1f1f916e5b6
SSDEEP 12288:CnfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:CnfJ4yL/tNCJPXUQrPJ
TLSH
T128C423AB60D59486DE5587F81688F001C3047EC6672F62F7EF82B8427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 7fdcf6648a072c2a6ccc6d459f6af75556b7ed8460ba37a9c4327b0a714e430d
MD5 6668e46befae3d78a6952357d2c99528
SHA1 4dafd49f4e0998150a2feca40501068b6511d355
SHA512 a16e1b7940e0e32103721dfc8d9c998e72134fffc8a65f7e1258ca1d07832ce14e605c0ca21cf97cb8e6692b3369bb125996a8b55ce5ed6f6c2de8409ac57775
SSDEEP 12288:oGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S4:oGfJ4yL/tNCJPXUQrPT
TLSH
T1BFC423AB60D59486DE5587F81648F001C3047EC6672F62F7EF82B8827FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 eabd0f3a4840e4df469c85ab6c306824cf205ec70460a9b348d4b46472557b20
MD5 8a68072c8b3cd8c3b3b5445bb56fca4d
SHA1 af903a48577f20886f05c70520b7cc3b2a4df357
SHA512 6a51621a2ba96ec473ab51ff7da967522594768c8cd6030ca8fed28b2d71c16831b9cb62f1ebfc430a3798d522f6dc2e7488006b573942b2a3550378f700b6bb
SSDEEP 12288:YMfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S4:YMfJ4yL/tNCJPXUQrPT
TLSH
T106C423AB60D59486DE5587F81648E001C7047ECA672F62F7EF82B8813FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 bb7d8a3bd8e92ce11a8fd8c8c98f0cf2c9adf5a3edd4a064e09839d839871cbe
MD5 0d8babafc30e6e59df0833fb5c1174f8
SHA1 c0aef0535308d6c75e10431485c37f69c6504271
SHA512 469293040a926f9d9f68584667bcc166eb9befa3ccd463bcdb78a718ce6225bcec354f4f9195097119365e9e466c5a1f99892426394a3418049fee7769c7f656
SSDEEP 12288:CV9fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SM:OfJ4yL/tNCJPXUQrPX
TLSH
T114D423A7219480C6DD66C3F84A44E001D324BDC6673BA3EFDF4268863FF9659296C7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 b1cb6a3315acfe65fef469c2c767ced9b2f3ca3731838a639dbecdafcf704bc2
MD5 7157c7c45dc98d77bf5dca63b0a6ba0d
SHA1 b76bc053997020ac6d3b56c52bfc05253409755c
SHA512 ef8e8c3fd8b78dfbdff65562b665eab3e44032871e75e9939420be810dac6807760700c3540691dd2c3af7743ced4fb11a10217d890bd9be4ce9b950915d90f1
SSDEEP 12288:zFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:zFfJ4yL/tNCJPXUQrPY
TLSH
T112C423AB60D59486DE5587F81748E001C7047ECA672F62F7EF82B8813FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 e0f150f5a06adb539814d9fab494f939adeeef858097d4caedd0546112642222
MD5 ee386c51e3ece0844c3da9c1f6b1ee3c
SHA1 d603209393950783fe5b990b6255f06bdeccaeee
SHA512 08708fc68c18c8bc0193ae1a0b35679afdae53ded6bb33cca6be6dc75bd246d04c839277708bdcb7e615f2f65974b118d675dcb51fd2f83e7c4ea2254b362b69
SSDEEP 12288:aifJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:aifJ4yL/tNCJPXUQrPY
TLSH
T104C423AB60D59486DE5587F81648F001C3047ECA672F62F7EF82B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 d221ea459a9435a7194bd358ab4181f11d25aff96df661d82e6ffe0994a6a3e8
MD5 b0e94f54611deb8ddf07900f9d2c6d03
SHA1 c48a22361e3961adf456c7cc76be0c2f8de46f3b
SHA512 2feea7ececd2188b1dfb70e8bfa0adcf3b9c4225fe0f9d018cc1acd9697db329216a588d8be0b02992805d16a80ce5be3b544b69ae3697479373da1a4281bbd2
SSDEEP 12288:hufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sb:hufJ4yL/tNCJPXUQrPQ
TLSH
T1D8C423AB60D59486DE5587F81748F000C7047EC6672F62E7EF42B8827FFD91A259C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 5c6cb4cdedc7ecbb4a19dba710d2bae078257f15ff551ccd8186f6c81ccf9966
MD5 4d195288a77bcaf0686879f35aa33550
SHA1 478916ea7aef69d7f836aafd2df0f0f85be9e4e2
SHA512 ad7a4a31dec88612fcfbb0f87e1837923dc9991117300a8210b06258bd28c9ecdb9ef9464f00eb4288a840ab399562a9313f19ccc555ae81d4d0f7d3c0940098
SSDEEP 12288:TiZwb6zzFEoS2cPvymfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:+ZMSzFVSOmfJ4yL/tNCJPXUQrPW
TLSH
T1BE0501A5B39018F8EC67827DC9549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 f06037a7aec404adf04d17caadca76e47cebf895ce7f5ecc9ce8ccdab4f4e185
MD5 57a81b9a7f81d55d1f982109e2050a76
SHA1 c35eed1f9f33c02c1802029a5476e20c865005d2
SHA512 df9ecde1413883a7d2462043fdf70844f750ef301aaa7cde38d99ef7a26aacf4b0eb1d7caedf185c1250f291c3fd626caeb40aec3496dfea1cf3acc809e7ee7a
SSDEEP 12288:5LfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:5LfJ4yL/tNCJPXUQrPo
TLSH
T1EDC423AB60D59486DE5587F81748E001C7087ECA672F62E7EF83B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 d89304de3d1259b896c469fc353d990d07279aaa871eb5d8dc12bd40bd537178
MD5 bb74f2e44a027cf63024426804cb89eb
SHA1 7c0f5d39a82cb6434a8619ec7216871aabe2f1fe
SHA512 15cbe5070992fec6215df33f8c91a20f39786a5df6118a386e702934f795c782f14fd17897fb10892a14710bcacc628d7e1dae76db66c7817b49a01cb72da2f2
SSDEEP 12288:XffJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:XffJ4yL/tNCJPXUQrPI
TLSH
T18CC423AB60D59486DE1587F81748F001C704BEC6672F62E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a55ef65df435227f32487cb76071adb87a417b1395e0433dc3784c88a6b635fc
MD5 664a4957bb1da5b67731ff63c2fb4e92
SHA1 fec2a67561a26dfeea18abe691c2696970add211
SHA512 93732f14fb78ecc69b82ed995d602200b26f11f20d2b8453e8b56be748f2626fd8abf595b084cc4ce23c8d73a09c4e6d8aec8d899225832e88da30369650814b
SSDEEP 12288:ZyPz5L86fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:Yzy6fJ4yL/tNCJPXUQrPR
TLSH
T1C9F4125732A130F9D53682788990A502F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 9057cd8c435b12730a468ffaf7ac9f76942eb3e05ef8ad5027c51112c589a15f
MD5 b7e4f7ae21c17461839b3e5c9904def9
SHA1 6195f3031e13d29a38517cc0cac4519a0e9dfa40
SHA512 a27a3420923068bb43b1c8916f45ecdc5f55c96793fe4ffe25a837c0647ae0223de1b9f45670e0b1ad2ab872060913df61ba05e82adb867399ee0661f30ce1f5
SSDEEP 12288:LLfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:LLfJ4yL/tNCJPXUQrPf
TLSH
T17CC423AB60D19486DE5587F81748E001C7087ECA672F62E7EF83B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 db86e1079f2e56c35a686db6d3bf1cd0c540651f20303475ad85a1cc90052103
MD5 2d1983f46aca4796e1ee11d6fd4ee5a4
SHA1 86fb9f22c93d3b87f2781abc9cbeac6e90fa129c
SHA512 7ce5c0e88cbeeb77c4bab7d59c007e940faa8b6f2ffce182276a3e55b8956ae8a672c577c83439c907094bbe995c8ebdaee3f3d5beda3f4f464b331967e856c6
SSDEEP 12288:6LfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sy:6LfJ4yL/tNCJPXUQrPd
TLSH
T1D4C423AB60D19486DE5587F81748E001C708BEC6672F62E7EF83B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 12e52278a50e21a35564494bac9904f46615b4958c4e6896cf2870f766c2f085
MD5 71dd9390674bbc7108d37c6061a1d3e2
SHA1 0e1447657884de74bdea437954c4e463a9c094f9
SHA512 d0957d60e5829b7d34206de52dd9cbebf87d7a9c2b72a3a0cd7d1859833b4b4a33fa4400859cab03a5251c7fa4cb183d2c18debf9edae622b9a9700d95ba0edb
SSDEEP 12288:2yPz5L86fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:Lzy6fJ4yL/tNCJPXUQrP3
TLSH
T1B3F4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 a87d4942f11842c8926279891b05c5e79bffd919267e4324e3f08149563af754
MD5 6aa3d48e3991d9e095d431c0924efa53
SHA1 85504244d36e3a2d9ed1257b4072be81123fdbc4
SHA512 c6698491bcc431056b31a39e055e37dc26f8436668dd8f81b2e64b3db1ab0bdb9f36049a1687308a8d8a57429b91fe64e44775b75dd266fcc4f540344f9b733d
SSDEEP 12288:aCd9eWYoaLHF3z0z04PDvh8fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTl:rTHaLl3z0zD8fJ4yL/tNCJPXUQrPp
TLSH
T1940501A5B39018F8EC67827ECD549502D3B27C9A0B70C25F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 8d0357814b16e179678681ae451fba28f6fba388ced4f976d23a8193b7fffe55
MD5 67de88cde2df4ea32b2ce8ecb0192b99
SHA1 ec7eeb93bb9bee2f876495013c62969e5b1f4135
SHA512 cb9daaeaa00ea0df93536ba71e2291a94eb811c8ffe71ebbdb371fca64e63121dcf9abe51487547b738c23c6b7a0f018f3182e10befa454772850d2e7354f384
SSDEEP 12288:Zi4e7+RdTfgwCHKy7GLbbdIvhfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGY:Z37d9CHKy7GZofJ4yL/tNCJPXUQrPn
TLSH
T1D925CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 f7f0505036e179af49cfe7399db657bd658cdf3fa90510e4a42bcb9dafac44ad
MD5 5f41197efa010d3b1607a00eab6d0856
SHA1 f176413f10de47fad09f03a8609cc153ace7e772
SHA512 7c64a8ca4fa3af266ebec70fc6d3dc484759cad11a58263607e8bca2f34d719c4d75745f9cefd956a6fa084d7f0c205cc492c416b415f850291b8d0e6c68ba36
SSDEEP 12288:ZsfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sw:ZsfJ4yL/tNCJPXUQrPT
TLSH
T17BC423AB60D59486DE5587F81648F001C7047ECA672F62F7EF82B8813FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 759b9473fa10576ab4535730a600af2931314740a0de471ebb63b4a5380562cc
MD5 a3bd3a91a89bedd81c88f15b8433965e
SHA1 97eb896fac28a04533c9d2ced79349ac7756e60a
SHA512 dd8457a5e3a0cf21233cbf18e13f54481e6dc394993f613febeebc71f301661c188e1356e2c4ef2e42523980198309cdddf10dcb0f58043f14c65a46c41462b8
SSDEEP 12288:vafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sk:vafJ4yL/tNCJPXUQrPf
TLSH
T154C423AB60D49496DE5587F81688E001C7047EC6672F62F7EF82B8423FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 ba32467386bf2b0796e2aa7d972c3e4d76074ba8d88cf3d3a88bac0f9f7b6520
MD5 3c0d030eacb7023f9af65ca175f6d62e
SHA1 91df4f21978960b2c03cf50db7ce72b84d03585f
SHA512 652153e3f4382317b28d34abbcb0fe349619b15e1e3c9e938b5f48f46f20745b8be248dc53c640cf7d8cc487b44dd389dbd1493b3cbc56f152b789eb95911056
SSDEEP 12288:whfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:whfJ4yL/tNCJPXUQrPT
TLSH
T110C423AB60D59486DE5587F81748E001C7047ECA672F62E7EF83B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 df839c6a1694018b461fae45e903942e686ff126da873caa17b151dfa2122dff
MD5 dea0b56587e7c5f1fec4e6e72ee4264d
SHA1 5944eb068aea4dfccef867405fb5e283f7388054
SHA512 a9393215d308bc6735f154f85a547a5c59e28beff209374dba8bccb5b4cb26f2aea50d2b9fdc3e9ccc12db6083ffd9b486aaf964c58e1982ec7808e52667f0d9
SSDEEP 12288:cLfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sb:cLfJ4yL/tNCJPXUQrPw
TLSH
T1E1C423AB60D19486DE5587F81748E001C7087ECA672F62E7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 ee4d63c63af5f88a7628542afa7bc3c48eb81ec50455dc21e69827dc84712892
MD5 c044a0323c1b8a2d51ef3f7b4d858693
SHA1 5bbdc01b48468f5a536bba1a784a254c02a219e5
SHA512 4492eb4e46b37021976ff18cfabb1ad7c048cbbfc7a257667681559eeae16ac53a048ce71366eca7220c78bc20404d22b8ee4826a7bfb2b95544b1d6e8ae30a3
SSDEEP 12288:hsfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:hsfJ4yL/tNCJPXUQrPs
TLSH
T181C423AB60D59486DE5587F81648E001C3047EC6672F62F7EF83B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 45f520bd7ddeb93b24992809c9ea69921279b1c96d456cb4771ebfcc314b67a0
MD5 bd4531311c0b77c0c923017a1eba5d85
SHA1 cb55e3d4c8409a829e31a8ce87b2244413abbaeb
SHA512 fbad0bf8bbc50152b82a8080a1fa78491be05290f984af10940f4fa493ed95221c99b6b03e3c44ddc323d8f39077d111f8b7106484f0e9f58a4acbbb5920247d
SSDEEP 12288:qzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sb:qzfJ4yL/tNCJPXUQrPw
TLSH
T17FC423AB60D1948ADE5587F81788E001C7087EC6662F62F7EF43B8427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 3534850bb71153140282cddb0549f6f5888d15d8578e1215f905d6c214de269d
MD5 5887934bf733a8231e6c65c755b8d0ec
SHA1 ffcc1e1abbd5e88329b83b28167e2129006d4bd0
SHA512 9be1924dbd72394b30723971b1e01d420f94e1fb2a9979e52b6b8027fb95826817783d74dea598ec0cf81d0629a394333706b8266c68c1dae3a8ee7cc8777916
SSDEEP 12288:TFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:TFfJ4yL/tNCJPXUQrPm
TLSH
T12CC423AB60D59486DE5587F81648F001C7047ECA672F62F7EF82B8823FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 ed50ed84c19e4d82955dab34a16ddb6d8676e143cd54e6d3ac6255b09189fd16
MD5 2d476fb621059c416ec8746253734e12
SHA1 b4d728bf8a5546a94c40eece60ccb9692399dd5f
SHA512 38091152a30e16b614ff060a75a688e09bfe3209bdf189e65758c7eb2562e6fb51158e0d54bc0bd77b8131b84e2bb068830d6aaeac4d8d54659273e7b0b204fc
SSDEEP 24576:9fwvok9RX6wkyAIvfJ4yL/tNCJPXUQrPh:7MnYIvfJ4klKXn5
TLSH
T14635D02AEBDC44E5E1B7923C89A7860AF3B178591B31C2CF029653AD1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dac3c7a0a421fb592d95daec8dea6e69155c321adf8c924b51317a1f2ae1a1f8
MD5 d969b0e3b8b9712ab770097aa43b8d7d
SHA1 16d4734a58b0679e38b6c75d2b28ec4da81a4e2e
SHA512 c6693749a846f666e802c97c83eb8aa909ae1265fefa6f3588b5ce95706f084e91f3fa2b5e85fee66d4bfba131c51ec3c2b93c466f745168e8766ab1de9ba8fb
SSDEEP 49152:bYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0QfJ4klKXn2:/ySzPofJ4k
TLSH
T1EB066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d9087d8e6310a364a40406dcc0aeb58fc7b3999b9607f71b577cee9ce76ead37
MD5 93596f025bbf28081541354fbd44de4b
SHA1 e1d3f9180e29f8c320a8c947a95a5820b96eedcf
SHA512 142f59d0ff26e5e71bd32a3f5b024a782ce9dc648eb522d5e109b94cf7fb09bdbed15f6c9d08c90b58109c5265c26a1089cd6b4e5faa10c557f1182528cb3f82
SSDEEP 24576:747Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY2fJ4yL/tNCJPXUQrP7:747JUQj1irIhCnDHUPfF/gfJ4klKXnz
TLSH
T1D965AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 e77a166c198b5a2f92355a502926e16997c358e0bce45cf9a45acb8a51f8297a
MD5 cb5f2872967f592b1df4960968ec9157
SHA1 2eadd3edc9bcf7b5a882ac6255e7fb04434193ce
SHA512 e10d4cbe9106a08b79f15500f640d7c901d20c8dc0a311707f65548f2beb24aad6d17817a776e3cfe9fdafae2f14615df526f8b183e0087bcf7e70c61c85f8f4
SSDEEP 12288:tNsf7fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:C7fJ4yL/tNCJPXUQrP1
TLSH
T19FE4015AD29441D8C46E92B8CB449201F3237CA593E2D3CB97C0F87E2FBA6945DE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 9c2d2e9757c18bcfe935badf44e39c5cc8a87dd49097566186fd429e9d00bcaf
MD5 e148e4a7aeb7f532b0a44324bb9c9d27
SHA1 f77acc264198f1eaf239aa6dbd56c2260c20a110
SHA512 68dda6d679a219de2454b29d75645d94ea7b1ba8028be6855a5e1a9c6beed3314578f6e8c605fc1d7e8ff7aa4da03bfdf728ef3aed0bc1f3cc6cc9d21ee04db1
SSDEEP 12288:4z7jfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:GjfJ4yL/tNCJPXUQrPF
TLSH
T1C6D423A751D49846ED7687F8164CE000D309BED51B2BA2E7EE42B4853FFC98A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2cde39b75e6ea4f30740f59b204567a12cb53131ea0e6e4ae15fa8cc01cc2a13
MD5 6a502d547b1a914d542eb3c7c9f007f1
SHA1 5aee0ca2d3316f0caea522b9d4a5cb1d30b7e4ca
SHA512 19894d11188b0e09e10bd21af9cf1591f511d03946880c4d317aeb568f2c967c1776248d25f68881832e527bc73f7fe23bdcd61e2feed46b7e0341125da64a96
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bY5fJ4yL/tNCJPXUQrPh:6gb4mBIBhGF2fJ4klKXnZ
TLSH
T12F65AF1E22EC02F5E0F9D2B8DDAA4417D6B278160732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 0b04ccef4fba8013e3e9b5b5b9eba903ee7ebb2f553ca9afa63315a5611a01d3
MD5 21bd7aa6ee0c6147f8217b9f6ca12138
SHA1 d02c58dcfd7ddeaac3bafffe85c9235db762e0c8
SHA512 fe48df19c305483a0f24d88e82c1f2d38c302469137daee011e4b683176ebc0d65c11c06aa69303c427bcc0354cc38b4624cd365bf3d3493b580a47421f68202
SSDEEP 24576:HG88u8FpJqH1bzria7/mmfJ4yL/tNCJPXUQrPB:m7ZFPqVea7/BfJ4klKXnJ
TLSH
T1EC35026676E101F1D47BD1388A858663F771B8150335FBDF0BA88A512F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 9c403aaefa05314203ad1b1d68c4ce3bca67ce9dc7c38ed8291481514b4b9ef6
MD5 84d8612946fcda05141a239b3b605e0a
SHA1 a8fc99e6b6c5f607a65780ff983198851bf2e589
SHA512 221bb09974b920767f50d75e46674013c39a011dbcfaf22a24715761dc66a689bd52f24a516e269fc1b191720a3fc2f448c9f3ab7a0db7cc5046c869f2438494
SSDEEP 12288:2HvUrBFrEjwaQyfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7So:2PUr+NQyfJ4yL/tNCJPXUQrPj
TLSH
T14805F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 25de8d3bde7dc302a68cb7144c85635c9083e71ddc6b77173ae1b74224284b4a
MD5 c0b9028418e75de7184f2d533183746a
SHA1 c0c135ab225163c508b02acab141dc81d1943a96
SHA512 cdc7838189029378ddc4f0357d27b6000c794058cf6fbb5f328f793fef43badb2d5d89abcb620bbf92c5767ef32bcd270c08a28133a8892646a3eaa818fa4050
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjifJ4klKXna:SG05lO43b3fJ4k
TLSH
T12DD5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c67d155f5aca28b2eb4fa9459ef54bfd17eefefcac9f35c64236bef6555e14cd
MD5 67f1083924407e40fd01c6126828b258
SHA1 d18b32710c80a58a1664545d3d30b80787251cf6
SHA512 47d38a7069f1bbd20a0fb4febc866c81750508d50540678fd8cdd1be51f11041b4b8872ae89928b578106f21a367fc417bd852c71416aef04520d781431f9c5f
SSDEEP 24576:kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnQfJ4yL/tNCJPXUQrPs:8a5POZ3+Jt2pasx2+mafJ4klKXnU
TLSH
T1AB65BF5EA6FC00D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7e121a9010bc0b7f6e664b097507c23d0a1ca07f610144cbe1d246e2f66e37c1
MD5 177065d5b311257c2a15fcfb470625af
SHA1 5706b914c90f29ca53b9266306d81f87e2be1dea
SHA512 6824dacf56c85e1d6605d11d56412a30deb6f2dbe91ebe1ac6fff056db1f7b8c0c466adade6ce624e1c149ef0218ef48363e945e95f9815b775189447f6ea328
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7FkefJ4yL/tNCJPXUQrPm:LNc/zEOVHFhfJ4klKXnO
TLSH
T12F858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a1cc31135f871ed199773fc898ef1d4a33d2c3aa9aafd0b7b2cdb3a098c37fd0
MD5 b2deb433c7a73f69c214d813d5060d0a
SHA1 e3328e8a1343faba0b86501ceaa024d92d97ac27
SHA512 995be5c36274782ccd7eab564b2b942862f450a2b1ae5916aa94bb8512c3242bf3657fecea87188cf9200d9ab190e1701d3a18cc1de575f23ca716a7b27218e2
SSDEEP 24576:+8kNvNnaFeYhJNtmZBmEfJ4yL/tNCJPXUQrPM:+8MwBtOmEfJ4klKXn0
TLSH
T1F955AF6EB6F846E4D1FEC6B48D238112E6727861073293CB9290C13F1E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 67f1cd1f9c91639848a88b0b8e401386cd9c246d65c7a8e07b29e3669b8f7e8e
MD5 8dd214e4059245675ac41c346990fbc0
SHA1 120e210c1a2b6e363726a48c3c9be35c37f737d9
SHA512 b31cbd4569d543f548b8a030585813287999db938989458caa04073694764574b5257868ae6ea896f794d09b33f1260c8fa527cfdb62b7c06637b63575ff4db6
SSDEEP 12288:7QcMxWDXN1Dp/fshBItT1IQgAHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GZ:7D3FHshBIYQgAHfJ4yL/tNCJPXUQrPx
TLSH
T1B025E17EE69C04E4D57BC2BC9A538506E77138E9032266DB06D0D1B62F6BEE42D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1420-113-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1420-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1420-110-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1420-119-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1672-20-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1672-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1672-21-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1672-14-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1672-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2024-80-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/2024-75-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/2024-295-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2024-74-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2132-104-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2132-313-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2132-98-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2132-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2132-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2132-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2780-244-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2780-51-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2780-58-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2780-52-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2848-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2848-39-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Download

memory/2848-121-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2848-46-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Download

memory/2848-111-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Download

memory/2848-45-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Download

memory/3312-91-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3312-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3312-329-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3312-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3312-85-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3312-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4876-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4876-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4876-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4876-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4944-319-0x000001CE2F210000-0x000001CE2F3DA000-memory.dmp

Download

memory/5088-8-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/5088-6-0x0000000002500000-0x0000000002567000-memory.dmp

Download

memory/5088-0-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/5088-1-0x0000000002500000-0x0000000002567000-memory.dmp

Download

memory/5488-136-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5488-133-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5488-127-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5488-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5488-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5740-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5740-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5740-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5740-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6124-62-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6124-70-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/6124-64-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/6124-280-0x0000000140000000-0x00000001400CB000-memory.dmp

Download