8075a6cf2181cf4aa040a953823a32e4b4eec4f4110197a4c5f77fbd9c9d5303

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
Size 1.4MB
Sample260720-tk11jahv2s
SHA256 8075a6cf2181cf4aa040a953823a32e4b4eec4f4110197a4c5f77fbd9c9d5303
MD5 2f22b921e6a4c2e83cd839fa8f9225cc
SHA1 9f27edc9a8ce435ba8715b9617ef0b7160e8bc96
SHA512 9a02627c3dc98ad29788395706ba37da7c2f138ef4724c99c60dd859d272d42fa1b7bff4f5a68bd773027b4d388cf6c0ff43bc8dac541ddb66438a195f853290
SSDEEP 12288:8mvB+z4Xd6aH++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:PvgzVaeyxknw4FYnshx8OfVe247
TLSH
T1D865126476C2C472E47A19330970E2715A2EF9705F70866FA3A8713EDEB04E0A52ED77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1468	elevation_service.exe
396	elevation_service.exe
4200	maintenanceservice.exe
5428	OSE.EXE
4312	PerceptionSimulationService.exe
5788	perfhost.exe
2328	ReFsDedupSvc.exe
3384	SensorDataService.exe
5720	ssh-agent.exe
3928	AgentService.exe
2864	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\50832eb7209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b61758f46118dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ba183f46118dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000058abf66118dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1468	elevation_service.exe
1468	elevation_service.exe
1468	elevation_service.exe
1468	elevation_service.exe
1468	elevation_service.exe
1468	elevation_service.exe
1468	elevation_service.exe
396	elevation_service.exe
396	elevation_service.exe
396	elevation_service.exe
396	elevation_service.exe
396	elevation_service.exe
396	elevation_service.exe
396	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4992	2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	3928	AgentService.exe
Token: SeBackupPrivilege	2328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2328	ReFsDedupSvc.exe
Token: 33	2864	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2864	SearchIndexer.exe
Token: SeBackupPrivilege	2328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2328	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1468	elevation_service.exe
Token: SeDebugPrivilege	396	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 4768	2864	SearchIndexer.exe	101
PID 2864 wrote to memory of 4644	2864	SearchIndexer.exe	102
PID 2864 wrote to memory of 4932	2864	SearchIndexer.exe	104
PID 2864 wrote to memory of 692	2864	SearchIndexer.exe	105
PID 2864 wrote to memory of 6044	2864	SearchIndexer.exe	107
PID 2864 wrote to memory of 4548	2864	SearchIndexer.exe	108
PID 2864 wrote to memory of 2972	2864	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_2f22b921e6a4c2e83cd839fa8f9225cc_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:396

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4200

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5428

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4312

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5788

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2328

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3384

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5720

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3928

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4768
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:692
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 43d8df7b23174e56d6948a9058040974e49360c14e1f15216f850fcda2d6620f
MD5 98e875521d04927a9e71ee94dca3eab7
SHA1 b7ef50015e0402398ef727b29a83b50e87258514
SHA512 70fbc2fa8deb72144e478948483162a34a3aedb2a4d32d2046e0304a0102df41cfc632e0ae26307ac7495caaf2b849f894b9c09379d9ac08c45d5b949d755729
SSDEEP 49152:sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnnx4x8EVep:W3q6HjBEix8EVy
TLSH
T1C1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 379cb19f51b92d1fd9eb723dcdf5b3524094546d79ecbfdbb9f6651e54f2319e
MD5 27023b8951d3f33a7582a330a07eebda
SHA1 3571ae92a69dbe958414edca30bdee7de720a5b2
SHA512 e79929165208385f6dc271959b3ace22c86a6f72204edee728ce0d1790c98cf08baa25cb8d715f5f0ef841caf2b4804b6ff9fecc523dc676ed2f310a4bc26011
SSDEEP 12288:T1XLsswWkxy2lRq2czAN+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:JXYfDtczANyxknw4FYnshx8OfVe247
TLSH
T12175F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 ea4694198a746ea9ffa0ab4b339f5fa942cc2c54b9163937a520ecf0efc91d31
MD5 22a2b63d290b8956ff56e9293ea254fb
SHA1 882bde42897acb20649b1014677e9acfebe9ba45
SHA512 44dd735fe190374bbad4f4612d18b63dc4604ebc1297df590d30a53664a7b58e7d53d4ad04a3679863634102a20d4ba513bed30c9ab0ab07a7299539488b3405
SSDEEP 24576:A0Le5ji0hmxFrM0yxknw4FYnshx8OfVe247:APji0Ar6x4x8EVep
TLSH
T1A595AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 175896af58c0b143f3f6aa6ff1a63dc4a75a018e1e0c029336d732e08973e7f9
MD5 a36acb9d8b225a55dce9fb278d5cd495
SHA1 0e0876119aa5afc620f14f25cc7555bf0e99ccf5
SHA512 6bbff28e072cf14526a5786f42cde4f91787363e08cbc4fddc2dcf1751889263ad4c824312c8c88006b4624cb8ba55f2022d3046154d6da397a9fb4c8416e1c6
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWE6q8wyu6yxknw4FYnshx8OfVe247:Z/ezSC6vUzPvxHjyux4x8EVep
TLSH
T1B9756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b90441c89f462902b34864a1af94822a8c2cac7ac007972b2cbb27a6df3a522a
MD5 d5b2ba23f638ae203be917b83a813748
SHA1 031619339bc25a2afd167247b55338f1cc42bf62
SHA512 3bf594a3c0303605a67028e110da42d8003f3ab5a266539de9df47296ea16ac6a03c119234cb2c7f22f365c823b450e86c1aecfe0071e90835444cde9c7eb1de
SSDEEP 24576:ZVbqPb88hv/l+6Ryxknw4FYnshx8OfVe247:ZVO88hXl+Tx4x8EVep
TLSH
T181559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 dc587e49623bf40efac57bba5463bda620a66708de49f6dfaf0b1fb1772b49ed
MD5 b18d27c64dc295630dc63b71baced604
SHA1 00bebb9960e8c45ead9ddc21048049c39cab3e8c
SHA512 5da34e1e36987161d9a4c7c2537adbb6c5f44c4c4967e6224aaa3ecd1484e0ca9ea63099eaa3922c08b6137ffa2250cfb5d40e9277bb3affeb8eda4ea0536d9b
SSDEEP 12288:iNI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iNIyxknw4FYnshx8OfVe247
TLSH
T1B765237CA7DDA4E1FA5E14331B7572623616B9A4DA74C11BCB78B14EE0B0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 d937bf54df31f4b2e56f03d6f468485f9b817c7e733cb914e97b4778fe969379
MD5 4139149070f8a2c14788923b0d32c40e
SHA1 3157c1a54d1b5915af2ce7132888dee274a8b1a3
SHA512 f8edb342aa29b3e59b83422b60fe1e63ce5c7e40e0c2ee537d1a144ea4e24a9b4ad15822c310ecc5f8261445bc7654d3a3533ae4e6bb23fd94815cda0cba82f1
SSDEEP 12288:reBNUbTVO86U5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rJIU5yxknw4FYnshx8OfVe247
TLSH
T13875CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c983f0ff6b06fefc9be1bf30811f39983eff16289a10c83a5ead4e60e086edf5
MD5 93088659c579ec2eda6cd2f944e39ecc
SHA1 5ccaec23ba695b3a5a1c4435c3b778cd472dc5d0
SHA512 27a6a868a71c7ef565cd494cc721df18cffd932780ab7bfa24bbb70694f905bc471826b4e4547a55cc8a482363ff1c0e1d98b29efe58ae76530a903289f6529c
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH6:VQvGAdlCEL8c/yRNw5Clix8EVy
TLSH
T136267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 e0f8f512e85b4a978109074638d275dcca5d81ae43937d8f5be22e27d5272992
MD5 e540d50a7e157faa395d53bae53de22e
SHA1 c6db832a247926eca0b6e94526730ed8ad27824c
SHA512 35b0f3554b59836b95f68758d57ecd3f1b672d280b88d681362470c1e46a00416202eb8b1043438c2372c6ac5bf7c2ce4497583bb0eb98a7a3597a30a41fd33e
SSDEEP 12288:JAwSfxL/2Dc3LDLLmt0LDQewsAjf+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:66ewsAjfyxknw4FYnshx8OfVe247
TLSH
T17285E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6ae6d2803cafa76b0f989e70351c0f7ec5db31370a4f6c625b754a5997cfaa14
MD5 71ea7528220ed067212673e292f771f7
SHA1 7f399841baf6ee593e61469d6d5225848ce19522
SHA512 62f91547a99987e3fd5491150d53a63830f5e35d8b2431c7f0621deddb76df8f4541b2fc954a8f2d98c379fd50ae902518be4c2a51442bf6a0e423a6d796df9e
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHH:/UEtQevvqc2W1cpV2EI32
TLSH
T125474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 59eb2287bfa3994fdebf6963ab18b62897641198b63ceb24dec4d6c56cf00b02
MD5 fe923ea9a3d070d7fa0a56e0932641d7
SHA1 433199cd0f9aa4d633bdc983f871722bb47d5503
SHA512 12dc95b5696254f08a65ae5c8d725ef7f92716e3d5b929c1a29a9915be37b5ea50d728cb12c6b1963f8554fc2243943cfb81ad3bb6dfa83604295372f8a9fa5a
SSDEEP 49152:NCbRquA/m2yL5zQfFiV+XenmE3/zqx4x8EVep:qoqtVjnmpix8EVy
TLSH
T1DDD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 be5b9cd1d5cb510c2978a5a6f82517834e4b3c216d42e2d4d6bd5b82931c23ca
MD5 c1488102fa7211557f6dc4d496ecfe8d
SHA1 b233621bffa7d450809cee7ebf5b4b8d4af2de4e
SHA512 fcca5de786011a421f05fd9966cafa52749044c11d63ba88548425b1b6adc2e50e7c89f70929fd915c3bfeffcbba555a8e88dd48a975c2b361aef4dbd9892b4f
SSDEEP 24576:KAhGLJIFoiwtA5l7S53Wyxknw4FYnshx8OfVe247:KAMyFoiq55x4x8EVep
TLSH
T10435AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 19ec0f8e48b3c1a5a1028c0b7e3815a92184ba03e645fe94889410b1c58865fb
MD5 e1e863e0461fc436b5209258bf46469c
SHA1 94d984d66269c269b0ac2ec3c5318ec9e73b316b
SHA512 b1532965d533bcf7578cb681084f4380176144f4ffbc3a3fc5410bab52555308aadf2a3f3583d207033950546c3c757c9b5df4e378a2e574304d4f68a393ba9e
SSDEEP 12288:Wmw5HEjsChNoBFgl0WDm+Ca+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:PwuFOWryxknw4FYnshx8OfVe247
TLSH
T1E575F14977E81CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 83e8d9eeed88bcb70043cb22a79dad40918b51f93aca7f718b49c20ff5f4803b
MD5 cb26b6d84899b8ed9fc4aaad61809cf7
SHA1 29cb564f2bc4b5714718f1e4976c00500da5a295
SHA512 2ae849c07e668955db076caf9f93327bb3596809bebbe7d7c2a6c086033bb30d242860969213700f351bb2b422d1cd271899a4fad919f9ef08b9eb4eddeddf0f
SSDEEP 12288:rFZ1Iyv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BZucyxknw4FYnshx8OfVe247
TLSH
T16E6512AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c58843dca9000899e92c7245a3c07e255b0c10204fd59f754b422e187e33e749
MD5 327614fa7c2d6dadde7cf12425dca76c
SHA1 7b960f8ef7b6bbdd5351f21a05859d9b65fe1ee8
SHA512 df733ab0e637021d0e6b80f65a8644eb874cbaa70b1b8f2b39c7cfe171a7d7d3670d4f1b16de20efe96b917f9d370e8e15fb982be2c757d3358833c2de445b72
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:gQRQyi36YOcPQLvw2gAf+PN3gix8EVy
TLSH
T12B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 50dcbf1e3175bcf5fceeaf871051ee8d568c567661b5316dc541653758fcce53
MD5 6a847431fee649a40aa5d71c6b767307
SHA1 4cb25ec435393612a307ded901b847afec94d17f
SHA512 c53f84b2a3b982fb39a78f6bfa80c262a1416fbc501cec04f5f03fd520fd021c35420d5e09555f75245a35363bd79376563cb30e5711be011add8f6cbfa410fc
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:zQRQyi36YOcPQLvw2gAf+PN3gix8EVy
TLSH
T1F2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e30a3239cf37fd807d382749e5cef20cb16056900ca28fd1dc78396847fe03a0
MD5 db7c3a64fc4a3117b2f10a82610faab9
SHA1 930ee9b5073f11386329b7d760ba9d0fa1b50e35
SHA512 6c87c871c95e445cc0858d22ec5f6eec388905857a68edbb6a99d1eb872ccc679f96d9baddd1736d3f1c7aada69e0febcb5c063617b16e6a850839ce8d81d409
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Myxknw4FYnshx8Z:368Qg55nhheWu7PNU3/6x4x8EVep
TLSH
T15EB55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4598e548dc61dc085f6ce082077ab3152b88df63a296404b42108edb76dab526
MD5 b5769df38ff61f35428c8d185c39b919
SHA1 8cc5d13ebde2c4d2a4c47ee0f9fa4f59c79a017f
SHA512 58dac10892e828017419ac7a9617cc60f887122ff4e329e1a0eeac690c707c48f762bf816be5221fba995f4e9085efa25e53876579910407a1db9c84a70b3a76
SSDEEP 49152:I3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk994:ly5112gYy5azzVvL69nLKnhZrix8EVy
TLSH
T1F8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 68e9c62db931f3e60e5a536c88a10af35b47416070e29fc8fb9c37b3c5c5a352
MD5 3b99ffaa5fc9c01c8e753e821967d1db
SHA1 1ac25ba91d8bd26a1430ec95c13f19b7ffa907db
SHA512 d48042627046d5f6cc31731ca4a5d57f5b4e731ec7c613b94a99352c28f11124c6938e0677250fd67ee028d2d631f7da3a2a78f3860dd95dd4257d81751569c6
SSDEEP 49152:4B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glox4x8EVep:Su6JmVxd2doix8EVy
TLSH
T1C6D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 125f372052ed3ab18824e4e3c0c25de14cf6f3d6cc946c6f6248a53e4cf28ea7
MD5 9aa7814c8974f4388fcf6e47e6c6f0db
SHA1 6720d9241df5ec7b9c536a83e3377a35586cf1ea
SHA512 bbdbf8417d7fcdc971a0dd90375d6934b822c4202a0274a8a22b412ae91be88a6b1dc2e265bde91e1816733653193be9d20bf40118aaa16cc81cb1d7e96516e3
SSDEEP 49152:W1hpsNoJpF1A6UU44CwH7R4xcx4x8EVep:WmifPbRpix8EVy
TLSH
T1A0B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9480badfb02d6a0a20ba83df9dcda62751a5c969b081998520cc807e85297d6c
MD5 770d01c0510e30f7a4d2ef87db39a1b9
SHA1 ae401aff3edbc1be34feeebe485ad01094049319
SHA512 3a9f8d49a47282b0a6476f2e13b5b2397bc80ae5a30a7d711cf9917eec0d924fcb7063f4378a51cb8f1e0e7c8da76389fb58516b1dbc583a304cf0dd1d539241
SSDEEP 49152:6SuZQIY0Be2KRRVtOnks6NMHq3x4x8EVep:k5dKTi613ix8EVy
TLSH
T1ABC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2bd2eda3fe95dc110c887ae8769b5aff3dfc54667405dd238e3407ae7d7a801b
MD5 e6e7f6a2b5d64c2ab61ae84d48e24aa3
SHA1 1f2c3ee793330c68ae100e8376d20a568fb1332b
SHA512 6f3f089ff913d436cf686f921be4013c1176f3a600d6f47b1cf82039d265f44e9c3542ca4022b892ef8ca9bcef43ec7d7b87e2b0cbf2e1bd3bd8bb70425cf98d
SSDEEP 49152:GhtSn8EApI0figngiDn0AP5w4x4x8EVep:HX2iyph9ix8EVy
TLSH
T19A95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 9d10380bd8028a1bc35d23b1c773bc48064b65809bb49dcf114728de1369a16e
MD5 d4df9fe978ac43e7c46b0425388d1b00
SHA1 50b6450688c99787fb3820503095d002a2beb598
SHA512 86577dc3e9ccbf27a71e50d05cbe28e6e04951094c872f6a1ea2f4aa20ee1483712c5e83b7d14f0d7a68d6a806a1da280a016c0999e384cf5c3ca9318b5e9dfd
SSDEEP 12288:EQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EQyxknw4FYnshx8OfVe247
TLSH
T11065237CBBDEA5E2F50D11734B7162626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 804d612febd67f56f15f617d744b55d62f50b792fd5c9ceec8d545baa64cd047
MD5 7760951705f7523e125498e1ae8b050e
SHA1 a037ae89aff7371171baa1bcfc41bdcb60ef67fc
SHA512 600e19d0a5d8990975c95260e0503be9eb656308e5dcbb4877b82bfec775c9a266c3c8c7b1a8f04c4d11a0b931d38fee391a110af6ffa1d5fc5c6ac26c8bf54e
SSDEEP 12288:mD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mDyxknw4FYnshx8OfVe247
TLSH
T19265237CBBDE95E2F50D10734B7162666609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 afe30dc6abc7f8a538dc32da189378260f833b2d85381a0869e71ddce3c1ebc1
MD5 1db0dec826e276656183fd8ecf55ff34
SHA1 7c24f7e7764a43b6f7bf9e4d0555af143fd1e177
SHA512 0550b8bef80a119be8e1ec8670cbbefa1be767e2ff0cad949f0304f2c11c1a1191e9d800d206665645978da5e7885cd8ca4bdecd58b0267fcba2f6a84849da02
SSDEEP 12288:xB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xByxknw4FYnshx8OfVe247
TLSH
T1EB65237CBBDEA5D2E54D10734B7263626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 1375a7714bf52a48f84e4088dfc2a77cf96bbcb3f547cce86b9deb0d01ff48e8
MD5 24055ee5e1bc2cee4f2c57685d4cdc60
SHA1 c56336c96755c5f39cbd16c3ac002d0a6b39dd7c
SHA512 f609d62ac5540886123acf9ad5c3b2cefe3842ad4353e53ae1dafbb3770f8bc9a8d5a05d1fbbdd5767825df04b94499fa67106a28f40a79ee8f4369eb4c25980
SSDEEP 12288:uV2+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fyxknw4FYnshx8OfVe247
TLSH
T10965237C77EE50D1E85A51738A726222B365B8E5E731835FCB24700EE9B0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 32f1984b2e8f2450c48e540936f7ea8e7f5485986024f5bbdbbf55d160db50e7
MD5 b211c8bf247fceaaf398e1c5d9a22bba
SHA1 cb14352d38682d1a8c549285a87ea659ea645ab3
SHA512 cd88c15e41d737d6563863d77d94a56b2f284cc6c31554da5f848347a287510ac5ca0c79a8ea88bf55c0aefdfa624d593e89b33a8fe708611e4a9b944792ef60
SSDEEP 12288:5O+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5Oyxknw4FYnshx8OfVe247
TLSH
T15765237CBBDEA5D2E50D10734B7163626609B5A6EA75811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 dd72bac0d130fc2def15a4a1bbbbda78d41703a5c6c867913ab7b601786a236f
MD5 508fd0b0427625afae502efb0ae35261
SHA1 28fb5c0046f5b7017cd687cda69d4da4998fefe4
SHA512 75013434ecd291b3e11c72e905f54930625a5b830baf304771ebde61cfae1f39a82a1c780095c59421c12d3de9647adfd7f3c1841831bed0f280c1e5ef057178
SSDEEP 12288:Tn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Tnyxknw4FYnshx8OfVe247
TLSH
T18765237CBBDE95E2F50D11734B7162626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 e15fd46ac31c0c6f06bd13e310c6ef5bd3e2c87e3ec1cf927c7c3d1cb06b585e
MD5 778d20d367e2f1103b48f5ccd5f14766
SHA1 12c774e82103ef3497ca15b10b7edbf509161eaa
SHA512 13a367f8c24828af09c40699aaf36cb459ce6a5323ff6715d7071c8e15307da9584b0d68c20da923bf906b7e53948c344582ac89b33d384ddc634268a3264831
SSDEEP 12288:Nb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Nbyxknw4FYnshx8OfVe247
TLSH
T1B965237CBBDA95D2F50D10734B7172626609B5A5EAB5821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 7d52e3090eb5ef52f18e25fc47e5267915ac595117e7132ab9f39763558901ad
MD5 6754c78d339d359bf248dbcce2cab04f
SHA1 ca302c7bbf916245c8f259c8b0da590ca73113b5
SHA512 05d1f2f3211ca0e3a9a01ffe4ce2f976d80e22ad1f46484f86a60c73decb58b6f51bb9589b564def81752d3710231122ff072f5a4e4497d46f3314162c0d6d6d
SSDEEP 12288:3iZwbZzzFEoS2cPvyj+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:yZMdzFVSOjyxknw4FYnshx8OfVe247
TLSH
T1437502A8B39018F4EC67413ECD259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 18ccbb3570627cf801ef81196a439039f943e87074741b7332edb79f31b72c63
MD5 b11a08573f4386d401a5ade39967ff75
SHA1 bcfb6c6e57c0a3a0f5082b091e484a51ba836d58
SHA512 fabf1d2f04ea9fcc633cb7f022c00870a39bf2e7c0ff9f5c93e0db4773d40fe4cfc87e925ac52cbdafdff6bfe8ef858fc037b799c88d2f199b3fdac1f3e4f0e9
SSDEEP 12288:Us+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Usyxknw4FYnshx8OfVe247
TLSH
T13C6523BCBBDEA4D2F50D11734B7163666609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 3fe463bdd5af97dd8ec21422459af4a7d606ce0838879a900d8c111a9f3f746f
MD5 cb1196c7c355ba6c726f087ca492b094
SHA1 4a3f53609a4b7ad1e21eb6898361886e8c025b23
SHA512 85613584fb424b62834f46cb40a6448b8add7bbdf6e5f49861eb3fa52dbea0e89ecd558f6eaaefa39b2a7fc687107609708f88ee5a670c26db47b5d1aeadb0c8
SSDEEP 12288:vY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vYyxknw4FYnshx8OfVe247
TLSH
T1CA65237CB7DE95E2F50D10734B7163666609B6A5EA71821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 133b8d004d810d943e659b4efea17abb8f3a9b83cd68ad0ede6aa68714475376
MD5 7c9c78017621f95da3e0d83b0deb0fe1
SHA1 e8dd1eb1ca3e063c926e696dd53769ad6e96073e
SHA512 bafbba79ba92a07ba3478461c94150ddb026fa587c21e739ca5bef6db8f259cde3e9c40054fd090a512c8b950e55fa3475512967605e7670dfd69b230e73b5a5
SSDEEP 12288:8yPz5L8v+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lzyvyxknw4FYnshx8OfVe247
TLSH
T16E75125B73E530F5E12A4236C9621612F372B872473086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 44de5cdf8e69a2695f09741ffec4cf4ad0d8824044ddcddfe857ca1f320d5095
MD5 bc39a0550e75317dec45a65a13cc23b1
SHA1 2364b758a97f7909a2cb921455b08636d86e97f5
SHA512 76c9b58e8d6738993931d1e11aab5606fda9cb7254647054b9e1fc32ed73a785f3131ee0e30c3fe8d6a178ab3e68c26345f24d8636ff44eb37d9eb74d69887f1
SSDEEP 12288:3s+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:3syxknw4FYnshx8OfVe247
TLSH
T1E665237CB7DEA4D2F54D10734B7163666609B5A5EAB1821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 1524dd7ad14094408b36f3e2d3a3b48e9747aa69d577e447731590afaac1607f
MD5 fd831f8989b643877134a6aa64de771a
SHA1 9cbc08066e1b49a70ec73431f4518a055bde315f
SHA512 bac95ccbd7658f99d5710b4b5ffa30b394c8a935eb52735593f596bb0009c87e555b18373920ee101f1e4c85de585affed399a2d8f907ae641e37852f928063c
SSDEEP 12288:ks+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ksyxknw4FYnshx8OfVe247
TLSH
T17165237CB7DEA4E2F50D10734B7163666609B5A5EAB1811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 fc697b3693ea9c206ed93cfceba6efd59a1421192003f7ef9bee6769102ccc02
MD5 149a7b5e65b1767affadc3c5c55a8344
SHA1 b44890bd18fcc684c752d42126e4670ed01aea27
SHA512 962a4d76ddd0a2d268ba634900c386ca3e489fe8b8a9ccf9785b284fa347af0b9e67d415b7e691c0782a18bd91acbce9c0df666099a01d9f8369854c248be918
SSDEEP 12288:VyPz5L8v+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8zyvyxknw4FYnshx8OfVe247
TLSH
T14C75125B73E530F5E12A4236C9621612F372B872473086AF87A4527A6E735E09D3FB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 f655a7b2e19bf8c6f130f363004828cc6579ae19a6ba5f4877b5f64c0d15c896
MD5 b81c96614feec702a5c850b9a6d69530
SHA1 3dac349a791dff697f43e8491fc1a4ea39097801
SHA512 59752215334b1d14ba010d1ee51c0f08aec9f9a7f6b136dc19168ac0487a155dcfe9cc46047d28cd141037373e538cc2ba76156557cc52268d245628d1c3cf2c
SSDEEP 24576:sTGaLl3z0zDxyxknw4FYnshx8OfVe247:sTFLljVx4x8EVep
TLSH
T13E7501A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 7b775f09b0f07e8b24bd672357324dfff24e930238538ac765c8861f0a00fdf6
MD5 341bcec51a4656ba0d7e962e2110ee22
SHA1 ce413de9413c8e8dd651deb81d2f698362631af9
SHA512 86877732f2d22748781c6b5afe725d6b6300f654a24286d671544b1066052bede5444fa076e9b371ba84bcf86ec353af0450daf7daef860312de90b07e6dd3ae
SSDEEP 24576:u3nd9CHKy7GZ1yxknw4FYnshx8OfVe247:wnd9CHKyaCx4x8EVep
TLSH
T14A95DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 7c77a0821dc34399c3e67684fc2ed687327a64555eb1c084207b1d8a2d2082bc
MD5 58101950ef32e648ab7765bce0b86b75
SHA1 72da814ad19d804164475695497f00730182d6ff
SHA512 97c12b68158273471af73103a300877c1a2c8ae9353cd5ad2942f521b28938f29684c8c634c1b56611974cae7165fe18dd94e447d24688e666f5d7919b96732c
SSDEEP 12288:6h+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6hyxknw4FYnshx8OfVe247
TLSH
T13C65237CBBDEA4D2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 af2e827fed1e7e2fa486f3ecba7db93f6664b3499b80e088e17dcd0aa491777f
MD5 3b229445343baa3cb9a672c18764c5bd
SHA1 ad48ada96f2e5526881f47f9d1aa0e85e9e26101
SHA512 c5542c2d80e37015bf2354b31590efb501e8992760d43a465fad3de4769964011ca33e4422c77da16d925665971ba68cc86de6f1bcf318fc29e33e9eef2128f0
SSDEEP 12288:CP+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:CPyxknw4FYnshx8OfVe247
TLSH
T1CC65237CBBDA94E2F50D11735B7163627609B5A5EA71821BCB7DB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 b8976d7af8402bc557388f652f913a3951a0c61e18e6ebc81b8c4707aad854dc
MD5 7b6df287c026466c0e355d86c88373fc
SHA1 bd0c8f18c4bac863252ef2968c4a32095c289ecc
SHA512 bb78e7d63caabd989621fcba602e75d797687207aeb5a3e6529078f3d61d4ce52b38713f7124d4886bcb8ff261ffbd190e629e65b4880231d71e455fa1d4b114
SSDEEP 12288:WS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:WSyxknw4FYnshx8OfVe247
TLSH
T11B6523BCBBDEA4D2F50D10734B7163626509B5A5EAB1811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 7f19a4546a202dd4970e844dfac169c2a3f80dc50d06763d5af7bd861e6e6edc
MD5 6c4fef37fccb4d16f4208aa4effbe34a
SHA1 f4d9c80ffe89753835958e2aed56bfbc0f2cfd08
SHA512 09cb4448a38bc67c507247e76f9e6e05c9752e9bb8a8eb3ee8f6d5068166ce7c930038554bacf20492cf4d9bc8403fb6edd0c6ea3810d06873d33a2f5abe2b43
SSDEEP 12288:ms+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:msyxknw4FYnshx8OfVe247
TLSH
T13765237CB7DAA4D2F50D10734B7163666609B5A5EAB1811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 9fc56d032cf5a29cbe6ae113499423070380406e03ba6240fd9ea2a70e4a99ed
MD5 46dffbce53d793b38679c5b4fe2065a5
SHA1 49f9f3550d067db7854ff5e27810b0984f079aa3
SHA512 8fde3b633b1f00abacc769fbd18336f2abee0d4c3bee817cd348635ab85ae85e487e68142f1d420eddb24922b380b62a9a256ffe91cd891b65e301727e80c983
SSDEEP 12288:Ih+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ihyxknw4FYnshx8OfVe247
TLSH
T18465237CBBDEA4D2E50D11734B7163626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 03f82adede127c04717731f44f14bd4800110580857dfbbe563cc4e2dee5886c
MD5 2db11753fd6c5e73a0d71586f8093fb7
SHA1 857e9e45e8d53ad93303a9481010f2f7b987674b
SHA512 58eda72773085b1cd6aedca05317bddaccc501a6087a2daf25532e432c5b5453f32c86e143be4491ea66b2f38dd53b5688000d63f28fe8723568d4b7f988076f
SSDEEP 12288:Lk+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Lkyxknw4FYnshx8OfVe247
TLSH
T18465237CBBDE95D2E50D10734B7163626609B5E5EAB2821BCB7DB10EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 c9b2f07c192f9e0e602d9368f58b85a512f91b82796de966a7f3b02b82a52496
MD5 cbe9c3e32ddcf5b4e71bffcdd50fefc3
SHA1 8cb450df825850bcabbe6f9aa383416be3164a42
SHA512 a7d4cc3322bb8648ee57d5e3e1fab9fb321a144a1f341b8e7ccb4253f1c339500e3468652a78aaea8b3dc86bbbc3c7457498f8758f9a1f052cb050794004fc91
SSDEEP 12288:OO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:OOyxknw4FYnshx8OfVe247
TLSH
T1F765237CBADEA5D2F50D10734B7263626509B5A6EB75811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 63925a29dcf24241c134b5c541c4e49a7b640399f7fc35a20b439093a5c1adb9
MD5 023dcc768f278cee583e6f296856de4f
SHA1 8761d84425b692ca27f86030f92765f8054e6d56
SHA512 0a96d9985a73a73bc336dad4a3b2e33ce5aaaa14c6f9771d87768b910ff591b5541cd18e4c2639d3310b8739c47127554a7b6e6bc276e1dc442a3321e089ae1a
SSDEEP 12288:UJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:UJyxknw4FYnshx8OfVe247
TLSH
T1FC65237CBBDE95D2E50D10734B7163626509B5E5EAB6821BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 ccac76cd66f76053affb53631ab2fc35d67f14e85a7777c5d99bdbe977374503
MD5 588732f4c998d35e26b06d34cb9af5c1
SHA1 aa2d3a4b4fbcdb3e9aee3a03847e0488fc5acdc3
SHA512 70f5474345584ee5625140afc7676e3d07e79fd0fccf8908e7ec62f993efaa55f9e5c710293b5c4f6c13336cde66254cc04774e868404de1449487311d11f818
SSDEEP 12288:nO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nOyxknw4FYnshx8OfVe247
TLSH
T16465237CBBDEA5D2E50D10734B7163626509B5A6EB75811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 16d06166cff27e703f840b78724e3582f3b022bcaa87340fd955b298dd47b2de
MD5 c8874dd88d9e5aa6fb67051ece06469f
SHA1 f49f55675fb0d202fd2faf329bc84be1d2ccd8f1
SHA512 3f672571c918c0fa67c83f817c4384b77daa43025487b2f10816cf40cc19ff803de08e92965546bf0402d3a2ff7f76cc6e88daa6c65dab03f9e8a46f55782231
SSDEEP 24576:KfwvJk9RX6wkyAIoyxknw4FYnshx8OfVe247:3MnYILx4x8EVep
TLSH
T11C95CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 75214e6190eb3043b4dfc09c07d366434a700366ee6280fad6f3ecfec46d8963
MD5 3dacf83db40d2db35eeebd2102b8fc5d
SHA1 708f3ad0fd226cfa86a80d7aa762c6c206fb0e85
SHA512 244c14e20a01bfca1a5e0d8023860931c92f0f83d98b69472a354605a4906a2b545709aec8f700540378804b360e2566df7307e1b34eaccb2579a1670262330b
SSDEEP 49152:EYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Yx4x8EVep:KySzPAix8EVy
TLSH
T1C8066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 18b55984f4e3d9bafdfea40fde98a7632892d63127220f75543af253ff0bae63
MD5 c8db73a3c5b0b32aff1ba14934ed6c0a
SHA1 07977fe635337d30c94bfc65e1a8d485d3cb1a21
SHA512 6f411a2976b208425fc5fc8d3c19d5f71ebc336d3d1a9a929dc6c3bccf70cd663cf38342531a5ab7b88b1c6eb2a0e31d58ddad0229695aaaba31a22eabaabe6a
SSDEEP 24576:y47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYzyxknw4FYnshx8OfVe247:y47JUQj1irIhCnDHUPfF/ox4x8EVep
TLSH
T11765AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 c5153ffc71f2801f44d84beee0b7f15ac2e6c3f459a300023e05dff9e78ed60a
MD5 f6dbe9a5e10f01d5d708fac03ed9a1da
SHA1 e287b612bc5583b64fcd882641bb1bcc2d6e8758
SHA512 3661f1df62d845dbb7e854ea370cfe62fc0916fad9eadba691bec6629f985d6159211acbc320812629ed0f5ecd8cd60e3403f7fafd56876febf09cc09ca2386c
SSDEEP 12288:d+sfc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7cyxknw4FYnshx8OfVe247
TLSH
T12275F028E29842E4D06E2176CB625641B3237C6597F1D3CB97E0F53E1F71990ADEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 b20d9c684b04ff494419f60309c66d27e18f2d1f0da28fc032654e5431a63074
MD5 b910810c530777a8d57ef9019c45ca0e
SHA1 354b11217c83bd2a2aeab4359bfb78c71cc134ff
SHA512 bf3626f4ec18377a9951dddb72b7e8c40cb85a1f4e7e006b69ac0473ac53e918bc1c8a721331cbcee39ce9a1e044ebb157a2cdf570d2bd7cc9a2ab895b2000f8
SSDEEP 12288:DZkQU3f+i1CWPK95CAV5dN/79n8kk+oNfcDLDhl9:DZNUPuWiUAVXthj9oN0DLDhl9
TLSH
T10F453941766BC75FC6A940325E32D6CCA7707C11EE04AF0773C8873F9576669BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 94910a1241107d9bdf47b686c9d2a2131f494d2d58da89ecdd784918b573e73c
MD5 4068741360e06809746fa9c2c83f2858
SHA1 7e3cea50d4ea4a0d691afae53f3cb2f3408663fa
SHA512 c8f1c15faee225a63408688b565ad1278fd29782fa3e0f3770fd9db08da5089e019f7fc7d0861ef5f918e6183225bcd03fffd44784259e0dc7cac8648794a273
SSDEEP 12288:GVA6XXZ5nmqQJcMpq0bsF2OsAezcpPOO4Mbj8qt0MZ1EuJqQjQI3NatrJFw7C1Pu:UmqQJcfItHk
TLSH
T143650B816137E3CFD1F66032032A6B4DA774EC02B7456F26B3C8453AD86A725B5B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 843feffc4567519980a6278fc324f01e33c8325a127499030ef12cd4d94e610f
MD5 be1f1d344ea07e51b4e647431233b4e5
SHA1 f67be2bb1806b433d942a6d1c42270aee7cb2f21
SHA512 6e6a95ea48a34dc5fd93e1d83334afd8cfadd214f4d38819de3da0329d369c74aa4d5ae7f2d61fb3ad81ada36684f836b35ad2b04a4861d12c02be8f5cda2716
SSDEEP 12288:M47U+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5Uyxknw4FYnshx8OfVe247
TLSH
T11A65237CA7DDA892F86D11730676A231360AB5B49B70C1DBD728B14EE4B0CD0D87E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cde67583e1f5a16f66b249be505439871324e5de1fdb3cdb05dfc54ec268aaed
MD5 36747de4da9f614cba481dea769f3617
SHA1 a57aed7bdc7cbc75b8bb4dc648435118d26d30f2
SHA512 11b568c7f01d93e27f665dd8ea9e2daec29e9c4072c178b270077d4d62673a1fba09f3bcd5251bdd4b6a6a7aef4d2c2db77990ccd52fa23c9143417c72348327
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bY6yxknw4FYnshx8OfVe247:6gb4mBIBhGF2x4x8EVep
TLSH
T10465AE1E22EC02F5E0FAD2B8DDA64417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 5a3dadd4614a444c6eb268a8aa5642fd00a269da3afec6d0de13e060584f1d91
MD5 b96aa99a76a7af5783bae27737280760
SHA1 dc2c919720239881f2261030327b8512602d465d
SHA512 1c753511b31414ee93217d70aba2a433c41011c105a4b1c125b5f83ae0816698e0c79b9076ecfc8f5c9404d41c1e1448d36b9897657c8d1165ccc7cd25ef896d
SSDEEP 24576:2G88u8FpJqH1Kzria7/mjyxknw4FYnshx8OfVe247:d7ZFPqVVa7/tx4x8EVep
TLSH
T12695F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 fdc01c3f3d854264e769fc577001bce11b558e0b6a3d4d6bb3766b46fae77d74
MD5 29350ba9dc9af39da4f3e34121b81a71
SHA1 ea1b95ab5bb4e86e3fadfefbba1c931502d5c020
SHA512 8ec23da470a8e9c0e68ac0209f2649a41bc1f3398902bf0a51721fae0635bc3b6c1967676c164f7e411c2611facf68218bf38c759f9afdb83935bd59cf617198
SSDEEP 12288:hHvUrBFrEjwaQ3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hPUr+NQ3yxknw4FYnshx8OfVe247
TLSH
T1EE75F12E22ED18E5E67AA17D89924319F771B4621711D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7d89715835d4e694a058a9c10aec8740d83adc5da8f79267dadc15beb3d0972b
MD5 253e994c0d33210b619cbc66e985b14f
SHA1 ca0002e72cf13a3e7d2fe367d349b2cc675c705e
SHA512 f9041ad9530d5ed7469402a8cbd0f2ff2ffc63e94083a618fcbeac6a3bae7cfb4e26a52287404eb3183500e04c88bdc95775a0109188a62d209a0ee733a834d1
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjyx4x8EVep:nG05lO43bjix8EVy
TLSH
T1E2D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c66859108d23cc7365cdfce297fc1c3b9c4d368425d22579972033b16058e329
MD5 e73300c01ca6a183977d4f09993f309a
SHA1 6e1ea0c5c72e7568d86e2f6219d93c1bbabfc64c
SHA512 4ccdd15e1a0cd7ae27c8b43e8bff9e060a812a0442727b2b292b3503871bd7aa88e0ec80719a6dbebac95216c02fc60da3df0719db774d6d7fc1b194d946b4e7
SSDEEP 24576:Afa5POZ3dpFWVM50JicR2hG0lasx2+47eidntyxknw4FYnshx8OfVe247:4a5POZ3+Jt2pasx2+m6x4x8EVep
TLSH
T12065AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c994ed7b91060921770b83c744d3ebe3b9d8648d10e1f9ebf221c9c11faca1f4
MD5 551bbca8303f06cfa6b1863a00132bd5
SHA1 9e96d46292d9d65d65452af7194ba683518608b1
SHA512 164f13e52d1c9b8d71e3a0075d3035909e03d3d866cc676a4395b3fd1cd7bd1abcb52d15835ee52efee8ba1d712f689dc9d32b43f482a02bfc9a3128b6f28f9b
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkLyxknw4FYnshx8OfVe247:uNc/zEOVHFNx4x8EVep
TLSH
T131857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3501a9854de00efc3e7abdac95805034115f0ea45a3b02cd21bcaa1f0a9f7d63
MD5 9f5756ca502e8828973c9c896a8b2939
SHA1 a6298181ca6fde72735d52e072daaa73a4572ca1
SHA512 bd8bfcc4892b499fd2ca3d16e799f393f36fd156c9b7067a1e31343ed8ad72d7545c721c3e182f4316f8fc5e3bd4133ac8acdd5a0f8852d02ca3109206c2522b
SSDEEP 24576:r8kNvNnaFeYhJNtmZBmJyxknw4FYnshx8OfVe247:r8MwBtOmMx4x8EVep
TLSH
T11A55AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 99e36e684c66d57b57872dfdcaf0a4bbd15534fabe16751d1a9c9fce86d46b50
MD5 4aa41525b28b7190ea1856b096695c53
SHA1 ab8259c24193043227ac1e51cf61062f06864d85
SHA512 e2e00f233d69bcdf015e3eb6544f005516e263d66f777e8cb2884d3a19aa944439130a636c530d3981a185087e80f5cbd0e62797641b9d5cc9da87bcb031a22f
SSDEEP 24576:lD3FHshBIYQgAwyxknw4FYnshx8OfVe247:lDVHeBIAAzx4x8EVep
TLSH
T11285E17DE79C04E4E47AD1BC8A638606E77138A9033256CB029491BA5F67EE47D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/396-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/396-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/396-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/396-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/692-380-0x00000185ADB10000-0x00000185ADD58000-memory.dmp

Download

memory/692-379-0x00000185AC640000-0x00000185AC7C3000-memory.dmp

Download

memory/692-409-0x00000185AC640000-0x00000185AC7C3000-memory.dmp

Download

memory/1468-22-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1468-20-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1468-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1468-14-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1468-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2328-91-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2328-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2328-382-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2328-362-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2328-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2328-85-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2864-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2864-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2864-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2864-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3384-104-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3384-98-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3384-365-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3384-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3384-363-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3384-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3928-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3928-159-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3928-136-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3928-134-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3928-128-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4200-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4200-122-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4200-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4200-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4200-38-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4200-120-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4312-61-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4312-347-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4312-69-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4312-63-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4992-0-0x0000000000400000-0x0000000000578000-memory.dmp

Download

memory/4992-8-0x0000000000D80000-0x0000000000DE6000-memory.dmp

Download

memory/4992-2-0x0000000000D80000-0x0000000000DE6000-memory.dmp

Download

memory/4992-73-0x0000000000400000-0x0000000000578000-memory.dmp

Download

memory/4992-6-0x0000000000D80000-0x0000000000DE6000-memory.dmp

Download

memory/4992-281-0x0000000000400000-0x0000000000578000-memory.dmp

Download

memory/5428-346-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/5428-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5428-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5428-50-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/5720-118-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5720-367-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5720-109-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5788-74-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5788-361-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5788-75-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/5788-80-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download