358f6be6781820f9d5dddc19d24898ed9d44c4392bfce94983960bf582a5cdf1

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Size 1.7MB
Sample260810-ffrpeawsdw
SHA256 358f6be6781820f9d5dddc19d24898ed9d44c4392bfce94983960bf582a5cdf1
MD5 5d8205bace3fb65ab0b460d4e6249a70
SHA1 a2b68fb821a4ce754a5f5fb2c260c04dd0ed1b1d
SHA512 c3450ef009bbd3e1c730acb0a80e659b82003bea51cf35e0df0b4adb14a5fe99f4c00c6e29520f5ad97534683419be8b2791c0b1551dc597f7d549d2310b9387
SSDEEP 12288:k3OpT1STyOeybehrXOmzNlUEOccM3tegtociOPyazluRF4KM7GAwOifEWDNRV8qK:kTyHDhrtNW/M3tBZPzwFa7/wOifnz20
TLSH
T17485F1207681D071D82201358FB9CB76552DBD640B2541DBB3DC7E7E2EB8BD21B35BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4572	alg.exe
4516	elevation_service.exe
2164	elevation_service.exe
3656	maintenanceservice.exe
964	OSE.EXE
1488	DiagnosticsHub.StandardCollector.Service.exe
2092	fxssvc.exe
4996	msdtc.exe
1304	PerceptionSimulationService.exe
2948	perfhost.exe
4768	locator.exe
2244	SensorDataService.exe
1092	snmptrap.exe
1260	spectrum.exe
2692	ssh-agent.exe
2672	TieringEngineService.exe
5016	AgentService.exe
3872	vds.exe
3248	vssvc.exe
3652	wbengine.exe
4612	WmiApSrv.exe
3284	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e59e379be52bf895.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041a03bd28328dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027015dd28328dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000974725d38328dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb78f9d38328dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000799e98d28328dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000302a45d28328dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0eb87d28328dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe\""	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4516	elevation_service.exe
4516	elevation_service.exe
4516	elevation_service.exe
4516	elevation_service.exe
4516	elevation_service.exe
4516	elevation_service.exe
4516	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4620	2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Token: SeDebugPrivilege	4572	alg.exe
Token: SeDebugPrivilege	4572	alg.exe
Token: SeDebugPrivilege	4572	alg.exe
Token: SeTakeOwnershipPrivilege	4516	elevation_service.exe
Token: SeAuditPrivilege	2092	fxssvc.exe
Token: SeRestorePrivilege	2672	TieringEngineService.exe
Token: SeManageVolumePrivilege	2672	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5016	AgentService.exe
Token: SeBackupPrivilege	3248	vssvc.exe
Token: SeRestorePrivilege	3248	vssvc.exe
Token: SeAuditPrivilege	3248	vssvc.exe
Token: SeBackupPrivilege	3652	wbengine.exe
Token: SeRestorePrivilege	3652	wbengine.exe
Token: SeSecurityPrivilege	3652	wbengine.exe
Token: 33	3284	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3284	SearchIndexer.exe
Token: SeDebugPrivilege	4516	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 2092	3284	SearchIndexer.exe	124
PID 3284 wrote to memory of 5072	3284	SearchIndexer.exe	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_5d8205bace3fb65ab0b460d4e6249a70_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2164

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3656

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:964

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2608

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4996

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1304

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2948

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4768

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2244

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1092

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1260

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2692

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1052

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5016

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3872

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3652

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4612

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2092
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0996498a1704b1693f2aaecc164a456b6d9a57119bd372f317b3f02ed0bc94d0
MD5 a6dfd9ceda9b4f8d0942af02e7b1c622
SHA1 d2ab880e75660e9fc3d0383610b30c877557ec7f
SHA512 c83a7b2c11106bec9db97aa70a1af8686edc76b633e58f1880d606c673447eb5b70b672113b76d73aa961e14e4edb3609a9b5c9bf51d7427bdb38a01dbd26cb2
SSDEEP 49152:cb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnd4ZPzwFI/wOifnzH:G3q6mjBzYtH
TLSH
T133D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 f5670c45795950927a7a88d2bd2c05e9edd53b2b67f668c6f527f5516936cf48
MD5 846ca05a9a3003c14918bd15b8be3a62
SHA1 d9a9adc1a04f4a87a229f8d1c8ba2b85ba0d4263
SHA512 ae8376813655708de40b63b5b876b93100a0ca819deb7fedb8294420ffcc7571fd806f6d3a5d9075d63f5760ddf8a81a23b7ea5efaba6f877978a254a05f3b19
SSDEEP 12288:X1XLsswWkxy2lRq2czApcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:FXYfDtczAOM3tBZPzwFa7/wOifnz20
TLSH
T1E975F128B3E109F9ED67827DC8A28501EB3378954760E78B03B4953A1F736C85D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 74a4a337ea2f3a240784d1d86ba3aa51b85fbd05f33f84bedca71fd4d4443693
MD5 a50e8b600083abbec6ec58acac5584ca
SHA1 cda6ef17dbacb72cad65cc116b4ab21d2b5950c6
SHA512 375bc2a1c687dedef820e9f1727a7b8dff13d7aa710b1d53bad835c11e4009ca297805973264912aed7b56d0bdb4e129d6fd2e6bb3be0833f3ea0a0aed772775
SSDEEP 24576:f0Le5ji0hmxhrMlM3tBZPzwFa7/wOifnz20:fPji0Azg4ZPzwFI/wOifnzH
TLSH
T16595AE16F6748371D073C0B9C5D2A68AEE71308657308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b9b47ff63c4e7cbb626cb669d0c0179dada3a188ca1b17806cbfdd4e98ed7119
MD5 7874c455383231ce1140858d38dc1092
SHA1 9bf1840ed74ebfdc3372f3be9dfa13934bae1171
SHA512 14bb986f32810a02c42050e0f172934b482dbf72e3dc8eea0f08afab5ad8be04380725ca4138d39940c94d5642e9dd1ece2e4bdfc3652f6a7367c7530c9be353
SSDEEP 24576:Ca7/ezSC6vUyD/aqgrvWj6q8wyurM3tBZPzwFa7/wOifnz20:l/ezSC6vUzPv+HjyU4ZPzwFI/wOifnzH
TLSH
T178755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f873199f5758c41976d74fc926fc2f4e8a21b1820e721427fb610d57eed69222
MD5 aba2aedb0cd967df49bc8304a8023740
SHA1 f29723c565b1628d3224bf81271d89c26c04adc1
SHA512 1bf7263192f9a2ae4b1c7ba4e2685843e3b5013248a9a9c1d15f1b77c0efcd87a48a9c38779f2606a872ca6cd82d8e158228608fb2c8dad095aa79feb88d2aff
SSDEEP 24576:iVbqPb88hv/l+BKM3tBZPzwFa7/wOifnz20:iVO88hXl+A4ZPzwFI/wOifnzH
TLSH
T164559E66F6748331D073C0BAC5D3AA9AEE3234415B318ACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 9e31a637b76ca6fc83ebee578c0167c3a21dea4e3c563b520183057e592807a7
MD5 4e5b64b1aadd0e3bb7cb1a464fa6294c
SHA1 e34b80252d1482a72770eafe5b3b01bbd5d1bb90
SHA512 72132d690a40ecbe316f53b2c29ee653e6fea600983d9a984ebb831797c8ccf2afc59f3f5306e4dbbfbdcff076bba025e43832ce5ac1618673ea0fee79effa33
SSDEEP 12288:1GQcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:1GBM3tBZPzwFa7/wOifnz20
TLSH
T1D7552382E79286E1DF521B7521E7E6028B19ACC85510B34F5BB2303F5EFBD46C01A5AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 75257514c3acc050d2add8808514b584a20718420add7e555886d0d21c13692a
MD5 1938baf59980be146f09bdbdcf328e9a
SHA1 67c03e4da608d535f3c875f6410aef651bb310c0
SHA512 8b92fe14bf795a89b0a8e006d40bc507ed58a8000d16c076c02e040a76035af2e2c8475e4c5b0a0b0bde185b92b21696ffbdced479f4efd116e6ec7aab962ae6
SSDEEP 12288:5eBNUbTVO86UNcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:5JIUSM3tBZPzwFa7/wOifnz20
TLSH
T10975CF7BEE28FCE2C67A4DB95692C700D76278704B22A3CBD175820EDE235D14D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 09b7eff5c2e6078ba44e641384ed97f4ca8abc4c38b7cb3db51b82db3240a077
MD5 69926580f140aa92be4407a7762ce277
SHA1 4747b1796a684251577783b712e372840e4b078c
SHA512 5c3a52831d389605cfcdb1fc57046b435036f3070ceb0ea75f0514bed82e50a5cbc89ecb418fb08c9d86aa58f33fa498e39557d6350e85cf375b62eece47cea9
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THC:mQvGAdlCEL8c/WRNw5C0YtH
TLSH
T123267C656BF880F5E1A7E138897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 9b9588e0b372f11d38cdc6df0df10a08144969d5c50aa6be333add56c33ff013
MD5 70872695416811827e8daca5c306d854
SHA1 0615da6b48791f3a70b69699b847681dd5c9b7f9
SHA512 23fdcee48f796e97e15d6576ac8deb96898312529b966abdd4881341deea479b323fb798f880ead11acb27a71fbb6d2f5d5f11d07c87f6aa676fc32b7a14e497
SSDEEP 12288:GAwSfxL/2Dc3mDLLmt0LDQewsAj7cM3tegtociOPyazluRF4KM7GAwOifEWDNRV+:bfewsAjwM3tBZPzwFa7/wOifnz20
TLSH
T1C285E031FF71E032C77B0DB61B66C716142CB9604B612AC3E3F8499E59706C26376A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5c5632bfe8a720679aff2f279e2a9fe7e124f586a36154caac5922fe48c28c7c
MD5 4098d2af9f8d43b006464311807b863b
SHA1 4a610a17b7644366c647c862aed6a42dcd899c77
SHA512 878abd88515aadc79b1f8e7a720401ae29c86c5468655eb8706eb7b71499c0dcfeb76c4f78b5861ddb8152a552b3dc7a11d065e786c5f22d6e3a43e7c3955b2c
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHF:zUEtQevvqc2W1cpV20I32
TLSH
T170474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 86f0f551a8a78aadcbb5d758ba47fa174fd4a3e34a51f2f617086c38e1d6982b
MD5 fb5c80a6c2ff815458405b081c3519d6
SHA1 c55210e99777bf4e1fb59ac218254a3bd757cfde
SHA512 7fb0474e60067c51a649d31fc6ef62ad0af3e6a0cb333a96ec60f395de639d34f00ba428b9a68bab1e20cc49b6ee3d0ce3fc533a8aba9e379201fc7c2ab017fe
SSDEEP 49152:xCbRquA/m2yL5zifFiV+XenmE3/zQ4ZPzwFI/wOifnzH:+oqHVjnmgYtH
TLSH
T11CD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 79801e0ac1fde27770c51d422b9e4d0d719c9c16d07aea94e3e8f501ccb17e55
MD5 482bab3e8a1b7d2d141b4da916642204
SHA1 3792986643afb616d38f6cb108d5379ce2b829dc
SHA512 bb7aa34d9d3de14e6cdb8b7dac504a76e896681bcac10da8381e2b1a107c71bfa5525dd71034127284a1f996c5eb8b060e364ad39c17fc3fbe7c440f405a42c1
SSDEEP 24576:XAhGL6IFoiwtA5l7S53PM3tBZPzwFa7/wOifnz20:XAM5Foiq5/4ZPzwFI/wOifnzH
TLSH
T1EF35AD81E7F945D4F5B3AAB899B69171EA76BCA95E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 3f914c67ce0a7a4c9bb0c4e0bc5b0fda3c277a08901197ed17717dd326e6035c
MD5 9e4c40bcb5cb058670d79bd63bd697a3
SHA1 5bf2d9d8e26d6ede4fd704917632dacf765422bf
SHA512 90e0052366828964e74057ee3bd92a36f4e4651c005dadd6215fe32dbac06755d0aba503f166797d74b8e78bd46c302fb341b18c08217dfa5976d0c3ca4556cf
SSDEEP 12288:cmw5HEjsChNEBFgl0WDm+CicM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92go:ZwuROW0M3tBZPzwFa7/wOifnz20
TLSH
T16575F14677E50CF9EA6386398597C132E7B2BC412A21D71F1770C22B6F77251AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 cac605e2ed2b3733632e33b56ed4f209057d2716f717da54778a5ca8dcecdcba
MD5 03550f75f30b1d2976ff6ba206246eaa
SHA1 e72ff47b19e6bf14beab46101b2dd7cdb69ad31f
SHA512 38f04ef62d4bdf6ac3b16a6b70bc5f57c4ab656c5e71635824fcfbc4c13bf8bfae149f7686845ed70ffef35d632c22255a2e527fcf3cdf02d0bb763f84f0873e
SSDEEP 12288:zyZ1IyrcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:eZutM3tBZPzwFa7/wOifnz20
TLSH
T14E65128A33E161F5DBA3467C88E29605D7627896233153CF1A71413A2FB3EC28D39736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7316f6450973e792c41857b27a854c3a4740c8fc88780655abec149f12264d2a
MD5 6c5fae038df5d3aa7e8a9d89bb5e47f5
SHA1 b77a4459d9a26c8571ac589f3ceccd47703d82a3
SHA512 81700f4c70e1edfb04e52831bafa1ca8eb5c8b207c3fb9cfb330e81b1392cdc295717f07007db87bcea0c735a4b45f7bd99c4299f18a80a68bd6b46dce374dbf
SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UW:PQRQyi36YOcPDLvw2gAf+PN3HYtH
TLSH
T1D7666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5e28d1a6e7c06b194a41b6fecab08ff211979cc5efac3fd65f35fc58a562e5f8
MD5 bd49d6faad36d72cabc7196a5069902b
SHA1 a6e380fa392067b3b95c17097aa5e663aa8dd37c
SHA512 aeac763bba619c256c4d89c1806da0a6b14ee7c9cf5544159cca469b5b4fc9a5c414dc3d8d077959512545af9ab7466d2c305c4d7b945fd1b1dde928de457140
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UW:/QRQyi36YOcPDLvw2gAf+PN3HYtH
TLSH
T1F1666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f452daf707b7e2e525b92c36f19c0ef27f8650d5cb80fc8537c840bc81c7e126
MD5 6a310b4f2d022ffde2f1cd7114b1f90c
SHA1 7edf0ed93545001c12701576ee73d4e2ac1373ec
SHA512 e870f1ce45b96ecb49d701f5f7fe5451cfa29cd47fb413ff58960dff444847c2ce8beaa041cabceb2f6ca0bc387a8089691d353bfeb6bd8defe8f615c85e41fe
SSDEEP 49152:z68Qg55nhkeWu7PNU3/g4ZPzwFI/wOifnzH:tthTRc/NYtH
TLSH
T1F7B54A33B2F200A9C44DE1769F4A972196D17C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a9d71fa0d4acef61544e70716f70b55fa1a2b98f402991d4e490201babe13ff3
MD5 0f7507609d9ea8c925a2a910ede2d6c9
SHA1 c9cc7c29590c5827c4d04d80faa535c2657828d5
SHA512 8911fa0b1a1b36f9d0a2b99bc2ac517e8622ce79103e24d83474f99307f283e164d40c1a64057d9a9993b8bcd872e557ecf975bc2542ad61548516b725938a57
SSDEEP 49152:F3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99c:ky5112gYy5azzVvU69nLKnhZuYtH
TLSH
T131167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 17aaa6f687c9321055b4a8a41028c0c83c124e61153b8117ccfc4395900cd560
MD5 a47fd992e80c85777d6188c9ae9432a6
SHA1 f8f4ac15e88740bf2a9fa686122caad3a1246b46
SHA512 c42fdc5b6c4e56f0b5a4fc4d495b88833d4dc6b577b7bac32b77ff0921866c6a436c32467eac8deadf3f32c52c01a5b9cb7c4eda6c87f502afe761d230c71fba
SSDEEP 49152:vB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl+4ZPzwFI/wOifnzH:Ru6JmIxd2dfYtH
TLSH
T151D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 df447d2b27d65da5aa40d85df219da86daaa01df96e0965af9e6cb70baeda90f
MD5 63daeb3af53701fa3e3df2c8f9c85a60
SHA1 d71109b78108f833ad56470e274b891a24a9c1b7
SHA512 9b5c8794dc6d5876813eda8bf2e59ccaa2fcab747c26e5421006c2fb8e6a54176a957d6055fe47dd42131f2e901cc92c58c151d94a4cd91aaf703e2363d61609
SSDEEP 49152:y1hpsNoJpF1A67U44CwH7R4xy4ZPzwFI/wOifnzH:ymifPqRgYtH
TLSH
T1A5B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 10e42fb4d54af905d1b841fac17ff95b330fe704be743c12130bf0af8bb027b0
MD5 c9a550bcbf773903b398d79b32271496
SHA1 136b325f3744cce8702738d471506e464d59daee
SHA512 f0a50ebb4c5b06886414cdf0c23ab478c8be4b4970cd280b035c26ef57ba4ca10ca510dea7dc0f0e009c53f8b9c92e8e168f956bd20c74a1bf2a43ef975c04c8
SSDEEP 49152:nSuZQIY0Be2KkRVtOnks6NMHqt4ZPzwFI/wOifnzH:95dKqi61yYtH
TLSH
T1A2C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3081d353759447190ccda91520615f85ad6b08e78e732855822ef2d0c1f4d92d
MD5 494efdca228c9ebb17d459a102563db1
SHA1 0676c48a2191ead3528237b911bf41b2e0148c33
SHA512 c157930509b3b38385cd02ebf418a5900342922f354807f5aa2688e75ea2228b2b6647787df182cb9cfe757bddf9443afbc0743d9258533f7f6f567443fe7345
SSDEEP 49152:EhtSn8EApI0figjgiDn0AP5wO4ZPzwFI/wOifnzH:FX2iWphcYtH
TLSH
T1B295BE13F2D901E8D05ED178C7468632EA62BC160B35B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 0fa42bd28e102278838c9c2ad5f9c8ce114a07b733a9d0911c00b4becd05e3b4
MD5 ac03b0aa03f82636f8417234bacae0bc
SHA1 50eba2a8e5a0781de0bbaf85f8dbee5f29b820bf
SHA512 edb3210dfbba28acc7d2aba82e014f235baa61f1faf8afd364a4ed95a529f8ec33d9054cf5d75cb870fb0f353cc5cae71bf052b81d46901e964aa4b1a53053ab
SSDEEP 12288:KocM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:KpM3tBZPzwFa7/wOifnz20
TLSH
T164552381E7938BE2DF011BB551D7A3018B0D68C9A611635F6BB2103B6FF7D46801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 e93c0f1ea82e00f7e14569f074dc6d411298aeb4e28e4e35491a4e3d66651f87
MD5 b63a94cde0d2023ebaf8713eb8f59993
SHA1 edf6b9f6d4a8643b1db4e06b549b04aa7159edca
SHA512 0e811f9201bc58d83f18c7d616c8f46dc799f6a1ec2d16e2e3e6f5ffad9bea4fbd3ba1baf004a610472e7f08bb5dcedac0f047346985865c24870d2503e5b862
SSDEEP 12288:EXcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:EsM3tBZPzwFa7/wOifnz20
TLSH
T1AA552381E7938BE2DF015BB551D7A3018B0C68C9A611635F6BB2103B6FF7D46801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 adef32ba6895c746ef72aa1561c803cb69ecc5b1b6de5a1ba1ef4ff8c845e2fd
MD5 806a03ead3660e4b90c42c04f9bcd047
SHA1 e7752d6abfdb9d0b55ea89df3370a82e48f2de16
SHA512 e9e61460a29fc688f01aa874f62f9a03bd72c02a02eb02b44870a28529c547da7b5e12c84370166856624bc55e26789b3083a4e0a55ea629c15414b3f4b1a585
SSDEEP 12288:4FcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:46M3tBZPzwFa7/wOifnz20
TLSH
T185552381E7938BD2DF011BB951D793018B1C68C9A611635F6FB2103B6FF7D4A801A9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 46ee5698336512ab4597736d367c6e3c4843767fe7d07e68dad9fcef78179612
MD5 065672a5ce0417029240421725c30478
SHA1 565fe0df5638595415ef8cc14d9cbdb16473d040
SHA512 9874373c31618b488a9f41d56f4fe465896666d2b70fd904e57d4dffef51434e7bf3d28123e71f4ed5a634046f79481eb707ba3fe9650e171a50212bac3b520c
SSDEEP 12288:IVGcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:aM3tBZPzwFa7/wOifnz20
TLSH
T104652341A7A342D1DF12977981E39201D769BCD8A731639F6B71003F1FF3E858429AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 76bd7342fcfbbb0a0856f19cdd1b7c6ec1b69dc5074bc21c7ee737b31b713e7b
MD5 223cd447a711e3a628eca5728f56a672
SHA1 77dbe322ee78044b6de6e58ba95a9a3824496ab5
SHA512 ab92d96aa1dcb142d495291eb2ab7b77035c9849ce82c79c724d64e0d17acbe45e37e9ec512a00476fa24201d3559016c473e3c87be358ce60d82fb2071df104
SSDEEP 12288:3OcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:3nM3tBZPzwFa7/wOifnz20
TLSH
T1FA552381E79387D2DF011BB551D393018B0D68C9A611635F6BB2203B6FF7E4A801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 043fc7ae0e057838cbea789981d62ade7a3ad9feefc99d229f9125f3299d2cac
MD5 e688f7e8812be8410ef2e9bacbda12a5
SHA1 e4e4155f09025f86719016348107c12ecffba477
SHA512 1979bfef7d4d25c7d40d7e9599da01d280f4d15367cb2c4df7f62bfc3511cab6b7e6fb62c12614a2c8b68d700a77b10f08b8975460fe7d5164eee57854dc3d34
SSDEEP 12288:oTcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:oYM3tBZPzwFa7/wOifnz20
TLSH
T1A5552381E7938BE2DF015BB551D3A3018B1C6CC9A611635F6BB2103B6BF7D46801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 ddc0418adb198400946485cd9d884bd39898e58abff726e32e80d4d67b30eaaf
MD5 c69c3b9989a62b6c08073b2393339184
SHA1 ccab24a5247d302b1abdee716f607da95fef934f
SHA512 a203201ff04052bf6746c8bfa920feb1f13fbd599282a71cb8b57f4992ca1a7148e070049893faaaea42fe39fe0e21bfdc640819d265c15531d39191fe4fc6a8
SSDEEP 12288:N/cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:NkM3tBZPzwFa7/wOifnz20
TLSH
T131552381E7938BE2DF010BB551D7A3018B0D68C9A621635F6FB2503B6BF7D4680199FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 373c65dbbea13a63cff82959d18f2b657cdf4045d9179b2df394fc503feb5a52
MD5 8f3da4c83d6977bcf36c70b8d5f890a5
SHA1 04ab94454475922d47b2622cd887e1ea949a001e
SHA512 568eba089ea8369e05a2e21aa602934abd601b68dbfc7627392808726e30f13c8f2cb208e4a177d7f7950a1cd5f8836d86eb1577ee45985e8070b4a4daeeced5
SSDEEP 12288:giZwbDzzFEoS2cPvy3cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:jZM3zFVSOMM3tBZPzwFa7/wOifnz20
TLSH
T15C750195B39018F4ED63823EC9668906D7B27C590770C61F17B4322B5F737A14C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 a2709116b761bf015ddc0a2c6fc3ddc145d8afc75122e6d4c6f8cc77c17d013b
MD5 08498cb4f516b840e41b2dca9149a027
SHA1 a2a49ec8f6ada6065098b8cd7ed3d5729f004af2
SHA512 367321f147667620041134b3f3885238757c096c24081a8b9243ab2d7ac0190559132512f9e1a8e86a832d93bd134943c87e671ca86b1ebe41c619f75afd733e
SSDEEP 12288:z8cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:z9M3tBZPzwFa7/wOifnz20
TLSH
T13E552381E7938BD1DF010BB951D793018B1C68C9A611635F6BB2103B6FF7D4A801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 5d61e0cc69d69502c72880143f3ac3deb95fb2a41d98d99dfb1e250d82bc2df0
MD5 dbe90969b2956e6be76cc738a5a7fa11
SHA1 5438a157edb91c5fa5670568b13227004331be1a
SHA512 3706f3bb925f5acb7cb9f8339b6f2428afdbc614e20a29156b2d6b916f5f32cf874062a3d858d897053fd455c26975ff9dd5c073a552316fadd4f09ad030878f
SSDEEP 12288:aAcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:aRM3tBZPzwFa7/wOifnz20
TLSH
T13E552382E7938BD1DF011BB951D393058B1CA8C9A611635F6BB2103B6FF7D4680099FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 9960fbf9b022b45a11503a5eb3e7919b9e182767a8ba4774d7fbd2f123863ce5
MD5 c6896e7cd71234ed124a368a2529ff01
SHA1 a15e554bf3520f27842e597cfb28cff3dd12e507
SHA512 48cc186eff871d8aa59180b8d862bc9bb88cda445607f37085b12bf9734b3bc556700dd3f0575fe8e55e7cbfcccd920fcf65d7bb074716a747305115dc7eb448
SSDEEP 12288:uyPz5L8rcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:zzyAM3tBZPzwFa7/wOifnz20
TLSH
T12865024773A231F9D622823984A35A02F775B875472097AF17B0023B2F77A919D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 ad7889c838d683881441361ec172ea04dfa2151aeec10890f77481ce5b09bd20
MD5 dc6a19035468c8e0fb55bca6fda8c3d1
SHA1 68fa08fb6aec25c049ef5b281de46803e00ac191
SHA512 789a883ef43aa35575e8069e583c5101cda95031dcf3d250a6beb29a8cc6c760b7bc7cc29e6546cab869289f4551fa0353982d46a7a3ae1b6bf64e9f1ddfd501
SSDEEP 12288:68cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:69M3tBZPzwFa7/wOifnz20
TLSH
T1E4552381E7938BD1DF011BB951D793018B1C68C9A611635F6BB2103B6FF7D4A801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 6ebe95d4178cb8eadba71c4991fda50cb9fe26cceed05a1284c142cc3f4022fa
MD5 a9f81c923db78085b3df7e0d741677cf
SHA1 b0e1450ac321ef0d211ab213e75953e819a77bf1
SHA512 32c800651ceb6f063da06cfe20d24ebcf7dc68a487d42d3d830125bbe8dfcd645c8f21e9fc7fc5ec731e11bb215450f5333426e4bc33a5896106d5fb85b0ca01
SSDEEP 12288:M8cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:M9M3tBZPzwFa7/wOifnz20
TLSH
T186552381E7934BD1DF010BB951D797018B0CA8C9A611635F6BB6103B6FF7D4A801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 db4f14cc3f17a80eee1dcf68946e2af193b60592ed02e86225bcad87903bb85a
MD5 0e9cc86fae198ffbb8cc9de6ef8e38b8
SHA1 c29de3a734cb95fbb4ed86cd2cb9ffc8561fe020
SHA512 a54c281d873ce189d05c33498c3d8b8d8dddd8af025c6a8e9f5b2eddf5b9a29620b6d726a9218b934be7733633fdf5a35bde606d4068af88553eaecb201240bf
SSDEEP 12288:/yPz5L8rcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:yzyAM3tBZPzwFa7/wOifnz20
TLSH
T19D65124773A231F9D622823984A35A02F775B875472097AF17B0023B2F77A919D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 e32cbcf07e1c659898e6a90f35573b5fd6e07d6e910921815809243c2c0c6887
MD5 62bd7b929999219b32c1cb08ee71b30c
SHA1 6d881a238a569bab5e0975d4efb2a7da4b0d465c
SHA512 95ba7f289fca08b58252015f6b12d9e3b0683b7e7665495aae410c2e72ceefac3f93d759e5ac1a162ae6831c9c7ccf9db0976930fd8a2ceb222d6a28114eaec1
SSDEEP 24576:xT8aLl3z0zDqM3tBZPzwFa7/wOifnz20:xT7Lljr4ZPzwFI/wOifnzH
TLSH
T12F750195B39018F8DD63823EC9668906D7B27C5A0770C61F17B4322B5F737914C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 c2ad8a53cb18c8e9b38ee2a25779298a0a1cf95ffaf02da857dcb3656adeacb6
MD5 7e82d963faee031f45e63d4d1575b83c
SHA1 324c3e09518add33e18684e99ce2ff573efdfe13
SHA512 36aa229b32db3386147fcf192bb0e6df45dfba9fb98745256d44afe5483507d879ebecd8a8e1686b0529729994782dcb8c8c2a6bf0c8ad55636f6cf3281826fc
SSDEEP 24576:03rd9CHKy7GZWM3tBZPzwFa7/wOifnz20:+rd9CHKyao4ZPzwFI/wOifnzH
TLSH
T10A85CF90F3E414E4F1B39A3589769511DAB67C9A1B31DA8F03A4252A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 891882bd565f18845ff88436766feb0e668df8b0715144655a5433421df2a71e
MD5 29ce63b8542be52e4a1776c419bed993
SHA1 290121515403cbf6e4194d48dfd959db8fc0662c
SHA512 a88e2db210ecd05542d7196eb38953662e3ce2432a07045f6c8c8eb8540f1258e64ae0e07d65d8ded18e21fc8b663b1652b11fda3decd1155b82fbfa479d1cdb
SSDEEP 12288:alcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:aaM3tBZPzwFa7/wOifnz20
TLSH
T1CD552381E7938BD2DF011BB551D7A3018B0D68C9A611635F6BB2103B6FF7D4A801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 aed58cb3ba45b395e5898b6ec369bc10c8be9a841a5069c12d1d74a6ca03b080
MD5 ad77d32bc2e73f4fe04eabb8edb63fef
SHA1 9a44ec23cf5a32ce625a3bff942cc47e21001d62
SHA512 f3b28ac51af4a56d510ee0cc7c2a3305db739697a92bf8fdef2496287f63b780f9b15a5d445d3005521910d41b087cb8867b8e9a09bc3c4d31b5a5ad029ff2e4
SSDEEP 12288:tLcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:tgM3tBZPzwFa7/wOifnz20
TLSH
T1E9552381E7A38BE2DF011BB551D797018B0C6CC9A621635F6BB2103B6FFBD4680195BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 c6b0f6faccb3730bd53518b815ec18018c997b78f57da146be9c35c0a4c36716
MD5 997cd4579e395a66a7211f2bebe7c621
SHA1 e209fa6cd79ee1507862dc581b3bea4cd8f761a5
SHA512 df725e0de05b67bda3ba056889831eb32ddd6a460ddd6afc86b2a27cb41c6d01fc0605c6c80157cef20a8cb43282e7ad8933616709957fbf672ee6acfb4aa3d8
SSDEEP 12288:fqcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:fjM3tBZPzwFa7/wOifnz20
TLSH
T17A552381E7938BE1DF011B7951D797018B1C68C9A611635F6BB2103B6FFBD4A801A8FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 0616a111ad2da9522cf9604f1968213dc5ea5c88ded8e66d3e8d6f24808bbbc9
MD5 b61d3fde5678d922fd2cf2eddd03244b
SHA1 c15a7f7d4d1b1436af68c8bdef1be2044c7ceeeb
SHA512 d44139d8e3838869f931d0b0d3034db3b9d35a098825df1d64746fbbb524c7254c613f6b3485a711954a151d4d8828e5fd8ab85b6a7c233f7b3a170cdc72e6a3
SSDEEP 12288:d8cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:d9M3tBZPzwFa7/wOifnz20
TLSH
T1D8552381E7938BD1DF010BB951D797018B0C68C9A611635F6BB2103B6FF7D4A801A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 33f93f2022bef2776e594b63f215c66c300aa27c35013616ede9b6255a3f2017
MD5 fb738d8fa5a17c94566e75502dccbe05
SHA1 04508225e2b9f050005e05f338872ad453a946de
SHA512 c49bce2f4eda0ab715fda5a918920ef02eef267480d09aa24c50162372d7d5d887a29058405323e7f5c953fdee25bb29be6497b157a43b5c680ee271d9e44cfe
SSDEEP 12288:HlcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:HaM3tBZPzwFa7/wOifnz20
TLSH
T104552381E7938BD2DF011BB551D793018B0D68C9A611635F6FB2103B6FF7D4A801A9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 3ec618ff739c2639e78bd6c40315c59ab576fed1e4bd507bbe06773bf97c2c22
MD5 f9f87ce2f89fdc162ef7703a22fd0157
SHA1 c42d2b03246ef68dc68e031fe7a489eed69c2227
SHA512 4a12853408765bbdf69183b0ad748d4fb7a51230fdcc262533fb1ba11f66b7c69b9c70d717cf64c6695162fda03047929b27a009c613980dc1c5d3928388707a
SSDEEP 12288:hpsfMcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:ytM3tBZPzwFa7/wOifnz20
TLSH
T19765F149D29402E4C56E6279C7968601F3277C6583E1E3CF57E0F03E1FB6A818DEAA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 29bb3442739595425f164deb1a6686f7debf6c3d133b548145fae1a96634e4f0
MD5 2d9a4e7b3ba615df8d294c563013d44e
SHA1 d9c2a66a072b5c3551001941e8c75700a6ddfc7f
SHA512 67d83852bbb1bde045b363dc1f8129675c95fc373ec8a9fcf6099324b6f9f4c28e15e0609b246be2dab90af831f566595aa21db4b21a55149ac78040b1daa902
SSDEEP 12288:GQcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:GBM3tBZPzwFa7/wOifnz20
TLSH
T138652342E3968BD2EF611B7410E7D211571D78D85B10A28F7A72103F2EF7D86C82966F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d16fb6b7623936edb034b142b7d17e054de19a32de010bddeaee9a0049eb3146
MD5 a164ba918494f5c1979043a6ecc20173
SHA1 2d58703e86ba94fc754c45d0b5cd11c4b761fc34
SHA512 e92cbbff22a08ea24aeade03a28f850850a7bbb5551add195f9a4aa217d03c779bb27433ffb03e7863f336493610ee04af1488a6f47a54c04406c3ef2aec698a
SSDEEP 49152:da0h2GEkuAe73q3pp46zwwQb4ZPzwFI/wOifnzH:da0hNYG4JwxYtH
TLSH
T12185AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 0036bf992e989e6a8eae2331e805a628f24588ad660371651d6442425c05e90a
MD5 44f64c42e181eff507630adaa9ff6670
SHA1 8e70040fe7d198b7a1da15eae137ec0283f2c6cf
SHA512 ecd83f8bb6fd9cf9cc4e9cb3d59d5563b54ddd71a72ea632bde7fad2a909bc3b8f5eaa27f69096f325513d99f55380c5f578f7e85c6660c0bb3cbb5aef12efe5
SSDEEP 12288:KhbHjfXzcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:KhbHjP4M3tBZPzwFa7/wOifnz20
TLSH
T19D65126E67AD11D5E631A27D81938206C331B8651721A3EF27E2813E0F7BED54C39F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c1bad555c3f82ae3a3c6c0983348d3178cb480279327631eb1ab4d36f290a712
MD5 3059eca851025cd3550cd264620dd1ea
SHA1 b979bbfcf07c9055d0ee6f802a37dd50150ab10b
SHA512 62847bcb9fedfd51bf33ced2929c07ce8b0210755c1ad2b6cc0dec7bf905e822aaf80443bbfb9af898b4846eef1fbc87245cac7653bbd49607a87267063a2302
SSDEEP 24576:K3YgnJcRTk4yti+R5dpR/gM3tBZPzwFa7/wOifnz20:KIgnaTk46ppR/g4ZPzwFI/wOifnzH
TLSH
T16145BF2DF2B910B9C8A6D236454247B5FB71782D1F2096CB0170C538AF1AED89E39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 293a6d984082556603bd58e81c2988764e3ec3f73c05521ee4b67bc5bcc97a16
MD5 b6283901e33d41c342931ad023268237
SHA1 4f6052a6772270572773595d224d5139102ebf65
SHA512 e54548538ddda852c16480833d9eb0fe071fbd5faf59596389e7c73fb12e2c2abaa7a18a3f4ab252665a00388b1b9cba7696f68d8b03d7472ed965fa7116b8a4
SSDEEP 12288:38cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:39M3tBZPzwFa7/wOifnz20
TLSH
T166552381E7938AD1CF115BB911D7D701870879C8572163DF2AB2603B6BFBDCA80395AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 34de4240d3b44ff5c82fa06d7560dd2e1d133fed9f7f0d0a58133addcb6ee688
MD5 b6cec85c8aff7a08f6a3e2ce584a4e1c
SHA1 fdb174964f5bc5817cf4a158fa77bf2924b295c6
SHA512 bb5c55bed89c3301fed3475e06296917bb88ce8abb0f76417f645a00bd3a684eeb3b0ecfeeb019677929f630473ef0c0c46491c7395c847ee5cb8db3639bc0ea
SSDEEP 12288:3ObIA4LWOsvAYFTFcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:YAL3UT6M3tBZPzwFa7/wOifnz20
TLSH
T12785F155F79500F5E967823CC5A38616D772B89D0320E3DF07A84A6A1F637E24E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 f62abbcf5e18b18268cba0670788850e0a44eb0f03be86319c2fa4237b094db0
MD5 ef4206b8c65a9cd4acd3dcd9c98bab3c
SHA1 3c7878a15365acbc5a670bb3d8547b52013135e3
SHA512 eadf32154a06b98ef256515e978d5e4cc562a73b3adaff683bb418f59cf21432056b1a03693dd80c20c4d28d413848cd2fd0f52496f93d136d000d24c1df495a
SSDEEP 12288:hpFtvOBcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:3OWM3tBZPzwFa7/wOifnz20
TLSH
T16065021937ED11E5D635A23D85D38309D371B8A5072263DF06E0807E1FB7EE89C3AA66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b20c3f3ef2ef7f2a551c98a7b2398057347d6838387dc465617d4642765496f6
MD5 ae4c38458a7891e33d950db4b965c0be
SHA1 59bc0ded0a0ccdd9e314991cbb211feee8d95b40
SHA512 9505dcfee96ac62ccc764210990b76d7e806a099ea2584ccd7b3304f2c6363774c64e7baafb52e7451b66b1531355be99c9727910cf75b78f33d58ecc8a3c452
SSDEEP 24576:h7NM9YmZqmWMUkPjZM48Mv6bEhsRM3tBZPzwFa7/wOifnz20:h7cBWMpPjN8DbEhY4ZPzwFI/wOifnzH
TLSH
T1BA659E2E6BEC81E5D576D13DC9E28205F6B2B4611B318ACF1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 75691c41bf7188fa31fc21a243e4d6f642deb8390ce3ac209c5637cf455045df
MD5 d89592529d4d800c180787adc48a62b4
SHA1 4a1cc1252ed0421a690d2d4407a3cb5647a4e8fe
SHA512 67f13c228d733007e26673a905da43ad2c68562e5575dddc74a3c92841fa7215f4aa0a6c5fad4fcf53c10f7384e1468b66b3b4587bc10cfb1af73ead8e68e733
SSDEEP 49152:pF2YuHNETovcvNYf8kmx4ZPzwFI/wOifnzH:c6tCf8knYtH
TLSH
T111857D6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 8083a4cb282c8711ff9d5ae882b172882ee60971c897e18dbcc93bac7223e45a
MD5 bb212b1b4eb88d274493638de22b1010
SHA1 58d043dfa2078564a967ecfe353e3fbfb4e717d4
SHA512 3216f9d2aab66928dfa306657e69eefaa0bfc64830e08aef65cda569e8eef9fa80a958da4efbb30b36e05eb83a972bd0567ecaa7bda707e4ab6efdede717448a
SSDEEP 24576:kAFs06+Omlf8NXEbToyM3tBZPzwFa7/wOifnz20:pFs060loXu74ZPzwFI/wOifnzH
TLSH
T15865AF2F62AC00D5D07ED17D8997C91AF7B1746707216ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 91cc246815b6372007e2c7a5b8e16bf184766e9dcec99f7076a66fbdb2477cef
MD5 e91cf23e7eb8399805dff0dd218669d5
SHA1 0427750b29f740f7ced78833f5ae8e2e7c5b1121
SHA512 3e64807e3dbeeeeaca83af4f097f0e260aa30f0b4f5d2b8cfe591bde3fbf86278853a0ed0b447a5647bb25fed687cb5f7da3f9201a6143bf5bc1905d02f817a1
SSDEEP 12288:DCJnJ5D3VkrlzxgcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:eJnJ5D3Wt7M3tBZPzwFa7/wOifnz20
TLSH
T1E185D02DD2A810E4D4B7C374819A5756FF72386D2F226ACB28B4D4353F12EE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a6bfc7861d34e630f26b7556e5a9e1e2da103367cf22c3ad67aca603ded09156
MD5 0b2ec25b95a2b79efb2590ac2628b2d8
SHA1 d65b8e5debd93e0f21301f075d5ec3e764682257
SHA512 83b56cee813369c31732c5daff70d45ef479f72bf8b0ea6be32a1016170526b8f0dc99a68c4cb6097a0732a825c130235020f02209e0c4f30e512a0f5c4c367b
SSDEEP 49152:zo06DIKdwc+eQnSt65aVV4ZPzwFI/wOifnzH:MwYtH
TLSH
T106956C15B7EA5294E9B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 4720811d7df0c0426581b590d022b33178afe806e63f4522144ac2d51f1c1871
MD5 ad95e5445853de670110ae25a8b5d72d
SHA1 ea6726a55fedeee1b8ac93943c2c6c15229209f0
SHA512 0b423360587e5b3fa023f656736003b0800ee8047e3a7ef54519963d9da8d818c150a8c715035f1a081eeabc8a54cb174ee28aadec0003fc29fa46a5499832ff
SSDEEP 12288:tEP3Rr+cM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:Or3M3tBZPzwFa7/wOifnz20
TLSH
T16765125D67AD60E5D626923D81D2C205C372F0A4272233EF1AE1813E4FB7EEA5C3DA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 759a765e86c3671a0a1a00cc2d872a70dbe8a92849e6e48bcd650b39eab39e3f
MD5 01d0992472e5c54f6bedcd65b8067997
SHA1 c507d0dbcb6716b225418df24c75f0891a95ce28
SHA512 099dfb2471b4de381d06512acbf4e61e5efe15b39bbf99641d757f2b1b039cbf47fa15b4c6ab2a104ef85de6df43b075493c5a0db5e8df05c6a455ee5b21d31b
SSDEEP 12288:jjkyDcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:jIyoM3tBZPzwFa7/wOifnz20
TLSH
T1DA651204A3D591D0EB75073895E382108B39BC605B21A3DF66A0E13F6FB7FC59835B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 dd5b2e7dbbcf3002e626f00f9fc4ade5fdc64e342d6f8eae737083e2d171e824
MD5 9bf07587f97f7c7ea4389b89f332230a
SHA1 b0e4ac68b8932199b46c6c5878d636b28db04a7c
SHA512 7144c95f67256ebf461dc1b1c265d50f4b60738a310ea0c9384d549d614660bb4099475e4f70cfe5403e270066a6d2d73409ab1db4fc5fe776431ff3a1488cf0
SSDEEP 12288:KFRcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:IGM3tBZPzwFa7/wOifnz20
TLSH
T1DD552349A3A356D1DF1107B911E79701871878A8571132EF2AF1A03B9FF7DC6803ADAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8ac169e814cc3024dcdb9701d83ff3d7662992f765e4de462884e5e3e4f1d9cb
MD5 c9f3760178b6efc0f12f9bf8204de76f
SHA1 edf6ec4432e2025f24c81944caeb731f1f19a17d
SHA512 ea22024a39cb34f844f6eef61caffd5c69acab23bfaab80aa9b0874057f4754f0ada92c61d2e27c16587002dd270e47c41c2f65baf39f018d0bf43fd485c98ac
SSDEEP 24576:vQ9MxZKdcz97w3JM3tBZPzwFa7/wOifnz20:vVKXJ4ZPzwFI/wOifnzH
TLSH
T1F2558D2DABE905DAE177D27595A250C3A633B4301B31D6CF2448D03D4DBBEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 cde596a4b52c18d0492286150c32c68df7de4c9f2b59ea99b5c10341c02c1af1
MD5 258cf54ea5aab6dad0be06f8477f4aff
SHA1 9f5f51c67b046b2f43253f37c9a9e123d278a9fb
SHA512 8ead4d47660ea9c91a90892e23abec5263bdfb3b3e3e7ec2ee6be400a10915baa3a63f25ed2fb0f3ee7106ce316e5274b54e0550bf8621a6a4ea8aab34d84cdd
SSDEEP 12288:3yoKo2HRple9pfcM3tegtociOPyazluRF4KM7GAwOifEWDNRV8q92gnbc:3yocxApEM3tBZPzwFa7/wOifnz20
TLSH
T1CE75E05FB76A40E2D162823C89868705E773B0705B2263CB6691C33E4F679E9BD38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ae3f879dfdd3de77753b85c692cd0fc0e82af943b24691dace9e0a3788087b2e
MD5 0019667ec4c6dca9465c857c1165f2f2
SHA1 b367957f5bdb0ee01a76c358be0fa7ec8464c72e
SHA512 482a1c3c57007b0a8a198860d899c4a6f0ac5040981b661c31f268d603445e3f0708c19621b783b312b11d16bb4342a782f919876bf8e01946c1a10b9a21acae
SSDEEP 49152:qWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKE4ZPzwFI/wOifnzH:s0zuNI9YtH
TLSH
T1E5A57C3DA2F800A8D9AAC375C5461366EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/964-125-0x0000000140000000-0x0000000140258000-memory.dmp

Download

memory/964-64-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/964-70-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1092-324-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1092-516-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/1092-326-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/1092-318-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1260-335-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1260-517-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1260-337-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1304-275-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1304-506-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/1304-274-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/1304-281-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1488-233-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1488-433-0x0000000140000000-0x0000000140232000-memory.dmp

Download

memory/1488-240-0x0000000140000000-0x0000000140232000-memory.dmp

Download

memory/1488-239-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2092-254-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/2092-244-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2092-245-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/2092-256-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2092-251-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/2164-225-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2164-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2164-39-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2164-47-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2244-313-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2244-509-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2244-507-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2244-308-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2244-306-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2672-352-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2672-434-0x0000000140000000-0x000000014026B000-memory.dmp

Download

memory/2672-358-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2692-347-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2692-550-0x0000000140000000-0x000000014028B000-memory.dmp

Download

memory/2692-349-0x0000000140000000-0x000000014028B000-memory.dmp

Download

memory/2692-341-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2948-285-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/2948-512-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/2948-286-0x00000000006A0000-0x0000000000707000-memory.dmp

Download

memory/2948-291-0x00000000006A0000-0x0000000000707000-memory.dmp

Download

memory/3248-435-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3248-385-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3248-391-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3284-422-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3284-472-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/3284-470-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3284-452-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/3284-416-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3284-513-0x000000000CD60000-0x000000000CD68000-memory.dmp

Download

memory/3284-436-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/3284-568-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3652-468-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3652-395-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3652-401-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3656-61-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3656-124-0x0000000140000000-0x000000014025E000-memory.dmp

Download

memory/3656-226-0x0000000140000000-0x000000014025E000-memory.dmp

Download

memory/3656-57-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3656-51-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3872-381-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/3872-375-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/3872-471-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4516-35-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4516-27-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4516-224-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4516-36-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4572-195-0x0000000140000000-0x0000000140233000-memory.dmp

Download

memory/4572-14-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4572-23-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4572-22-0x0000000140000000-0x0000000140233000-memory.dmp

Download

memory/4612-469-0x0000000140000000-0x000000014024F000-memory.dmp

Download

memory/4612-567-0x0000000140000000-0x000000014024F000-memory.dmp

Download

memory/4612-411-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4612-405-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4620-12-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/4620-6-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/4620-1-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/4620-0-0x0000000000400000-0x0000000000678000-memory.dmp

Download

memory/4768-301-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4768-515-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4768-303-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4768-295-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4996-259-0x0000000140000000-0x0000000140242000-memory.dmp

Download

memory/4996-260-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4996-266-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4996-480-0x0000000140000000-0x0000000140242000-memory.dmp

Download

memory/5016-362-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5016-368-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5016-373-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5016-370-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5072-521-0x000002B455450000-0x000002B455460000-memory.dmp

Download

memory/5072-529-0x000002B455450000-0x000002B455460000-memory.dmp

Download

memory/5072-520-0x000002B455450000-0x000002B455460000-memory.dmp

Download

memory/5072-524-0x000002B455450000-0x000002B455460000-memory.dmp

Download

memory/5072-525-0x000002B455450000-0x000002B455460000-memory.dmp

Download

memory/5072-531-0x000002B455450000-0x000002B455460000-memory.dmp

Download

memory/5072-530-0x000002B455450000-0x000002B455460000-memory.dmp

Download

memory/5072-522-0x000002B455450000-0x000002B455460000-memory.dmp

Download

memory/5072-527-0x000002B455450000-0x000002B455460000-memory.dmp

Download

memory/5072-528-0x000002B455450000-0x000002B455460000-memory.dmp

Download

memory/5072-526-0x000002B455450000-0x000002B455460000-memory.dmp

Download

memory/5072-523-0x000002B455450000-0x000002B455460000-memory.dmp

Download

memory/5072-519-0x000002B455450000-0x000002B455460000-memory.dmp

Download

memory/5072-518-0x000002B455450000-0x000002B455460000-memory.dmp

Download