98fe2ee47e24d87b168f0a6eab3256b02bd4daa381e01a38f133d5cc72088474

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
Size 1.5MB
Sample260730-vrabtswxev
SHA256 98fe2ee47e24d87b168f0a6eab3256b02bd4daa381e01a38f133d5cc72088474
MD5 a7f967f27870fee9b9f291d31f393236
SHA1 f398545922dd05d90b2d6c8d157876c75a2cd714
SHA512 aa99e1de603f141fda51e17b9c46fbaa2eeac33ac7cd1a353c9d339615105877135a58fa74eeaefb2313e9d4280e7d0afc93da15d58d2dfecaf6527cfe12b9ce
SSDEEP 12288:qZmdbex678tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:quex686mctvE/BT76+1NCE
TLSH
T11375120174C280B2DAB71A710560E3B1DA7CFEB01DA51DD773550A7F9F302D29A2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
376	alg.exe
824	DiagnosticsHub.StandardCollector.Service.exe
3932	fxssvc.exe
4028	elevation_service.exe
2940	elevation_service.exe
568	maintenanceservice.exe
4828	OSE.EXE
116	msdtc.exe
1456	PerceptionSimulationService.exe
1740	perfhost.exe
5060	locator.exe
2724	SensorDataService.exe
3512	snmptrap.exe
2156	spectrum.exe
3308	ssh-agent.exe
540	TieringEngineService.exe
5056	AgentService.exe
3944	vds.exe
3280	vssvc.exe
1732	wbengine.exe
4628	WmiApSrv.exe
3444	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\903e95682d44b5a9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000682638e94620dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d9c4de94620dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df29bce84620dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016e9e2ea4620dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b0496e84620dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d7165e94620dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
824	DiagnosticsHub.StandardCollector.Service.exe
824	DiagnosticsHub.StandardCollector.Service.exe
824	DiagnosticsHub.StandardCollector.Service.exe
824	DiagnosticsHub.StandardCollector.Service.exe
824	DiagnosticsHub.StandardCollector.Service.exe
824	DiagnosticsHub.StandardCollector.Service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4412	2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
Token: SeAuditPrivilege	3932	fxssvc.exe
Token: SeDebugPrivilege	824	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4028	elevation_service.exe
Token: SeRestorePrivilege	540	TieringEngineService.exe
Token: SeManageVolumePrivilege	540	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5056	AgentService.exe
Token: SeBackupPrivilege	3280	vssvc.exe
Token: SeRestorePrivilege	3280	vssvc.exe
Token: SeAuditPrivilege	3280	vssvc.exe
Token: SeBackupPrivilege	1732	wbengine.exe
Token: SeRestorePrivilege	1732	wbengine.exe
Token: SeSecurityPrivilege	1732	wbengine.exe
Token: 33	3444	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3444	SearchIndexer.exe
Token: SeDebugPrivilege	4028	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4412	2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 5116	3444	SearchIndexer.exe	122
PID 3444 wrote to memory of 5056	3444	SearchIndexer.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_a7f967f27870fee9b9f291d31f393236_amadey_elex_hellokitty_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4412

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:376

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2328

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2940

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:568

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4828

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:116

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1456

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1740

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5060

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2724

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3512

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2156

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2880

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:540

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3944

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3280

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4628

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5116
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 eb4eb974bf3ac079a1f8b0d756220ff082c14a4fb3cfbde32d60273f0641dff0
MD5 3cc17fb478aabb4680ead592aeb75576
SHA1 e4069cdd8c54500a3ce33ebe26101fab249bc03c
SHA512 ecb73e64a5e2d2be3d1fa3f82baf24be50e44504c0140ee2b91e47f515b249060ca1b3319a4ebe35a1c42671366cf3557fa00dfbdfee7fca2efd416a52814e65
SSDEEP 49152:hb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnL6mGvKVO+n1:n3q60jBIXeN+1
TLSH
T187D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 1eb463e8242610587dc7117ab15da119b949f4246a2a04c4fb98f4e584195267
MD5 37b649e59925604d01b0625ee05758c7
SHA1 bc67574e3a0dcec3f540431d96caef83646590e3
SHA512 478469c65f4e28b73a93c88b8bddf4033bbdc632a22d8a1561bb8d4e68298854a49a21807e146058d2e9b4fa9ffa40c0fa20473b8bdfa471c9dd97f46f4c0514
SSDEEP 12288:K1XLsswWkxy2lRq2czAstM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:AXYfDtczAs6mctvE/BT76+1NCE
TLSH
T12C850224779504F9ED6B4278C9A2C112EA737C9547A4E7CB03E4892A1F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 164ce57eef77d2ea188ce202733eb44a39e7eb3212aaf04e4c101b69296160f9
MD5 8c68a23f866108c2a59208ff19a7502c
SHA1 e256136b1382a86a7b304ab4e47c06c7eb79f701
SHA512 013710977633a00e8c0b70ddae46d698c65704793193690ac9554361262003570a2c11456545868d031bf77d29c1b8170c3ed5fc216d4f3b2a019a7e2bc9e993
SSDEEP 12288:CXZNYVLeyUji0h90ZD0wxpGZIVutrHsTtM6hct28uP18WR/FW2Gb8JTCMMK7LIFq:G0Le5ji0hmxqrMT6mctvE/BT76+1NCE
TLSH
T13C959E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9ba0b0bfb01b99513ea8954c763a0c4f1d497c80c1d87fcbb1cc30ebc8072105
MD5 92758b287b2c98aa71e33d08aa733219
SHA1 847a7eaaa4e8dc9a359fa13b92b204b89bacbd32
SHA512 a41284f8180d6c548d7fd2841b13b95252b319457ff878fc4800238e8d395e116b7dedacee79fbcbd0dd687fcb155f2b7fbdb0b1437ae4f77faa9cc354f1b0f5
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWr6q8wyuB6mctvE/BT76+1NCE:E/ezSC6vUzPviHjy66mGvKVO+n1
TLSH
T1EA755D15F5788323D0B2D0BAC5D6BA9AFE723086573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6f2400429d0c2e97d490e893e34fa7d374512a2158b1854a4fa5c4b2bb4708b4
MD5 1fd2f713a48fb8ae0673ee544b225a3d
SHA1 fcd7b266f8142414d3c19899192dc5ee64c518d4
SHA512 7392fee85b9e8e16c8f3108285838adab6a23b2fa1e72b8020c693256dcde8d779464db9c64cdd1f688f7221e93b2c250aa6078065ff7dd761113882f30b788e
SSDEEP 12288:WVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im984tM6hct28uP18WR/FW2Gb8JTCMx:WVbqPb88hv/l+b46mctvE/BT76+1NCE
TLSH
T1A955AE66F5748331D073C0BAC5D2A69AEE3234425B318ACB1246D72C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 67c2b8b0ee667a447712567e10cd9e0e38930225144841c7034d3a03edde3773
MD5 02fe899ba98725eea4595d12230cf9e3
SHA1 26ecf0366ade990eac0d3d6cdfccd4b15f7f4f0e
SHA512 043bbc2429c5dc9100bc4463d76e4c5df73093c7796124365822f72999357d75be53740904dcefae6bc972db0fcb2f921fee6b0f56ef9c9ca702a762a86d4427
SSDEEP 12288:lMftM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:lMf6mctvE/BT76+1NCE
TLSH
T18F652382981B11D0EFFF07F06395E296E8516EF934DA1C81D362991F9D30162FD0BAA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 bd32f75eafb8b3014e6fc26f7d43cff67782658b6040a76927dcae98a9c40818
MD5 a5d4345ab97d503bb188321c443b6269
SHA1 0f82ac5ee533289d4415a034c855008d72ee1e59
SHA512 07f28e1a55f0191ff3d278c614de2d927002caaa4fba02b4a63660ea235d93fda8e143b89011ee29b74ebc738b65384e598a746a6875d07fbadc875597016fdb
SSDEEP 12288:FeBNUbTVO86UAtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:FJIUA6mctvE/BT76+1NCE
TLSH
T12585CF7BEE28FCD2C27E4DB85691C240E77278704B52A3CBD165820EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8c5fde463dfa4924690bbfc7e16573ffd49080cb5f754fcf7248dd7995e627fa
MD5 7c1cb1351ca321b7fc28fc5bbf85648e
SHA1 6a11bacd64e47a3792575fb65d1c591bd8f044c9
SHA512 19c8de28196e9a36927253ecf4881b0b0ebd06de1bc9d78a7f8428080fbbb8410ccde179ce3af38266e201e3e48d2dc75ae6335bf7266e7f5d586e4e540b209c
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THK:5QvGAdlCEL8c/RRNw5CxXeN+1
TLSH
T1F3267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 e339506af90f7a2e77e8bac8a3ca1740d69aaf68b2c8ea733380873bb090e2b0
MD5 d5d332b8d73e1a875ba9c7c1e2d97168
SHA1 16d0d045b66bfa8a5828292a7555c4982684d812
SHA512 79e6a2ed7c2ef0d248073a1924f274271421e65a1f106eebaffb871fa352db7abc01a5b9e77228ca9662cd055ac8abe1e74c5f667e6c11123e4ef814b35728dd
SSDEEP 12288:rAwSfxL/2Dc3+DLLmt0LDQewsAjWtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WG:UrewsAjW6mctvE/BT76+1NCE
TLSH
T10585E031FE75E036C7BF0DB21B26D316546C7A604B9219C3E3A88E9E59302D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 615be27733672c235520c5e233446daf0e49e81c02e374af0563a288dc373759
MD5 8ec795ca5cae735d9b96eaab3eeaf1b2
SHA1 9a83ededde47cdcc49287993e4a1e9e6b01c8070
SHA512 754568f6b57521d779a38fd15e035c07c15e6f8e5732ee6afee8dad7e348f5ae6a7ccbc05f7fdbb195bd7836166ab9a0b46bb4df516b964dd146c2caac96f638
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHOXeN:YUEtQevvqc2W1cpV2RI32Me
TLSH
T181474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 291c78cd00e8c90dae936c45713f77f13ea4605e3e67f4491b96f47c9a2b5c81
MD5 cca9d60d902f7d541b6f9c16d7748c78
SHA1 ef4fe790cfa40d5ca9879b53aa559d6fcff36649
SHA512 252744e85ddd8cdd40fb25efcd39ee216b50077c443a7baf3d274c6bd7356e2e1fafba0127fe3a6e6f3fc95fc4f92ad9050339341f8bdf2fe2336f04365332f8
SSDEEP 49152:BCbRquA/m2yL5zQfFiV+XenmE3/z26mGvKVO+n1:uoqtVjnmVXeN+1
TLSH
T1EFD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ecd26fcf97cf59f4eb06487fff2d3540fef290077130fb12796f44d0e34bf5ed
MD5 e93abf0b9036fea32b290f717983a47c
SHA1 c6d20d2cd157a5548eb6bf8fe7dcab9f6b61a5f6
SHA512 7e578ba0e1ae372ce2bcd432f47acbde737324da5220204dc93d5c91a827436d114ef7ee65a38370ddf9f6f9accd1e92cc10eace8e5a1fcc390eb7b7489b02d0
SSDEEP 24576:xAhGL2IFoiwtA5l7S5316mctvE/BT76+1NCE:xAM1Foiq5F6mGvKVO+n1
TLSH
T183359D81E7F951D4F5F3AAB899B69171EA76BCAA5E31C20F2150C11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 0866ec2519d729c0b8a48683a076f7651afaaec229a5bfb153148b93d9af9694
MD5 f00340bc7076df63e58365ba7b324fea
SHA1 5632b3907fdf8f46fcb4eb7252d3a51f785a429c
SHA512 c066bb2867590cffc8f711f798a3fd24aac6121a128ea2a2ee4f4078c7fffdacad96867e675a6b00557b22252ee8149d236fee294232ad179f7c6466706d3594
SSDEEP 12288:0mw5HEjsChNDBFgl0WDm+ChtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:xwu2OWa6mctvE/BT76+1NCE
TLSH
T13F75F14676A508F9E9A742388657C136F7F2BC513A25DB1F1360C61B6F33261BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 240906ef53015bf6fed77bf39982d5fc88075f3b884d2420e352bca6e77872b1
MD5 c624a9d99503a3b9ddeb9b91c0abd7aa
SHA1 38845fe1ce34a728c9d3b01095818cf190c09459
SHA512 bfa3e82f7c9406a2e14b4d51db091cbc488c3ebfedb3ce1707ec4c732c96ea6205e19b7779164c42a79f3ac9c2af64b28ded9026376501320317269229962fb8
SSDEEP 12288:pMZ1IyGtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:GZu76mctvE/BT76+1NCE
TLSH
T16E651286226520F4E5E702B8C9E19245E77178E637B603CF5221466F6F32AD26D3A733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f1a1be556926baec1dec53cbe276b92cc3ce7f6f2e1aeb3e6d2878e4fb939166
MD5 3bb77223c0fd08a1c57b8fb642e87175
SHA1 3fe9006a009cde55ab3601e513ba3ccd61dab191
SHA512 2570d3587444d2e0f47cbb5e17ad9d2592c5a204443c99cdca027b4a3e16fe4d889ab8d1589b0cafc8b7211a688d8324385e3bb31d9ccc923ec2b2b1821727db
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UG:qQRQyi36YOcPhLvw2gAf+PN3UXeN+1
TLSH
T1B2667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8e6b59a0f3827743903c15d3138e833e9d7ce761e2bc6cd34de2c2d850a9c482
MD5 aecd9681add521d82bf868f924bb0573
SHA1 7f93b07fc02dbe130705b35ee6b1d2ea691b21fc
SHA512 a9d4cf86fe1ec86e0acab605c81129749edcd5390081a34d14b25633c68a02c44b379a55da4627f1bf6480081e19380af0f1835d29b87ab2657672c1c80d02fd
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UG:nQRQyi36YOcPhLvw2gAf+PN3UXeN+1
TLSH
T117667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ad32c59a57a15cac1f5ab0831217e3dfb414c80800a37e51e0694b75aa2694a4
MD5 c92c7c795d0e14b610706de143b70cc3
SHA1 6a0dc66a5848cb65b076b3d86c9b649863d29c91
SHA512 993951cc40ca715e9785b1b18699d1c732161089f2e6c386fb2986c68ef4b149a62a2f3b90b2f634bfb9477ed9fdf0fc86baafde027d60ad11d4285c22806017
SSDEEP 24576:hwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0L6mctvE/BT76+13:t68Qg55nhceWu7PNU3/m6mGvKVO+n1
TLSH
T189B54933B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9099f8a3985c6800960c5d83f4f9e0a9342dc46ce7056acb772724c6e5f97e80
MD5 69a8768c320b98ddab8eb2aeaccff98c
SHA1 bab601bd07e6a13731bfe30304d0b7ef190e8635
SHA512 b0164cf9ec241273d1ce24502971eabc510451215540a7f6fb7ddaf7e0bc41b2b6e8ce434817e33b7a0e82797386dc9b4dc24ed9dff40ee087837b5e4ca808ae
SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99:ry5112gYy5azzVva69nLKnhZfXeN+1
TLSH
T159167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a839bb6bc8aa0d8b5f7758afa6a27d342de4a36850f352e53b5af70a3410e9e6
MD5 0020512c17125efc7eb3f879f3f6b79b
SHA1 d502e2c08eb8201788c964221e370bf59d7c0730
SHA512 aed658aa5bece25ec5e4ce53ae90ab263b7e6cd7c6aacd37a77467a3a693c072284387dd68db78e2995e35eab8b8dd802ac1fdd02692801c6dc1c2c2d0cba7aa
SSDEEP 49152:CB+taZ3usBWOBr4tEG20bqx0z+n217aau1gl86mGvKVO+n1:wu6JmUxd2d8XeN+1
TLSH
T186D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 70595f2e8f438a78df5072319aa7162ae9743ff8424243cc41b9ad4740b31f42
MD5 a6b06b70efff38011db16d2772137f2f
SHA1 5fca689f2a5c59d5d700196f3f60a43ea56aa766
SHA512 0afde8851ca2bc8a130ba56d9a8aa0f40e33fa9df267e93e331068b0715a5e105007a61f754f21a7e3c0f7d7b040ad349dcf3df42c0c04c2d5448d7d223c117e
SSDEEP 49152:A1hpsNoJpF1A6BU44CwH7R4xg6mGvKVO+n1:AmifPkRVXeN+1
TLSH
T1CAB5BE13F29900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 084b9f9f224854ee95251a1b9b9cacff017b46114a40b75bb0e52a33b67764fe
MD5 57978d66c74e85c17faaa56bd3e71533
SHA1 a0655e56fb6e2bf9774f88dfb18af8ccb443a90a
SHA512 b66d085197c0acf378d929df10910192eb0f26f929daaf97ee87dcad278cb5aaca575b031860a7817e5e89c30d794dcd0dde32ce51201d0c1ddc42b4648a3bcf
SSDEEP 49152:JSuZQIY0Be2KNRVtOnks6NMHq76mGvKVO+n1:H5dKvi617XeN+1
TLSH
T1A6C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 48470a86d98ed9d3c64c3c7abe7c06ca2b4c5169fdd14c79e0e7112e13721f27
MD5 59884ffce33ab651f69fd52b7ba4b33c
SHA1 8d5a956bf470db25605f0c893597c569a50a8f80
SHA512 e83073b0e556505598239961ef3cf87a3b256096db2da4f7f23671736e3134fc29ab7fa16ef19acabb47688e6414da483431dae89fbaa5527d55aefabb272eb6
SSDEEP 49152:EhtSn8EApI0figXgiDn0AP5ws6mGvKVO+n1:FX2iyphpXeN+1
TLSH
T17495BE13F2D900E8D05ED174C7468632E962BC160B39AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 60dd591586d759f7df49289e1bd601a9f3a241f246300e4fc55b7f7862f16bf4
MD5 aed9f908298193e495c5f5361ef6a7f8
SHA1 2fe2a4bd83c89874795d32e0e565a66cb8b6eec2
SHA512 98f826639717b51643053a609f3205a27994899f1e532513e66f1a128bcba35805217851cdd5ac40f6eaa59cec61ecabdcf6cf756f8ac4976d6dfb3aba8eb981
SSDEEP 12288:4HtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:4H6mctvE/BT76+1NCE
TLSH
T11B652381981B01D4D9DF07F19395E29AE8502EFE74DB1881F326851FAE305A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 278848002b7dc24ca51b3968d1c2c0aa7c13d344857936c0b84cbd8d1245f5e2
MD5 28221cfc6a2eb962ff587af2fe11d334
SHA1 7f3e3f0a099a00ce1b57588a8df2f522a66fb53d
SHA512 6e0e036be9b634202afab3880db8bfc4edb325dbce6f52ac5fa77d91573a94fdcf32ad56383b245c1778bfb1d3c37bc511cb934b22e6dc26a3403cc73af963a3
SSDEEP 12288:aytM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:ay6mctvE/BT76+1NCE
TLSH
T1A6652381981B01D5D9EF07F15395E29AE8502EFE74DB1881F326841FAE305A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 e566bb4ce31ec0a11b6f6d4b753dac615e58bfc2d3a175d0dbb08cef80eece45
MD5 ee475a49995da74835565a56cd9b6c11
SHA1 dce07ddcd28eb254bbfaa2d86a41aac4706898dc
SHA512 57ff2aa986aefc296e8aab793c8c220f61704862a0935ef4c2bd2432a0abfbe37f5725917c72e4554605e02e8060045690ec4efa0ee78819c84d9d20bd1c528a
SSDEEP 12288:6ItM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:6I6mctvE/BT76+1NCE
TLSH
T15F652381981B01C5D9EF07F19355E29AE8502EFE74DB1881F366841FAE305A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 20212eb8ca4e73b5630d0013ed2dfacca5da0a408d14649a3317f62904255c62
MD5 1d979c0c6d05557bd457cfe0e750a00c
SHA1 c5086576204640057e45629b08f39a21e04c1b04
SHA512 d4b53d090500ef6e8df4e700597ce5164e97af5b2010404451d636fc749269cf3bdd900706eadf3f01c9a96a5628544e8890be4fec9542b859acb2e02f082e20
SSDEEP 12288:BVVtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:x6mctvE/BT76+1NCE
TLSH
T17E652382691B01C0D8EB43F0C2A2D296E5B07DE975A719CBE311491F5E703A17D2BFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 fb11840cc4e132216729bc3b4dc94f8634ac8c0722e5d919cdffe476053dc113
MD5 190beac8ae9dfbb109ba0b28832782be
SHA1 17f35dded5264888f7786d1e6f75e340e29fbb26
SHA512 54039526b183dab5c5cff96988166a87b699dfa93d6e3a37264c7ea29995547cf1afa9262c1f6a167c1a92029c59f86059d9a63723c35ffbbf7b2ecf3b51f54d
SSDEEP 12288:HttM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Ht6mctvE/BT76+1NCE
TLSH
T111652381981B01C5D9EF06F19355E2DAE8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 5c4cfa77d59b754dfa63982bd046a8887b09efdf10426f61962242016eca0a61
MD5 855f597afbf244bc9309ae5501ac181a
SHA1 6b08571430ad286fe71047868ff8de21483cc61f
SHA512 8e171edd8340772e654aa5fcf32a4a1c3ff514de831e9fa03dfa54599a0c606610df5f2236728361d75336b3cc5b8c03989d43e65fb2e3b486978778d74f269d
SSDEEP 12288:b+tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:b+6mctvE/BT76+1NCE
TLSH
T1E6652381981B01D5D9EF07F05395E29AE8502EFE74DB1881F326841FAE705A27D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 329eb62cfe185a513fd3ddf8d8ba6930eeae7e7819f6e841675ccdd70073268e
MD5 d5bc102973933e2875c86478555bee72
SHA1 a0cef0cd6a1b08a93aa6fbbe8325db73dfd29d71
SHA512 f46236cbdcb2b7180d6aa1eb8f5414fb5e3a57b16b97831ebbae7dc08563e8187722c0a6cdf853714c5ff772a91cada5a94c7f3e8363cfc26e80dd74b212581c
SSDEEP 12288:kqtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:kq6mctvE/BT76+1NCE
TLSH
T175652382981B01D5D9EF07F09355E29AE8502EFE74DB1881F326841FAE705627D0BDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 ec9bb3364b81dc950c9eed5fbcc20fb69eea29427d43dc87132b13e5d08b86d4
MD5 80db38a59a11a0c831cb89368d220bdc
SHA1 4a73305b3db0564e10afce44ef510b6a93ea848c
SHA512 369a78a364d1c6ab47a36602aab11b4809a630a639c8aa0caba65816273e60a9c6111463327b482e680ccede6e7b79248bb8c5cfefc16a04120598e90a231168
SSDEEP 12288:oiZwbrzzFEoS2cPvyStM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:rZM/zFVSOS6mctvE/BT76+1NCE
TLSH
T1D3850295B35118F4ECA7427EC9558506D6B27CAA16B0C60F13B4362B5F333A11C3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 2e9c70df5978ef2f7c12768a1ba644f7d5e66857973e5e2ca6bb447036e778ee
MD5 20fde7e7119f29e96e5a8c942ed0e285
SHA1 3a3677a408220e6f92055f11fb2833a428352db1
SHA512 d5ef42941be8923fabc38065f5e8e08ed2cee83d5734cfc7cde8de95c603bf204b4c5f587b2f0c7f68b3e41db0b8201cddf29cbf55f2969dc38aa15b162c6352
SSDEEP 12288:LrtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Lr6mctvE/BT76+1NCE
TLSH
T124652382981B11D4D9EF07F15355E29AE8502EFE74DB1881F326841FAE305A27D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 07c2544f78e1e30fcc1b4fe8bbe4b74bc1885756e30977191bd36dc82c166837
MD5 678aebad2fa37f27a8fb318648a3c9bd
SHA1 e0aa85a160c4e69fbbd74be06d4d506e185128ea
SHA512 459030ea8f00f2793024795b731ab68e8d8df714ae8a263dee5af68fa538e7af80679b07e24f4d116675448da09fba341c5873a45a1e9f090089ed9673f035ec
SSDEEP 12288:sPtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:sP6mctvE/BT76+1NCE
TLSH
T12B652382981B01D4D9EF06F05395E29AE8506FFE74DB1881F326851FAE305627D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 097f41ce68164124fe5a0493a8c5fb9005f8212e75fa644f58d885d36f49755b
MD5 8ff67fbc974046c1d763bcd720ab9baa
SHA1 307c3d60d5e7acf5ad52ccb2e995be8e22822667
SHA512 0e154365bc9386fd4263ac13be106bf2e5e54ee1ee7bfddd6e9fd5e81b63d41471af1d7e5c19544a34ee9765ca73ac3b539a775f804ade6634f1b03384b0217c
SSDEEP 12288:CyPz5L8GtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:fzyG6mctvE/BT76+1NCE
TLSH
T11B750143726630F8D5BB4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 9ccc8718c6db2ccd4b2ed41ac93ac97c9c852b08b6a4b21034c51076fe1fc554
MD5 298344c69b453c32b0564b60c70c3ca2
SHA1 7962c48c39e9496e714a2ccc69151cf3b45211a7
SHA512 2373d8e611802cae62892ea1e056e5c43a5b6d6bc1e087427cc74d484b6f7abb559154a963d82b255da6ccdc6b138bb630e40382a5de0c52a67eb99f0d3e42eb
SSDEEP 12288:+rtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:+r6mctvE/BT76+1NCE
TLSH
T162652382981B11D4D9EF07F15355E29AE8502EFE74DB1881F326841FAE305A27D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 c82deb97cc53baffbdf8cc59b6b107a54740fdc2ce56597a9a15b25c7c3b93c2
MD5 cb2187f2cdffae23161ee378600810ff
SHA1 9b1ca6c47a86a5ba8bd2fe2ef259a467c33447c1
SHA512 22109b16a8f1670365d0e6a02fc54a73cc4c9d89f1631a892340cc05657842b793847ea6fa87fab5900f5a9ee9df36ed8f199bdea7d3e1eee37c96c68e6cb8e2
SSDEEP 12288:irtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:ir6mctvE/BT76+1NCE
TLSH
T110652382981B11D4D9EF07F15355E29AE8502EFE74DB1881F326841FAE305A27D0FDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 87f0fdd9f1d5041fdf445e4bc003e678b31757e73432e83f81910a245d7968d2
MD5 704a38066de663af8a233788388c4801
SHA1 41f60eaf05c8486345c1101a6cc1097e5aa4c2ca
SHA512 f767e2c57778ebf5cc1ed49f490c39a131b78468935acb48a897b97b0859c5af1d515e41f0f61a0278db04f9cf25851dc1ce6f0129408c39b95f2890b663f75a
SSDEEP 12288:TyPz5L8GtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:ezyG6mctvE/BT76+1NCE
TLSH
T16F750143726630F8D5BB4274C9A25202F77178B627654A9F5360463B2F332A1AE3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 72b4155a9fff8570324912c0756427d9e3bb927cd29976a7b89b94649a8804b4
MD5 cfbf5890ad9527e929c577802e4813c7
SHA1 b83e79dd974c1e2889f236cdd1773ccd131232bf
SHA512 04f344af149a9abe8669e90e1fad2ee85a8e1f97fbdcebc147ed660e8f6b49c8dff1fa71e878e53d99175b63f15742bec3afba8f11e1f6f4730f49a34f5a9e8d
SSDEEP 12288:fCd9NWYoaLHF3z0z04PDvhYtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:KT0aLl3z0zDY6mctvE/BT76+1NCE
TLSH
T197850295B35118F8DCA7427EC9558506D6B27CAA17B0C64F03B4362B5F333A11C2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 849d8b936de71e6065746a7975035ff1c730e2e793a49b1ca2a8020bb11c80e2
MD5 7837a700e1a4144089995084635b78b8
SHA1 f9381bc9b53df3b1b67fd7046374db7957d9f885
SHA512 0360160db5ed8e53655099b0de134b9c49542f1efb178f6a2768c6e65b0112c10e0b6abdac30584fd4750226d1e264cc998051510462fb8390fa4959d10ae951
SSDEEP 12288:yi4e7PRdTfgwCHKy7GLbbdIvZtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCm:y3Id9CHKy7GZ06mctvE/BT76+1NCE
TLSH
T1B595CF90F3E410E8F0B78A7589769112DAB67C9A1B71CE8F03A4651A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 eb40ad4a3c9622c2f65eea30039ee4862b035c61ac772557eff00268ae0a1429
MD5 3c4e37be5f2e82b9f996d6d6578b1c31
SHA1 74f6ffc03ceb79cbc340b36faf852f08accadeb7
SHA512 a04438a41ebb9842fb97846d76242f00462ab19c401320562f719af5f8d8a7690d4fe2a05b6209ee81f88252223f798ccbdcb82c9da92da5e855986a48a47a09
SSDEEP 12288:EotM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Eo6mctvE/BT76+1NCE
TLSH
T19E652381981B01C5D9EF07F19355E29AE8502EFE74DB1881F326841FAE705A27D0BDEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 dfdd966d0bf50fde68c48240ea476503ed6909f9c276871dd8c58f9a3da526f2
MD5 197a06e2b8b33056bc5f483b26c98543
SHA1 e8f60783ceaa6de210360e405942a04fc86a6433
SHA512 5b4daf21b4ab43f7a3454862d8693a0408547eb7e38a4b655cea67689ca2b9ecd00f1d99cc593844b078daf859070f10722588634ebd005604c9df8f82e6dbac
SSDEEP 12288:WmtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Wm6mctvE/BT76+1NCE
TLSH
T1A5652381981B01D4E9EF07F15395E296E8502FFE74DB1881F326841FAE705A27D0BDAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 eb5d7147511e83e816c922caec101bd5cf6cb1ad9f985408ec0d4f092bf6e065
MD5 070c870365cb943113ef1715a3c8274e
SHA1 18084be8dd68a7d2107f322509c6647fe7719c70
SHA512 620a813956e13af27eff76430fd4e2230dbd9911d85937a32d1455b97896d8b3a637584210a61ac233fd5d8eab0986eec413a5746cba1027254281f11afbac26
SSDEEP 12288:h1sf7tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:i76mctvE/BT76+1NCE
TLSH
T1C175F14AD25902D8C0AE12B5C7569241F7333CA5A7E293CB63D0F53E1F31690ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 c4bbc969adc880cba4f4b0b9b3629092e9a7b277683e94fc2c3dee2cd3bf0014
MD5 2276427a3594dd864ac58af6efb6e97e
SHA1 f3ebf9783ae481312357f357d2b534c44af7f800
SHA512 58654efc65b3888107a539472df4be09cb1b1bd76e51fd55f465f7530e5408ca89e88e87eb68e39ca12dd657796785d738fb4d903725174fea9025a5043b9576
SSDEEP 12288:5/tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:5/6mctvE/BT76+1NCE
TLSH
T176652382D91F0185E9FF07F05255D265E4253FF9789A0883F212851FAD305A2BD2BA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e34d4974de728585e82736fb2e10df3951eecd81980950607b72312b8dec490f
MD5 d89e7b7c49acaa1604f45af35e1df2fd
SHA1 6e0964d997a782f8c7c9fbae0983fe22d33634ab
SHA512 93ab627f12c548dce2df180b0f7671b46ff0dd06221112b3d8c9edd8d96f8a6b367b6de9894041b63555ea9e0999e98b55646e061f7f591a4dece8ccb70c3ecb
SSDEEP 49152:+a0h2GEkuAe73q3pp46zwwQN6mGvKVO+n1:+a0hNYG4Jw6XeN+1
TLSH
T14285AF1E67EC82B4D0BAD278C9A6814BE6B2B4261B3156CF1151853E3F37DE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 9da2b07ead9697f30db4eeacfdaf6ae96ea005824da4571101645abe94c7bbfc
MD5 e4283a8589876f77f94ac642b2553b54
SHA1 c7323a13105a82e62d08ed49782ade42c2ae6624
SHA512 6951fefb3d2264005f986af470b20528730dec8c94ed4aab78a990aa8ceced8029ac5e200889fefc32931faf7955b49b1870e8bbd9093d09811a2e5ef3324b33
SSDEEP 12288:khbHjfXotM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:khbHjPo6mctvE/BT76+1NCE
TLSH
T1DE65126E166E10D4E5B692BC8291824AD730BCB5271253DF6392813F4F33AE55C3AF93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 47bc705e95396e3dedd7aa69fdf40dcceecd2ac8281b0de00d5067ff84e82158
MD5 ac37d1f3aa31234a59adbe35b1e02531
SHA1 d4e847a9625ffb3409d790f39a22be45590e5226
SHA512 a8a8cf568f7f5a6bc20230031225bb8b6d48857b13ef6e3e4fdf9073e9cfa2ae281e610d37b05c7b892d98589a8edeaba1117d91898ad7df7ffbc4f2ea7d9aec
SSDEEP 24576:h3YgnJcRTk4yti+R5dBR/w6mctvE/BT76+1NCE:hIgnaTk46pBR/w6mGvKVO+n1
TLSH
T13E45BF2DF2B910B9D8AAD236450143B5FB71782D1F209ACB0170C539AF16EE85E39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 d7aa48c25105026b1b898a2b5c37f9e04c7f08bef0dcad4a54578a7a7e3395bf
MD5 169cc884afb1df97c1d920358c8566f9
SHA1 b27c2ab6936af030c37e310d76b9c2a9d95a92da
SHA512 7feaaa8ea29822c1bcc32cf735819e8dd9b53d89100078873f22cfe0acd24e175dc4ac7ecad1475cfab1c275d53b1bc624b667f1b5c5b3fc77c117a8cdbe5714
SSDEEP 12288:G7tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:G76mctvE/BT76+1NCE
TLSH
T192652381941B11C4D9EF07F05256E29AE4503FF936DB18C3E226851FAE305E27D3BAA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 5a043718303daad5d47ab42f9b10e12d847b5aed3ff7139ff136366cd14ffcbd
MD5 7cddb06fa9cc2639166e8294adb962e2
SHA1 0d7ab9639a1b0bf4977e2efff5063c4d1645be16
SHA512 aebcbe83af6e909c854121f176649895580ea094b663b70ae974f4485aa8df229be993e586e115dc81dbe67064bda950323db84f80b3e86992e4c8256f49af57
SSDEEP 12288:iObQA4LWOsvAYFT8tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:TIL3UT86mctvE/BT76+1NCE
TLSH
T1B4850145F79500F8ED7B817CC9A28616E272789D1364E7DF03684A6A1F237E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 cf2b76945074a39ecabf07d4eab15933578c4b3bfc2bb496e41717269028cf28
MD5 0b2cbf53cc3fb98003a5b88525d43d8b
SHA1 23b46053348d774f803d8162fa440b955d4d0579
SHA512 68072cad130db64a901dc01525b08270bc297af5a77f62a7554c3bd475ae520800e5b86ef7fdf39eb35978518dd57adccf4f9cb6007596b8d83940164f9d3ff5
SSDEEP 12288:hpFtVOItM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:NOI6mctvE/BT76+1NCE
TLSH
T15275121A36AE10E4E57A52788682834DD371B8F6176217DF4290807F5F73BF46C3AB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7ec62a83325a85d1f64078106e3171536cdd2680bf8ef4d2d26a341ac140d7bd
MD5 c1dad16ac53a3c51e6743074b6e09fd3
SHA1 335a45f8057c51644423f6e760812af7882ca0a5
SHA512 f717636bcac017ccbb5a04819967599c4a05981c60599fe3816d4090055dab43a9d2fa884a850b1b1711a6373a22359f3631c6820c50927ec760a1c5bebe9f6a
SSDEEP 24576:/7NM9YqZqmWMUkPjZM48Mv6bEhsv6mctvE/BT76+1NCE:/7cBWMpPjN8DbEhW6mGvKVO+n1
TLSH
T1AD65AE2E6BAC81D5D477D13DC9A28206F6F1B4611B318ACB5162833E7F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d684a6b571df35968b4a7b003ffe57d4c68538aec42a96732f763002a2875ce2
MD5 8b50742b7ece552b5b05977ad6e93c7d
SHA1 31fe1c6100a08e95bc4e1224cb106a0e8efae296
SHA512 f33c228322527ba5c60af12e722807453aa167f606f1c977e0c766c0833688787be8335c1c01bd70ecb7718572915fc8b998a40d3e60517a4277fe8adba5d346
SSDEEP 24576:gW6BApg2YuyuNDYTabvcdvNYf8km1R6mctvE/BT76+1NCE:gF2YuHNETovAvNYf8kmP6mGvKVO+n1
TLSH
T127858E2927ED80A4E0BBD2BD45B6D246FAB2B8511B3055CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 8e3c6814fa4625e6eb81394b5e7953e1da293e3edf6be9b974758801d5da87cd
MD5 8224df6c13db07a71f67847553ace151
SHA1 89f865efb9cc0b16510092fe995cf8aa6e5fe646
SHA512 5f360c40e911bdb06640a492fb41db62202ec7a00e2daf446c45d1b5fbde09e6394e63c261055c0d53d0687f8433fc2d5eaf526a136ed52e789e71d2c6182791
SSDEEP 24576:8AFs06+OmlfQNXEbTo06mctvE/BT76+1NCE:RFs060lcXut6mGvKVO+n1
TLSH
T16065BF2F62AC00D5D07ED17D8A97C91AF6B1746707255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 a960e4b26d6f5efebea04f4ca486969583659eb131dfc46313a14882e5d59796
MD5 4b7d04c4a72b230bc32312decf5a5470
SHA1 a10ba5f13692df9628d4925cfec9db6d00e7b638
SHA512 df0d0739ea03d2e71dee75ae814b31dc8e41dce1a8936aa71a1f949e5059aedeb0be0c6b549d40496f9794b3480150c28ce619254b23a5fac8fc1206a17a768e
SSDEEP 12288:/CJnJ5D3VkrRzxPtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:6JnJ5D3Wxt6mctvE/BT76+1NCE
TLSH
T18A85E02DD2A810E8D4B7C3B4825A1786FE72387D2F2269C72474D5363F12EE0A979F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e693e4accdf4372d60cc381171739ddb7fe35b20db4c73ae8a9e5c043114ee4b
MD5 4113d0cc70d6c1fa37112b9d3ad50674
SHA1 121f6e80c00f729311c61a459ba7b9bf00c91cf6
SHA512 b069c35e67ce74ccef0f99751a9861538748b5107659fb73f43d8531df4da24b19530bc27e56ec3ef9f454b26077edec29382c434770ff53f1bea23252d4c835
SSDEEP 24576:rEPghm6/7IIXdwcXrif7qQncjlP65i3Vu+6mctvE/BT76+1NCE:Mg06DIKdwc+eQnSt65aVT6mGvKVO+n1
TLSH
T127955C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 31e0fd6aaaabfc75aa8b01b003da8d81e4e3b728f180995ce516f14096557a53
MD5 75db66861d7f2d5ab69450cfa8cd45c7
SHA1 d5a2f381ccc1e238160601df275241bd3357a73d
SHA512 8d8e2ebcf395f1d8abf38513ce47afe65eb1700164b6b832eb760d05d20985e5ac5a707ba56a8f81f508ab28c6f9db4227dc66024c43e2e5116c7aa3c270a7f7
SSDEEP 12288:hEP3R8TtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:S8T6mctvE/BT76+1NCE
TLSH
T14A65129D2A1E20E4D56A51B88291C245D372F4F43B9227DF52A1C23F4E33AE52D3EF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 c31228962294822435dc8ab9945142badd9c025ad424ff8c0ee8614603c09465
MD5 85d214cc13d60d1e9c2c919bf378ed3a
SHA1 8d9f49a602f2530a68a00e087ee8098eee34a4df
SHA512 ea0c105d79401f9b088531e373bf1a4b371ff410d5dc338f259b698a037996646ae90efbd6b243f78dbe2bdbe3948fefeffa947e84ab97cf56daee2fe1b2dffc
SSDEEP 12288:XjkyGtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:XIyG6mctvE/BT76+1NCE
TLSH
T1B9751241635910C4E9BA06B496638295DA30BCB07F2616CFA190E63F6F327E1BC36F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 b6074c80e2e6eaa16fe33358dc4d83ec6c60f5db6a8ac757172ea7fc40dbcf24
MD5 37c729c36c1a29f2d9ce9724b5ee3486
SHA1 6ac09e7b77cefbdfd08dde71de20de49da309b24
SHA512 f202750e484b9ce80792fae336c2c00d3ad7e505aefa33e34db68157f68716958a59ec17b3268bfad53b937b0a0892388022fc17d388a92a19ddc3ba5dc3b3bd
SSDEEP 12288:RRYtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:jY6mctvE/BT76+1NCE
TLSH
T1D1652385542B21C4EDAB07F04355D296E4603EF93A9A28DBA2A1C43FDF301D2793BD97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8c9db47bcf394dd883fe643a8a75e6b46eb2a41e30023b08c50ceaee5710f8ea
MD5 d938031af2a7e77387b3c1d85a547410
SHA1 6a3bf6cbbd3929955a5d9f87344223618b400301
SHA512 8e05806659e6004df8e335b9a1e2ad6ff49b561dd537aab40153109f185e45b013a4841ca1f83f9d0941e260a7c863aff69ec2509e3b2c6348c7f28cd1a97800
SSDEEP 12288:jLQZb3C97GYnZMv5zBcKY9dMD3HtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WrC:fQ9MxZKdcz9dw3H6mctvE/BT76+1NCE
TLSH
T1F3558C2DABE905CAE177D27595A250C3A633B4311B31D6CF2448D03D4D7AEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 5f5c4eedde62bcd2d563a11f040e7871d5c703acdef3085ee830922c0c3ec067
MD5 e2ac379184b0452050b545c7b85a056f
SHA1 a02267d2819889cbc9dd3b62606afff457e09ca4
SHA512 f51d02ce1bf292142f7198fd22027586f6564cc6a3fa7d715bc1594694e9e3b4ae155ce67af7f7e89e42ceb2862b6999f70ee21399024ee5201c6d3ec113bb5f
SSDEEP 12288:ByoKo2CRple9pytM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:ByocwApy6mctvE/BT76+1NCE
TLSH
T10375E05FBB6E00E1E176813C89858345E773B4742B6217CB6291C33E8E239E9BD35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1d3549f94fbf6726a130427b8f878fdbaa82e13930b584c268b8ed171b938b9e
MD5 b7f348d697657e9cfeee62a22ce8e313
SHA1 46d1ff65ed26df3b3ec26e8e1d407ef919f3d4e4
SHA512 6cb6f40d9464ea49eaae7345f918729d1e6cb25dde8fe4513109cd88164f59d715845354efa31753efc93d972307a63091c59a0a69215e5d5500dd83b6d5874d
SSDEEP 49152:SWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKy6mGvKVO+n1:E0zuNI8XeN+1
TLSH
T1BCA57B3DA2BC00A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0261e725c0c792fc598adfa227e3a66b09d77bc34bb36d08b6e36cf5beb5cfb8
MD5 adeb292f59232ac2b305141608d97ee0
SHA1 6c5ffbd77da99494532a08032e896765a3292f3b
SHA512 5bd4b3007b20499f16da62850649ee664341f85e0020c3a5f1abdd1f515c6795dc1ac70087ab568e80b9bf8d3c03d1b13e88a5780686d489de6276578a45b9d0
SSDEEP 24576:41QT7EcpfxR+N5AWAz3ooiYsjMqbT6mctvE/BT76+1NCE:FTDxR+N5YzTujMq6mGvKVO+n1
TLSH
T1F255B02EA7F905E9D1BE85788B23C512FA727861033193CB42A0C17E1E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-262-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/116-330-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/376-221-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/376-11-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/540-323-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/540-428-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/568-77-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/568-83-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/568-75-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/568-86-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/568-88-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/824-236-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/824-32-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/824-25-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/824-34-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/824-31-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/1456-334-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/1456-275-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/1456-266-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1456-272-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1732-339-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1732-511-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1740-283-0x0000000000840000-0x00000000008A7000-memory.dmp

Download

memory/1740-277-0x0000000000840000-0x00000000008A7000-memory.dmp

Download

memory/1740-278-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1740-338-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2156-300-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2156-301-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2156-307-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2156-424-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2724-347-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2724-293-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2724-421-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2940-252-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2940-73-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2940-70-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2940-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3280-335-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3280-494-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3308-427-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3308-312-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3308-320-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3308-318-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3444-402-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3444-386-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3444-418-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3444-353-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3444-531-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3444-425-0x000000000C980000-0x000000000C988000-memory.dmp

Download

memory/3512-297-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3512-420-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3932-46-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3932-76-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3944-493-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3944-331-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4028-251-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4028-62-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4028-53-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4028-59-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4412-1-0x00000000022C0000-0x0000000002327000-memory.dmp

Download

memory/4412-0-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/4412-50-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/4412-6-0x00000000022C0000-0x0000000002327000-memory.dmp

Download

memory/4628-528-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4628-343-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4828-91-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4828-253-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4828-97-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4828-99-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/5056-444-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-451-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-434-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-433-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-432-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-435-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-438-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-442-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-441-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-430-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-443-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-440-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-439-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-437-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-436-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-445-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-446-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-450-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-449-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-448-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-447-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-431-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-459-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-460-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-458-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-457-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-455-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-454-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-453-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-456-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-452-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-463-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-467-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-466-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-465-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-464-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-462-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-461-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-429-0x00000227B52D0000-0x00000227B52E0000-memory.dmp

Download

memory/5056-328-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5056-326-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5060-290-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5060-342-0x0000000140000000-0x0000000140168000-memory.dmp

Download