0cf3f914abc2e9ccc2f0cf6e7aa54669a72a582c2597651dccc19ccea0d1fbd4

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.3MB
Sample260820-ppdctaxbjd
SHA256 0cf3f914abc2e9ccc2f0cf6e7aa54669a72a582c2597651dccc19ccea0d1fbd4
MD5 71fc12692675a1499eb74a76ff4abefe
SHA1 10d9451da299ed4fb3b77a956460544df4390978
SHA512 bffba69e41baf6b4bdf690b160aa7f5c9645ff5246926b1a1df0c23804be2956a915655d1226b0eecce095d5ddf69e77acb441bb585ef8bf7122bd81aca31bf1
SSDEEP 12288:4xPlfqhvwMQfgC8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:41lShv3NC8LwsXYHU9MPxMu
TLSH
T118651221B1C19472D8F239329D60DBA55A3EFC345F50AEDB77841BBA4E705E08E2193E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3812	elevation_service.exe
4372	elevation_service.exe
2076	maintenanceservice.exe
3900	OSE.EXE
3968	PerceptionSimulationService.exe
3848	perfhost.exe
1584	ReFsDedupSvc.exe
3544	SensorDataService.exe
3380	ssh-agent.exe
1192	AgentService.exe
1740	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\646d153bd744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaw.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0bfa2aa9f30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b07043a89f30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6b171a79f30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000304bfca69f30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006fd75ea79f30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018584aa89f30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
3812	elevation_service.exe
3812	elevation_service.exe
3812	elevation_service.exe
3812	elevation_service.exe
3812	elevation_service.exe
3812	elevation_service.exe
3812	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeBackupPrivilege	1584	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1584	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1584	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1584	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1584	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1584	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1584	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1584	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1584	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1584	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1192	AgentService.exe
Token: 33	1740	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1740	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1740	SearchIndexer.exe
Token: SeDebugPrivilege	744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	744	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3812	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 5584	1740	SearchIndexer.exe	101
PID 1740 wrote to memory of 5956	1740	SearchIndexer.exe	102
PID 1740 wrote to memory of 4696	1740	SearchIndexer.exe	103
PID 1740 wrote to memory of 4852	1740	SearchIndexer.exe	104
PID 1740 wrote to memory of 1464	1740	SearchIndexer.exe	110
PID 1740 wrote to memory of 2816	1740	SearchIndexer.exe	111
PID 1740 wrote to memory of 3724	1740	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4372

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2076

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3900

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3968

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3848

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3544

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3380

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5584
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5956
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 2988 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4852
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 2988 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b6d0e8c5efdc3d9d271997ae9a2ca1935bb72060e1ffc266e4b04b7303d0413b
MD5 ba89eb02521744e84aff65fa0fe348b6
SHA1 e06d86243a56c4598f47fbd513b0d1aa345ea86f
SHA512 8136f4f96d92aec1ad62338e58012ee6982b6f290b3e24bac7cff3a4d97619ed56b157247ccb1dc7f30ae4a2ed03fc564bf9152d39f8eddc6fd80ca67601bafa
SSDEEP 49152:xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn88LiUqx:33q6HjBKLjY
TLSH
T1C1D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 45350145b9f8f6248c9de32fdc090e4b3c180d1f687cd7226b38703fd58ff0b9
MD5 b7e5fe22544785e95f876042e5c328da
SHA1 cd6fddf0a38249e21046d5da028e589d746acf96
SHA512 d52527c874cdd4779e80b6935cfd010b9198d89332d82fdeb32ef51f412b6ce3040b29cac3e0cb5f65fd7f615a97b2b48c0e6634e96b33abb355d984d421cf5d
SSDEEP 12288:T1XLsswWkxy2lRq2czAV8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:JXYfDtczAV8LwsXYHU9MPxMu
TLSH
T132750128A3D408F9EDA7917DCCA2C505E6337C5447A0E7DB03E09A6A0F336D85E3AB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 f41eae3895f85952d79916a5ddd907ecdffae7f68b35c0e1ad2b1cdee0a94a3c
MD5 54bd7ed724cdae05915620634bb66df5
SHA1 870e4ace1aac18971807bd1db6425b5a7f56b9d6
SHA512 653f3d8199de55b9a1648362418ded9bc23cd2d6ca48f71d64c50ae54b918f9c45aa967822ca32d0d70386b227b2c798ec4646218ba603f625a15e2132206bb2
SSDEEP 12288:iXZNYVLeyUji0h90ZD0wxpGZIVu8rHsE8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNky:m0Le5ji0hmxrrME8LwsXYHU9MPxMu
TLSH
T1EB859E26F6748731D073C0B9C5D2A68EE97230855B308ACB5286D77C3E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f4da595129c2ff5671a0ee0ff398988d15037a890321f8072688c73b8846f323
MD5 8e745e948918b4dee480918dde4f193b
SHA1 eedbcc054a366654f7a0f890c3bb13fb7f36d7e2
SHA512 5732df6decdaa2eef20d0e53a6c4a7e1e30f51e76acafa17aba12fe2a4fb7f8db54c3b63850223014631921f0ff2624418eb219d70b9c11c88f2aa12b240a855
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyua8LwsXYHU9MPxMu:+/ezSC6vUzPvxHjyD8LiUqx
TLSH
T1ED755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 adb5aca0d768f306c808726972abbc006215982ab6bfb6d44a78a083eacb6fc7
MD5 b33a217421aaf64a6f384e1076974b64
SHA1 49d9b9294c8882357ae71a39052e73a42c25414b
SHA512 6bb1ee1d90be418de8a9ac4e46200fff7fdb04ed0268a41a502201a56935a83cd8bc7181c08b6467a236188634f553d75c886b9d233264f2c9ee3882e2bdf65f
SSDEEP 12288:ZVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98Z8+g7FmsTL0v0vCHSwu91GPTUQw:ZVbqPb88hv/l+6Z8LwsXYHU9MPxMu
TLSH
T1BF559E66F5748331D073C0BAC5D2AA9AEE3234415B31CACB1246D76C2E67BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ee730e6190b121cee53a60d8051aedd98cfb55ae2d241b7a906b153d7e4ea011
MD5 b3bdf11c6a6e5f92acc24715ffd42a87
SHA1 69ac0d220a2791f9615b77eed8e6b8f718f6ae2a
SHA512 524e084ba21d37e0c6cd71f2b30065d4ae833c888f8a3268e50e676720fe7272ba72f21602256e40e382c44693c16df7160d24d2dc329b787e192ce11b6b8940
SSDEEP 12288:Fjo8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Fjo8LwsXYHU9MPxMu
TLSH
T122552325878938F2EBE6707AEDC1D74911277D68E8E4EFAB7450BFDA0871860CD9016C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 6a5442796576bbe84a1a0ee7dec4f2e4b338c4898c3716e4b3d6be30816ebb30
MD5 1210551b61006b14f58b992bf4594848
SHA1 eabef46d704ea5f7e99aa183b663a3393330e12e
SHA512 eb3adfd56e0dd763931e3f8c7d87af54ed19280fd163768e481d5497ea7565ac209c6d6a693758dcfc8fac962f1d024e82b74794990e70f2aade4e399c16c786
SSDEEP 12288:8eBNUbTVO86Uh8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:8JIUh8LwsXYHU9MPxMu
TLSH
T1F775CF3BEE28FCE2C67A5DB99A91C700977278304B61A3CBD164C34E9E235E05E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8f742dd2e0c23ecf85e476bbf7bc208e64ef8acfec3849f398cc5db40fd59734
MD5 27e36277f25519b3fc7f96931cff9e62
SHA1 8d418409a96673c560c731fbf7ea0e710f67bbe3
SHA512 2d7906ff1f52797dd4a2877a9ceda831e1616f3e077677ec6f5d1fe683e447bb61542a9c76127eb6e657fa52308dbebdda6c440a1c9d9de4f177f77958ecbab6
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THb:OQvGAdlCEL8c/yRNw5CLLjY
TLSH
T11C266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 909a54560e1f1ba505a38849d7002415bbc16563518723ec14675cbed9ef1b22
MD5 c74c64e5631361b5bf30c0e20288e244
SHA1 31713062e658c109664daca687200d21755de753
SHA512 8ef02149fe1ffdfd528f865312f4ef24671c8dfe2099fd11a90ef18164526a96895200757e80b7d15be6fcea17d49ad7a29650a760e85019545c4691341be50f
SSDEEP 12288:WAwSfxL/2Dc3tDLLmt0LDQewsAjX8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:rgewsAjX8LwsXYHU9MPxMu
TLSH
T16E75E031FE74E432C7BB0DB65B26C706143D79204BA11AC3F3E89E9E59701D26772A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 15c2466cd25c012f83fb4d018ab530996299def2b446aee1f3d6b3aa3fdd20a0
MD5 eaba2e097503e579f2d2447385e82daf
SHA1 d79787f399fd3e9e99d9cad0bebda0aadb307383
SHA512 30c2c10e1229736bf415531b2f9d4b5711e768495a7e9a8d449067d5a77759f0407d47a73e864bf998607f76e9ce9ee315f29ebe88911de339a05d9e336e2333
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHkLj:3UEtQevvqc2W1cpV2EI32kLj
TLSH
T179474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1528dabd4de2644b47f6998a08ca3cdc0a2d3fc77a868e84e75616141a8f5747
MD5 428d126d095801a7a7ccb4f7761fe990
SHA1 bb7ae1ff4cc6434c7eb21d55ce6535c17859474e
SHA512 44bb3fc574437c32679207fa015eb9d3942c5bfe03123a1189f8f29ec21607ddf0307b21ded43c897bc8c99cf0a99dbc4340dc3f110575427be0e81d625e5947
SSDEEP 49152:QCbRquA/m2yL5zTfFiV+XenmE3/z38LiUqx:5oquVjnmHLjY
TLSH
T1CBD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 72f676546b417e71924d637c5bb8c4ff0c075900df904f86837e4cf1a81ab82b
MD5 1e7090b012ebbdc20477c903d44d32fa
SHA1 c0444f6f4b1efd1ea118cb6c00d1eb2152c1ca03
SHA512 1ae4df2cb1283d79a094769226f45589ea1a4f519a521532676af20659fa057a805cd553af4fb4d84f1f44ad8e6092357b6e98f6c7d9a3ceb9a84cf7264c2e11
SSDEEP 24576:9AhGLJIFoiwtA5l7S53m8LwsXYHU9MPxMu:9AMyFoiq5W8LiUqx
TLSH
T148359D81E7F955D4F5F3AAB899B68170EA76BCA95E31D20F2150D21F0E33E509D20B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 5ec83d426fde7da80a68f01f28fdf5c388dfbc0db45078f646942b72c6e180a8
MD5 0d7495f29d74d4560df297986f5c5328
SHA1 f0f4354cea62753f36443d288402d656e5e3e110
SHA512 a6e8cb24fbbe0d3876e62d5e3871836bf0eeb583e474a6f69bc68021b8618663a814390a439b9f37e4258a80756463db8b360924c2fa34f4586ddea3b8017dcb
SSDEEP 12288:2mw5HEjsChNGBFgl0WDm+C68+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:vwuXOWj8LwsXYHU9MPxMu
TLSH
T13865F14663A81CF9E9A79139C987C136F7B3BC152A61DB1F1760C75B1F33260AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8f0a774bdd319505331a597caa549824a10da89e4e527937e2f382b4356c342c
MD5 a3aa82418fb53f96e9b4619ef29b4508
SHA1 91f66aa0056f2bb5fd9c5cf7c8b6f450227d9b9d
SHA512 512b07f2302eafb1a094ee84420b3d2911d264da733daebd0b023415b1c5eb3cb7414f3a97b2d3f77179dfe3683fd0e39367660d5a2d8470d9b40ff4881e6eb1
SSDEEP 12288:fHZ1Iyn8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:fZuM8LwsXYHU9MPxMu
TLSH
T1F155126A23D830F6E6E3613DDDD18609E372786567B693CF256087AA1F739D08E31324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7647fe7c749dd8bfbc1fe54884ce90bc8cecf27da99deb5c160f22ea45cfe52c
MD5 d7fda97c6fcd52451a0f14986dba177a
SHA1 1ab7aa0e2b74b426434f6d826f4a9b0b2a17e7df
SHA512 0d4d2dcbcd7edeabfeeec4f57a55b6c68ab7641a4ed8e3cd6d96ec1358e10195ace78a5be19d4ddb6c314b39aaf48677f51e3b71d7c7be0676a1663e9a13ec69
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:0QRQyi36YOcPQLvw2gAf+PN3+LjY
TLSH
T170667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5fecaadffd17fca702061e3ea37c7b4f4a5cb467d5763d1123e7d2fa1528c0fc
MD5 5081f0cdab208b59c3e05e525f4a179d
SHA1 be79038b60857354fd1188f2a8fa9b1a4401114e
SHA512 4895814b0055886950c74ee6a44b5358ba439407dba272e8ab5e80706089b6a2fa93b330869e81842949179508f2a05a4fc28af17f5f577927e8b21eca32057a
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:1QRQyi36YOcPQLvw2gAf+PN3+LjY
TLSH
T12F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a32230f623845395df8ae3dd4f0672b710bfa5ba8b0e4d33e274e1319c404242
MD5 977cb60dd9423369dcf47b987cc9b8b0
SHA1 4843a5b2f1a574f7da9926d1a6def295e750264a
SHA512 337b4ed0fb2b75e674a5595ece2e8ad4180e13d8309653195b40d0e36cfb5a28959c75a2586fcc47a422ef29a22088e10b7a3b3e4158c53524a72f3b97c61bcb
SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL088LwsXYHU9MPxMu:q68Qg55nhheWu7PNU3/H8LiUqx
TLSH
T1FBB54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851173061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 09ccef48f273df0df776aea60f2675396c9350ea1acd61b5ce9398688c6ee366
MD5 3552df711c2934a3ff274e4a312e17ec
SHA1 36e5aa08cee87cb324e0ed596f9b453388fea217
SHA512 11248e3e0e3bb6ac8e6862885ac77be77e1b560feb3c6fb823e1c9757e1a7994ff5722b3c7ad13b31793cef7e0c327cad97956d19f043907e9c528efb6c78c37
SSDEEP 49152:+3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99V:/y5112gYy5azzVvL69nLKnhZVLjY
TLSH
T10C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fbb51970eea7ee96bfc036fe9c0bdd7020f1298a9d25f4359651d22736fb927f
MD5 a61f88256bbae61589590f342cdbae66
SHA1 7e53a5f1b8fe5c5e094a08843bbb4e8460028021
SHA512 4029f9f1639247b30692bfc12e5f48314914d32698061d01db9814b692fff49efe630eec23b5c88ecac6198a4a36f11f82e2b206540f950710754d8a4015497c
SSDEEP 49152:VB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glF8LiUqx:bu6JmVxd2dmLjY
TLSH
T1CAD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d99ba039a334a9e1842b53c8b7c219cb9f26f542b4da3c1b7febb560b0b6df59
MD5 2df604b6401bab6cb38370962b8fc16f
SHA1 9eb6dc9ed4cdacc9c79e4072e4bf239b5ed7a6a4
SHA512 2f13c7c955f04a3eb4b245a241e666f08d0ffe2fddda46fce4b70812e09069fcd2630beee7b11220e9a2cf16e78b99edf6f50825c10430e153d1816465b9a7ec
SSDEEP 24576:dhv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3R8LwsXYHU9MPxMu:X1hpsNoJpF1A6UU44CwH7R4xB8LiUqx
TLSH
T151B5AD13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2d6b9268ced1d1241b5295541054d5c040df842a5b2edd81f60dc502d02be767
MD5 9e400f2400c5d23272d5826e98456342
SHA1 0cc9edbfb8268ad56e65cc9af40393df4473b131
SHA512 c187def28a3436e316a3296f64dedb6c28582021a39650bba1b3f915de2ace0b149d2f36a8022d5b3cadeb4a821926a86b9b2ecf28d4fedebbca85b3fed2cd41
SSDEEP 49152:BSuZQIY0Be2KRRVtOnks6NMHqM8LiUqx:P5dKTi61JLjY
TLSH
T1DEC5BE13F2E940E8E0BEE674C7669232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8192d0af1e11110cf759ef5015eda463f31f56f2ec942801f4a101326097d70e
MD5 29c49a9ffa0646224b5c5df17c18ddef
SHA1 34d55ae6084dc85f4428ee0a9e28998a040608f7
SHA512 f5d4c5e1a790f1f4a948b7a54f29b9486b5e19a0d896a69754d72f449ffa61a09266c08563c0b669f36a5e76d0a7b7bc1f8f6445b9a5ac5d7726680306776741
SSDEEP 24576:ihiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLR8LwsXYHU9MPxMu:ihtSn8EApI0figngiDn0AP5wV8LiUqx
TLSH
T1EC95BE13F2D900E8D05ED179C7468632EA62BC150B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 989541752fdf494ac8be7f336bffda05aa67f2b82281999f3fab5d9541543151
MD5 24c1de1fed89f6b26b04f34eb9d4bb1f
SHA1 2a159b11618c7304408e241a78aee8d901e56237
SHA512 83857e8fa6c711f546fc9828589cf534fb4e48a21ea3ca65dbdd07ead1d9c03cd1f26bc04d9956c3c621eb37bc4f1dc9b37b1d40e70957143429e465d69c4e4f
SSDEEP 12288:Qw8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Qw8LwsXYHU9MPxMu
TLSH
T13955232586CA28F2E9D571BBDEC1C34861273D6CF9E5A7EB7450A79609B1CB0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 51f2bba2d3c0597697b99496807114dcf7633a5d699e85ec448c28542305d6e9
MD5 b52f563572d0b3e4abb1bb528af71a93
SHA1 dd9bd23bf787006f96b7d5227d31c505577d354e
SHA512 c7bed2af3f20c0c9e1e64735b190e3e8c54535b1b4a8f68d8701afd7b2ef74ea2b8d51c301f4dc9060fa92bfeb1a61714d3e1ef147978631de396310666a4fbf
SSDEEP 12288:B78+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:B78LwsXYHU9MPxMu
TLSH
T10455233586CA28F2E9D570BADEC1C34861273D6CF9E5A7EB7450EB960AB18B0CD5047C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f0d3ddaedf603d1a206ee0ab3e57ed175ba49ec941e64ebfde0db936a32dd870
MD5 539cdc2e80acc342b264ed5bc39d7474
SHA1 31d1395fdbc465e01e86a5752a136f098481ffff
SHA512 09028423ef3ee3f94d44f88d60e85ab0cf602e60c3e9b98ec232e1b2405e247e7509ec9bc1309016229fee966c033cd0283f4dc14643fa3f6b4da06364f94aa0
SSDEEP 12288:sJ8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:sJ8LwsXYHU9MPxMu
TLSH
T15455232586CA28F2E9D571BBDEC1C34861273D6CF9E5A7EB7450AB9609B2CB0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 22a343c7cf59cef9b03fd000df43cf460dfe7fe6a878229b735f13f1acd68bd8
MD5 76b338be9af7a4bccac0c09e370ef1c4
SHA1 4552f25c59e62108def8876aa13909cdad3d3046
SHA512 cd7d6d4f5751f84f500ef8c9b64b8a90192c971af8926a808fbb9bae2cd1be76405212f6e8e61c9a5503e4cb006a9ec4ca82e187994b35cc9e598cdee6c7e40f
SSDEEP 12288:EVG8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:t8LwsXYHU9MPxMu
TLSH
T1D9552325479A14F2D8E2F17ACDC1C209E2777C68E7B1A7EF75005B8A0E715A0DD7066C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3bbc6041baf6ade5a440c2890fa1d6ac8e0795b8e8c7ba2be9bb986b7f6447bc
MD5 069e1f028a79a4a81ad72b9547376ed3
SHA1 32ce8647ecbf0c9da13e2bec2d3fcd26769396e6
SHA512 95158861c6b1ecba95cbf5aebe38f118222b39107dcba4e3e5ae49e9ec92d8611a5f58126c435be63e39e7442cf2e7eb5c94363d7845f215d2632d42970b7c05
SSDEEP 12288:we8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:we8LwsXYHU9MPxMu
TLSH
T19F55232586CA28F2E9D570BADEC1C34861273D6CF9E5B7EB7450AB9609B28B0CD5046C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 81b3d82fc60a72c52e161fd67c908ab85140343c3ca0fe91845d70f31c28e257
MD5 f343bc09eaf0af7b4612df55831cd022
SHA1 214b679c176a0c6430a3f1c4ce8ff48ef35c2f47
SHA512 48c54037c03d9b6346cea0d5b908dd3fd632f75cb7dca71e84c30cbd54e26b97ad5ecdebce564e23b748a12a1ffeef31cdd3fbb514ac790d3a011256a3f3ec95
SSDEEP 12288:E/8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:E/8LwsXYHU9MPxMu
TLSH
T1AE55232586CA28F2E9D571BADEC1C34861273D6CF9E5A7EB7440EB960AB1CB0CD5047C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 886b92655eba004cef79b26cf756a6c24551cca85ed7a3d485c20d7178930e13
MD5 013c2f723d0f75f1d816c960ecb3b862
SHA1 7919a5bf62624bcf3c19b64804dba4c08e19f371
SHA512 392f16e9f4812dd195488d0b152330aac77907309ff78e7422ba58671e265d8f6e34484338a6d2e57870aa8fedfed97df2d9ee17c7d0ec22ec88bdc4597ec3eb
SSDEEP 12288:vT8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:vT8LwsXYHU9MPxMu
TLSH
T11255233586CA28F2E9D570BADEC1C74851273D6CF9E5A7EB7440EB860AB18B0CD5047C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 106eacb94c8e5027d247f9529edb7d6ad81781c77544571d8a955acd51129790
MD5 801a0551f197109201b9e0710f05958b
SHA1 da5d9e600e20fb72bd14876ff0acc0b6e00fa6fe
SHA512 86b2d4e2bfec87e21a24d71f59c36dff22544a2242821e7b83d72d28b5c59c34f5a1ef1521f76ef61c401e7b1fd1022ef795fe5f316546fcd43a5dffa7cf4509
SSDEEP 12288:QiZwbzzzFEoS2cPvyb8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:TZMnzFVSOb8LwsXYHU9MPxMu
TLSH
T1CE7501A5B39018F4ECA7813ECD518906D2B27C694BB0C65F13A4376B1F733A05D39BA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d899a579d784bd101c911946060d7eaefca024104b092ed4253c0770927fac86
MD5 32c338685930e0e9dd842e0de558b591
SHA1 a9a94ce511d469e0a112ed9fde34cc9a782bb295
SHA512 3919296a2a3f4fb360b87e168247c1f8dbe8f79aacc864af0d2d51094286ae3fe2922f36a9bcadf8a9df57d50ebb9b5e0af76c86c0da615967a01a9adc8a1376
SSDEEP 12288:dc8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:dc8LwsXYHU9MPxMu
TLSH
T14B55232586CA28F2E9D570BADEC1C74851273D6CF9E5B7EB7440AB9A0AB1CB0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0f1a6c14aef94eb540930926feee833abf64492f17ceb327f5984b52fc339534
MD5 71be0e8ca2df982b2d22378e6a9ffa7b
SHA1 db8387a7bd9bff687e7f178018b4a08b4d51ca99
SHA512 3ff674d5e237e11063a2cc320a15e60e31e3c6e719f40be9c188681de4b630fdd9e8614c1f37abcdd34860b493c75d851a12d3b105421f8da16f7c0c5b162bf1
SSDEEP 12288:t48+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:t48LwsXYHU9MPxMu
TLSH
T12455232586CA28F2E9D570BADEC1C74851273E6CF9E5B7EB7450EB960AB18B0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 21c1e6f4102e4703b461a5f6055a4578898e0f92562eaddb12e1240ce87c7699
MD5 d58d0d317cfbee1c83068f7ed5153d7e
SHA1 97fa2ba375061c1a92e651b6c8a83ed43125b654
SHA512 5e5e17f2d8123383bb392f4818eedb590fa5e611ccdda98112c622121df4740dd010d13f2a7e0161b001307081ec28c4dfa18e99fe344515d8fd9da4fae34119
SSDEEP 12288:iyPz5L8n8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:/zyn8LwsXYHU9MPxMu
TLSH
T1A365021763A530F9D5B6A239CC924A05F3727C355B609BAF23A047761E336E09E36B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e5edc12107d6fa592540ecf045fe5147bd7bb1d8f2d241b569b23c36c8529c61
MD5 0e3953f3e434d15fb5382317f2028220
SHA1 50544b5655ea7d3f9737b453da5140503821caca
SHA512 1e0f127fc80dadb8ca519c1822e8008696b843373c8b0a6ec9c9c94e2dfd36acdb5b5a7b9619c9c15c8a931f22ab4770d70f11b94c0eb77d1e3ba6e810c1f1bf
SSDEEP 12288:rc8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:rc8LwsXYHU9MPxMu
TLSH
T18155232586CA28F2E9D570BBDEC1C74851277D6CF9E5B7EB7440AB9A0AB1CB0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 18e57493b027e128bb1849c7de91b4e3c32172b23efa4f71eb036b45321a895b
MD5 ee615d2743c5dd70aafe1366eaf79a7c
SHA1 8986d2d261c3d7ca9bdad19d42e3cf4c98c71a61
SHA512 b5892a9404bff25a0f5c7f97d5d59b67d5bc7577df0aeb3600a9554293b4e9b5c78a9d2abdc6ac0728b3d78bd302a78ea955c92e1fd94c794e76986ec2c57e79
SSDEEP 12288:9c8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:9c8LwsXYHU9MPxMu
TLSH
T1F1552325868A28F2E9D570BADEC1C74851273D6CF9E5B7EB7450AB9A09B18B0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 8c513f98a0fe5a7f1c05df02e7ebb86808781302596f82c5d1355d4b4e0f705b
MD5 2527d1410fe0edfc567ac99e91069c31
SHA1 3fb743c0d2fe05099d04803ac91c473ffb7297c9
SHA512 e89893892f59d8a763fc6e8a4e268ff387bb1c70be749cb5997bac956e68fe621b00e6ac236483d461331fda8172fcd98c9dae187fd4f8ac12b642fe8175e794
SSDEEP 12288:MyPz5L8n8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Vzyn8LwsXYHU9MPxMu
TLSH
T10465021763A530F9D1B6A239CC924A05F3727C3557609BAF23A047761E336E09E36B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 e17fd699855c9136686aaf22afbe722ab4812cf8ede8c1a841862bddfd8a1056
MD5 f68cd060cb2df218ec739f2663c3f625
SHA1 28940441ceb12cf3a617eb935bdaaf5ce417de84
SHA512 839095be0a18281002e64302cd883f5481c30b6a009bf52133308b04c92b1285ac427fd2774b50474a5ace8c0f8feb517abb829f5d9356e7d43e053ec5f943f3
SSDEEP 12288:YCd99WYoaLHF3z0z04PDvh58+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:BTkaLl3z0zD58LwsXYHU9MPxMu
TLSH
T1AA7501A5B39018F8ECA7913ECD518906D2B27C6947B0C75F13A4376B1F333A05D29BA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 b19fdc8c21b66f96a831945e9cb15d1c32b0cd3822720ae71f7262c0f4e39448
MD5 072a49d580ca5675672580e21349416d
SHA1 d0d93ead391d10d4bb282069c242e8c149952e4d
SHA512 669e7d3ff9d51abb599b9ea529ee6f685bce36801634edbfeaf8a7fb756ade87ba95516a4dfbfaa3b7b57ad580173ea7b5b016f38a4410359f812dd1cc1ae418
SSDEEP 12288:Oi4e78RdTfgwCHKy7GLbbdIvy8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:O3ld9CHKy7GZ98LwsXYHU9MPxMu
TLSH
T1FE85CF90F3E814E8F0B79A35CD628501DA767C695B71DE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 91ccd7c8b4b5bd3225156f722c764f33b0040fb83eb2368b520f2ddcd4c27a29
MD5 4925c23e1486f1ee288ce8a839739429
SHA1 aaec90afb9038e144675da05e445ef946b6d348b
SHA512 55b1cfa27c41168523c8051c8d9edac1b9ebfdd2afbf33a043ef1aa87dae69a650eaf7c4bbcb8e08527160c4b566403b4c7b5b17e56fdb9e8f243850777df0f9
SSDEEP 12288:ep8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:ep8LwsXYHU9MPxMu
TLSH
T1E4552325868A28F2E9D571BBDEC1C34861273D6CF9E5A7EB7440AB9609B2CB0CD5047C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9038da5e79accd8e26a19023daf44f0baaa6f654b3df78ef300727b044900c14
MD5 626b72f33b8f325526b92b4039338f4a
SHA1 28ee1bef9d95e6f6547681c2098eff76781c2f92
SHA512 3089d3abd20b10471fa322042ef5e2624285b295c15d5a5bf9ff96aa86f58a974e50d1d72478af8759a71468245892473d112e5e5f6bd1313d78d322e43e2aef
SSDEEP 12288:2H8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:2H8LwsXYHU9MPxMu
TLSH
T16F552335869A28F2E9D570BBDEC1C74861273D6CF9E5A7EB7440AB960AB1CB0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a6248b6391b48f8d329a64e5b456debba7ff468243f9febcea3111e64261961e
MD5 dc8ceddf483486afa842fe97e55210da
SHA1 5f642ccf1b4583856bc31d14e6cae06fe9c2d78e
SHA512 7ec00bd6d9e3c18857899790df577af81146cc1b084b87be819ab957136b266573cde2eb8b297f87dcb392262beb882a05fd65761f4e6dc5a1271c9dfa251c0d
SSDEEP 12288:fy8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:fy8LwsXYHU9MPxMu
TLSH
T15B552325868A28F2E9D570BADEC1C74851273D6CF9E5B7EB7450AB9A0AB1CB0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a056b6ddb7badd38cc452426fcc4a349c161d78e246d89381eb24115f3560bfa
MD5 3002ba9aecddc772b83b607ca67a6d10
SHA1 dc92881935cc88a6f49793e5a714a6467105e4fe
SHA512 040643156c4f4d673829866ae5eb98a4fedcda6cb466a13051ddbae04f965b85392e42a56251b909dee6797e2d031ba76d88265f216f2383b138e24fd620d7cb
SSDEEP 12288:Yc8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Yc8LwsXYHU9MPxMu
TLSH
T10F552335868A28F2E9D570BBDEC1C74851273D6CF9E5B7EB7450AB9A09B1CB0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 4bdc648c0de259691934e862391117cbdca3b24435bbf74df2af0a40c29b177a
MD5 13fc163a3e1c3bb6eb7c7193e7cb2b88
SHA1 7ab1055c058f76ab133635082a22b23dc3cb285b
SHA512 c8046f753f016f65364be80d66f38c5c9dabe1af5e80589e263d7e2eb4e1bbc39c74e4a5fcb6cecfcc5065bc8da509652e2ef3457c953a28d900a77ed7484e9e
SSDEEP 12288:Bp8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Bp8LwsXYHU9MPxMu
TLSH
T1BD552335868A28F2E9D570BBDEC1C74961273D6CF9E5B7EB7440AB9A09B1CB0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a10d6b44797169c79bc153a4ff5a2afbab1791960a219ded515774277bca7301
MD5 a82421448558aa32340f1e85a6e92e29
SHA1 c6125e8ade75add361e44c6d7ab927d84c6fc17e
SHA512 3933b85009fd5c29c49cd59f29fbd809d2806b59ba32fe2d2dedf3ee64b2654b4e6c13cd7ca9606e95be22eefef847340c0b7e23db96431147374d6e3b9a19c8
SSDEEP 12288:j08+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:j08LwsXYHU9MPxMu
TLSH
T17455233586CA28F2D9D570BBDEC1C749512B3D6CF9D6A7EB7450AB8A0AB18B0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 85e2c9c3c674fe6a1d82059e51226500c4155fff048ed6079739f0e2877b2124
MD5 2a6374c34f78b5981be6abb74246e8f8
SHA1 73689c7d64b1eaad385b15ce4a6a8f6cbafa4196
SHA512 71ccfbb41712bb0b533c86a08baf0c23f9452d9938fc9d6ac7731c6b5906c5469842522c6ada5834202a5216cb6ddb1a20c8f52ff64a65df6dce28c3eb02db94
SSDEEP 12288:Ze8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Ze8LwsXYHU9MPxMu
TLSH
T1AA55232586CA28F2E9D570BBDEC1C74861273D6CF9E5B7EB7450AB9609B1CB0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 ed6b29467d7686c134adfcc992dbdfda96a9c82a99faf0cf0f21e0bce2a3765d
MD5 0d01cead0d8a900c776794adb7c966b8
SHA1 c2baf1050aac076a0e38291a8049638bcce7cbcd
SHA512 5661365726482e976045f432bf343c6f6d34259fd2d1888259ae20d9c537a8e0c29de7aad953cab531ed594887beec48b8338cb735d7084fe50350c39fdbf563
SSDEEP 12288:9fwvD5uw64Lk3tRX69qkyAI5q8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:9fwvPk9RX6wkyAII8LwsXYHU9MPxMu
TLSH
T1A085CF29EBDC04E5E1B7913CD9A3460AF2B178685B71C6CF129953AE0E33ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d408a1016a2a5b329f71f08c0a67955ccaeeda090269f60c35ed9456a59f4c03
MD5 3188ff7a0f1b478ab8966a7698277190
SHA1 c61b7fd2ac3ded2bd9101aca943cd3283f588476
SHA512 db0d5c80f1c15c5fc56090f302448d66565ae680765c40594639c234f311978c9953a771042faa72f00f00c972fc46a68626e4d811576b2a8468139b1b55dc4b
SSDEEP 49152:iYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK018LiUqx:cySzPeLjY
TLSH
T165066C96A1A801D5C1B9C1B98F0BCC1BFB7134490335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cdff6a7cd090e02ce68e41ce79e20f8bc1925ea0351eb63247b5409573c97771
MD5 aa66c95758d77cb3be9dff3becaf0493
SHA1 d01d34b697a3c8b4e39e30f71bc0e53a3bcd68cd
SHA512 138f1ca4ecd05211c48d6b2e9c5834d5e5584713414e9c62e506f3cb4b9551d934edf5e02095755fc1f53f7622387958a9450c92b1756eaaa1b0dd92c174be87
SSDEEP 24576:F47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYr8LwsXYHU9MPxMu:F47JUQj1irIhCnDHUPfF/F8LiUqx
TLSH
T10465AE1DA3EC01E5E1BA927885154A5AEA71782D5F31CACF2270837D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 343c32d8d6d3b8b514f5432aab3bd61d8173e41a4f36d2f8a1855dd6f7115a14
MD5 bce62896cca7fcb30f0bd2f15d14ccf5
SHA1 17fe77a783c7faca347a8efca3a649c879f99461
SHA512 90eb8afe88acce7748e0613f7cbdc6d43a7c4ee4a3413bc0107b0aef32abc986361fc3f3d88491e8b6ece62b026adf3dd17500fa6b8c0c4c9b12c173f74b24ff
SSDEEP 12288:U8sfM8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:KM8LwsXYHU9MPxMu
TLSH
T16D650119C29811E9C0AE617ACB828A41B3337C6897E1E3CB62D0F67E0F765D09DE5717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 36bcabd5483f06f5a05f303ae9889fc34c63e2179f74bc155a2b23344c0d6c5f
MD5 a4133b2bb0973d80cd8b14a2e7f0262d
SHA1 47b871e7d7c48d487ec0da0e50e78266ec8c3b60
SHA512 5ebce9e8c64621dcbb109429caa1a1087b2ae0c34ced5b8076165950611f0d636c1d91212ef9f0e58e7c5473a8cbae8dfb0109842d11be467b8bcd68d1d2856d
SSDEEP 12288:JVZbzcnU3fE6RcxLIEqa6iRV9Ur9gtlZqf6/AmR/BuyQngd:JV5zKUPX26iVUr98m6/AmLuyQ
TLSH
T1F5351851762BCB5FC6A940325E33C2CCA7707D01EE456B0372C8873FD576669BAE2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 3909d2731ccb1f22db5e50667ce2ed0e8e4859f79f14bd43db9ec5ef387a1c55
MD5 0e40d775725aa8b73bdeef84b52840a2
SHA1 2b03d8bac392e1d350a1775a2d10f6478c03d6f3
SHA512 3f52074d67d582d39be5a5b86a5a1ab91591268e8e95f31647ca8483a59432e412d3735dcd7b89ff77a837bbd47e8bd066ecd72d30b0d4d3f2ad04305c0a36dd
SSDEEP 24576:ncYaaNxoFJJJS5Q7lIXwmhXU9ZVPqeTKkG7:fmrTu
TLSH
T17B55D8419137E38FD5FA6032072A6B4CA774DC07B7456F27B388453AD86AB25A4BD3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 44b94d24497ada82f3897c6e635fe0f788dc3e1a5822517754826f143c0b0457
MD5 c5f3044f47d1e630fdbc9526db523df8
SHA1 bb0448a608d013e8f57f47cbb721e0d75350ed2a
SHA512 01606c1210a8287ac5c73af820d686a1df4f4fe957ac0f2bdfbc91b932d2c400b9cd9312bc5b437d43e712a160c5777bcd8ebcdfc5267cf9e4005218c5c8b7ca
SSDEEP 12288:PS7k8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Ok8LwsXYHU9MPxMu
TLSH
T153552331879D28B2E9F57179DD86C208212B7D78AF94E7EBB440A7DA1971CE0CD7062C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 66a5bd797e69cf59e0f7042d6c0006a12800e262e076fedaa51b36bb52310bcf
MD5 c8272ee08aa85a52811384403867bcc8
SHA1 29348fceacb9eb90d215d414ac9d5394b9276553
SHA512 bf30dc6aa37ea732dccf892b9ccc5daff0c08df91e63aff6d8c431ee0185ba26548d7e7106869a28556341eb2482037c8bdb9841b62a2305372d429264fbe21f
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYa8LwsXYHU9MPxMu:mgb4mBIBhGFr8LiUqx
TLSH
T10C65AE1E22EC02F5E0FAE2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 20b8d4e44a66832cfb491253b15052f5ca330dff0bf638f18f5fedb42f96c34c
MD5 8b4432397115c97efdd0267d2efaff37
SHA1 bdc32bb1412390e4c1894732a5db5a84b009e57c
SHA512 649c6c0fb7d2511d8f90d5a863137611c3d302350833697f1164e451f1a1b52fba7297c6f965bb59f1c7165e62bb5569afbb1733b666ac9fbf1aa3d151bfc7f3
SSDEEP 24576:2G88u8FpJqH1gzria7/mb8LwsXYHU9MPxMu:d7ZFPqV/a7/S8LiUqx
TLSH
T1E385F16567E101F1D4B7E138C9824663F6B2B8251364EFDF06A88B551F23AE04F7EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3750ff1216c95eedc6b267bd185a6e8d671e2d1083aa9a90c5b6ac8573c2cedd
MD5 f95ecfc8ce5d338617b6144405dbb832
SHA1 ba230a67eb082b2ff63e579285d33f81987019f0
SHA512 19ef1471a33cd767eeec47218d7f19c28cf6191acf159075cb88924c76754071778f6415808b662b7c7944cd2a09cf3e151d95658539a3b8af3d8d66a8643a84
SSDEEP 12288:lHvUrBFrEjwaQP8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:lPUr+NQP8LwsXYHU9MPxMu
TLSH
T19665E12F62ED18E5E676A17DC9828709F77278611751D2CF02D0827E0F63DE8AD39B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 99ed6cde21e7831d28fd4a5ee2f25cf50181cc3345f84efbfa19868b1f04bec9
MD5 7bd8df0eba19eb5e19446d7139c5afa0
SHA1 648347389b168f7ad907ece7969f8e2037a123f3
SHA512 51538472c9f3251745063d5055687f301a2ead95c511c66458817106eb7123441895fd38f901089776c71619da7efc2ab047ed81ecc0dcf53f3a9a13ba792d89
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/8LiUqx:+G05lO43bNLjY
TLSH
T1A3D5CF6A62EC11F9D1BBD17CDAC6460BEBB23815033556CF02A486A91F23FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 75e3932b3423fd0d86800e930144a72dfbd3a0e697798135882f9ff4e5e6205c
MD5 ff081a3cd2e840e911bd69a3f4fd1f25
SHA1 678ed5f8af9cb3c0e3d1bc4791065b65ab0bb4c6
SHA512 7d9079022f2d722b48770899e341224ff577446884f866b43dc6516fede200d70ccefab6a2818c70963853bd88e12f0df399bb9aa26bcbacd0d44e1533007f91
SSDEEP 24576:nfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn18LwsXYHU9MPxMu:fa5POZ3+Jt2pasx2+mH8LiUqx
TLSH
T1FC65AF5EA6FC00D5D5B9D17DC583860AF5B1342553329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2bb36ff0ac777d3f52f17a7f48fad37348a9b5e7b87a698c10b1084bdf8933b7
MD5 86b6744312b351db062cbc5ceb41ba9d
SHA1 3884660b2d2f22f5aca70c057647c7708b62eab7
SHA512 041e75caf50f50a13cd4e0f2e2a5194c9eab222df44d746b9e2121b8d6bfb5183b4da09fd233a4e15be569e29363417a32d4f444552f57d5cb5f57700dde6f22
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkD8LwsXYHU9MPxMu:5Nc/zEOVHFy8LiUqx
TLSH
T128858C2623E901E4F5BBE1BE89679546FA71786953308ACF0291811F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 547d9bea8638d8ae5d5d1be389eaa52d6cc33196f272293b03db52990bb0f56d
MD5 a9a0ac307f4bb3e25fe1b8dfdbaa91e4
SHA1 d7ac53a8d32ad35b703efe586c370e5688bec56b
SHA512 e3d26d99192adc5debd29990a248e1c072cd7e44e820d4b9538a3da9148a8ba75d3d0ae923806a80d1c5ffa13436f20cc3a0876643628fa18c76214ad1b3e327
SSDEEP 24576:x8kNvNnaFeYhJNtmZBmx8LwsXYHU9MPxMu:x8MwBtOmx8LiUqx
TLSH
T18A55AF2EAAF806E4D1FEC6B5CD238512E6727861173293CB5290C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2dd103f1f9b131690f4b104eb3dfad0226c4d6e8b94249f7c04c81f5210fb3d2
MD5 f6624275a09b8434b1f86d9af05a22bd
SHA1 34e8beb1d3ea2a9d78d7a8cb9b17268c5e61d396
SHA512 f9daf1f6450d205de7065e2fc67a1bac32a4948ec09de9afd2b5f56c052871b039c103eb425e489f49a804e3633c492f59afd7fb257ca3e824515dec470b9ae4
SSDEEP 12288:PQcMxWDXN1Dp/fshBItT1IQgAQ8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:3D3FHshBIYQgAQ8LwsXYHU9MPxMu
TLSH
T1D675E13DE69C04E4E57AD1BCDA538A06E77138AC032266DB11D0C2BA1F67EE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/744-1-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/744-6-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/744-7-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/744-77-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/744-0-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/1192-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1192-130-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1192-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1192-121-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1192-127-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1584-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1584-322-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1584-88-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1584-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1584-81-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1584-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1740-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1740-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1740-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1740-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2076-52-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/2076-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2076-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2076-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2076-38-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/2076-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3380-108-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3380-114-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3380-115-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3380-305-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3544-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3544-93-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3544-307-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3544-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3544-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3544-99-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3812-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3812-14-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3812-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3812-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3848-302-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/3848-78-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/3900-271-0x0000000140000000-0x000000014017B000-memory.dmp

Download

memory/3900-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3900-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3900-54-0x0000000140000000-0x000000014017B000-memory.dmp

Download

memory/3968-287-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/3968-65-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/3968-67-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3968-73-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4372-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4372-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4372-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4372-107-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4852-320-0x000001BFFD830000-0x000001BFFD8DA000-memory.dmp

Download

memory/4852-399-0x000001BFFD830000-0x000001BFFD8DA000-memory.dmp

Download

memory/4852-400-0x000001BFFD8E0000-0x000001BFFDB6B000-memory.dmp

Download

memory/4852-321-0x000001BFFD8E0000-0x000001BFFDB6B000-memory.dmp

Download