30d0533b3841e2c0d217801a3a5f1cc08f0f2a5a360b8b8d9415ea8a59593a05

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Size 1.3MB
Sample260901-243bpsyfqh
SHA256 30d0533b3841e2c0d217801a3a5f1cc08f0f2a5a360b8b8d9415ea8a59593a05
MD5 f88ba6727aa6e7692dd5dd9f02015148
SHA1 b3bd754cc7f10f1904a57c55b67a95a6f77bd819
SHA512 d1339e010f6057ce51f7e4f12c055b7caa1adb5721160485f7208d19ed8de641c7914815c53ce2411517f1f9a967dfa3b359f0fb1571f7edd296056380e9b6f5
SSDEEP 24576:1JPq5oUkIxqujKeT/Zvdp/Lrd6jBqmuN0Kebc46vVa4eZwq86QAhhUkXuMDtz6B6:1AoUkI4ujKeT/ZvTDrMjBqmu2KebcFvS
TLSH
T14155BE11739AC039E6B226B099399BA6453EBC717B76DCCB23C4796D48306E15E30B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1632	elevation_service.exe
1324	elevation_service.exe
6064	maintenanceservice.exe
4308	OSE.EXE
2300	PerceptionSimulationService.exe
3264	perfhost.exe
5164	ReFsDedupSvc.exe
4776	SensorDataService.exe
1244	ssh-agent.exe
5488	AgentService.exe
5556	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d308dea0d744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9a0dfeb663add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3bd962c673add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000644989ec663add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001da2c2ec663add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002473222d673add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006090e82c673add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024ec8fec663add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1632	elevation_service.exe
1632	elevation_service.exe
1632	elevation_service.exe
1632	elevation_service.exe
1632	elevation_service.exe
1632	elevation_service.exe
1632	elevation_service.exe
1324	elevation_service.exe
1324	elevation_service.exe
1324	elevation_service.exe
1324	elevation_service.exe
1324	elevation_service.exe
1324	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1540	2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeBackupPrivilege	5164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5164	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5488	AgentService.exe
Token: 33	5556	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5556	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5556	SearchIndexer.exe
Token: SeDebugPrivilege	1632	elevation_service.exe
Token: SeDebugPrivilege	1324	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5556 wrote to memory of 5912	5556	SearchIndexer.exe	100
PID 5556 wrote to memory of 4572	5556	SearchIndexer.exe	101
PID 5556 wrote to memory of 4316	5556	SearchIndexer.exe	102
PID 5556 wrote to memory of 5460	5556	SearchIndexer.exe	103
PID 5556 wrote to memory of 3392	5556	SearchIndexer.exe	107
PID 5556 wrote to memory of 1356	5556	SearchIndexer.exe	108
PID 5556 wrote to memory of 1812	5556	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_f88ba6727aa6e7692dd5dd9f02015148_amadey_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1324

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6064

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4308

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2300

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3264

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5164

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4776

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1244

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5488

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5912
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4316
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5460
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5ce2dcf41f011048253db782d8ed5ff14659265a831d0de32640218e55586aa1
MD5 ab95e2b02c9c920d9eebd3d88e330abd
SHA1 f83e0ac7160d8533bad1f956ccdd39f13c68fd83
SHA512 6b5e9df8e329926b9b00c870e2e19845882c6256b13b30eb07e61edd8b11b38ccf56a6abe3c58f8b6dfb9fab512d4d7f98ea014922a05c0445ad75893375c3a7
SSDEEP 49152:Ab+632BuPkFKRrdE6ohQstBhuXjfS4LWxnkebcFvVa4eZw6QAhukeMJz66:q3q6tjB8bAvVa3w6QA0dMJz6
TLSH
T115D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 6a2e4378c6c14a2a560e5f87dbc0d0475632ce121baa4585cc6a7dfe3742dad0
MD5 89197eadab90f14e122da48708392b51
SHA1 1ee875f4732c571ecf304d6a636957bce02d51df
SHA512 fd730a2b4accade6afb4e0734c7ecfefb2d7bfa7867666270fd9ebe803aaba79523700967245cb4912e2dd3dc373b80db0547447b59ed6d94973d265236dbbf3
SSDEEP 24576:qXYfDtczAJebc46vVa4eZwq86QAhhUkXuMDtz6Blg:xtcaebcFvVa4eZw6QAhukeMJz66
TLSH
T16675012873A408F9FCA74279C8A1C411EA72BC954360E7DF03E4A9695F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 bb896fa76b09f236f44aec099b7fe55691e4bcbe3509b9dee0a21beb02c9ed1e
MD5 bb2a5fc63d60683bf59c690313effc97
SHA1 e2a276c6865f2dad41ef78c59b30c9bf8728837c
SHA512 ef3a95a6f2722ee96b0f95d092eed9515bb1a394414121caf55956ea6a62a2edc803dd6974c6b9f25dd772aa8de1f89b120af841d09da63d444ba182c87daf70
SSDEEP 24576:u0Le5ji0hmxLrMMebc46vVa4eZwq86QAhhUkXuMDtz6Blg:uPji0A9rebcFvVa4eZw6QAhukeMJz66
TLSH
T11E959E16F6748735D073C0B9C5D2A68EED71308257308ACB4286D77C7E67AE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c7a500e8ea32a2f28657e6332c840ed4cc75541ce7386cb42ef8a4f5531d1527
MD5 41bfa863b2f04ccd91c94e0bc2b73a12
SHA1 99a50ae394eb925dded4c832af91ce2c0e705cc5
SHA512 60be7795a08ac7d434f566bd7f9149bd6989d009f62dbaef1dc653db5d899e0f1e67b49e83303afe5f707944de6d634277d4b670ac664849aa1412513412e883
SSDEEP 24576:Ma7/ezSC6vUyDZaqgrvWx6q8wyuKebc46vVa4eZwq86QAhhUkXuMDtz6Blg:r/ezSC6vURPvMHjyHebcFvVa4eZw6QA9
TLSH
T112756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bacd06be9ed28906caa55c1ff41cf9270c1f7312029405b606bf3c8ea4a007da
MD5 1037b75f4d2bc1849b10606b461bdb29
SHA1 604d1503e75c51dc0bce2819514305544af0e8fa
SHA512 5dcd765a7e0f52d9ccb2b2b200fc82beee706cc058fde086a26fc712dde0d6cc9835217aaf111f3700ae853cadf2e66ec75d910264e4afcdc343a28ed411853c
SSDEEP 24576:cVbqPb88hv/lV7Nebc46vVa4eZwq86QAhhUkXuMDtz6Blg:cVO88hXlVBebcFvVa4eZw6QAhukeMJzJ
TLSH
T13155AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E776E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 1101c41c8fd086ee31a2f0484a55d1812bc9a9dd679fe2779611fea1aa88cfd1
MD5 7efbb41d0c29a4ec9ee3fcbc7b935027
SHA1 3a4ec622338ca696bcada6acc610712de94191e2
SHA512 8e1ce828e1371f6ada825e4a4c6b8560901752c77ad10c51b2726ea72e2195d2edd1795d434d95dec50c0d141fec5f1d9771aefdda4591d33b04cc5df1033cae
SSDEEP 24576:rTgebc46vVa4eZwq86QAhhUkXuMDtz6Blg:gebcFvVa4eZw6QAhukeMJz66
TLSH
T11B55330584190DEAFEE202F2F5D8F8558DA4AC94A14B756D33A6BD9DDDBC0F8CC8121E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 d0afdba3013fdfb9cf5ef562f37b1755df96221935a17226141315e4bcddf9f6
MD5 82e147726d6bbcc973c6dcdfb42c3d54
SHA1 8ede1ee9a510ac6b07c095629a06808352cf2e94
SHA512 85473433b524f54e2846846a21f13872652ae6a7df60367636474a26989a0778f5308aa4a5a7f66fef853e80532d89099baa069003b17cf008296541bb1e5e5b
SSDEEP 24576:gJIUVebc46vVa4eZwq86QAhhUkXuMDtz6Blg:gJIUVebcFvVa4eZw6QAhukeMJz66
TLSH
T1D875CF3BEE28FCE2C67A4DB95691C600D77278704B62A3CBE175820EDE235E05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a1b524ca2f611bab442ebce42e8c9ced1a5f584c381da59d65dd0e79a5e74b70
MD5 1a9967f10208207f094667bbaa64eab4
SHA1 eec377ecdb440428291417fe9528feb3d0135594
SHA512 9d3445c1c0703fc3b7e177d061ae31a3cb81d3f3a765034a39093a1297ab4064119b98525e2c146908015d540125c15170283cb0de0997ae9d807c615a0cdb51
SSDEEP 98304:8QvGAdlCEL8c/pRNw5CHbAvVa3w6QA0dMJz6:hvyEYc/p3w8MNa3wpXdCz
TLSH
T107267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 edc8870f83762d04b3fd11958742beda7821e62225e1097fc461a67b88b84c9a
MD5 3a4d5de1546eda0885f5fa01a93f3af7
SHA1 b5471679f3ccdf363065a77e7f09aa80c5332ed4
SHA512 7e8f8b7f383ba27de38dcb30eeab3b7761d7910184ba5edf8bd83c71f5008c7c9ef0379f248bc7ff152ea52454841255593d7743e61b0771251cfea30b3bb2f1
SSDEEP 24576:6sewsAjbebc46vVa4eZwq86QAhhUkXuMDtz6Blg:nljbebcFvVa4eZw6QAhukeMJz66
TLSH
T18475F031FE74E436D6BB0DB22B25D706183CB9204B522AC3E3E89D9D59341D22776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ce42c846a5cd1724fa3d9888ec320d534f74ce09d8b18277cf633f993c0fff96
MD5 2e4266f53b7a5e7266c32c1d8c003fd0
SHA1 c1b45ed08d13e86eb5e3f79ba05401e280e67aa9
SHA512 9e4cfb8acd453eb91219e67f34fff924b44817d1c65ad2221e5fc18830533183254c83a9a96e4f7572f703ceaacd15123272272329fd50ef6f5e96e177dcadc5
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHVNa3wpXdCz:QUEtQevvqc2W1cpV29I32HSOo
TLSH
T153474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1d6e804f868e4d9d6f6a432f73451c45590b09964d4754caec1053e2de11cdb2
MD5 af115cbfbac0e1a8c8115a0b4c492f1c
SHA1 5c55faef68b5616ba0b5e0c10e1307d5566f2c64
SHA512 a32855cdf3bfac1df200d3dabce11e56339111c5dc9fbf7b5837074cde7aea862848f807b9c326c745ea696e4e7e5d29ed82a81a0578d4cfd768c722cdb58094
SSDEEP 49152:QCbRquA/m2yL5zifFiV+XenmE3/z7ebcFvVa4eZw6QAhukeMJz66:5oqHVjnmDbAvVa3w6QA0dMJz6
TLSH
T1FCD58E0976B8C1E4D1F6C37886A2C647F37178154B35A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 60d2e5f80eb51dd3fef4fd6840e302859bf9cc295377c21dc813017e033a951a
MD5 76bfd6c846875a6d20afeb575ea35c56
SHA1 c77848d28a97230e500bc790716d4a71822b0acc
SHA512 766a8e13b2f902a0217d533bca8779079a2642b36fd55ca1a4926d0abb287fc5f0883940c065d1e45c8e4d57beb8cf223c1cf06b2b376d8eae019ebda7e6a9ca
SSDEEP 24576:BAhGLmIFoiwtA5l7S53Gebc46vVa4eZwq86QAhhUkXuMDtz6Blg:BAM1Foiq5WebcFvVa4eZw6QAhukeMJzJ
TLSH
T15B359D81E7F955D4F5F3AAB8A9B69070EA76BCA55E31C20F2160D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 7633edc6e17233902de49c614cbec161df32ff2127ba1ecc84519a15765b3646
MD5 27bd3cf7d0e1343f9b223ba1d653caad
SHA1 50a3288e4137a07f63b4b606483df87844336bca
SHA512 d7ac03673c248a65fb8eaa2c605d179b503f9711179851c2565ed219a0269121fc194ca64e2be96259d27fa0cae906e92483700c0b4171ac31609faa6e045209
SSDEEP 24576:PwuLOWnebc46vVa4eZwq86QAhhUkXuMDtz6Blg:PwEOyebcFvVa4eZw6QAhukeMJz66
TLSH
T1CD75F14A72A80CF9F9A34239C697D436F7F2BC112625D71F1360C65B6F37261AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 f0f45b9d4579cd54327a1acc45ba5d0ec306c14f4772ba51b24d4afd7a8db284
MD5 cdff95f3864784d1cc9d874e54ac9868
SHA1 6e811c52a4c756e7eaf09ac942232e7c04e7b991
SHA512 991f99e1cb3bee89d7c05e7caf634a4e3ecc5816d89fc2d3a1703f754fa5d4b6f2d2b0ea4032a810368e37d3ca783a693f143e2f30b77dc61a2db569cf01cf4b
SSDEEP 24576:4ZuUebc46vVa4eZwq86QAhhUkXuMDtz6Blg:iebcFvVa4eZw6QAhukeMJz66
TLSH
T15665234A32A824F9F5E302B9E9E49405D7B17C92633743CF236566AD5F768E10D39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7aaea32ca159258a79c61399e8ed82f87e4dce61efdbb27cfb3cee6542aa2e52
MD5 8fa7a67e873345fab2fe388bf4660288
SHA1 ae3c61fc7974fa9de00d8c7f17930fb50fce6a5a
SHA512 91ab20b110c962baa57936d2d4a28c4955fa0b60b151dc79040d78bad30e60818021e03891228629085e30e83fc8b561c795ee9ccaa0d0add1b20cd7e1579f69
SSDEEP 98304:9QRQyi36YOcPuLvw2gAf+PN3wbAvVa3w6QA0dMJz6:0QyiKakX+PNDNa3wpXdCz
TLSH
T190667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3080b62ffbb1532b1212a61d530e250c28edb3371e7337702e287b5d90e99fe6
MD5 87fd7d1f77becc1d76798d742ce12565
SHA1 943a32a8dbe4588c08e1808e902fe077ed894c84
SHA512 264c52baf416ed6e3a7262dd85f84352e15557346cf83c56253f879ea7ca83b236442cde4c3c83be0057675ee6868600bde406d93d4119248c81f4d6ed624f9e
SSDEEP 98304:IQRQyi36YOcPuLvw2gAf+PN3wbAvVa3w6QA0dMJz6:fQyiKakX+PNDNa3wpXdCz
TLSH
T133667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 452a07e9b6e6f0e66cc7c1b00623f97b260a323039665ece4ea9914b1c1209a2
MD5 0d7d0c1811f9313dcd63c1020daedc96
SHA1 1da027b4403d064e5ab51b880b11351062b1a125
SHA512 f4730d5307737bc822d00bd613d6947963cb6aec77fb7fbbb3fb7dd10338e9d67984ec77dcbfac4e8dc5b66c9f84a30de565ed753eb72ac88057a9d902e2a316
SSDEEP 49152:w68Qg55nhxeWu7PNU3/rebcFvVa4eZw6QAhukeMJz66:qthGRc/ibAvVa3w6QA0dMJz6
TLSH
T130B55933B2F600A9D44DE1769F4A872196D17C758FE1E3DB8111720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 29f30fe3469fd6493eed7182aacd2fcbe7f28babf719f09c9b337cdeb42505be
MD5 560bf67f67cc3a9d5d3c1aecfba71b64
SHA1 87127f11fce364db18afbc26523215cf19303c77
SHA512 2fa7a0d02ae5e4dd2e240c2d4e3af823771fb9331eeca59295da80e2db576dcc7969aedebcf65e9a63e70d04c473d1ee43d9792b42b9b9b427014b546d831fd5
SSDEEP 98304:dy5112gYy5azzVvD69nLKnhZ1bAvVa3w6QA0dMJz6:ALIH+WhANa3wpXdCz
TLSH
T188167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0bbcbb8efc232efd8b78d684e336f6a9956d0de8ecabc7d7f18b84f862136bb0
MD5 9b87cbdad01b2f8abda6cc2c2bade78a
SHA1 86029bbbc6589a296c65014b3c7abb7dc3c12431
SHA512 2cd10dd990fe65274e76f6e4540b55721d2ab91176c4251b5e48ffefbc0c57b61eb0eefd23af09db442da308e928140987965771fa217a968b71efefb64002c5
SSDEEP 49152:OB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glZebcFvVa4eZw6QAhukeMJz66:cu6JmQxd2dYbAvVa3w6QA0dMJz6
TLSH
T14AD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d527007faec5a157620566347c214ac873bb25cc70637792cd24bb862446319e
MD5 179dcfc2d802acbf4099caef982d7539
SHA1 a3248dd5d99e1b8a58a38621c9c068dd66086a99
SHA512 a4d4842a87dc70033f7d0e57e2a625aeb4bb5c8771abc6a6af686e34b10ca39db5182c4a84faabbb67447b9a349c03e2ada47b1d2d585df9b6862f1bc40041b2
SSDEEP 49152:Y1hpsNoJpF1A6yU44CwH7R4x1ebcFvVa4eZw6QAhukeMJz66:YmifPVRDbAvVa3w6QA0dMJz6
TLSH
T15CB5BE13F2D901E8D06EC17887569232EA62BC460B35B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4e1ea17476e1f73c899dfe1d242371b5a297e2bf69c08a15b7af00b5f9b3c4d0
MD5 15d04fcdcf5a4c66b6732d468433eb12
SHA1 649af1427894f7fc7338c39a679b414b6eab320a
SHA512 a8c91771246be2958069cf9dbf3310cf5096c224c1d22a6319acd1bcd70648d63f5aac91f84c6503ec686d1a8d85e139158927b5ea2a60a49b8fda6da8581b7b
SSDEEP 49152:hSuZQIY0Be2KIRVtOnks6NMHqUebcFvVa4eZw6QAhukeMJz66:v5dKOi615bAvVa3w6QA0dMJz6
TLSH
T1D7C5BE03F2E941E8E0BED674C7669232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 874bd06daa31cb1bd97f7adc9375b90af3d321cbdd863ccbe056e61a8c7d7825
MD5 6a5838a4636d675d424c9acc473f0b1f
SHA1 98427b4ebc5f1d2d3237d2ace2af82d300b5ba23
SHA512 a432b418b6cb8541aa1f00786f35d9fb60d9340751970326f64c192bd45e81863a3c886445892a95cf27caa4d94f1bcdfee71c858da8c4fb95cf5257e8b381a7
SSDEEP 49152:IhtSn8EApI0figGgiDn0AP5wJebcFvVa4eZw6QAhukeMJz66:ZX2i/ph/bAvVa3w6QA0dMJz6
TLSH
T18295BE13F2D901E8D05ED174C7468632EA62BC150B39BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 e727b0a6fe6a095383fe719ce7baff5a2b87e505ffe1a0481d08aa5880d09288
MD5 05a8957a2039bfcd100625554978d22b
SHA1 d19006017c2eab7393694e2b355feacf3cd792b0
SHA512 80e7035548410ef10200e2667c3fd1fc1258e74160d9dcad9bd8bc32d383d0493d7b4d99265efe726a709f015fdd8195d08a00cb680a20f433f8ca26aa54dfcd
SSDEEP 24576:CIebc46vVa4eZwq86QAhhUkXuMDtz6Blg:tebcFvVa4eZw6QAhukeMJz66
TLSH
T10F552309941A0EAAFDD102F2F6D8F485C9986C95F25B216D339F7869DFBC0F80C8165D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 f3aa10bdc62271591b83a0c661ebc252d13b69c6fefd6aa47fa4bc68df7f2a37
MD5 98054a36cc5cca098d053425e63954d4
SHA1 a9736ba4920e1202336119a3c7cdb713b7b2a72b
SHA512 b525db4b5f3e55b6adc58c5e62049f46542a71fb36153e345435b473b811c642f206cd1af696baf13dee78df990dbb6da57f0d98b6ce82b3421b22d4a654990e
SSDEEP 24576:l/ebc46vVa4eZwq86QAhhUkXuMDtz6Blg:9ebcFvVa4eZw6QAhukeMJz66
TLSH
T168553319941A0E9AFDD102F2F6D8F485C9A87C95B14B216E339FB859EFBC0F80C8165D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 49961ff70b3690556755a8784690f121538ff922ffa45e462dbfe34e8aed83bd
MD5 7e658b27514d3558de16ea201a195e75
SHA1 3b3e1ec4b60fa4453ec04768091650e2b80284f9
SHA512 0771e7bf118db4b732b5af4cb5c1ffe666ade819da563a3a1053c70f8ad3c2db44e0f388cdae2f1252809ce249600e703777dbca48257e640677f04a1e3a40b7
SSDEEP 24576:edebc46vVa4eZwq86QAhhUkXuMDtz6Blg:oebcFvVa4eZw6QAhukeMJz66
TLSH
T123552309942A0D9AFDD102F2F6D8F485C9A86C95B24B216E339F7859EFBC4F80C8165D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 ff5b1798100bbb72557d1d7f8de515428751da6027cafdb48440a7c32229ee05
MD5 39086cc8911b1ecc8fc3d2e19d8b36c6
SHA1 213d068e68f58195560be2c8f73c381730a3a5be
SHA512 ba65f4d2115b46bee9b31bb373893254e6f2bb9594920a79c7f65c1ac0aea7821ce9cd5b703aa77698c0f0d7f0c476320a203c36e2a7fc86c7e3f3c40b17b048
SSDEEP 24576:Debc46vVa4eZwq86QAhhUkXuMDtz6Blg:DebcFvVa4eZw6QAhukeMJz66
TLSH
T115552309652A0DDAFCE202F1E6E4E455DAF4BCD5F32762AF2352389D4EB40F85C60B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 4325d7458c69ea47fdfb16828bc7d089802552cae22af574de0dee56993a05f8
MD5 acc2808f764ba20c2e91e71e1f8e4487
SHA1 fa39a3460db3edad4e3989f966bc003f08c18aaf
SHA512 f702e3c086a280a09dd0e19fc1e468a3d290ed8fdeaa084c399a860db7559126b6ae275e1cb18a57f936cc59821f91f5062433d192e90da3933db8bea6e1e613
SSDEEP 24576:2+ebc46vVa4eZwq86QAhhUkXuMDtz6Blg:xebcFvVa4eZw6QAhukeMJz66
TLSH
T1B4552309942A0D9AFDD102F2F6D8F485CDA86C96B15B216E339F7859EFBC4F80C8165C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 0e78b998a9b2d58129da998ff77edb7930896c41dbe5a072986eae48675c717e
MD5 f44b9a8565795ca7bffb93ffb4b4fa58
SHA1 b792c1bf2e25a4ff8cd7526ec60256174fbde2ce
SHA512 69202ae631b1009509447d167172ed6dcb4993edb09c286d15d123ea2f5cc7dc9eab2f9d3a733a4968fc71061226446e9278af020ae7f7616075526baeed475b
SSDEEP 24576:kjebc46vVa4eZwq86QAhhUkXuMDtz6Blg:OebcFvVa4eZw6QAhukeMJz66
TLSH
T187553319941A0D9AFDD102F2F6D4F485C9A86C95B15B316E339FB859EFBC0F80C8065D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 5b0634c293b243cbd498067c6c838a7a558c357ac988cf0ae4f9191017673f14
MD5 92530920e4aa9f90ad99c82ca4d286ae
SHA1 8f3d1b81437a3c569370fbcc71637c3fe8847a87
SHA512 cd5d2c8c7bc9cdb001a58c0d9b1d9c4a472ba1922c48c6a6f4b59b810eb4554165e2dfd37c2ddf3f6b01e081c9c1f7e34d2dc084dcb337724fc333057d4e50ad
SSDEEP 24576:/3ebc46vVa4eZwq86QAhhUkXuMDtz6Blg:vebcFvVa4eZw6QAhukeMJz66
TLSH
T1B9552319941A0E9AFDD102F2F6D8F494C9A86C95F15B216E33AFB859EFBC0F80C4065D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 0b4097190c343dafbe87eda2c7bc478929b049cbead1d5218ed0374b67951047
MD5 b0ac6999e1a43ad9a2bc487a14949598
SHA1 cb0fe96cdc18c4dce735c91be533b571cfb0c6c8
SHA512 ade60d6f3368df3858236af17249f0e377e4fc8cf7b58c53bd4f33cb212eecc6b953db85cd879dbe81aa0b8c4fa05d7a2435fe746c2a9280f836078af3e3904e
SSDEEP 24576:8ZMdzFVSOfebc46vVa4eZwq86QAhhUkXuMDtz6Blg:8ZMdzfTebcFvVa4eZw6QAhukeMJz66
TLSH
T1FF750195B3501CF8ECA3427EC9559806D6B27C5A0770C61F13F8366B5F732A11C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 f12f0fc1ce9222508363ab7dd99a855d909256405870ca40a2ad0fbd2d999cc0
MD5 8f964a469f9508059ec990132586ea7a
SHA1 f97544185f10db1b0833d2f1334befbad79ba055
SHA512 f846c195cec065df834381ad934eccea47c315276763b85cc716cefb1c70302038afcf5b63f5947c78b83e8cde5ad0ea7db8e2aa075407b97eb4e8fee271c3ce
SSDEEP 24576:sEebc46vVa4eZwq86QAhhUkXuMDtz6Blg:NebcFvVa4eZw6QAhukeMJz66
TLSH
T1F7552309942A0D9AFDD102F2F6D8F485CDA8AC95B14B21AE339F7859EFBC4F80C4165D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 45136058654af9e3be6053f1c2e77b4071c0ace72580dc8b31e59a096da96272
MD5 79f0abcb107d0fcd84e5684f9429c5cc
SHA1 b66e571fb8acc8bf210e0fc4b7bc7c660c6e01fb
SHA512 4ab0bcf489cc3b3f6360963f7424ff4c67110882262621299716cd60bb72e615c95bba03520b951cf7f49d6dd6da95562fb3c1f7720fd8a8bb41cf6fe272ce7b
SSDEEP 24576:dQebc46vVa4eZwq86QAhhUkXuMDtz6Blg:6ebcFvVa4eZw6QAhukeMJz66
TLSH
T1E4552319941A0DAAFDD102F2F6D8F485CDA8AC95B15B216E335FB859EFBC0F80C8065D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 346341348ce0860caa0363b974f5650c05351f4a78759605fa0f078cdd4f9d1d
MD5 4d1c59092f05e8f93c3e83a645a26a99
SHA1 27674a024b9e592805bdbc72d2be81b10c400e91
SHA512 2790b0778614a6b9be5cce7c0cc944750a797bb44ff7c08e8f011051cbbccf7e3d379d4395f99d53e3b012367074901d149142ad3851b2defea053c2e076db28
SSDEEP 24576:uzyLebc46vVa4eZwq86QAhhUkXuMDtz6Blg:uSebcFvVa4eZw6QAhukeMJz66
TLSH
T18F65120772A530FDF5B34275C8A15902F7B1BC7253259AAF23A4567A2F371E09D3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 f166bc77a251c08df9aeeda939e30b32c68c03e6a462013a7915cc0d9bc54a6e
MD5 ed70088eb3587d8c333fd834cfa52e4d
SHA1 8c1282134764f1da7bac69451e6232943e10cb10
SHA512 053014c29276f14a8ac95f0074e859d1dca0fc14a1b86c12c29c2e177caaca372158783fe8a811637b166fa4a51c5d6722692cec0cc970dd980c7ba866a18875
SSDEEP 24576:0Eebc46vVa4eZwq86QAhhUkXuMDtz6Blg:1ebcFvVa4eZw6QAhukeMJz66
TLSH
T109552309942A0D9AFDD102F2F6D8F485CDA8AC95B14B21AE339F7859EFBC0F80C4165C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 b1894256e1aa1f056d12581d7452765b7781c7945fa530f99f4caf6ebb7ac4d5
MD5 ab9f7c1f3e95c7e2937503c5d960bbcd
SHA1 4f6a921ab6aa25749434e8a321669b73f380063a
SHA512 52dc01f10eb9a89759d997445e75af0d8acf29ffbcedb90f86d38ee509bbbcfa001a8899c64837ba63cffee83fac22dcfb7407a4988e6acf26602d7ab5d1c954
SSDEEP 24576:NEebc46vVa4eZwq86QAhhUkXuMDtz6Blg:eebcFvVa4eZw6QAhukeMJz66
TLSH
T18D552309941A0DAAFDD102F2F6D8F485CDA8AC95B14B216E339F7859EFBC4F80C4165D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 ae47f2c774103e78db14056d2b3d705e68895e1b31d1a0312c94a5ff37abe427
MD5 387014ec85e4e755db6c3e505a34a6dd
SHA1 6934faf4712dbd69ca6599ed7a2ebcc7cb1a9512
SHA512 0dc12748444d0c92e4c4f2ab6a702a3d585e9e5418f5e12e81e8c885e8d161da77a331187b528694b29f2a84b67b457b2f167f30cee253505327107078124622
SSDEEP 24576:kzyLebc46vVa4eZwq86QAhhUkXuMDtz6Blg:kSebcFvVa4eZw6QAhukeMJz66
TLSH
T1A765120772A530FDF5B34275C8A15902F7B1BC7253259AAF23A4567A2F371E09D3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 0b4ebacb6fd0b7cc35dcc10115a8f7f3a9ee100b03b20e68d596c01d9709fa6e
MD5 db00a58ef04a2b11b5bcaa13c76b97b4
SHA1 23133967edc3439b2bf0f5028cb36f18a3275a22
SHA512 052f6a8f44faef85de59ec9ef79d029c8ad834434f5829e148319855b08c6f0633555c79d65a1274b67259e5ca6a0bacd278c694868616ab932f34fe60a70209
SSDEEP 24576:1TSaLl3z0zDtebc46vVa4eZwq86QAhhUkXuMDtz6Blg:1TJLljKebcFvVa4eZw6QAhukeMJz66
TLSH
T12C7501A4B3501CF8ECA3427EC9559806D6B27C5A0770C61F13F8366B5F772A11C2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 f298805b049eff07df487c85a8516c5ce3e4b0b68f71a5d309fac52774105111
MD5 d98e5f5f4338fd605326d6443637f339
SHA1 3548c1cab80c74268c81ac4c3cc6490e80a9a8c1
SHA512 342e252a9169664714502fbd7a366d2e1086189fe0c63f6fedbacc1697cf9450462599f7ca91c7c92f0c91d16ec8dcae35f845b5da0f4b7b7f3008888e822b3d
SSDEEP 49152:J0d9CHKyaTebcFvVa4eZw6QAhukeMJz66:ICqKbAvVa3w6QA0dMJz6
TLSH
T19A85CF90F3E414E8F0B38A75C9769511DAB67C9A1B31DE8F03A8255A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 4b59c158b2afb9f9f5e088fc94a4fde28fac9dd7790c8250111ba9a1725fd8f5
MD5 47255e3807c8a413a32edf59aea98c90
SHA1 68645ccf70c76a314936ea8e84485148c61dd05d
SHA512 2079ee7182b8bee7fd702f7885ae0172468b9b7c193f5ffb186f3729742212842e3bd0d8c56c2a0f7114352fe2f58393b700d55fe0941f3fe3b5c5ef012cda63
SSDEEP 24576:q9ebc46vVa4eZwq86QAhhUkXuMDtz6Blg:UebcFvVa4eZw6QAhukeMJz66
TLSH
T185552309942A0D9AFDD102F2F6D8F485CDA86C95B15B216E339F7869EFBC4F80C8165C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 74e8ec06cc83cffaee85b80a601c8fe1d01356513ee576f3d105794c0aa1dd05
MD5 733d066dad45192e8f8a237b1499a6ca
SHA1 5c601bfd83bae82fe7eafddcdd0106243c9a7b22
SHA512 c5a6d97ce141061153a27931f7f38e8f0731ccb104f14082dd12160e92a2dab8eeec4476b128c0c7bdf5a42c975705d72be0bcbbbc1e1a7b2e50e2e1dd231a4c
SSDEEP 24576:rrebc46vVa4eZwq86QAhhUkXuMDtz6Blg:PebcFvVa4eZw6QAhukeMJz66
TLSH
T16E552319942A0DEEFDD102F2F6D8F485C9A86C95F15B216E339B78599FBC4F80C4025D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 a206a80486a5846a632993d5292d7c1d3d740bfe6de9ec1753a1b8ff21b7f6ff
MD5 909cbfe8ea7b453764074c7ac61c7a63
SHA1 68f6e9da5d51e13b9e60cd17e7b089578d417756
SHA512 29630332af255b4a3c2e112687393df5fc52aaaff1510935557a62bbf0c8ec195eee8133890521bd4c5a85d8e025c9d73f98882778732ae33805534f96b03ce4
SSDEEP 24576:6Cebc46vVa4eZwq86QAhhUkXuMDtz6Blg:JebcFvVa4eZw6QAhukeMJz66
TLSH
T13E552319942A0DAAFDD102F2F6D8F485CDA8AC96B14B216E339F7858EFBC4F80C4055D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 5565f268784517e82916dbfee48fd526e9949268e12606a0949974b6ae81b232
MD5 0bedb253db803b8502075bbc151d74bb
SHA1 2040b6fdc9188b089ed57696b1640264338ff406
SHA512 543561f23ba49c31509e0b8d7ab5ead051149a444f254375e9379dd093eb5150fda8ee2946162092ce0630601c538bb58d168b0e2294669989056114f924fc56
SSDEEP 24576:ZEebc46vVa4eZwq86QAhhUkXuMDtz6Blg:yebcFvVa4eZw6QAhukeMJz66
TLSH
T152552319941A0DAAFDD102F2F6D8F485CDA8AC95B14B21AE339F7858EFBC4F80C4165D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 57c741fde5c38c73f2edaf3eb7c990fdbdbbdb67110d22ae88e97d861634b0e6
MD5 6aa819bb605bfe05a2bf3b0bf01fdbbe
SHA1 0419f608a90cb762235eeec2fcd140b6a3cea0af
SHA512 7e7ec20eba5bdbdae35d2f97acd394c73a78d0b9c26a325ff107686437ef083e4a776c92a8aa4cb94710d30a1a3d95e78b7bf18a75531cd85141345e3c749d1c
SSDEEP 24576:e9ebc46vVa4eZwq86QAhhUkXuMDtz6Blg:IebcFvVa4eZw6QAhukeMJz66
TLSH
T188552319942A0D9AFDD102F2F6D8F485CDA86C96B15B216E339F7859EFBC0F80C8165C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 61cee43b3f3ce9cfcd2280aab76a77cbff19df5b1d6ea741e4f68d17d86cf343
MD5 0a9255d67730b51f00eefe8020775bfb
SHA1 440dc6e7022a9d2d8d90a1a965c44c14e56b561b
SHA512 64a53a33b8873e4a88924e6ca828b5c5fbb201b8f21a17a465260ffed45c5fe7b06e6ddb5d69a0bbbd4012ebb8c9f276fca79e012aa5cb2e7a98d277be9356c2
SSDEEP 24576:Ecebc46vVa4eZwq86QAhhUkXuMDtz6Blg:debcFvVa4eZw6QAhukeMJz66
TLSH
T1E5552319942A0E9EFDD102F2F6D8F495CDA8AC95B14B216E339BB859DFBC0F80C4161D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 1e5bebe1c0a20877fa990fd53a6e511eaf966c0a37be2099aa142661c1f6441e
MD5 4e1856f32c3558df5cd3ab430786fd29
SHA1 9b2d742c9d99a2581bb948f52a8693b4b16c4aac
SHA512 6c7a500e27adf14839d0694bb0b0a858a2ec2854c044a4a8ea478dd5d8775d3590fd0c6878ee3c3e0d70ff7df70a6c25253d4a67caefe1ccfc52f296c7be61f3
SSDEEP 24576:X+ebc46vVa4eZwq86QAhhUkXuMDtz6Blg:uebcFvVa4eZw6QAhukeMJz66
TLSH
T168552319941A0D9AFDD102F2F6D8F495CDA86C96B24B216E339F7859DFBC0F80C8165C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 5cf61169762c6ee1475eeeef170eee24c76d60ec5cc7228c068106a9a3193269
MD5 613fbac2823c2f8c827393ee4ced77ee
SHA1 ec2cd96499ec9f532c21b3debbaa9bdd83d23387
SHA512 5cf28342658005e59d5883b4db60c204cfb82a9d3b38fc0885ad7228167bcbc8911c576d2ebe1de1a9749f1c123badbeb41639015adf1d481694b6f23fd8dd97
SSDEEP 24576:wFebc46vVa4eZwq86QAhhUkXuMDtz6Blg:CebcFvVa4eZw6QAhukeMJz66
TLSH
T117552319942A0EDAFDD102F2F6D8F495CDA8AC95B14B216E339BB859DFBC0F80C8151D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.3MB
SHA256 2c44c08b8248bff94a7bc392e5991b94b6d16d3a6728d49a7097493c870538c7
MD5 a71cbe82899c6a62f2648c49e70e6b20
SHA1 3134014de34ca58cdb680a5cc01fa9af1acbed06
SHA512 7aa241d4361e34cf38bc71db58ac195508c39259d9707571468296b04f0041c15ff4107c27494566e58cd0d5fa8e8c8dbe897d88e5a2afb00bae4551b5edc67f
SSDEEP 24576:E+ebc46vVa4eZwq86QAhhUkXuMDtz6Blg:zebcFvVa4eZw6QAhukeMJz66
TLSH
T14A552319941A0D9AFDD102F2F6D8F485CDA86C96B15B216E339FB859DFBC0F80C8165C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 4714cc32ecaa4148ae8dc8bc0d795ed2316331043a6b6a9141a2a9c337ab1bf5
MD5 0585e11f26139cbfa9c803e5b38a0556
SHA1 19c538e55d4b699c0674a3ac17f05ea663f828e0
SHA512 3e73d07223cc9b9d2245ef576f9434dfa580105deaea8ed5de4915bedd6512a993f7b414507ff7f514efcd1faf8c13306ec8efde69e2c4008605dcde3c56efc9
SSDEEP 24576:LfwvCk9RX6wkyAIAebc46vVa4eZwq86QAhhUkXuMDtz6Blg:nMnYIAebcFvVa4eZw6QAhukeMJz66
TLSH
T13585D029EBDC08E5E1B7823C99B7460AF6B178591B31C2CF129A53AD0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e413d972ce14d6c824b7e13a36c6ee50e8068a4cc1a89c0742b00940d71fc13d
MD5 ceb0b9203d65e31e5c6f03e23defc9b2
SHA1 a8f7e1721dc05bfaa32a2a9127abccdea68932a4
SHA512 9d56afcc081d38335fcbee1ca87a37646586690c97818a4aa7ee4436ba4a79d85b9713ef0287c57c9810e6894da8f9f81bb960705123d4fa6704519f70369d9f
SSDEEP 49152:+YjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0pebcFvVa4eZw6:2ySzPQbAvVa3w6QA0dMJz6
TLSH
T19C066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 727f663a9dd7ca98aaf70d007e83349888b272a3298ada3239457e44be9e719b
MD5 c4952879472efe6f186539f4211e2e1d
SHA1 205ac5921f9f82bd5aee72789cf981fadebf9a88
SHA512 b960ccaf88e54914bbe73b57d6ca3b4569a121b894ec24ca2e530aa43d174691d93a6e464b7663054965bdeb27b7fc0c747e6ccef9ff7f672fc092b804ea5b15
SSDEEP 24576:c47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYPebc46vVa4eZwq86QAhhUkXuMDtz6w:c47JUQjairIhCnDHUPfF/ZebcFvVa4eV
TLSH
T1F965AE1DA3EC01E5E1BA827885158A5AEA71782D1F31CACF2270837D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 557e058360c4ba12bacfaab661386a3a08d08256d50a716493c876ae08cb98e5
MD5 214a3b8246188a188cd441bc65773566
SHA1 5b22025c0f490bf80c33e7bdad5a8b5e5c1cd352
SHA512 ef31fdd1643a328110665d8e32457b5968f662c38874cfa71260e8f9a25db3fbbe49686de6ba2566d90352303a61c877688794e4ba512dc3783a545c130501c5
SSDEEP 24576:TUebc46vVa4eZwq86QAhhUkXuMDtz6Blg:AebcFvVa4eZw6QAhukeMJz66
TLSH
T1B665F009D25802E8E0AE12B5D7959941F7737C6593E2A3CB23D0F83E1F795A05DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 620709df84c46609a6d452f39b67745a25258df3d7c7ee2959300620150aad19
MD5 d20278e7802f804f9fb2348f0b4f6d73
SHA1 98fde195c812c4dd55edc0bc988976bdb853aaf9
SHA512 cf0c35ecdacca6c19fb2f1001ce81ad884e3425d8ae2f3d57e5aa204ef352f228bf4788991c5e6d7193f7b958612dcfec4ca3e52e0e16ad4f7e062cf49f644e3
SSDEEP 24576:lrLajUPvP5LF+QPVMKJX3l8/IRB1vn0/QX3N:0jUnPlF+EXnl8/IRfvnQQHN
TLSH
T157352940762AC75FC5A940325E72D6CCAB707D01EE056F07B3C8973FD576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 1e3ef7231853b57b62fb71e57336aa5d5feb5c73aed88d11f5a49dd349a24d98
MD5 7d0559c4fdd37df0448f0f9c3154c4dd
SHA1 9957cdd12101bf5c144ffaccf7ab96ce85acfabe
SHA512 29853aa5a5a6a244af8b527dfde27fe15f9c74698c22283565155fb2f9f787030f8258e01accbc5c1e0d7710bb9e81574f36beb4e805bbddd70d75d397e302ba
SSDEEP 24576:z6uclkdNaxLF06IkcQAyuLPX7UAM4cIYkoJA:taxLF0KcQAyuLPX7UAM4cIXmA
TLSH
T1F4650A816537E38FD0F76132076A5B4CBB64EC07B7056F26A389453AD82A725A0FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 38fd8f611a82b5978e4ba5dace1874a622dcf4ba33c713aeb62f49afad70a0b1
MD5 3cf2f67702697900a51acebbd569e5a8
SHA1 8e167ed72f04d3533ee6eba66ff50df3ba93484c
SHA512 b582fed7682175f3bba22031011a1a1c53371b7a4afcda0764ea6953fa06ee77c472d5ce887e4f37ef20b3d7c897f00604eb6c2b91c9dde2e07eaab7092bb532
SSDEEP 24576:wsebc46vVa4eZwq86QAhhUkXuMDtz6Blg:wsebcFvVa4eZw6QAhukeMJz66
TLSH
T1CF552315911D0D9AFCF202F1B1DCF4249A5CBCA4A70661EF725A799DAEB84F84CB070E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5ea38d150fecd718bfca34bc48aab16e25deda85e742d7e140723510f54c7b1c
MD5 571c6377ce0304f90ff0e1346cb0e77d
SHA1 108a85a74d027e41e1284c8c82307d15089e065c
SHA512 06adad97f02657a20bd834c0d2357bd7c850416fd4166e1875ab9990a2fb8606d29c6806fb0f1016c42114d52666d63095654cbe27ce26e45b0290d1e6bd6c2a
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYKebc46vVa4eZwq86QAhhUkXuMDtz6Blg:Lgb4mBIBhGFPebcFvVa4eZw6QAhukeMz
TLSH
T13665AE1E22EC02F5E0F6D2B8DDAA4417D6B278161332D2DF1251426D2F3BDE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 7f000f2aac1e5e6fdf85c2ef451fc7f36f4d2a00dcdfce97e650f27be5e1926d
MD5 449bc724309e7e7142f73d880ec29666
SHA1 0cb4f959e4aceac53a3001dbf235e9287ae01d2f
SHA512 f9a3144c3ba5d41c76c53c87c34114d79fa04cb84b0d20fe3646ea41b829916522d23c5fa73db5601ca90266e49bb3c244e49307d717545d46c5b437b1603862
SSDEEP 49152:I7ZFPqV+a7/iebcFvVa4eZw6QAhukeMJz66:ItF3a7/PbAvVa3w6QA0dMJz6
TLSH
T16495016576E101F0E4B7D138CA864663F6B1B8251364EBDF07AC8A551F33AE40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7a0a6917f72d05f618ac93ac2e7ca35468e161032ac36f5b51fecaca44bb1769
MD5 437168fe5da7d9f2270013fa56772232
SHA1 11ea42532414ad59a086f995f1a1e26b865fc2db
SHA512 da72422a030d578a025a13af51795a7fc56b4a965965bda180bd9f2655f2d43c476bda77ab70e9f81b1df8765b43f555c39c2c9f8168a28003febf59051ccc17
SSDEEP 24576:+PUr+NQTebc46vVa4eZwq86QAhhUkXuMDtz6Blg:+JQTebcFvVa4eZw6QAhukeMJz66
TLSH
T1B275F12F62AD1CE5F676A17D85828609E771B862131292CF02E1917E4F77DE8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b962cca45751a191d81d89e52371d364aafa09272416a1796af7e0beb003fc8e
MD5 f02529779f91d67650e8756cb2bbacf7
SHA1 7726b69a0f05c58fa8f06a7c023c65c86ab8ec2d
SHA512 c1c8b692b43cb7f28f54db67d091d234667873238b60572019272e5f3fe79d5827925cac31a1698fad7b6c602bc79daed7956635709e000022377cb117189a33
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjebcFvVa4eZw6QAhz:mG05lO43bNbAvVa3w6QA0dMJz6
TLSH
T1B6D5BF6E62EC11F9D1BBC17CDAC6860BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e74fe075d29d74038e2ed3b0f2b5aa40d04abd7188b0c2021d501780ad6dfcb3
MD5 b6ce48c9153de7fa57962afb3c4b63e9
SHA1 9d031c35c6b379e9ab652c8a1e89e6da54b6e937
SHA512 54a3dcf8aa390b5a00223cafa8382b1296f1d77c74d2ff76690026e81b2d2799537b7dca409a30edaa0a2833d250ca8de806d212648e711f977c3baa2d03e7dd
SSDEEP 24576:Ffa5POZ3dpuWVM50JicR2hG0lasx2+47eidnpebc46vVa4eZwq86QAhhUkXuMDtF:Fa5POZ3hJt2pasx2+mrebcFvVa4eZw6p
TLSH
T12665BF5EA2FC01D5E5B5D17DC583861AE5B1342153329ACF122182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 10738952b9c6837c9ade06361b11ab38f85900eaac8f6014b47d2a705a0b65ad
MD5 c128c0d1424f8e7605492289dab72fa6
SHA1 90f68aaf26f3e02b75a64f4f52e0ee296a632946
SHA512 09185e726cc1b23ea0a146c6da45587eb97b7d2b203d95a7ac28fb980c7e125a7f3a32f926be0c5ed8fff41da4dde3b43c9f9c1bcd686d38a2b0404ab609f5d7
SSDEEP 49152:VNc/zEOVHFCebcFvVa4eZw6QAhukeMJz66:gIAxbAvVa3w6QA0dMJz6
TLSH
T18B858B1622E901E4F5BBE1BE89779546FAB1786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f07f74efc935bb64545f96782a1e9ad6ea678342820eb2c9bffd3eb62a24d945
MD5 ea11b103714fe43aa98feb2cfcdb931b
SHA1 b01c8270023a68bffb05b2a9941eb3ededaa173a
SHA512 b3b005a82deda88ddac0652c00981b891662a15cef80eabf70418df1cc88dca7e71c22ab852741a1f13937e59d16eca98adf4e71d9b4b1840181bc71dfe85877
SSDEEP 24576:93kNvNnaFeYhJNtmZBmFebc46vVa4eZwq86QAhhUkXuMDtz6Blg:93MwBtOmFebcFvVa4eZw6QAhukeMJz66
TLSH
T12D55AF2EB6B806E4E1FAC6B5DD238512EA727861133253CF5390C13E0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 b0793564326274ec7d3bb0c3238bfee7f299279ccde252b1798ef2bbde56aa1c
MD5 c8ad39eab4390a003b4ef27e1cfa31ea
SHA1 41b0f55e5b87bbc17fe6a9c65b77c55e009b8e87
SHA512 ba84a24b07395dac2cb844c748a57cf02437c02914e8cde75bd58245acec955f13cfba6429f616cfa5ecc930173c0a4ad2799c14179d48df1c115540abd97918
SSDEEP 49152:rDVHeBIAAoebcFvVa4eZw6QAhukeMJz66:PbAvVa3w6QA0dMJz6
TLSH
T13085E13DE65C04E4E47BC1BCD6A38906E77138A9032266DB12D491BA5F7BEE42D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1244-120-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/1244-367-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/1244-121-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1244-114-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1324-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1324-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1324-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1324-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1540-82-0x0000000000400000-0x000000000055B000-memory.dmp

Download

memory/1540-310-0x0000000000400000-0x000000000055B000-memory.dmp

Download

memory/1540-1-0x0000000002370000-0x00000000023D6000-memory.dmp

Download

memory/1540-6-0x0000000002370000-0x00000000023D6000-memory.dmp

Download

memory/1540-8-0x0000000002370000-0x00000000023D6000-memory.dmp

Download

memory/1540-0-0x0000000000400000-0x000000000055B000-memory.dmp

Download

memory/1632-94-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1632-20-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1632-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1632-21-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1632-13-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2300-73-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2300-299-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/2300-65-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/2300-67-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3264-85-0x0000000000400000-0x0000000000550000-memory.dmp

Download

memory/3264-361-0x0000000000400000-0x0000000000550000-memory.dmp

Download

memory/3264-77-0x00000000009D0000-0x0000000000A36000-memory.dmp

Download

memory/3264-83-0x00000000009D0000-0x0000000000A36000-memory.dmp

Download

memory/4308-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4308-54-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/4308-279-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/4308-55-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4776-102-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4776-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4776-364-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4776-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4776-108-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5164-379-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5164-96-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5164-88-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5164-381-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5164-363-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5164-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5488-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5488-133-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5488-127-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5488-138-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5488-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5556-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5556-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5556-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5556-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6064-38-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/6064-45-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/6064-46-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/6064-39-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/6064-50-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/6064-52-0x0000000140000000-0x000000014018E000-memory.dmp

Download