f70c6ff0078fbd0077774a05a6e21061dcbd4737c51c578f59dcaee7320a969d

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 08:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.6MB
Sample260802-j65kqsfl2t
SHA256 f70c6ff0078fbd0077774a05a6e21061dcbd4737c51c578f59dcaee7320a969d
MD5 942d147f42f071a554ea389510c186b6
SHA1 3e6d313667740578f193d46c614c7c7febfc8c3f
SHA512 3cec313d90f697e21e8a5dabf651efff7d3787f9953f0fedc5c4b6ec51e78e8b7bcb0f42af513fcac45f88762fd33d3b954cfa2ab5322d5dea555c7834331337
SSDEEP 24576:+6DQSagCFtL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:78S9CFtLLNiXicJFFRGNzj3
TLSH
T18775E043B6C08031EDF615360DB49BB95A3E7D214BE759CF93942ABE5A30EC18A34727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4696	elevation_service.exe
2444	elevation_service.exe
4080	maintenanceservice.exe
4172	OSE.EXE
2776	PerceptionSimulationService.exe
3672	perfhost.exe
1664	ReFsDedupSvc.exe
2864	SensorDataService.exe
4364	ssh-agent.exe
824	AgentService.exe
2916	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8bcbbcd583806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\LimitSplit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a929b2b55722dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092367b735722dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000fb6dd735722dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a8c3c735722dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
4696	elevation_service.exe
4696	elevation_service.exe
4696	elevation_service.exe
4696	elevation_service.exe
4696	elevation_service.exe
4696	elevation_service.exe
4696	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	824	AgentService.exe
Token: SeBackupPrivilege	1664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1664	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1664	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1664	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1664	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1664	ReFsDedupSvc.exe
Token: 33	2916	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2916	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2916	SearchIndexer.exe
Token: SeDebugPrivilege	2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2104	2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4696	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 5704	2916	SearchIndexer.exe	100
PID 2916 wrote to memory of 4784	2916	SearchIndexer.exe	102
PID 2916 wrote to memory of 364	2916	SearchIndexer.exe	103
PID 2916 wrote to memory of 4704	2916	SearchIndexer.exe	104
PID 2916 wrote to memory of 204	2916	SearchIndexer.exe	106
PID 2916 wrote to memory of 3468	2916	SearchIndexer.exe	107
PID 2916 wrote to memory of 5836	2916	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_942d147f42f071a554ea389510c186b6_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2444

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4080

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4172

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2776

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3672

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2864

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4364

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4784
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2856 1880 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2948 2864 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:204
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2856 1880 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2948 2864 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4287874b812d3a5bbb6ff866f9aa7ea8e474091ea6069589c8ec2376ee92730e
MD5 e98b20b5fed9d9b5e868758af4d53859
SHA1 3df1e28d86329df95b7170d228e781a8f049d5d2
SHA512 d3cb6dd9c878c78f3282cf488f83d40e22ac1c2e2def2e748a080acf98fa66f5f05d20ec2103ece1f43110a8b21aa82467f68f495085933349f5acb08d5bcf82
SSDEEP 49152:Nb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnJLNiXicJFFRGNzj3:T3q6mjBa7wRGpj3
TLSH
T161D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 6bacc32cc37b44a9beb912499570199240ad555e59c52407b52f1bc30f056b49
MD5 d163acd64d5c25ba9d497440ca9b2760
SHA1 2079561e063ac46a8e8cb92da47fa7dc8714a36f
SHA512 a98bb562d639bf13286dd793c7284844dc89f1368e7639fa9f18df2d995ebd8aaa4b3ad2ccb687190fc7bc829202440beb5242666cd88c7d197ec90281dc4077
SSDEEP 24576:GXYfDtczAW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ltcjLNiXicJFFRGNzj3
TLSH
T18F75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 a34bfbc8726aa032d7e2f6b872141dd30a2ee76c533053359970a695418d15a9
MD5 dcb92b6f45ecc0fb94ec2e922db01e23
SHA1 047289c37dc790c436e2b7436aa8743f67079134
SHA512 047088f44f9aee27033200acabc853f1a45e71c0cc92026a05a36fb6e712fedc624e1c0f7656dafeb69cce16f730192b776f5a93423a53b6b3613d9b8b259b79
SSDEEP 24576:Z0Le5ji0hmxhrMh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZPji0AzELNiXicJFFRGNzj3
TLSH
T183859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 018626f7cc597812203e6b0b5cda99eeb1d6ddce848ae32778ff4e7c042e75e9
MD5 2b01d2289122fb4f729939065b6967ac
SHA1 fb02186b81dd17e1683c10453a4e73719257319a
SHA512 03ef73c46e4d595334fda76a0e96362312027ed1e5dd9ad74982c2072baa78653a9ae1cc09d28d2e5ae3fda53be2f3dcded9291477048cc1d138cf5c68d43137
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWj6q8wyuz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4/ezSC6vUzPv+HjywLNiXicJFFRGNzj3
TLSH
T160756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fe19569632480e5f9db83e163af1c7688603ac47fe1d1b29051ab647835d930e
MD5 8220a3abf592078d48829f5cff6fa3a8
SHA1 fe421f8566a86e15cb40f3d78ad29158b10ecc91
SHA512 894a1669a5860db921c779d8f7bf2a11d20e8fe2c07c5e72bf1e15b78da2f6243012993fbfddb57f0293b0840789e5662eb2e85897e35c2e1e2ddad2887e1a13
SSDEEP 24576:zVbqPb88hv/l+Bq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zVO88hXl+kLNiXicJFFRGNzj3
TLSH
T10F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 31f05d93d9a2d1c47f9344dc76cc40290769903cdbb65cd4f07d9cbf2c3e67a8
MD5 7e307e716850baef330808b4675a141b
SHA1 b72b4b9c411eb423bf1c927a91e107807e567320
SHA512 d8c566dfc467e18c6d72f245054757e5af6b1ecb2cd1e14b5449c568da9ceb46fd9462af18817445e68af3d4e2313f95d828c73f85bd7da99daa5db129c02422
SSDEEP 24576:pGF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+LNiXicJFFRGNzj3
TLSH
T1C45523D3468854B1FBFD0039867A5828B5845E2CDA5A5DE2D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 30dc239dc42125a009ac34e7afb1414136040ee9c11106f0c0452b75cdc14c55
MD5 35ebdab84c5af135567fd8106a5589a4
SHA1 6b7c4dac0c01e12f93296699435e438af811dbbb
SHA512 1fdfc256ad6913c9e75f8298485b75f78982437919049ab767a80d8e44cc713328ad84ad32a928a8a6f950062063144845ff0e9a37825c008ab2ad1afc815289
SSDEEP 24576:jJIUC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jJIUCLNiXicJFFRGNzj3
TLSH
T17175CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8c298ba9b44b89f2f12da07f8404757217173d996bea46b3ec84cfe56674a68b
MD5 1fdb9dd83e08a1ca4998045c38f1b1cd
SHA1 1c8713a96838c63b6faf91b1b03cd2acd0d693a4
SHA512 d62612af4c921e5bbc61753f551b087af35db7d74fd53df47bb2097c5aeb873176189f324a10d1f6972bd36ca83682a957046c4d01016f19f1d5c0846d79e849
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THc:4QvGAdlCEL8c/WRNw5CD7wRGpj3
TLSH
T10A266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 0f2d9e181848a05a703778f63b1cfe500530d991ffab49261408572071e76b48
MD5 6f56e9db158bcdbc864e24ccee177b20
SHA1 228deeb88a30b533c279ce0b5bf5464b8d1374bd
SHA512 0294c36adbd88772cd5962c028b6d6342325ff995ef74f7fcbed17fcf7a45d39f40d25ddfb991a5dbe54902b4fc4361e357b33f331121f43745a04fb19a1d944
SSDEEP 24576:ffewsAjU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nljULNiXicJFFRGNzj3
TLSH
T18375E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 af1131cec68e5b2d17794466e73cbd0e1cb7dc354754fdc1f1c32c50315469dd
MD5 9e7f2cd6a447b9b441502cb1fb6e06af
SHA1 a18612465df22d9fac57aeae3eb93aeaee24cae3
SHA512 732d1b2ef2602aa3abe4d53b2c55a46874423534c98dfe6a2879e3c354ffdd7b2f3a46b0e566ff0c981c359b88bc63c06d66af2683683b400b89a3daebaaf828
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH4F9:LUEtQevvqc2W1cpV20I32M9
TLSH
T119474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 41063eb9b4e0b2bfe8be7280e06cd0740763e58e57b26cc04d90a4256c4ea65b
MD5 69e9cce70f4b25da7f6f84e836564bb4
SHA1 f4007cef305aa56b03da403822d9bddab5e5aa72
SHA512 79b6b116244b8f54e5e1ab5ef366b2105dd83ac11914f72e3adce4b8ca8b37f2aafe0be7e753bfc34a87d46329ce3d26aa26476e2581aa31ca534c977431c979
SSDEEP 49152:4CbRquA/m2yL5zLfFiV+XenmE3/z0LNiXicJFFRGNzj3:xoq2Vjnm/7wRGpj3
TLSH
T1B0D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 988e0329bae2df7b74132db7f26c258274c21723014697f6af2c95c9402444bb
MD5 670734a771489b0c00c73596db06f335
SHA1 dc8512a6ef39983a5b671b0054ba6bb814a88811
SHA512 8c1951d3b4cc6e004d65add402cb7a7cb7fb235225ead140581ca34026dffc3fc7ad66838667a8de6e841c073deb5a8026b96fad8da46f8fce2de3a6cc0f527a
SSDEEP 24576:OAhGL6IFoiwtA5l7S53f/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OAM5Foiq5PLNiXicJFFRGNzj3
TLSH
T179359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f56493c9fb1edb40c1e48f51546d925cf65e259b6f27411fc4138cf8b9212ece
MD5 8cef6c5f63052b979b665726fa09f6d3
SHA1 0d5c1e05ffeb60ec56966bd666ba66b4ba12bf19
SHA512 40a2de0412f91224f8c73b06b1d4e7a3cb844fb54116faa6fdd954e04416544080b583c6a5347ecb22c1753479656dfead2c2820ed415bb8966a976724fdbdb7
SSDEEP 24576:iwuROWQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iwSOLLNiXicJFFRGNzj3
TLSH
T1F565F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1a43097b2aa14a4495412f12b3eb43c2e9e229ee0215c289825607a698c8d7f6
MD5 210e6265bba7ce277e789dd8bc9ab627
SHA1 66e2f10ac60d4759bf8aa5730dc711501b766489
SHA512 19ed707bfb9c839fa6381b9cad139ac21275eb18cc64b888443b58d51baa5c2a071f2385a0e7d0d844b70a0fa14c80f8f94ea3fc764a5d8c2c4a47b14a963f2a
SSDEEP 24576:YZuZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7LNiXicJFFRGNzj3
TLSH
T1DA55129622C420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c4f27553e2cf3ce6f109ec04d86c1f5fc136b63a6f332c844795964442003f2c
MD5 c0d5bb2bb6a5ecd23bbf03f0b579fee6
SHA1 fa08daf94b067fe532964cd81bcdbbad87c47c17
SHA512 d438f9035565c2a769274b653250ed64f91430c7c37f6d868a42f7831875ea67062e15f3c0d225c7f0ad7ab867f9d29570b9d5dfcf02a6929b408e83cd4aad4e
SSDEEP 98304:yQRQyi36YOcPDLvw2gAf+PN3O7wRGpj3:pQyiKanX+PNyF9
TLSH
T1B8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b611a26a2bb8c1b0e5527e448253a9566e05494d8a878e9c4b985bdcea2e3385
MD5 a11f8841630e922b4df5fc726e1f544f
SHA1 f663f572b94f6156ccb447960074c6f79276e796
SHA512 6404d353d0ccf4d796198d770d7c6da366989578eec99a0c6ad2ac69a260cc0c916d1cfcd87e774dfbc7b507cbe5dc91d414d025143f2bb5c22259f70ea5d4c3
SSDEEP 98304:8QRQyi36YOcPDLvw2gAf+PN3O7wRGpj3:jQyiKanX+PNyF9
TLSH
T108667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9c752b4d59134b5d6adf0ba0e50472573bba7f91dd23a3f2e3e59012de437f1d
MD5 56ec3ac0a5e49bd27b093edccccc1284
SHA1 9f82447329905d3ebca1de1c7e46bef44a9f7bbd
SHA512 6085d8e350e593c96bde7b90095de6ed576da625c4a45791b0cd8050f5b330c29b656ca84d7e9c1276e891600b3c9e31646c04694583a6bb35b0039b71983cb1
SSDEEP 49152:m68Qg55nhkeWu7PNU3/ELNiXicJFFRGNzj3:EthTRc/E7wRGpj3
TLSH
T124B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 58a802fbe82f06d75862ef85967f0f01b8495503366619297a3c1b2c7a0c7032
MD5 64b3e232a3cc2b992a8c37af72651a5d
SHA1 fd4b9881f6ffb3ba401684e8259daa2c2b1498da
SHA512 d3b7f7c8ec820c2f89a7c1144d948fdfcb6a1d8561ba25c8beb275d1e11e355e81576c8b866ba4fdb82571cd64bea5e0e84e3f26e6f53b43670777e5cf3efd1d
SSDEEP 98304:8y5112gYy5azzVvU69nLKnhZF7wRGpj3:9LIHRWhbF9
TLSH
T151167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c566792f623deb6b2e7cb2155ccc32fbf73ac668c58b9467ad2892af0c72f144
MD5 d230977824248b60c60d3ad13e33c6ea
SHA1 8254bbd9c25ff73ff24ef10eb30f5f4a1b33e7ea
SHA512 e986187994bb7b4d2ce9a48dab1dd4dd0a6d7a784b94c49ecd1fcdb7471e3dc88ebaf3b2df487b236a55b3a038fdb364f2b3fb72f0b4bbfe5d6a17c9260a1e36
SSDEEP 49152:bB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glGLNiXicJFFRGNzj3:Nu6JmIxd2dG7wRGpj3
TLSH
T139D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b65f7e07a7673fed16b988641e90fd246098049470c52b2e8640bfa255d2f80c
MD5 204cdaaf2fb212135ea98ff3348d4801
SHA1 bde07d908ba1af53e4a22afffa65823e1f9e6850
SHA512 b91ddb9e922a1ebe3b89166ba88ea813aa0517a469b57dbc2432497eeaac52cf65921a856450bb938ca1aa68a724b834c03ee693362e6550bc674990586ad408
SSDEEP 49152:U1hpsNoJpF1A67U44CwH7R4xiLNiXicJFFRGNzj3:UmifPqR/7wRGpj3
TLSH
T106B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a96770d1c9b06a6dc481e11c00e4d2b913de4fe55d75c2a5953ac556e4c66daa
MD5 624f8b6a714c35ae620a69fc3edf18ab
SHA1 557000790c5b31339429c48e8412ef5635c9ece1
SHA512 1b8824f035b54bc42d0e52eb7a69c8811665703743184a344edbf44a5d59bbddd93d57ff99df0e211a61ad48686f657340f9d434f28562a14f18b894ffcc0947
SSDEEP 49152:BSuZQIY0Be2KkRVtOnks6NMHqZLNiXicJFFRGNzj3:P5dKqi61Z7wRGpj3
TLSH
T108C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 42450fd0dc381c65b362aede7b4b031e05010a967490866196435b7a35d5f0e3
MD5 88ba94d385af25c6b465314e7212fbd3
SHA1 9e004d5c9fdba3c107831d23044ac5807ea69e96
SHA512 88aa3d812964e430b3175eefedbe607c79342a8e6c07d5aec1277c5d8116cae029a3f56b9ffb7c3f0ddcfdebf0c0aa9b347b5fa1d93de7504e92cf1db6f34993
SSDEEP 49152:thtSn8EApI0figjgiDn0AP5wWLNiXicJFFRGNzj3:8X2iWphr7wRGpj3
TLSH
T11195BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9adbec1236cd99efc31ccb00d1b27ed1a1466fd91ba3dd7d0d231cf269522abf
MD5 37d9185d39deb7aaa44b98ad2244bae7
SHA1 22cc5208027e35ff4f6a1a27b5d184a40ed7b2c4
SHA512 f54d543bc49f595ca1c7da12d7a75432b69b418f03d5978e53bd50f5c2f38b8f132814ab77ed7738b356436b1b37bf0d48d8f8612350642f02dde58070000071
SSDEEP 12288:4RiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D85523D3548955F1EBBC0039C6754428F5882E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fb982dd4ab7fe604220874b73d8b3d4f2013e42e050a296e2648fc65c609b621
MD5 57281f1540620750d2ce5997462f6ac6
SHA1 8f1284ae0936c20198267209359186e94fee15f5
SHA512 fc0e57a278c78ac53b5f5db173b60e7663d9548790dba7d0f99927ca4e0afb5a9beaa22f678005353065c11476d6275fcf37a254b2fa39dc876893f7e4b4b732
SSDEEP 12288:wuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1875523D3548955B1EBBC0039C6754428F5882E2DEB5619E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 54c0545241a9eafe2e06df0867feb21c2f7d5c48b728056405b9436c9118144a
MD5 05157e833bce41176786d3d96a59e8ca
SHA1 2e554d6ff61fcb167306adbe01aaf13a5d3bba87
SHA512 ec90f173978aeea579bd45d879ca7bb542604e6fc682d4df43933f0a03163ba71f8058523af2b9a8f4335b408dbbd2f8e4e15bf467ea16e3193392ee3080b393
SSDEEP 12288:voiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:va/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F65523D3548955B1EAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 bdf2ad2fe027dc6c7c5360c73bf7e8c960f5d2502615430bc163b80b5a46f9c2
MD5 a0d21ad8a62e0c58ae388842376402e2
SHA1 075e58c41b55bc9bea11e7364468911a52ca976e
SHA512 da9c7a388269a562a86961ac7ad1fc7c337f250db315b803be486bb3ef8a65a8c44f15c8c7098417d626e90e8bb538703f1158fcc1d6412ae37f9a499b9213ba
SSDEEP 12288:bVriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T114552392168900E1EAFD803DC6764424F2A47D6CD7325AEBD3003D1E5675FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 77d9684cbbf1af348e361b44861f95cef92bd9ac601d0c6111ef66476625c8a5
MD5 6b2eda6e6680b0853e06e0c672b75d1c
SHA1 b97a5cf8057db8ff67e05f119e608ecdf724ebc3
SHA512 8304349433bc3c4400748e0a2399d38927f1a79ef50a7b760b8277b47f1ab8e1e28751b20286a026fca19fa292bc776c7a9a2ebbbd5798fa1426c71ac8c8e052
SSDEEP 12288:TTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Tn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DA5523D3548955B1EABC0039C6764428F5881E2DEB5619E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6c542c1001bad0d69b8fdd158bb5ab35ec31f80723d9d944d739eef525579391
MD5 17d580d10caf2f82a0aa8d172a8b04ef
SHA1 970305e01bdc3ebee7d3d79a01b643e58e056202
SHA512 92606dd11dad4a6fbf6c92d7bb30cad5a703c8d93c118a6b28d5df86538885a31777c21f419a6e54e16e1842e5485aa3f6e25fb655f0ca133a685b73fbb2fe32
SSDEEP 12288:GqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Gs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EF5523D3548955B1EABC0039C6754428F5882E2DEB5619E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c62ac1bda2359eaf89e7c889a457323ed42bedffdfff580eb93090d867df49b5
MD5 6381c489c21327600bde09276ac70c36
SHA1 fa152538656a1064126dd4f91b78c02379b1bc69
SHA512 960e1c68777d5acbcba27fc9ab64dbb48bff744cd2b714f104a514d2f7b0b2824419902cd3debf498ab6e26cf36f7f81f8e4043480ce816cffcde289bb1bd9f3
SSDEEP 12288:L2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BC5523D3548955B1EBBC0039C6754428F5882E2DEB5659E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 f084b72ba0a6f8bb1208c4a6e4bf4fe2bb8cc60c08c9425b753dfd04121618c2
MD5 e93dc6abc4fe41cfe0324f69769ea4bd
SHA1 da77cdcbb69f42a83c38bd990979553af65c2dca
SHA512 f62078e6f52f2c3ad737c4f3287b2f8402c20cc2c0a5c3515bfcce83411173ef1e91d0135721b9adb338b01bf257f862b6c2a9be6b84c78bdb052456a8f32bcd
SSDEEP 24576:FZM3zFVSO4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FZM3zf8LNiXicJFFRGNzj3
TLSH
T14F750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 70f83085e33e025590eb2a81f2d0543d64a781a6d9d0505ddb784d5567a36c86
MD5 c27adf1bb1509f1faf27d89904e13ad0
SHA1 5f2aded3cf192bdb17f80ab76bef680ffc454129
SHA512 562a6815d3deeedacb69574684f772d5e73c007bd496d8f10d3bef923afd7283492d5545ce7997ab78bd6ce913c32787c196c2af5abd84da74b47a653051fd31
SSDEEP 12288:QliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10F5523D3548955B1EBBC0039C6764428F5881E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b428ce61153105c6ce83a570ccf8b7019210591b89b85abb8a22ba48466c85fa
MD5 f368bedd530b216f89c432671eae1af3
SHA1 3c801498ccc19ba574bbbfa4fa2e057b1eb73f99
SHA512 81bf6bc35449292aaa43328859cd2377c6571804815f1a50bffa097a2048ffc277e51c1563a4a732912ccb2e41c1891005175dc9ea3b57e0a831f8dff1770ea7
SSDEEP 12288:qJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1585523D3548955B1EBBC0039C6754428F5882E2DEB5659E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 80cca30c3470695338af12a48d01e1a0f2955a52a08a11e2ec92557b34cf0e94
MD5 ed305d2c0a5635f5a07d9250ac8010f4
SHA1 d33336c26f5a4a7e35cfd11edbddb2e54442a02b
SHA512 2c610336b02b9b5be2e334fc1e5848270d6fcf4f35a2423433d0df2dccac71771e732352cdc9ce1201022a9f726059408a4dda3b6cfbe407f205fd2e9a8127f8
SSDEEP 24576:Jzyk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JrLNiXicJFFRGNzj3
TLSH
T147650147629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 fcef8bf169830a3312008448a321a62a0ec9ab382bd2ace829c315744cc0a60a
MD5 fdfce8967b23c838eca3112db7e96b0f
SHA1 416e5b1bcfaa78d4653522c361b2d150e03739a2
SHA512 e10bc965c681e8b46c436b18927387318d6d51b5f0feed17a2ee77509fc06f0c6c4a26c00028b27837b5eef8d78c8ff24c9ce8503f42196eaa40c324920ac788
SSDEEP 12288:GliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Gp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12E5523D3548955B1EABC0039C6764428F5881E2DEB5659E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 043ecd18587409443e1a47291691db1ce2959c6c95a3489fe2296178e761f692
MD5 3118e397c609fa069485cba437cf3e58
SHA1 3b282196051bdb45366580f655b69fa2674e73b8
SHA512 3ef79e188d32e984f5249411b632f3f6a4cac618b90ecd3a4612ebf1975b0cf3fd2f80685f105c065a346a2ebf322c3bde01c198af21e084dee5c03d8a76019b
SSDEEP 12288:eliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ep/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1435523D3548955F1EBBC0039C6764428F5881E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 7a1057dbb60b77720f5b8c92d7bf3f0c27b6339e42805452f539116e1ba97b09
MD5 ff747dae4ce7ddfb3412569248cca276
SHA1 5d014d6b3966f687d559906d55ebf705aad5519d
SHA512 9f6987eaa93b4d49eea563980811eb61699bbcaa3179422fc64280e284c6480715f63aa61bf93f148d0bc104a26134523453faca605ef56ef99b4e53ae747498
SSDEEP 24576:szyk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:srLNiXicJFFRGNzj3
TLSH
T127650147629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 33704c5f0152821c7cf23ff40898a309292b1511aa9ae70c2baafc0cf8e0d287
MD5 35690ee3696d9b5ae45cac16bd27164a
SHA1 73be8156731885be06f9cb3d3a0645efdc54de2d
SHA512 3ca512a202fa467c7a4801b9e26c2d504556413a74f3202e8d45c1ecae3a284601bbcf8ca2551dca0a2516a7b4e47d32da0bbdbe2da745c9b6174c990fbceb43
SSDEEP 24576:cT8aLl3z0zDK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cT7LljzLNiXicJFFRGNzj3
TLSH
T1237502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 ba7d81e37ed1ab6b7857ead5c652b5283cdfb59b5b959b9664d90b34ebeeb23f
MD5 2f4516055f3b71519a858c3262ac6b4f
SHA1 85ab47940c9a75dac08d8ab2c8ba9a8963479de4
SHA512 92213cc704f832e18808c45ead6d9314e1b124be8015c797839eb3c2e1b5ca1ec357d2bed63bc78aef140f93ed38b53d5056fef8c1a1bc06718811fb8735cf7f
SSDEEP 24576:A3rd9CHKy7GZu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Krd9CHKya8LNiXicJFFRGNzj3
TLSH
T14085CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c7b2a223e197062be359b3a3c18943e8e13d7ba5c078713b895d1bb79c0ad371
MD5 3f7be02a6a3e341bf9e8e95162c6ee09
SHA1 9e2bf76fa73b9165292f44c36c6b504933754f70
SHA512 632f2750ec6319ad6fdf7c02e3be5cf3b4d49552748ed09be9955ccb00ceb1fdcdf534c74168334bf2c966094ff75c4f8d8f2d8995edd68a7c9c1f9d4691c448
SSDEEP 12288:HIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:H6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E75523D3548955B1EBBC0039C6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2cf8a7e5c84b62af37cbc61ef48b4b493924c7914f881d9a444a8c52fad275ed
MD5 c9f3d916e69104fea9523c499a93a205
SHA1 b9ba7cb97ed7041f9a58a6b4c2edd44f0c9e9e66
SHA512 d4c1e773ab51acd477921d33c8e34a1be1c0304e02ec02b4530120d5cc0fe9bbe76732a964f1690960956e58e9eb1fd6706994fe41bd08775ec90378e81f948a
SSDEEP 12288:PCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:PE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1995523D2558955F1EABC003986764428F5881E2DEB5619E3E3443D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a26309cddf5e239e2317c1fa42e308c4646caafb8881a53c82996e9579f3b633
MD5 0bdf82332ef14eae0482e1bbb3a013f9
SHA1 0dfa0c8dfdd29ddde8556ee3cc3062a82ce5d1a0
SHA512 b00396549f9620eeca503ad4637f70fd73385c8b8e9ba956b9f9b48fc8f6c81ce343ce0ab2088b35d54e191c84e71c90f9833d1de4900e81cf2e858ba2478a33
SSDEEP 12288:/PiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1285523D3548955B1EAFC0039C6754428F5882E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1b7dbedcc7aeb39c2cd6ae8358da583d9a717b2549662ed99be6eac4fa3c7d0c
MD5 fe43abd114e707d9b959c98c1da0e5e0
SHA1 bf373828942e6f13c052c6a085c8d283cf5051e8
SHA512 fa09c7fe29ecf73270bc47d23491cd7d70ae493dd0c245b18d9ec6db860fb88983b57d3a6d1a517e65dea287ddca4e6b04b91fee0daa69dac2d177ed924f0902
SSDEEP 12288:OliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Op/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17F5523D3548955B1EBBC0039C6764428F5881E2DEB5659E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 60dce24fc37099882a1cdd0488263b8437f8714aa711f85408497db769d85889
MD5 7cf0acd51e55bd9620ec64594f77cd17
SHA1 f02bbc5577c7e20bc23f43d6e93736642c18b13b
SHA512 e4e2773b59f7885425263fd2b1dc2f7a166477811f40284a11b81c2929e7fce9b05f29ca0ae7722a9c4ac59b4db21f63dc7d9e42f9ca0b901b10e999ea743bfa
SSDEEP 12288:+IiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1385523D3548955F1EABC0039C6764428F5881E2DEB5659E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a078e19bee9f5863a09df9859761927105dfc67e6a32560e98eb6548ee19486f
MD5 3021324d7ba4999cf255a0e53cf033c4
SHA1 5fc0066aa28dabadb9b69cb6fd458af06eecc797
SHA512 26a2e939f33af4005b229b3b24c8ec311b42c211ec8457678b751441038373f49f554f91fe3fa8f2fb23a1a3306ccc90daf9e29476bb4147f7d6efca0557d892
SSDEEP 12288:UNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:UR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F75523D3548955F1EABC0039C6764428F5881E2DEB5659E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 55e728b2f50f03d6aec75f5ca8d3dc14761acf6ac7a2319c395562626250e16e
MD5 a211577096dc183cf38cee6b1c46e412
SHA1 4411c6c08c05ecf61d0e4e084f098a65b334af69
SHA512 b56952d643cbf171d9ee651ff53af9ab9b77922dd5964e3c8f82a675b73b0a550eb82a96986e19df755943bfb2e701417dde0382fd78bbb41b0b5820d9f0e8e6
SSDEEP 12288:ATiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:An/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1825523D3548955B1EAFC0039C6764428F5881E2DEB5619E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 7bf151af90e4f0a6bb7283736af998e333c9ab9ec2e829dce47e6cbe855bb56f
MD5 dcd55320c2ab1b59fcd54edb8527190c
SHA1 9780064ce7393716f8cb06c2d388ceb8b776d400
SHA512 7a2f89262ad20c89cc267505ef67b002e095b4cbfc4a87972fca23682b3032c1d78f44a9f3a516b2ce17b7870cfc67f35f10bbf5e866f59ded55d4064a520fbf
SSDEEP 24576:ffwvzk9RX6wkyAIl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6MnYIlLNiXicJFFRGNzj3
TLSH
T1EF85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b72e92d0685125569acef8107698bab5de83ae30e991778dfb68ba5b96cbc163
MD5 435203c010dd7efabccda690fd144c41
SHA1 ea2ce540210fb3072e6f11d15ddb304475f87fc8
SHA512 51af2ee3f4f53295af0d0ecf5c63900eb023a511fe60b8c1ae61afc28dd6892bc25dffdfbdd5a9d57b2d2a97f680d3d0775f1dde32978d181b0c22d239d893d4
SSDEEP 49152:FYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02LNiXicJFFRGN:0ySzPu7wRGpj3
TLSH
T1FE066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 10a98d3bebd4bfb681e4171eec072d58bc11190a3dcea04c651c779d9d202f12
MD5 e8700d8def02f07cda65b59b8df3f120
SHA1 c89931bf0582093c5fae31dd7bcafa48b980d744
SHA512 4cc43ed351f967e9faa3bdb34c97dbd62cdf2cc4cf3ce677aa79e3c1c925074b4ca7014b4cb6270ae25ab8aa0654bd035dcd5588836b4a5d6a449621d4f250eb
SSDEEP 24576:W47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:W47JUQjqirIhCnDHUPfF/GLNiXicJFFS
TLSH
T12F65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b858e1e7f3bdb5260a77bf3c7c68ab83a5eb9f495aa1c92ef2d6340e6d1e7e68
MD5 e56526991372a94848c4e276e60df04a
SHA1 ee2c2b9daceb0651fa95180fc7a51b7571544b3c
SHA512 30381576f212c58c29fde5572393a7ac67316ebe09acdd7f06484774f893fba9577a0f82ba923bcca4395d46d318ee061db9cccdc213d57f6af99817416fb5e6
SSDEEP 12288:zpsf1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12465F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 aebd68f78e37c08c32fc4e0dc36cdc8c5db67f513e4556cc6c5de536913a29e4
MD5 e635e8f3cef8a1bba56f137cd6b9f08b
SHA1 fbf35dc4df557fb9096f5d679dcfe67ee7dd2157
SHA512 6cf5e9238a75ec2b82231f0bec87ecf9451bdf4724a25b730e19a5ba0a27443170ed1b453f4a54959e6b34597e9aa5573b0b3245eec8686a9f37ede12423c259
SSDEEP 12288:/Q3qhU3fhzqyTEnNBzPZgXabkgEdsg/AwKKlwJ:/Q36UP8z3bjbDEGQzK
TLSH
T16C252810766AD75FC6AD40321E36D6CCA7707D41EE059B0372C88B3FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 cd8c2efd0aedb59d3f05e45f1426fd33edc5e6b308a305522e9b3e851d424655
MD5 7bd8a02bac51d593f6a28f9607a46b86
SHA1 22446b909b79bb5aa3edec3a359544042e92810b
SHA512 982e03ab5b593a23bc57feaf85007fdd7b85d08585ab69418227baf43400d9b6a79c8411916e6458948d2b64a81944261ec962d10da01c44211a09cc8b72ad63
SSDEEP 6144:zDPtPc8JEyUygUkChBAgREG0tIGqXeRVH6BK2xY3mrBXPB31bv/Z748DitjGkLht:d0YEyUysC0RZquPOFLB0nRqasXyp
TLSH
T16365E8815537A3CFD0FB6072072A9B4CBB64EC47B7055F227388593AD82A625B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 741ddd920d592d54e5ff4e9e78b9f669646144da96e535e16b4b7b8094259584
MD5 d789640e17fb65d2c598293325e44d8e
SHA1 3207923243c25cc5a4e11ca739af7d111d1e0cb3
SHA512 79f2d1bad1b794077a9d22fc4af482ce65393424d48e63e20e852dafaad96d834692c23a545ee3521d27df5a3e2dd47764554fe2434a0bb23743ba1808b85730
SSDEEP 12288:wF7diJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:UB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1905523A3568C59A1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1f1c04a0e9e4836e80d7354255c11018c4d675bd9375ac86bcd7cb68a1dfaf76
MD5 ae0f80b410d147fe88510b615b04932d
SHA1 5e057c0343df7f8c6148f4f0178795de76cd5938
SHA512 8b4aefffa908a84d74ca60ed2a860d1446eab888484e8e93242b902764afaf02449da1569c458f9c39386053b8120469210c66d075e1716b0b6803e22a5aef3e
SSDEEP 24576:8gb6bmBIi49WNNFpg1rSvFv7bYz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8gb4mBIBhGFILNiXicJFFRGNzj3
TLSH
T1AD65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 e67bd01dbb2955dad0c68dbbc6cddea0cae320891cb33bf6593bc6be34bb2c49
MD5 f4f8f9c20c19ed37471c49afa42afb26
SHA1 93b1d735830d06895de5e8ab154155beec265da6
SHA512 2f24e3ca13510592a74ae9808db72ced87f6e0e8737657564c205340616f8d7a8f9a6d757a544bedffc83b5c009566e1acf907b7b9117d725d7378e25a00cf4c
SSDEEP 24576:7G88u8FpJqH1vzria7/m4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:a7ZFPqVya7/bLNiXicJFFRGNzj3
TLSH
T1FF85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 50061aca6c98fce33efdd5220ea4860249b9731a5c31937e90757f38a9a637a9
MD5 1fd8b0aae7bf619b2fa87977264e7674
SHA1 a78eb80a03b1796105218af4fc9154fd1259870a
SHA512 bb00ab41a0d3e57e779c45b97d5edc9f93315073aed0abacb93637f83604b49641d6e87d6b563dc88748bbd6ce754d6b14df5925837174772a106e2ae14383a2
SSDEEP 24576:5PUr+NQ8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5JQ8LNiXicJFFRGNzj3
TLSH
T19565F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8df2479341d842e52b01afc9e5f751c20cff3d4e037b59574059e342a3ddf224
MD5 f4a00c89bd959aeb28660fe40cd97d25
SHA1 dc187c41f305d23c12a03b15c8eb61260f754ebd
SHA512 77c36b0b6ef3608ffde4ef411fa646db36f67ef99e29aca283371ac23cfa1bfb11ecbb9f01ac1b0104f3e4a5cc117c0440195f05d8efaa41c0685c1087a5fb70
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjsLNiXicJFFRGNzj3:nG05lO43bt7wRGpj3
TLSH
T19AD5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9e27ecfeaff0731b62ed12e5bfbe588e76c93a099b94f89ab65e9e5f8e0b9756
MD5 dcb0bad72374814cce541559f9fce2e6
SHA1 cb8fcd19e99d7bdf8725dd0ebc27a7aadff7c104
SHA512 de419c01e85bf161bd0b6cd58c0039202c74d45ee047e6f1168b0afd55724aa974d27fa1b1af301918d738ea104a6e24943d6c3552f31a3ea39aa8d3d7602431
SSDEEP 24576:/fa5POZ3dpyWVM50JicR2hG0lasx2+47eidn2/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ha5POZ3lJt2pasx2+mELNiXicJFFRGNf
TLSH
T15065BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 638afec477df17d8e0a1690d72ac53d2c74fcc2db45b7569b1e8c9033e057a7f
MD5 85a4651c4bbb9fc9144175e0bf5c5cf5
SHA1 06e99d72e9860391137894a9542d2ed2785597d8
SHA512 3eb696cbf72177036d099e9c72fd9d52afc503b934112e75bf5b0b0daa00c517c942f9a27addc38eefe37464c812def478810ca5255ec263549105b04f99fcbf
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7Fkw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vNc/zEOVHF7LNiXicJFFRGNzj3
TLSH
T1E6858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7b134e5a5285a2919ee4fe27da593becdce44ee4e96071c89bb48874c82bcb93
MD5 9f6e014f0652596eea74cdca3785bbc7
SHA1 37e0c257e0e4d1911cc61d3146c3ddc1b86b732a
SHA512 b8a767fd05a9aaeed178913b11da3844b2b12e1c07ca879d9df045e292eb21f3f8476e0d4d1e61493f256bee7959e44a081120870a90b8f153c596a771455bcd
SSDEEP 24576:vzkNvNnaFeYhJNtmZBmS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vzMwBtOmSLNiXicJFFRGNzj3
TLSH
T1D755AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b424db9355299c172960e34d9b175daf725625bfb59224cbae4a22e238e38817
MD5 abbd82171fc77448da6f299ba66143f7
SHA1 8ec4c2b206b4038f0d467b3649cab7007fef91c5
SHA512 70fc11df1af7169e9a3dfb92dd92e214861e7e25be3c9d8f510a3bad89a66e20f77578a7e64ea95de526dab711710e13bb7d2d0aea137d008df55741dfa32c70
SSDEEP 24576:YD3FHshBIYQgA9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YDVHeBIAA9LNiXicJFFRGNzj3
TLSH
T11875E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/824-128-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/824-134-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/824-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/824-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/824-139-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1664-95-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1664-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1664-327-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1664-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1664-89-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1664-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2104-0-0x0000000000400000-0x000000000063E000-memory.dmp

Download

memory/2104-1-0x0000000002650000-0x00000000026B6000-memory.dmp

Download

memory/2104-8-0x0000000002650000-0x00000000026B6000-memory.dmp

Download

memory/2104-77-0x0000000000400000-0x000000000063E000-memory.dmp

Download

memory/2444-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2444-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2444-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2444-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2444-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2776-294-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2776-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2776-73-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2776-67-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2864-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2864-102-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2864-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2864-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2864-108-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2864-313-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2916-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2916-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2916-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2916-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3672-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3672-79-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/3672-84-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/3672-309-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4080-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4080-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4080-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4080-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4080-52-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4172-55-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4172-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4172-61-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4172-273-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4364-115-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4364-315-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4364-121-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4364-113-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4696-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4696-20-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4696-21-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4696-14-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4696-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download