1b053f84fff3b49aff6f54305b3f28a03e8d2c3adc0ec94dae13eddc9cb22261

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
Size 1.9MB
Sample260804-hcfh3staqa
SHA256 1b053f84fff3b49aff6f54305b3f28a03e8d2c3adc0ec94dae13eddc9cb22261
MD5 81e99d842f4e89f4b433260c67939649
SHA1 6fe4bb251084e4d56516f21ff7e8f5f5c71604af
SHA512 dd233cbe64c93cf777e4a2090377f0c640767558c8fef0051d7b214852f52a91d5ee761e220d4ae796ec94232ae4cb75b3a86191c01f762d0db8c7c0b43845e3
SSDEEP 49152:w8Rm28xdSuL9RiewAbeMUg2IUb5+Pl6bJTIZ5jdgp:w8d8xkuLPiev/Ug2ICslgJTIZ5Bgp
TLSH
T12795D001F444F022D8DE9C30BABB8A7E28297D20172547FF5B9038675FB07D96939E5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1548	elevation_service.exe
3312	elevation_service.exe
4948	maintenanceservice.exe
5984	OSE.EXE
3244	PerceptionSimulationService.exe
4412	perfhost.exe
1604	ReFsDedupSvc.exe
4900	SensorDataService.exe
2336	ssh-agent.exe
4784	AgentService.exe
2616	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\316adce6238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a73a472db23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5043975db23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006382b773db23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042a11875db23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1548	elevation_service.exe
1548	elevation_service.exe
1548	elevation_service.exe
1548	elevation_service.exe
1548	elevation_service.exe
1548	elevation_service.exe
1548	elevation_service.exe
3312	elevation_service.exe
3312	elevation_service.exe
3312	elevation_service.exe
3312	elevation_service.exe
3312	elevation_service.exe
3312	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3672	2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	4784	AgentService.exe
Token: SeBackupPrivilege	1604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1604	ReFsDedupSvc.exe
Token: 33	2616	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeDebugPrivilege	1548	elevation_service.exe
Token: SeDebugPrivilege	3312	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2864	2616	SearchIndexer.exe	100
PID 2616 wrote to memory of 3596	2616	SearchIndexer.exe	101
PID 2616 wrote to memory of 4452	2616	SearchIndexer.exe	102
PID 2616 wrote to memory of 4652	2616	SearchIndexer.exe	103
PID 2616 wrote to memory of 5648	2616	SearchIndexer.exe	105
PID 2616 wrote to memory of 2944	2616	SearchIndexer.exe	106
PID 2616 wrote to memory of 5804	2616	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_81e99d842f4e89f4b433260c67939649_amadey_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3312

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4948

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5984

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3244

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4412

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1604

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4900

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2336

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4452
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4652
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1ec550787aabf07eddb7ad298b1ca90519e5697e287139516208e20e365ca7c0
MD5 535a699621a59d06406b73cbd588ccc6
SHA1 e5a657f0708853d061bbe8ebcac0e171de79596d
SHA512 ae877d76d3cb2e5dbf9f9098ac720d19776da5085ae6e575ad343fc61f6ef368526ac3b57142117bb1f5f12a9a4c87c45d91a5e52546b2a3807d6e0ab16319b3
SSDEEP 49152:jb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnUb5+Pl6bJTIZ5jdgp:B3q6mjBDslgJTIZ5Bgp
TLSH
T184D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 15bd2b2fb66cd835c013fe27a7939b5520d8f976fa7b7aa8f99abb6c327e88d6
MD5 806a4db22bf98974cda91958199655ad
SHA1 4537a125b2b99a4815e57b6150c2980f0167e7e0
SHA512 8a3eb9b8f23e236cf4ff065807fffdb3b074d0a1dfd874e19e29c6fcffa6ec6f974e0e5854b77ae1fbaa006c20e80fe059b3051174a56a65218d5308bde79e85
SSDEEP 24576:HXYfDtczAEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:StcCb5+Pl6bJTIZ5jdgp
TLSH
T1CD85F11967E508F9EC67823DC8E1C611EA73B85587A0E79B03B499265F333C86D3E742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 e614c5022bbe48a07badc59b65b68c0f36dcd8928290f55264e886992c67890a
MD5 2c38e2b99d1142b2b81b021d7506c7a0
SHA1 89b05683d912ade1f70e71c4a041694749211459
SHA512 bf4aa02fb3e759e170af0447e60ba9fd7ab913ec432529628deb30b943b6990a855a5763ea3227f7e3ca9670e148ee6b7d0872098727981ff845d4cdfa1dd780
SSDEEP 24576:C0Le5ji0hmxyrMRmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:CPji0AIdb5+Pl6bJTIZ5jdgp
TLSH
T1CC95AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 db1b13fdea4be3f93e8a0a31c78e7a8043ad2edf9775eafae94942f9a2ab6d67
MD5 0b2675bf083f5d8bf12c14efe1cb558c
SHA1 9b38577443e1215bf8aec9076d96a187866259b7
SHA512 fa723b33c15b51345327f244d3c86eeeabe83695be941a41ca4a11391a1e650a92839390358bba37f3a95541150a78cf5f00b9f025119b3fde3e753d81371f58
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWj6q8wyubmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:s/ezSC6vUzPv+Hjyhb5+Pl6bJTIZ5jdw
TLSH
T197756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8039793e95e43d5deb86e80f89249a5bfddbb1bf212a0d91e1b90b0eaa114075
MD5 85c53416cd3ad4d2c38258c0e5f29cbc
SHA1 c5e7860f94f9718a545f2ed56eb3d9565f174525
SHA512 2369ec9c100014112cc2fdf240168d9c5c7ef11056b409e28ddf7166272d9d28f86e22eb37fd71d1633e86cd0596db1d84347bbfda0ea339ea30afec92cc2a5c
SSDEEP 24576:3VbqPb88hv/l+BYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:3VO88hXl+9b5+Pl6bJTIZ5jdgp
TLSH
T164559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 6b5a24f8d26f4cb652317cae7d45305a1223b5fd43991319a9d9c023abe108a8
MD5 b37212eb56575080a9217b38f9c41573
SHA1 23e3058653a3085dfc77a1c7a2d600179b323a85
SHA512 af0af63e033b4bbca332442de51e048dd0f8f527ac47960ed5abc0afc4776eaec0170471bcd08da2b6eefb2528c6078c01d190ef730e1e2c36012f5d6c9cedcb
SSDEEP 24576:JFlmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:0b5+Pl6bJTIZ5jdgp
TLSH
T18C6523838B6930C5E5AB5739E9CDDF00F87AEF55CD862B76C5752C2BE034249B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 017fa293cd6e4d0d318d11f963e88f70e46924cb57d070ba536117ba723bac8b
MD5 23558d771ddcbca1b0bf2746e03ad03f
SHA1 1aba146fdc3350bfa80152c1807e98f468777abe
SHA512 dc2df73897571476270d7bd31005ab886d59a78d433299566262c2259258dea5e070ecdfd188738e2d4b443c9d01a08e33c5adddc6f05e1eb911637b73209617
SSDEEP 24576:pJIUwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:pJIUnb5+Pl6bJTIZ5jdgp
TLSH
T14685CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55E76815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1432c52cf149097071992cc6af4d22830d435b9fbd49f2016a0033aeb96effcb
MD5 8233905df3dd5e7d073013bf034cf926
SHA1 610a8ed41398aa3bfad94ac33c30f3ebffc2a8a0
SHA512 68d5f3d714c84ad1b9f4bcf7fe5900c093a3d23cf3a4030eb76ca092dce0ebaf1e262f6face201e41fac1955a0514208bb8a5964d060b46eb0dca5033ad36211
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH9:aQvGAdlCEL8c/WRNw5CoslgJTIZ5Bgp
TLSH
T17B266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 e64fbddd38b7860e99a721abc2097e4108d9d4ffe34caa8c89dcf8b1f413524b
MD5 a4d44ac986e2b1244267fb7ae59d80df
SHA1 95a93645a7b1a88d8884c2e15bf402cdc9c6209e
SHA512 7da3d7047c328dd4aa5b5ba78e84eb185387ffa24ce0113bc66fee6415f15dbb3527e14810ede8388f5ad3ee99e09eb521e803f90d8d8afeb511ae1c136b2e19
SSDEEP 24576:HOewsAjimb57GBiOl6a8JTth/RWZvR6wQQ92pN3:uljtb5+Pl6bJTIZ5jdgp
TLSH
T1F485E031FE74E036C2BB0DB65B65C716643DBA208F511AC3E3B84D9E99302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c981f3ff00471858e6ffb704203ebcd31148d68d9fe410b3e68a9dfb55a13778
MD5 3aefc9e6539ce2b1544b27fe45dd5f83
SHA1 2c935bfafa2ec8afabcc238e10a957fd376414ef
SHA512 c65378c91f246d32bd28101b67d5dcd7664e67c7cae94bd9146f5b409f432c434b2dc94068f97df5e0b1aa00ebd2b4c726ba0be5b1e8d5aa346df49b2c8bb755
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHxsT6p:nUEtQevvqc2W1cpV20I32xs
TLSH
T1DD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9e0f52e998b72b9e74eba690dfb6181abd545edbc691ec9f8b27a9b269ff91e8
MD5 7eb9b50f24fa7bf6eca7e0909dcf413e
SHA1 bc1d5e11e88255acdb67b2b7166f89641a7acd52
SHA512 e160ce19faa4d6b818dab929c08308fd3951d021e5010e53564fdc90c3e29950ff213bec6a5d6b1053ca9bef95109dcb8d283315fd52d7cd29a0b2191e834ce3
SSDEEP 49152:3CbRquA/m2yL5zQfFiV+XenmE3/zNb5+Pl6bJTIZ5jdgp:goqtVjnmMslgJTIZ5Bgp
TLSH
T100D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3d14199b9cbd58562abf5600c1bb7284a103252d8d9ba122ce94ae42c429ff55
MD5 c24b5273146520cf0b8b44013ce2c569
SHA1 b1bfd9c2d074a387254bf6c7720cc3cad7a77d6a
SHA512 eaabd14fd786220a244257a463d94943f1b09f20af812d1b88d92387a49f94b06345c2df7ce7415b58250fa56bb586cf711d7be924db0aaa515747df668468ff
SSDEEP 24576:yAhGL6IFoiwtA5l7S53Xmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:yAM5Foiq5Gb5+Pl6bJTIZ5jdgp
TLSH
T1B5359D81EBF955D4F5B3AA7899B68570EA76BCA65E31C20F1160C11F1E33E40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 349c91696b1b90a5b5e940fcbc87d6d64f38b6e5ddf80b868a6e0c2efb40cc31
MD5 da9cff5672d918ff6f2990e32b02efca
SHA1 2b0210752e7f9486e344a242be52dfa56989db4c
SHA512 6156e7269ec12fe93516a0f28e47bf291ce6a74219ae6411c4d2b8f69c991510e7f98164d2fd34770306aea78d9390bd048d5b0c64256b4fe18133a64e30fc15
SSDEEP 24576:LwuGOWemb57GBiOl6a8JTth/RWZvR6wQQ92pN3:LwNOqb5+Pl6bJTIZ5jdgp
TLSH
T1E075F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 67d955c6b6341c1120f8ce89113a5ac684d9217d2b49b08191b7c5a1f572a704
MD5 17e2790d7e90f83a8c6146867ca8622c
SHA1 c270f21dec244a77830e313ef6304d6b69ef128b
SHA512 3145592841bf9ad728a43bac1793fae567733a32c444a535e882c2175b6c4344f8083a24b75f36c705f6502c4585b18317fd23b38f8e682ea555d1256f4ed84d
SSDEEP 24576:cZupmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:+b5+Pl6bJTIZ5jdgp
TLSH
T15A65128A17A830F9E1A7523DCCE58B00E772B8529B7653CF4674056AAF33BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cc7f041f7455406bb1d432b377a44f10b99f56eda8ee3f1a12119cb232018883
MD5 b34e2498df80ea8d7e7d339c3b5fb114
SHA1 a74c238c2101f3a62404eb93d923dfe6c4fca153
SHA512 6408a4e523d91191c8fdd09edeaed2165e9ba362e4e0e851ab0194d38a8e846d1a9755804de0520cfa30313e172e18d243bcd36276a828d4aab993f22a456b5f
SSDEEP 98304:GQRQyi36YOcPDLvw2gAf+PN3/slgJTIZ5Bgp:tQyiKanX+PNPsT6p
TLSH
T138666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 572031638099209d86822d96ca13a67b8ae27071c93b167d78ef38bb4eeecb9d
MD5 d4b8946dc463f54c397cf83599ea4c24
SHA1 06257154cfffa6e5dd71568f7f179baef7e8d61c
SHA512 2e376ed161d8e12f69841833d550002097acd221206022ab4e176c526632cc3531cad0c13d8088149e0e0f6678770b20bfe8fa63c2cb1ea94b0a03a7ebfdc8d5
SSDEEP 98304:GQRQyi36YOcPDLvw2gAf+PN3/slgJTIZ5Bgp:tQyiKanX+PNPsT6p
TLSH
T108666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 647da8de060bcb5c4d41e6dfec79d268359547edad579cbb7562654ebb6b3337
MD5 96d83800f509cd640931f71c5eae4ca2
SHA1 c8d407b88053df6e960a15108cca89a88f5c95aa
SHA512 27cf8a6024e0e869bc3affa23961f4fa242d9a424bf4c965cd53a6ebafa9be1f0c0f72b890f0defdcd52e1ee4c1bfdb956526dbadf59061f4eb9973f7a336f3b
SSDEEP 49152:b68Qg55nhkeWu7PNU3/db5+Pl6bJTIZ5jdgp:lthTRc/JslgJTIZ5Bgp
TLSH
T155B55A33B2F60099C44DE1769F4A872196E27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e65b7a5919951ac9914f6068a28d643ef8db57986735377f80d9f051da640605
MD5 e95ece81d2130df50cfe5e5786051d36
SHA1 2218fb665bc1b4546244392ff0933af4d5032ad3
SHA512 e116f989d629f9c98a66d2de32002cb738aafa7ca558edff6bc5af59cfc347c0bc3703e777e97fefa25d3393ca2ca380788e531fe6963dc0fad05f6161fe5a3f
SSDEEP 98304:Jy5112gYy5azzVvU69nLKnhZmslgJTIZ5Bgp:kLIHRWhEsT6p
TLSH
T16B167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cbddda147e092f53b556bec1226ad696b03f4d28dba27faa209c0c9f4fdbae6b
MD5 e5d913149e7cf032a375cebaac6df0ce
SHA1 b9c2c3e83a54842bd02dde2a15c0462606a67d46
SHA512 5f0c716acbc76fc05efeaa9721be2ffa7039608b545e4bd7f739f636b07118c016b12dbecce85de14534efd2c52f73188b3545c625944bfa56954599d0636893
SSDEEP 49152:YB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glDb5+Pl6bJTIZ5jdgp:yu6JmIxd2dnslgJTIZ5Bgp
TLSH
T1C6D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0c29eff75ac8b894ebea4d4037b241072f2e9423f227cdc980504aa47a58054a
MD5 c1aaf41fac8cbfa4e453bb6ec26c9e78
SHA1 153359935963744297eb3f3d1fce1e19dc2e5f64
SHA512 5f5606d4a458e0127ff83c13087685fc001d3eebdba7eeedfb42c72afe64ab41fca7781fafcd670cb460d882a454e2e727f08013fac21503cbfdc1c2f74eba1a
SSDEEP 49152:V1hpsNoJpF1A67U44CwH7R4xHb5+Pl6bJTIZ5jdgp:VmifPqRMslgJTIZ5Bgp
TLSH
T1A6B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6640c2036bf9dd8f60bca21bd52d8414b3ddb5b1c6ddbc4cd42023d86c32202a
MD5 9446e8583467eb402e157965e2ae640d
SHA1 80819a39851b83a043f82541a11c593f79602024
SHA512 77f6465b8204b27bfe1bd539e9e74d6d5817118c5c128fd23f7e13a01bd320ee8968b493645a73112ecf289390586a67598740f2703d09d26353912e72653441
SSDEEP 49152:gSuZQIY0Be2KkRVtOnks6NMHqkb5+Pl6bJTIZ5jdgp:65dKqi61yslgJTIZ5Bgp
TLSH
T155C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF065072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 115817809cc8f7d413a1d2afda891141171b9fe9a6af369d89e15e3f5846cc2d
MD5 072f3eb93c5eaa97b6a237db70aa3a2b
SHA1 797df1dc03a43b7a110e36453d5e57b59b31520a
SHA512 81166cf541ad51ee2a9bbcd49c4f984e13bfa9114fa1286116627e84c2fa8abc9d9b3bcb44d4625e0316a7e244b9c1f3f57c2043f1ec496f18bafbe643257a09
SSDEEP 49152:AhtSn8EApI0figjgiDn0AP5wTb5+Pl6bJTIZ5jdgp:RX2iWphAslgJTIZ5Bgp
TLSH
T19C95BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 e0152969646b60a4294eab96ae459787181bee1aef5905c64e8531bc48470844
MD5 64dbaec4bb99bf47d6111f62e9fc2ee3
SHA1 7927542bef8dacdad10c6a29082d7a557a91c751
SHA512 765de3b9a9c1e70f31380e9591d801fd6f30d7db07468416939c9bb7a47f810a5229413577c9717dc87cb3ee6b64d8a8f6bc3c508e5d1205d8c34c66c86ebbb7
SSDEEP 24576:V9mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Gb5+Pl6bJTIZ5jdgp
TLSH
T17B6523464A6B30CAE45B5739D9C8DB00F87EAF56EE8727B6C57D0427F131789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 ad79575a24d547e6d961ba7caf95a368a656322357f856f26b3df2ad2365b44f
MD5 8515e48d61fc277a94754fe602fdca4e
SHA1 2f029aa27030b87583dc3180ec2058d0c1f4fe1f
SHA512 0e9010b14f9980b1d555b45935b0409b29f2832c349b384b3d71c404a32654f99bd9349c0499c478fbe267aa151bb82305311d81e19c117d077f13c4c486b804
SSDEEP 24576:UGmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:ob5+Pl6bJTIZ5jdgp
TLSH
T1CE6523424A6B20CAE45B5739D9C8DB00F87EAF57DE8727B6C57D0827F231789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 478709fe15d253509d37f415463c3edc87e52bc2dd05b6b578da7691b345ce49
MD5 64ceee10bc1f90d5ae166d49c3429f33
SHA1 b8c3e8c02a8eb9cd5e9b08f1942e1f9d5beb4046
SHA512 e78bd4a1aca44c15e8fc78b0f7c756428da965e367993312c441ac54a84b09b1bada8a959013065ce2db8c56c2457e1f9c877ff470d04d5813068514f4ea984d
SSDEEP 24576:qImb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Eb5+Pl6bJTIZ5jdgp
TLSH
T1336523424A6B20CAE45B5739D9C8DB00F87EAF57EE8727B6C57D0827F131789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 f27254feee517f6122d2c21554e0bdbf6594a97844d94d7da8d79dc2de6745c0
MD5 b3d18bf2b0dcd3e4d7687b4e5bab4790
SHA1 047fb61d34ddfaf2d40c416a2d30f789b5b9e280
SHA512 948379a241cdc6f24ae3687c8072a7f905f06d303c7cab9bd76c684ff88f83e5ed70b8e7ed334fa9823b0e7816cd72e820dff1a48aef97a0d4cfe3043df4b698
SSDEEP 24576:rmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:ib5+Pl6bJTIZ5jdgp
TLSH
T1976523464B6A20C5E4A79339C9D5D700F4BABE96DF5267FFC675081BAA313883C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 a0eaf993a0a7cf31a8853a6adebde254a351cb0d967ab448e56a21bdc2fd1c96
MD5 161961b150fdff1fa72c2ad9700e5b75
SHA1 9c4ba1b7daa4d4cbbceee509428f912c72161a2f
SHA512 d1a1043232f8d68d2b52a1b4f725a9b8618cdf359a665b4860ad28d7f9100e7efef779f1483b2fb93a6cdb5ad61053ad4a616f8e342767b7a88be2537c11e58e
SSDEEP 24576:cfmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:tb5+Pl6bJTIZ5jdgp
TLSH
T12A6523434A6B20CAE45B5739D9C8DB00F87EAF57ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 8e000c4fa8af7ff9239b212bfabca6dc718f6297765889597e71217fdca1f512
MD5 8960cb19bab604c9920a80103da9d445
SHA1 956988ca853d6d272b514c875c80c3ae01b6d747
SHA512 917856af3135e88ad3ed00ae24ae4c5196cc22a66b31cc50395fc08ec1ccf48e2878b10dc9696c7dbec243b6df74e2530df1b185dc0c430ae35e2bbc17ec3267
SSDEEP 24576:G6mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:kb5+Pl6bJTIZ5jdgp
TLSH
T1CA6523464A6B20CAE45B5339D9C8DB00F87EAF57EE8727B6C57D0827F131789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 dfe414bbc2459a7b39396780f083a28b16b950b42fe07e15cb82b7757bb862e2
MD5 4b3189cc53a0624289a6c9cdc9f11ac6
SHA1 a7a96a089958f9ba2ed890171c827e2d50ed76c4
SHA512 04aa3bcb331382c66ff229dc1b97572eab1334128048453586e71289fdd903f2819b460f8a5c4abe4f9f0e7ab93e8e421501c33d81ade34c2b692edb7c903ee6
SSDEEP 24576:EOmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Qb5+Pl6bJTIZ5jdgp
TLSH
T13E6523468A6B20CAE45B5339D9C8DB00F87EAF97DD8727B6C57D4827F231749381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 55a0a83b36092c74b8a2adcc9a7e844308ae1d4ff5233dfbd2c36ef2b80fde5a
MD5 6671b2f8094a400a7bbb0bdd69b7da13
SHA1 b178fbae39f7c07cf17820ff407d5e52e0b155c4
SHA512 4430732cf040bbfd91f75a18aabc3dbbc34b92b8e92e478bc83bfe9adc0ef519caeceaa691399929efa5f9e511ab9659a6fad180032dd6faf84186678aa9bc8d
SSDEEP 24576:6ZMazFVSOmmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:6ZMazf1b5+Pl6bJTIZ5jdgp
TLSH
T1AD85F195B36018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 e45578b86a88b2e05c620530f204e36a2891ea4847e23d94645a07a48edbca34
MD5 8f6669f437e438ad05f33db82b058006
SHA1 39711d2b38692af0cbe7fe599429d22d36266e4e
SHA512 8550b5fe0173f7251d506e8be9c951f6a59a4535081a43849d0037e9b2517be1c3c6b8215dbe8d9b525c0aabf3dc3a3574984df6f03c19cf6d628fc8ba5ba3f3
SSDEEP 24576:A5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:jb5+Pl6bJTIZ5jdgp
TLSH
T1EB6523874A6B20CAE45B5739D9C8DB00F87EAF97ED8727B6C57D0827F131749381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 532b40a781361ab4e30e81aa3349473bf09bc764654862a10fd954c422479b88
MD5 92c87867880a8334ff631573715b2a5b
SHA1 b917a6015107697fd81a3385a65cd1a26051e6d1
SHA512 670dd24863a9e6e2ea64aca92ea2f9b54d35e48cc09d2833749a74f89ec0ae6810ad58cec112a4b79640d6a559316ed021de09f2aa6f40f5b51dbd258841ffe8
SSDEEP 24576:k1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Hb5+Pl6bJTIZ5jdgp
TLSH
T1586523874A6B20CAE45B5339D9C8DB00F87EAF57ED8727B6C57D0827F231749385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 6b0e91ea890ca4dffe9275b41185c584fff2112ff9974ef8621030d9ed99de26
MD5 93aee09bfecf9d50189f7a5859bc9897
SHA1 e812142f217e0e7df91693b69652497c13a7a322
SHA512 20b7e13d9ccfc9dc0de26512b8b3d86af01e4c0f14352c7a1a4839556f342cad8e4e56a537bd2d4a7af2307a42b8fc1c6d8b4c692653df6e8f7fc61c8f09c1f8
SSDEEP 24576:szyymb57GBiOl6a8JTth/RWZvR6wQQ92pN3:sKb5+Pl6bJTIZ5jdgp
TLSH
T1F375024767A630F9D0679239C8D15B01F776B8328B619BAF47B4063B6E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 34dcf0a1cb7a6b7180a7f7133e8684dec0eca20772ad2b573fc3b4b70108e956
MD5 dba07e7701b748897bc945b1f2b1891d
SHA1 94c98f0241ee892adfdd60016508eabaf1c256de
SHA512 d8cd668a7ac1657d6f1d2d87c7b05d2986808aa9660796661b946d57fa82f649d23b2f66d8e7432bb25e8775da53b3ef01c3b3b885ba841618682e6104043ac5
SSDEEP 24576:y5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Rb5+Pl6bJTIZ5jdgp
TLSH
T1626523874A6B20CAE45B5739D9C8DB00F87EAF97ED8727B6C57D0827F131749381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 b786a33b7d6b3b4ca60774e79dcba39bb87cd7999e5be19fa58c3eb91f146edc
MD5 fa81118e9f610f4bb402730797747ee9
SHA1 3c9f2fa090f3afc66547a3a94fa504b5525aad2e
SHA512 7236f97055a5bccfc74a05ecc934aabed8c511321a8899d1883a25514a3dc95ec9c9b2feeed55abdd5830084ed4432f298ec3dd4609dad43e279fa8112c0fd6b
SSDEEP 24576:i5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Bb5+Pl6bJTIZ5jdgp
TLSH
T11F6523874A6B20CAE45B5739D9C8DB00F87EAF97ED8727B6C57D0827F131749381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 4ae83f192d0563ed6e093d84ddc9b3ad1e48c36ce8b33297030d4a1897a5313b
MD5 75e504564d9addfabe1884c8bb39d228
SHA1 b620a72b45fa9e2ac1815644f6c7a65ab98d35b1
SHA512 62cce1f0ad500552dcd3db7ba33206a0cc789a7db49a9a60a9113aba7d607081fd4c4dfda99c6372b0840021823da1a050d742ac6e854515a942601bd9b59043
SSDEEP 24576:pzyymb57GBiOl6a8JTth/RWZvR6wQQ92pN3:pKb5+Pl6bJTIZ5jdgp
TLSH
T1B775024767A630F9D0679239C8D15B01F776B8328B619BAF47B4063B6E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 ccb79ad408291fe9466cd1df45b9f919aae8524b7f659949cc6674a9ed0fe952
MD5 38db78c5c87fd7a23410ec351977cf2b
SHA1 b10f4148ce5a2cb2d1c3b42cac977f908951d392
SHA512 df1756e73beca3156dfe6bafddcae5098d38b8d97152c72461c77603fc89478024452b148105e16777360c7a61b58015a7f4f7d3b15a30a3ed2b2f62c14f35cf
SSDEEP 24576:OT/aLl3z0zD4mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:OTiLljSb5+Pl6bJTIZ5jdgp
TLSH
T169850195B35018F8EC67823ECD958A05E5B27C5A4B60C65F43B8362B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 b1e03f4d609dd72861e074921c40b13e23076e16b9dab0c9c7ecb335dfb18abe
MD5 53625458fbf2675f93974a7ffdb52944
SHA1 ab7664c24c025151e8f9c22ff267e4876339c7c5
SHA512 c2bf18c45a9abd5124e46afef997d31548e150dcf52222cf1e3ab9331899bd311198d8898d7c42062fc83c6cbadb9221eeb77fa1bb8ee8436517c11752355083
SSDEEP 24576:33Ud9CHKy7GZcmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:HUd9CHKya1b5+Pl6bJTIZ5jdgp
TLSH
T1DA95CF90F3E410E8F0B79A35CDA68611DAB67C5A5B21DE8F03A4251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 fea80dbcc059b7a21de213064286a47d14ee0631a2f903087a275ad348c204b2
MD5 72206069bb620fb73792ed73b88a70af
SHA1 9d69ffff94285af4d4e4481a2e450e558e8da652
SHA512 5923b13accf3681c10d8f41abb4196c8271f67765a3385a62d15ca48a7d8c4efbf250c15c2b6fc9f755c01569601cc7d82319391dd0d9f50a47fcad301369537
SSDEEP 24576:Gomb57GBiOl6a8JTth/RWZvR6wQQ92pN3:ob5+Pl6bJTIZ5jdgp
TLSH
T1296523468A6B30CAE45B5739D9C8DB00F87EAF57DD8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 c91a56d0f5526673ace4890c884374fe7bf4af569c394e1203d8aec2867f19bc
MD5 64dba519961231bc669a73a6c0965073
SHA1 dd19de78463344b4d403487ff1d280deefd9a248
SHA512 2bda6d8e0e3be2c39fb7f64b5d69809de5859a519da6ad435abf1a62e21191e34a5dbde33a676c84180f263c6fd3c51a5b1d741eb60f370d9ce0d79c51caaa84
SSDEEP 24576:oSmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Yb5+Pl6bJTIZ5jdgp
TLSH
T1F56523864A6B20CAE45B5379D9C8CB00F87EAF56DD8727B6C67D0827F235749381224F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 1b5fc9b01fc4ee011f6620879e160d596fd53b12e83aecf47fcfc6a8d5458583
MD5 d7ff3c80cf7db3bdb94d8324aebed7e1
SHA1 c09aafd510b84d00f8815be1472ee996233a7680
SHA512 d5024e03605adeb734b4a0ecfcc93fa76eca2d039dc85fa77ef6de3dee1431719b87145c55ba826d89ae7f16f1c263e3befe8b76c896ed54146231df4602ff6f
SSDEEP 24576:ADmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:1b5+Pl6bJTIZ5jdgp
TLSH
T1516523864A6B20CAE45B5739D9C8DB00F87DAF97ED8727B6C57D0827F131789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 031094bc9bd8ea3b62324a054f3a7ba4e5446812afa2f6606d98bf51c7a31964
MD5 aa0a267c111adb2a1d43c448bb7c6e77
SHA1 01c04fe08319ff0a0f8bc54e0a4183934a826634
SHA512 6428a8bb79993877ba0e7d22d3708372e5826cfa1d83545460e20a43b1a841892eecda9ca067fd323da58346e8404f8d251c595efb8ffc8e17f169e3bf3bd065
SSDEEP 24576:J5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:ab5+Pl6bJTIZ5jdgp
TLSH
T1926523864A6B30CAE45B5739D9C8DB00F87EAF57ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 e1deb2cfae2f68d19ad6ed12db190dab6a6f8b6affe0bb25b77f6d5cd403f910
MD5 a348c21c455371c439a406e1d1e74c27
SHA1 b74dfcad781ceb6d7c99195b7ca81d3dddce13dd
SHA512 14e710302ca0ad7cbdad76715936a3e711701ff5d329df0d083ae849ec621d3d8d09a3d82ee6c28c47377f68545a0ef2fdd6df274deb2e5c81f17651465a0096
SSDEEP 24576:pomb57GBiOl6a8JTth/RWZvR6wQQ92pN3:5b5+Pl6bJTIZ5jdgp
TLSH
T1286523464A6B20CAE45B5739D9C8DB00F87EAF57ED8727B6C57D0827F131789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 fac815a5da6d333ee755469f69390af597ab3b491db38979bbeb2908d3ca17e5
MD5 4b2ed21cabcf84b92ec540147830536e
SHA1 18e6fb6d7fdf9dd60a9840b5cd5dad8a09864cf9
SHA512 160072d95d381d5d9ba7e4ec4225b10bc786f132065fb5d3f77e3541dbca381cdd6c179ce6af29af239591d7499c4ad8bb8bf5842874c652cac7981ac51f4975
SSDEEP 24576:/Bmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:kb5+Pl6bJTIZ5jdgp
TLSH
T1636523464E6B20CAE45B5779D9C8DB00F87DAF96ED8727B6C57D0827F231749381220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 9666d8eb6f61b13159bec99544f65336e72464d26cbf5cdb7539883e97961edd
MD5 3c549a76af1fb5999325570b747bda13
SHA1 c32e265634ecc6752312f45dd4edae9ca6452ee6
SHA512 ae94bf58018a021aceb665d7cb166201e63d89b5dd1cee36b5674526a2d84a438a8bd9113ba27a0cfa0e5ca39f7dd152c70ef0c47480ac29379cb697dfa5d75c
SSDEEP 24576:/fmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Wb5+Pl6bJTIZ5jdgp
TLSH
T1806523424A6B20CAE45B5739D9C8DB00F87EAF57EE8727B6C57D0827F131789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 badc5a35a18567a9c0f7578e8b1204ea1b43039f3ecdaee43a27419aa331927f
MD5 b01a6bab17da19f85a5a95f304293cd8
SHA1 fc6a423aa9299573ecde08414111b42c1e937f84
SHA512 3706674159bab5b69fac7cc50ff30aa3d8d86c9569af90b2173c9c83fbbc0c445c2b4453b3cb4eaca321e04eb17b9873ad0f9d8e7609c4668b370696153e84fb
SSDEEP 24576:0Amb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Gb5+Pl6bJTIZ5jdgp
TLSH
T1F06523464E6B20CAE45B5779D9C8DB00FC7DAF96ED8727B6C6790827F231749381220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 0c819b3fb1083209448b58547464b048f9ec7d5ab3c1eaa983b9163e1a671d96
MD5 b461e6346461c0c0247cc6d5f89c8655
SHA1 64ab6649178d2c7ef0cdc4c885185a412430a9d4
SHA512 0f3b3aeb020d6f0b5508790e9c54ba904c899e03f4f23523a8e003f215e81e8b4c1f3b1968c64c003f9714f90a95364d8fd60fda666a3611d22e9ccc42ecce9d
SSDEEP 24576:sfwvhk9RX6wkyAIFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:lMnYIIb5+Pl6bJTIZ5jdgp
TLSH
T1A995CF29EBDC04D5E0B7923C99E7460AF6B178595B31C6CF02AA536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dae791979b256f8a68f53b6df139a6ceb19106f1737b1b61f4eea7474d98bebd
MD5 86c4c3cbafd6c8b9b21f243183f12815
SHA1 4b9dabdbc5d130546e6e2978ab722d8b0125bbd2
SHA512 75b5ef8e21dedfbc9788eb4280885ada572072d37956ccebfb346594d498c8ea876c1e07b5b744d0733fb6ef5467e5556f7aae5f38ff0860eab1742256635da7
SSDEEP 49152:4YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zb5+Pl6bJTIZs:3ySzPfslgJTIZ5Bgp
TLSH
T1C3066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a23ee0b43c98ed37d31f061d63f6e4aed004b18cf622ff73b63cc200263c7263
MD5 a7b2a2572bc94902c321974b9a015c33
SHA1 7fed458e2a3d4a3856cdbc6fd7ae8c1178b87931
SHA512 38dfe2fed25de2f23771771b5a57aadb7ec383742879a0f6ec5d2a83e45bb9a6a3fd77c56cea53db87abdaa2da9c0ee6078ff2ea19208dbcd33aa918b2ecb75d
SSDEEP 24576:v47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY2mb57GBiOl6a8JTth/RWZvR6wQQ92X:v47JUQjqirIhCnDHUPfF/Db5+Pl6bJTl
TLSH
T1DF65AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 03882e10b68055d4dd5d62c3f7e532b87bdb6c2488ab2078ef444f65bdfb73ae
MD5 d2874fc536b2b8ff755f84dffaf5a912
SHA1 7d3f79575d8efeda9dbd793c2b383f15d3385daa
SHA512 d25ccf65b38ae1d980df6ff9a8b0cdb0566c92a22bd4e85ef71d97cca919be6b7f9d9db05d5fb7f1e2a9e2b710dffce5db3ac4e12e8e86521d8758379f0310f6
SSDEEP 24576:3pmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Ub5+Pl6bJTIZ5jdgp
TLSH
T10275F14AC29811D8D06E6239CB858A00F7777D65DBE293DB86E0F43E1F366846DE6703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 58f74e52afa1d90435802f975fc4c956d6867b7fda803c70a220415e24884db9
MD5 374415f64fe3fb6aed8070b158900d7e
SHA1 e1f9161a3ac89fc99fba21d5d98e64d960ca07bc
SHA512 ad2930d3191c30fa9cc5cdcf52b22b4a391769381b1be80dfe42f47bda9a68d91781fd37789dd0982c6229d7cf16bd0da1eb8abcb8143807bf94a187b23d548a
SSDEEP 12288:Jjk+Yy5GvO1gcBfInPS+XKRHom4PsCaP/:JzYkqcBiPSKKRIm42/
TLSH
T11F451851766AD75FC6A940325E33D2CCAB707D01EE056B0773C8473FC5B6668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 bb7ea615fb01a4350f3198fbeb8a8bbc454d56b1f9ee0b3fbb29449d25b4f568
MD5 6ae609b6167eb38322986dfdb1d1192f
SHA1 3d94b98c9d06304b7f121e9ddd6f7ca1e511be98
SHA512 b38eb97d79fb3b10ebcc14b9c98299ce66d1e57340db37b1e372aee488ade340527f0470f9e2bffcc77a3d661216b39d299493fc847925ba8009c3e23dc6b177
SSDEEP 6144:7IxFLs0OIAPrv6HvzgaVjJFWEol6KDexHiKSZsB4c3W6akDV+C1PpKBmoxX6KDeO:QsBPSJMnc506oikK6
TLSH
T15165C7819537F38FD1F7503207296B4CA7A4EC06B7096F2673C8453AD86AB65B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 21386c2bfce06a335c8c15db406a27ba1dbc81326a4221b1d7f5482ddef60462
MD5 3aef7a2814a70e2fe76182b23c9757f6
SHA1 7cf56ab59082d8328ecd53d04fa9b01de27f1a31
SHA512 e4676b8933368e2d08ff5a413f1eed39361552974b70c32fe686d9b803e5c0d1600a41e59547d9470c506ae9661c4670724bd8bae8367327d4fe3e077d778a51
SSDEEP 24576:fxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:fMb5+Pl6bJTIZ5jdgp
TLSH
T13C6522428B6A6486E4BB5739D8CDD710B83EBF65CF8566E7C539142AE1306C87C7220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e33b36f2e962518c8780a2c19abf016c01d3c1f3139cb78d08d23e92bfdc214b
MD5 1a6e98f46a24af64266af9d022704283
SHA1 d5bc678a87e7cc1e3b7cadb72852e2a2415dde16
SHA512 01515ec42f028b0545ad203b695551df1a297c3e09b206fbf95f60e5b81775fdd761bc93af50602312dd0a7593f765f60707d56379249623696da24b13aa097f
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYbmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:mgb4mBIBhGF5b5+Pl6bJTIZ5jdgp
TLSH
T1E3659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 dd6202401fa4e456eae54ebc75e43f726ecb868f95dd4c7b9dd4f7125c349ecc
MD5 233606942647a51e78f0855263d1d6c3
SHA1 d4e9918daa59d2053e7947fbe8fd6caae0ece64b
SHA512 5c6f1ec8545bd2c47582850271d8a3df7961727a3fd2a97498437d210a8aef70d0f9d34b046fd324fbb5e70406956d8a327b5211caeae3f9b6b457abf257e91d
SSDEEP 24576:+G88u8FpJqH1ozria7/mmmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:V7ZFPqVXa7/6b5+Pl6bJTIZ5jdgp
TLSH
T15595F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a6b3d33e19ee30fcfef80ec9f7a22399468fc520d46cd349eaf0e95d0812839c
MD5 79ff6b1a98a089619efc592bc8f6baa3
SHA1 68994c30b8e9d2a670f9eb3a79fe5c1132d35f5c
SHA512 70e69d5f234e8ec066b538188705d094528d854a276b74e64a25460e7301c56f4eb2d2bd125d39f4ee0fa4464b6671e09520fe695d62d750604a751dadf376f4
SSDEEP 49152:8BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlb5+Pl6bJTIZ5jdgp:fG05lO43beslgJTIZ5Bgp
TLSH
T1FED5C06E62EC11F9D0BBD17CD9C68A0BEBB23815032556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9c3abd2ec70116cdd0c4ea92fd33bd65aaf3bb2b709ad5afd1b1b1d5c8dae420
MD5 65c1583fd7973afd85e148cce8ebecc9
SHA1 c502a4f431597a54f804147ba61ba31e57a6f9c1
SHA512 3d7510f2a2573fe9304554d4c98ee34d0c24440b4ebc021b2abbcc72a2d6fb1950f7cddbecc04ff72fd6e850adb36ab777562d7d6913d60e26e3ac2f2ca2adda
SSDEEP 24576:Afa5POZ3dpyWVM50JicR2hG0lasx2+47eidnkmb57GBiOl6a8JTth/RWZvR6wQQ4:4a5POZ3lJt2pasx2+mdb5+Pl6bJTIZ5G
TLSH
T1CF65AF5EA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6c5859dff90e50dc83ee240df0a6fdfee3f28b8244cf8b944c460dbef6ec2cdf
MD5 ed789e24c86e40ecb9f74145b99df2c4
SHA1 ec787c9349a8036f642663ede2be8d284038f0a3
SHA512 db625394e2a3e630c62257ccdc7da42308799a3aa1a00c9b7d4d367ed35ed94a5824145a3d65bcf30e994d56b2f778a753a5e21bf5605559ab9a7fc5e0dd26b1
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7Fk+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:uNc/zEOVHFab5+Pl6bJTIZ5jdgp
TLSH
T1EF858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6f8a8d721ba1ee5a8d437a552e6eb5b644754d9fb7a81e629cdb8a75016f5428
MD5 a75e8248c1b4fc77df71d189081cad06
SHA1 f6e1c90fffc6ec24e222d39493bf4900ec8ab0c4
SHA512 79805158160e1863574ffd4ee3e41f816232ec4a88cbd36fb2edc3585f6a356cea563eee09188a0d849bd001e37428727be9d8d125a598f2fd5a268b7e87bf40
SSDEEP 24576:YzkNvNnaFeYhJNtmZBmAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:YzMwBtOm3b5+Pl6bJTIZ5jdgp
TLSH
T15855AF6EAAB806E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 706982b1d25945dcb5b71f826c94dc3b272f14b6673aeaed3926e0c0142cd459
MD5 3a12b8b7d0803c7b6987994877ecdc40
SHA1 186fc29be3008460bc6f3431c8b5f0932fb21fbe
SHA512 209e959de72842535d954b4d154d690791b995ed1bef96b86f97841658a9c42470a240b0d5481a3c5ce6bf7c492708e5168e3a4ae76be569fcbcd90b4d67e5d7
SSDEEP 24576:FPUr+NQKmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:FJQ1b5+Pl6bJTIZ5jdgp
TLSH
T16775E11F26AD18D5E67AA13DC9C68709F772B862471292DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 471d9337ef3631431dda17764e84809ee1a008d88472116c937b15a539fa56de
MD5 c9c0711096aabda23c1470571072051c
SHA1 ccf918d1c3b22483e1bbe7fab3e549aca4e798f8
SHA512 d339d6fd06a1c99872b6583bd0990f19add99fd70b677c5652d2e4e175f500457f10845c09592f847bc0cf259ef7c576bbfe66afd02123363f1f9ada02e13731
SSDEEP 24576:ND3FHshBIYQgAdmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:NDVHeBIAAgb5+Pl6bJTIZ5jdgp
TLSH
T19585E17ED75D00E4E47BD27CDA938A06E67138A9472266DB02D481BA5F27FE43D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1548-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1548-24-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1548-15-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1548-90-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1604-98-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1604-92-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1604-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1604-384-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1604-290-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1604-386-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2336-116-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2336-315-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2336-124-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2336-118-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2616-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2616-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2616-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2616-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3244-244-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/3244-67-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/3244-75-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3244-69-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3312-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3312-115-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3312-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3312-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3312-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3672-0-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/3672-8-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/3672-1-0x00000000023A0000-0x0000000002407000-memory.dmp

Download

memory/3672-79-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/3672-10-0x00000000023A0000-0x0000000002407000-memory.dmp

Download

memory/3672-323-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/4412-80-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/4412-279-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/4412-86-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/4412-81-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/4452-374-0x000001D10C680000-0x000001D10C771000-memory.dmp

Download

memory/4784-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4784-129-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4784-135-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4784-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4784-141-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4900-104-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4900-302-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4900-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4900-110-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4900-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4900-317-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4948-49-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/4948-41-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/4948-40-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4948-53-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4948-51-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/5984-57-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5984-205-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/5984-56-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/5984-63-0x00000000007B0000-0x0000000000810000-memory.dmp

Download