98324b3bbac34dc84ee8743bbb7c35fdc07cbe00a11d85bce223b972986b9aa5

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 07:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
Size 1.5MB
Sample260910-h8ld7ssxex
SHA256 98324b3bbac34dc84ee8743bbb7c35fdc07cbe00a11d85bce223b972986b9aa5
MD5 147d851b4dd03ead538569cf46ef003e
SHA1 9582733e8c13cb9281b996b1a696cb4ff9b00655
SHA512 6922d9762ae367d9245c2aa110c0cb1aa9740b52c0dc6948328f1ae10cb8bb4de9b0726448d59e3929b81aca510c20020af99bc4aa1dac997b01db8cbb830714
SSDEEP 12288:GjnNk1DhQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:SG1+yxknw4FYnshx8OfVe247
TLSH
T1A9651224B6C5C0B2E57A19330970D7715A2DF9709F30AA9FE798253EDE708C0C629A77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2328	elevation_service.exe
3060	elevation_service.exe
2792	maintenanceservice.exe
2556	OSE.EXE
2744	PerceptionSimulationService.exe
2144	perfhost.exe
4412	ReFsDedupSvc.exe
2516	SensorDataService.exe
1488	ssh-agent.exe
2124	AgentService.exe
3884	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4eba2eff5387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ddbd58b9f540dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000070134178f540dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c0f6bb9f540dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce357a77f540dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000914966b9f540dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2328	elevation_service.exe
2328	elevation_service.exe
2328	elevation_service.exe
2328	elevation_service.exe
2328	elevation_service.exe
2328	elevation_service.exe
2328	elevation_service.exe
3060	elevation_service.exe
3060	elevation_service.exe
3060	elevation_service.exe
3060	elevation_service.exe
3060	elevation_service.exe
3060	elevation_service.exe
3060	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1340	2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	4412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4412	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4412	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4412	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2124	AgentService.exe
Token: 33	3884	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeDebugPrivilege	2328	elevation_service.exe
Token: SeDebugPrivilege	3060	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 1796	3884	SearchIndexer.exe	100
PID 3884 wrote to memory of 5308	3884	SearchIndexer.exe	101
PID 3884 wrote to memory of 4596	3884	SearchIndexer.exe	102
PID 3884 wrote to memory of 3484	3884	SearchIndexer.exe	103
PID 3884 wrote to memory of 1672	3884	SearchIndexer.exe	105
PID 3884 wrote to memory of 4488	3884	SearchIndexer.exe	106
PID 3884 wrote to memory of 4300	3884	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_147d851b4dd03ead538569cf46ef003e_amadey_elex_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3060

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2792

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2556

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2744

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2144

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2516

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1488

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0549f2d087a434aee887c377fcf41df1ed5f6cfe27ac8409c1ae1b6cf3d044d0
MD5 05b89e3da4f2d34846076af75a5baccb
SHA1 b144a339f135c3d0bec4ef83a7a17fc3261efbbe
SHA512 dda5157cd723fa9e0497ec8ebeba109741ab7093a52946245f953dfc1b3a6f785377928240134be37286a3b748e10ad6cb5a5b8eb334f40838087b2e48de44a2
SSDEEP 49152:bb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnVx4x8EVep:p3q6mjBKix8EVy
TLSH
T181D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 e48aba5aed9c53ce02adb1998795c7f1d3684f63e1d4ce502950e3ca0958d52e
MD5 b1fca5e1b4458a7b982e31326adad5fe
SHA1 0a257258dfbbf56aab0e9f8ab021f7741dd56079
SHA512 b2873b54f5f2223420d72183ee2914ac76bb92800c8a9dd23f2a97e15e0697c536445e9102e188b583a65cb6efa6660e75fcb12c1f83be5119d5a0eb8537cba5
SSDEEP 12288:21XLsswWkxy2lRq2czAb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:0XYfDtczAbyxknw4FYnshx8OfVe247
TLSH
T1F975F12877D548F9EC6B8139CDB28112E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 57b19581982cd5e02470e8d69435fca605af9c473ef182a019d6a4f18b9e140b
MD5 7227fd39a12803fbf6ba1094c66457f7
SHA1 2a4a31ec54d0540bf9f50315c73b19c3990c34fd
SHA512 d739ba8f791e0fd2029d3f6023cc27c3c88b4e2e98b459acc0986d33dea5a86956a67d622ab26b3879a3e1d4842f2e8254db8dc98f3ea62692ac1bd9b6ed4fcb
SSDEEP 24576:l0Le5ji0hmxSrMCyxknw4FYnshx8OfVe247:lPji0Aoox4x8EVep
TLSH
T12E95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 51e11a09495fd3924dd4edb276a3f5296c1ffd523ee240941b680301cc623fb4
MD5 28b20939605b088c07ffc591adfa920e
SHA1 a0a6712071d0a9a1d490c990f98e7c581daa4eef
SHA512 03ebf1b6f4424b793a7c2ab817db152f4ddca7e67ec1658a0c4064de266a6fb9bbc997052fdcb1a092acd341f2c537a34eed2743a475297d8edfb345208f9614
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWj6q8wyuAyxknw4FYnshx8OfVe247:1/ezSC6vUzPv+Hjy8x4x8EVep
TLSH
T1B6756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d10912f92c15311aa8773a9b974cf384ee69f9766f4a93c88fd9738f808c47be
MD5 ce2309e359eec4ba7e7769eff3c25fea
SHA1 e08924c6e6102019b0dd79d4bc602ebd9ae47b02
SHA512 7e21efd314ffacd8ee3394e69beff8daadf58baa19bcab3949e356118cec0ef0616cffa65946110142640d40c463658244bd2cadc7ab04c93aa3151737e0995e
SSDEEP 24576:9VbqPb88hv/l+BPyxknw4FYnshx8OfVe247:9VO88hXl+Ix4x8EVep
TLSH
T1F2559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 0ac90d0df5d18c98c070f966d9c47820e029b92ecefec0475b51181afff03dd8
MD5 c859508ed64885e2f8d54f3a143d1345
SHA1 4ff905923467cfc8faf52936988987aa5df2fc90
SHA512 b751108cc092e8cbb01cfdf9a1b7bb2aeb1f19bc39bcab9a93c7c89fbcb8c4edb68c16b89446ab0060f7072444d2c697817f3b28aba484caf2647d307a7f840a
SSDEEP 12288:PaW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:PaWyxknw4FYnshx8OfVe247
TLSH
T1FF6523BCABD9E4E1F69E14331A7572223605FDA4DAB4C11BCB78B54EE4B0C50D06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 b3bb1e674b0db8ed40961990cc62ab58ad2674ff1acf09aee985f71113b17439
MD5 3404ce7109c46dd2e143831826f2d393
SHA1 dc723398a140ac75a15b3f261256711d85f62a56
SHA512 32f92e5fa76da95d1458ab5cb872afcc3a12d650d653a2018c21e42df3a4e9a52e0ed5351841aac9c05c3491c3184740ad3047ad997e76f097e1d48babac98be
SSDEEP 12288:NeBNUbTVO86U3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:NJIU3yxknw4FYnshx8OfVe247
TLSH
T13F75CF7BEE28FCE2C27E5DB95B918200A76274704F6193CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 be8959dd65fe4fd516f2c66eb7b81bcbca1782761816eb66892513393fa95bf0
MD5 12456f6a2786066f26bbf07e79422b3f
SHA1 839c497ec4cb4268b422e0b4242aedbeb4e1b4d7
SHA512 2973e7b98c693a3c2ea593aa0f8938576a65e24ab80d2f8136964ee7cbac9ff60a5c44b9d58ac94b7bbc3dba30ca92466ccf8c371fb3609971dca239d9e4a565
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THI:CQvGAdlCEL8c/WRNw5Czix8EVy
TLSH
T106267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 1d88820b867a08e6d56fecbe2a278d49b61fd8a30ad11690cb029e0ffbaeac0f
MD5 a0e096a155ca78451e7af69a8f820867
SHA1 55f3d69c336227d17405eb732149944ef57af082
SHA512 521194bb20070cfb0784dfef6f273c92819d24c8ed284ca2017963cc8095c335aa6a112f02295d863d6bca8d95cd8e3c3da27a1ad920faff28797458378f9e37
SSDEEP 12288:PAwSfxL/2Dc3zDLLmt0LDQewsAjt+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:Y+ewsAjtyxknw4FYnshx8OfVe247
TLSH
T14485E030FE75E032C2BF0DB21B36D716142DB9604B611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d10f91070def56583c02cae4ea366575e4a097e2b0103e0a9afafa9fb13d1545
MD5 1c567b59a4a3b331b6718a37d237ee71
SHA1 aa22d21881a97b21717cad8206d5474bf15f2bbf
SHA512 d7e8fa0db50644f910a4faa293a9e5abafa9ce7f515ee82829b33ebfef5109dffacd2308c3a5c3e70174540a6f0bcd7917aceca96411b0a38d5428dbd03dbba1
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHd:sUEtQevvqc2W1cpV20I32
TLSH
T1D2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1ac53ccd56986ad19414cab1f5d3f9a7b1d5cf8d8a0342ed315dffca0e6ea97c
MD5 582a5b832fbf01cac0dda327ee499fd4
SHA1 8e1a0ecf24c7c36562e224c268fe190d48bfe253
SHA512 0c8d26e84b2be8a2417af17f8e64b35c96a1ec4746ba46d55ec86394b25ab3b694235227cf028f621ad1aeca423cb7bafeb3ee34da499faac326ed3b6fa8d942
SSDEEP 49152:5CbRquA/m2yL5zLfFiV+XenmE3/z4x4x8EVep:Woq2VjnmHix8EVy
TLSH
T1DAD58E1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 76d8f5e83ea4d0fa9e39ba364092c88b82118044b4689dd7784196ecddcc75df
MD5 8eccdefe4f2906dcc2d6229ba308abb3
SHA1 93d7bd98a40f6cef6035d2b7538a0e5ca24dc92d
SHA512 bbe01fccbdad1975fbc41bb10804326d80b8d7afc36c7da5587b47342b3e9b36c112597234550698b5399880c9d7925907778f7b3fa5e69e920f75f77b6969f1
SSDEEP 24576:bAhGL6IFoiwtA5l7S53Myxknw4FYnshx8OfVe247:bAM5Foiq53x4x8EVep
TLSH
T19835AD80EBF955D4F5B3AA7899B69171EA76BCA65E31C20F1260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 8f9c9162a100d27cc112db9856632a197f8596e05fb520b8b23e42d370bc001e
MD5 9418969c53f63d53286d26419e2aaf55
SHA1 3e5146f36700eed3c0e13a41c147751fadc1cb9c
SHA512 1a1aa37386931897ae25cd427190b59377ec72fb1a9ec0dddd98fe61010887a059798d3321400b7f09aa722f634f5bb4b1a27aa955c779c480acbf5389cc815d
SSDEEP 12288:Amw5HEjsChNrBFgl0WDm+Cg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:dwumOWZyxknw4FYnshx8OfVe247
TLSH
T10C75F14977E81CF9E9A741398657D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 d044118a46eed9f61169dbfd264ef13033b9587964196c151c50d164681e2a20
MD5 d54ce88e06078fac3f5d4bd1938ccf69
SHA1 214b6c95fcd4a15e02a401e148f96b28dd8ef734
SHA512 793a7a60b127194e1793e00213b51344f17e7b4e2a74ca178c3712df0a02fc9cda6e434ff5c7d170ecd050df08379317de55bbfcfa811bf4d2e141abf0312add
SSDEEP 12288:LvZ1Iyd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:LZuqyxknw4FYnshx8OfVe247
TLSH
T16A6512AC33E860F1E1A7113A89F15206E762B4A2677183CF4768625EAF71DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 233c0b739c96fc9ae47811941d0b7524b5812d7c61644f4416f615084593d232
MD5 0bb3677c6aede77c6d3c4678d8f2a2e0
SHA1 42304f65339365f9497f8d32d40d8d20c2360145
SHA512 a32cc2edc4b6d7195a775cd774ca94a52b7493dab74d86b316692d4f85a651078b6b1ff5aa277f15e83d15ac76755be86c00dcbfd58564d72d3ba6c57813e22c
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U0:CQRQyi36YOcPDLvw2gAf+PN3mix8EVy
TLSH
T12F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 409798de70bfa3d747d46c2b79c761589511525379173704c3d7deade80fdecc
MD5 76cbbfcae327067d9bf30f5ff67bbe14
SHA1 1056d792114aeb0d561c88c141c89e22c311f9ed
SHA512 70b01a48d820a9f385c6846d15c41ca5de4c0537c883c80b2feff8d50023ac4a3ab1519de8fcdc183f32b623fcf41161a065ccd03a5c8f6c283767a6c963722c
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U0:6QRQyi36YOcPDLvw2gAf+PN3mix8EVy
TLSH
T16A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 546882f41a645d1b707335dfde543a585a5347c41439aaf3062ad7b4ec844931
MD5 e4af87b6f85c5d33d4da8b6b2da14483
SHA1 8a07314e762c8c35ef5da5fd8d58bc367a6360ab
SHA512 1940206ea48063e26e236e6712e43247393485fec5017da58b80e7dc927786c6ec334de80e45711c24969a00757cd0f9a063b9192a172f16dd5b3606e7d1afda
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL06yxknw4FYnshx8Z:C68Qg55nhkeWu7PNU3/ox4x8EVep
TLSH
T199B55933B2F600A9C44DE1769F4A973196D17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 68896eab8a35788807b99a9dc442f10606aa4972a64cf3a82c6795b934c5d8d2
MD5 3a92471367202bcb5e1b563f2d99b47e
SHA1 2b5b345e250607047f1c57293eeb8febbcdb00e2
SHA512 093be4b36cd7ccbe094161dcbaed26670b5d6a620d8b563b39a9acdaf2314372e358971e0809bb87f407a6e8345f2ec109a993538ba71cad4909c8f41c6a9a22
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk992:Qy5112gYy5azzVvU69nLKnhZJix8EVy
TLSH
T13D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5f51ffc91541cd2ba019f8ca88241058eb5d181e0527ec69f745014e655cb846
MD5 1799798c0a5efd172511118d2a9c69fe
SHA1 3e717ce1fcf10f1716e4f42c50b94fef7f27a6e5
SHA512 76c0870eecaef901a9fcecf87f38f61713ea2fa5383a53e18a92f42c6e6fb7464779b54ba3f58c72311703f991f34bdffe1b4f80f31064f561428b4598584384
SSDEEP 49152:cB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glOx4x8EVep:2u6JmIxd2dOix8EVy
TLSH
T1CED59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b8d55e562b85ddf6fa8641f5f1455de4d14062d266a1444e69bf43da09671775
MD5 eede297574479babe403d1d7c8c26b64
SHA1 1a24a97ad54d7c225d5624cc6a7f031dd1b673cf
SHA512 056ff7b3538914eb6da4125d3a205aa6745d4039564d324bb192a380caf03d6548e76ecabe37dae435c87a2f92703335cf8f5ef6f848cf5393a01dba9f4df71c
SSDEEP 49152:F1hpsNoJpF1A67U44CwH7R4xix4x8EVep:FmifPqRHix8EVy
TLSH
T10EB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 29c2ef20a1905f876643d562c71ce92e4ee2be21a0d1c8eac3cf12702b54bc35
MD5 5698cbff32c4198f1bdb00dfd32cdb16
SHA1 d08342a8e63b6ec45e431ccfab6e28d7dc54bc35
SHA512 c069eef597964e21f9094b4da32a0215246dbd3d27f043efe881e718e60221360ca080bf7774d500d2c05d6588686ac04395976080fad6af59903892fc3d921b
SSDEEP 49152:hSuZQIY0Be2KkRVtOnks6NMHqFx4x8EVep:v5dKqi61Fix8EVy
TLSH
T109C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6ce16231edd022051c4a2f2267f02a8311a20a8eb8525a8b51692dca7f803e36
MD5 e74dd85d383c3f082d966f8fcaf5d344
SHA1 3614c5c096ed3e8f5669a1e8a9a0df10a67f79e8
SHA512 cc5362d5c91c07e57e5f52ae3f80f3405f610c26063b08649509cd55c2c01f90506030e3d3dfd9d525c6689724ccfecfe5a0672a634ae03735edcd2047d80357
SSDEEP 49152:6htSn8EApI0figjgiDn0AP5w+x4x8EVep:7X2iWphrix8EVy
TLSH
T12795BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 a5c1280426f9f33cd50192872c2acb2c197b7de2f8f1e251fbf69463a91a47d3
MD5 2ad08f4e75985c56986e5ca9c981c0d8
SHA1 0634e65f05ec17a86c2a3ca7b7d60b96a1006d44
SHA512 72f98eac2dd36a0371a81038b106c77dd617f3a04dcb1831b6c9d7d3d69b1067a50affe61c44b1c5918adedcfd9b4d0ac9f80ac7e131d57636379256f00b6976
SSDEEP 12288:q++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:q+yxknw4FYnshx8OfVe247
TLSH
T1B265237CBBDEE5E2F50D11734A7173566609B5A5EAB5811BCB7CB00EF0B0C90A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 9258129b42fc48804fb5b61071266fd7b9dc6f4c453ce3fe81f78cb651912d13
MD5 2da1ff5171d922c8e4c024495280b4b6
SHA1 987ea838d15b41c9d5625fcaf3f38b193a6dd52b
SHA512 f4673e9e2e20cb9e7294ad04651a04e0d317b05df890ec8106e40b9b59947e08f3e4f2e7c49132ac09910e5660cf6a6b7bb074708051b9201621791b2fe847ad
SSDEEP 12288:gR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:gRyxknw4FYnshx8OfVe247
TLSH
T19D65237CBBDEE5E2E50D10734B7172666609B5A5EBB1811BCB7CB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 11b811f5fd20d04b335095fe4bfc6f3c9864f76703f05e79ebbf7d82662fffbe
MD5 51006bcc62704803057bbb397400ead4
SHA1 303ac6cf2e15d43b56def1679442aaf0041abe29
SHA512 6849ca459fd9cb68215ca2c46ce78bac1df8c93da270f84b6c99a566866effc4aca5c12e0bbf919203bf564587a8c66b88cde58ed5c2cc92407c1a5fb1757a1d
SSDEEP 12288:vf+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vfyxknw4FYnshx8OfVe247
TLSH
T1A165237CBBDFE5E2E54D10734A7133666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 c633c4bd58403146b557af2ffa78eac9994bf0f9b4c9fc4d6e29158b7108f0eb
MD5 29ed87311b87ae36b9124fbeb40b61be
SHA1 4f833cafb4e6f0cc8be144d3c10746f0d6ed31a1
SHA512 6b5d9a437c576ca3f4ef68aea676feeb28e55e2e29534534d748d87cbe13233c20204f7268d9ea53d5914560c83329cd641b6be552a41527a34950ecdfca17e2
SSDEEP 12288:MVs+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Lyxknw4FYnshx8OfVe247
TLSH
T1B665237C7BEE90D1E45A51738A726222B365B8E4E731835FCB24750EDDB0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 8632c9a13bda39e5daa99023b0c87956eb8649fdf2793d27073b38dcb3b8ca2a
MD5 d6f0067749036fe1044a239b8e5a0fb2
SHA1 7b0b24bc6689f3d7536fa85c801d279f67e81575
SHA512 6d53a2cc52dc14e640fddf7f482440b601da005f852a293137d8b5b199e72156b33ca399bfbbc282a1a93840c5c0e991815239e913ffbf3cecfdbc4cff5ea2a4
SSDEEP 12288:Ak+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Akyxknw4FYnshx8OfVe247
TLSH
T12F65237CBBDFE5E2E50D10734A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 f63e32496588a5d9f0e1a2132b5a25a9606948f405eb2f4e7fd0ba7af9f4ad9d
MD5 5854a46d3e5963fcc727d25b3dd7ee26
SHA1 a671303e9c6fa2d626f5cb7f77822e2976599c3c
SHA512 97136fe1e999eba69fa5ae69ce24ee348deff5c560879c00f8b0a23ec0b20028101d8f20625c4f0f5d227bfd4d0e24fc4779e3a29be3907fde2724aae22fd69e
SSDEEP 12288:a1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:a1yxknw4FYnshx8OfVe247
TLSH
T15265237CBBDEE5E2F50D11734B7172666609B5A5EAB1811BCB7CB00EF0B0C50A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 1328e2b73ccd8c6304db2a68da0822212939295a7e188185fa7daa9512f73090
MD5 06b8897ccaada9b42a52ae5c80aa0bbe
SHA1 c257eb2461f1d4ba5a6b38a217c89a25d1335eec
SHA512 7e44fc75318e51d90337100f898900dbae120055633dee09643373f7d80b37b13afc599a35353bc033f577335ada6ad06560ef106576e1f4b519d5d369c4de19
SSDEEP 12288:dp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dpyxknw4FYnshx8OfVe247
TLSH
T1E865237CBBDBD5E2F50D10734B7172666609B5A5EAB5811BCB7CB00EF1B0C60A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 9c9e32e1fed0f01a8575e307ba93ff655f8eb95f691074c96b021e10f9a2c777
MD5 c7162464d946e01a43248d341cdf7c17
SHA1 1692d33d1a981634ec1f10b367b675b596d24431
SHA512 fb198dbf425c8c5c52fe3638b7bf59ffe71bd52837cc47e01b72ab58d9cd35eb0b854079f9415770277618e4fb7475b77094bcbb0eac75b4e4c9066564f92e48
SSDEEP 12288:0iZwbyzzFEoS2cPvyx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:XZMqzFVSOxyxknw4FYnshx8OfVe247
TLSH
T1267502A8B39018F4EC67413ECD659916D6B27C694B70C21F43B8362B5F736A01C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 1e06f8bb29aaa1ee08213d6d59b6547d14bedd9b513d5287b85d1f2450061f1c
MD5 cf23d2fcfde4cab7217fad0de5f6c5d5
SHA1 b478832191f49268860a399413a18ababf604eda
SHA512 83ff510b5a89b6d0961e68d4a2d44757061b5697a92b93002b3c2689e07529ae7396d4806097b0c30138a1cb4cbbc04dcf845e0d1817ac67ac9b0e19ac00aafa
SSDEEP 12288:xa+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xayxknw4FYnshx8OfVe247
TLSH
T1AA65237CBBDEE5E2F50D10734A7173666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 fa9311e83e3a48c9207108a0141d2dae798a27141bb544062de400ffb8d57a4d
MD5 dc02465b1d1826708e91da4c89fb2f01
SHA1 dfd0d4375e46676d28d27d7629a18679a0a25da2
SHA512 23516d76772022cd50bfc6cdd7f6edaa3b4e990174847b9a5e60c9b511dff00a12caaf2a7c8da206f69ffd69480fdbca1e085c614b7d7361c3d5ab317bac7984
SSDEEP 12288:XG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:XGyxknw4FYnshx8OfVe247
TLSH
T11265237CBBDEE5E2F50D10734B7172666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 720472ed741ed3343f9f7d48f45a9d7064df85100a73c893b40593be729fdb70
MD5 275443a52dd7f8910d50d247f0498d92
SHA1 c25151c1101adea0ccb06271cab515587357dc96
SHA512 5b373858c479a03b2a3f9d18d20d31c1a8d599ab563b10622946c80d81d4df4e9a5b4958c67346e515595b2cec48d7a6209d326da6dcfcd9b87ebc9cc68eb995
SSDEEP 12288:FyPz5L8d+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Mzydyxknw4FYnshx8OfVe247
TLSH
T19F75125B73E630F5E13A523689621602F772B8724B3086AF47A4537E6E325D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 5b141273fb884c902ee27772e09f65bc1dad14c05698dff05c7177c19c40d7aa
MD5 e6e5c34ecd67fcb49b70f52559de5235
SHA1 19cace62cefc8995b2daf78aac15dde00afb2ff8
SHA512 1e3b758a0829ed4d15326724c563ce9411f6e96ccea02dd992767f1952f420c9d09a8560c6cd0908b893ddd5d61d9f6620a190376f7740230472f5a24fcc8f6a
SSDEEP 12288:fa+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fayxknw4FYnshx8OfVe247
TLSH
T1FA65237CBBDAE5E2F50D10734B7173666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 ecf52ddd925a3ef407aaf8c0349c19805aad59017e0d3d188a5d0bd2d050ebcf
MD5 a944833dc3ef46eeba7b1e3112008f45
SHA1 70aa3cbf268ca3a84ca2d79b0b1c16d3b0e7f1ba
SHA512 75353b7a03a224148d016f16d08d9afcd7485a3864d45b56089e1f5772df2f88422727a8bfb5d3f3400a8443e4b8272d12c1bc9c115a3f75a9757c650ae0983e
SSDEEP 12288:fa+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fayxknw4FYnshx8OfVe247
TLSH
T1CB65237CBBDAE5E2F50D10734B7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 99eab73d741bd9c844c78db5166c6d1ed9a3e4ee4800cd6a8c86712c9b572007
MD5 341da823301bb80becc13f46ea13a6c9
SHA1 47e639bf3566d7de173dc35b3b0d0bea36556871
SHA512 6cb986c96857dc72e2c6f2973a77cba41438f7672c973d99ee074b148bdd2c67c0172d4bd3ec719e8f68ee442f07bb0633571c12d2cf67e8090a69a683d242e2
SSDEEP 12288:/yPz5L8d+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:yzydyxknw4FYnshx8OfVe247
TLSH
T12F75125B73E630F5E13A523689621602F772B8724B3086AF47A4537E6E325D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 1689bc0482cda67ab7a7ba54f9778c5278a0f8919fcd128358145eecba8d5fd8
MD5 01cc0727796a04af69753342930a1282
SHA1 e1a0f6b9d0de5341461f1b7f00884fc01e7cada2
SHA512 9f8231def95d9ed150b58267e1564d08683d819c46ea3d6f4aa3200e015414437435f1f1bb666fdc5337e8d20fdcb561a61d6fff6f6afb701f7bb076ce4861d0
SSDEEP 24576:sTPaLl3z0zDvyxknw4FYnshx8OfVe247:sTSLljDx4x8EVep
TLSH
T1D17501A8B39058F4EC67413BCD659516D2B27C6A4770C21F43B8362B9F336A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 6e2bd16de8d73dba61183879660dfeaaca389b5c2418b2b1bdab9899d5a6c279
MD5 d1de9be9edc42edb1ad29f0beb18a68a
SHA1 c65aea11c5e97701387dd1f1f596e01137e5d17c
SHA512 31fe49059d3001edd5dd61241891bc9deadc0c3d02f05e0c5df79feefe5f7d7c0d52034ad26afc19680dd4e79aa51efed632c22ce8c8560ddbcf561a30d6fbcb
SSDEEP 24576:C30d9CHKy7GZDyxknw4FYnshx8OfVe247:k0d9CHKyawx4x8EVep
TLSH
T1BD95DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 62f60d1a15f1137fd40627d86fb2077114022e91a88859b2ed37720930926c62
MD5 54b34b059d5edfa24fe612737db066bd
SHA1 464f00ade259ee846354a41d41aa1a1bb9141898
SHA512 be41f29e038a635561de1f115fccae16dc2852859c0ceed052e44450c63653e90c3f9f6e20b545e26b468db612d24105e6094d3e69713e10ab92203cf812af28
SSDEEP 12288:X/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:X/yxknw4FYnshx8OfVe247
TLSH
T18765237CBBDFE5E2E50D10734A7173666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 f6162512dc41d5cc43459101b592fa5d6db1e12290cd3d954af0d5d56c5dbec1
MD5 c0fa88253ccb4cf887d6062709c27e32
SHA1 7564c725d7e9c1e7133285e654309c2528ded838
SHA512 5e3f52f4d5b0f3d7dca03aaad65f5c304360f3e3ce54ae0cf1dddeba9abb9f36c960257e53b5effb947045ee0d71ec88e044921eecde211f78509a009c8cb626
SSDEEP 12288:N9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:N9yxknw4FYnshx8OfVe247
TLSH
T1BF65237CBBDAE5E2F50D11730A7173627609B5A5EAB1811BCB7DB00EF1B0C50A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 45377396d957f6eb8eec978e6e72c3549ee615893024452cddc5365540504fd2
MD5 b9c6ad15ff3cd101fcc00febba01a3a6
SHA1 e917dff74a0598c176d59d3a8126b6182b912cca
SHA512 9b6d9ab832e10078fa2fac424a4aa868a3c2409bd9ae19aa2cfff4e82a5ac00562ee1b313805d4c3e0b14680cc4dacc893c24f5bd60149fc46642be9197ac089
SSDEEP 12288:g4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:g4yxknw4FYnshx8OfVe247
TLSH
T1D765237CBBDEE5E2E50D10734B7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 81de7a9bfd724847c6745639e2ec2c38eae1b967c70ccc22c215f64425e76067
MD5 22c50431a05376429bdc8de3ea39cabe
SHA1 aec2ab67d2df67314f2785564b3c7827ce0715b7
SHA512 e73c8583edb3f5dcbc0b582bedac6c3b32d0f45482a4ee55b328e6d2e6a26807a94f9a10220a7d8a07f8b6edd2f6593e29cbd0783f3c8f6082717b7e38e7960d
SSDEEP 12288:qa+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qayxknw4FYnshx8OfVe247
TLSH
T18565237CBBDEE5E2F50D10734A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 487262b12daf160ff7112a6da217154a5416d5795223219ef84341c9f288bd12
MD5 6fa5eee8046dc2986bc364d53edd11f8
SHA1 406fc3b92282c1782ccc933d3278a318dffea52f
SHA512 a11faf3ada21820c3f67fd1fee7cf2ebc4b0f580925feac7e8e3fa71925684028fb10f8e3185fa9106725fddcb57c8ce3905f1ee35ed27db3ea5585dd82a6d59
SSDEEP 12288:8/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8/yxknw4FYnshx8OfVe247
TLSH
T12B65237CBBDFE5E2E50D10734A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 52595e38a15266c2ddcbabd25b608fae0e5b0a2de2463a6f3e2202c5c00afc14
MD5 29f33890a9bb24a4c9ee7533cf582f39
SHA1 ddedf0304e5a7b742923f498f0f88eb79952062c
SHA512 095aa3a4e814e089a82a613316f6f40fbec7365d1db401ca3c86528b872cc539505fdb5eec227de7ff60071dd2a6379c7cd354152fbcbd11a825fea98515c8e6
SSDEEP 12288:kS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:kSyxknw4FYnshx8OfVe247
TLSH
T1B365237CBBDBD5E2E50D10734B7133226609B5A5EAB2811BCB7DB10EF1B0C54A01E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 6a179df58bf8fee6bc91a13378a2894c8d95f5a9cfa55ab6ee45a89e4cb26e61
MD5 a9bcebda52be55a2c92cd2c15f984883
SHA1 9bc6ad0dccb23780fb1241640528568a3675f1f8
SHA512 c66e4141eab6c334c70376e52a87b2f48a1b83bc5128c5aacbb6cc0dbe3e5c8b7cd147d52b33faf3dd479330a8d9e26de6636ee2a9fe37b54c435d0b3a36b2b8
SSDEEP 12288:Nk+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Nkyxknw4FYnshx8OfVe247
TLSH
T18C65237CBBDFE5E2E50D10734A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 256c07acc0b72ad2210fe821847f3f3de29307147604bfde39984a0ac20f10fc
MD5 729ec4501d94afaecbcf334954bd9b76
SHA1 078132e98539ce7a0f8a3e603fe2a377bc9e9d2e
SHA512 c7a1dab7b7416e4a2b6a1686861ff037a89ad7e1bd9526347000f26619df11794ce686716906befeaa7b4344e8fba825894d60c5eeaee5e0357be02bd6504861
SSDEEP 12288:On+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Onyxknw4FYnshx8OfVe247
TLSH
T17465237CBBDBD5E2E50D10734B7173626609B5A5EAB2811BCB7DB00EF1B0C54A01E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 0ba0c5922d2b3927619edef0d4d09a4c202145890777915afd797033d6ab8ecd
MD5 99dd38fc79357341da88b20c73bad6a3
SHA1 cb1232dfabe5f2effffb09750b9962d8f2c6f708
SHA512 345d77b2a22a8b1a2b8ebe03242cf9fee8f63d43412fd3eca24d7f371e88d297656e2998e1067f2f8d57b512fb7d01e7e597399b4a9d48f9fbc7beca7b0817da
SSDEEP 12288:2k+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2kyxknw4FYnshx8OfVe247
TLSH
T1B565237CBBDFE5E2E50D10734A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 07629626b984d852bb50b836974538ac7ef6ef6a4c304e007a314cd5a772339f
MD5 b879d0309870a45843150e86f4542448
SHA1 079f416063ed08508514135dbd87f8c2ca264e75
SHA512 54dc744a93e791111dcdc1579668872061cabbbfe5ef988ca0bd757dd1fa74834b2c02f6e9e8be3a554b716d9bb89f77b47db5686e9a9e549da3b67d14dd797f
SSDEEP 24576:5fwvgk9RX6wkyAI2yxknw4FYnshx8OfVe247:rMnYIpx4x8EVep
TLSH
T1E095CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d586a8ff5c63255bab5286741541d54e356ff6d3edcf3a3882d28bbb3ca138b2
MD5 86942397c0df6e773b732496781ff3b2
SHA1 94c90374a9ffcd609966e05671c6a27add576049
SHA512 bd4813a9b01dad92bd392fd97d8725af49b98078dcec6cc68da8dc0ea6622eac95d3186e5f983ffdde07a67e9b6ddfb69e1879e70998caf81ec6c1cf323f5c73
SSDEEP 49152:iYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ex4x8EVep:NySzPGix8EVy
TLSH
T1A5066C96A1A841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4bcf63e15745b72a949aaf352a0408fbade304a61e34e88bd71413033bfcd757
MD5 b35d44bb2655f48e175bab780e4fbdc6
SHA1 52bcc2cec003fc8e38fe95c442e2a1fa299f0e72
SHA512 10c2100bf07c1495b2517f9405ecea8ae6aba8fb412a86415b864aba3db79f938c1132e3f4bc5aa94f76fc068ec28950695bf4145ae9386044dd1deaa89d3c0f
SSDEEP 24576:447Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYhyxknw4FYnshx8OfVe247:447JUQjqirIhCnDHUPfF/Ox4x8EVep
TLSH
T1ED65AE1DA3EC01E5E1BA927885154A1AEA71742E5F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 1fa7b4b603f78708aed670207b4f0bfecce260c6da6dc022f2b989473f13e3d3
MD5 3c62ea26a73cb5fb985dcce11a387fee
SHA1 29086966bf24b345f54969ab504b9755ff3d5da8
SHA512 89e05663e47842403d1b6d2d1f9198e1ab2f5c6c3da21cf84ff7b4c9a6ab514d9e90a1407dfaa30a01dbd042076ea1614b76c00820446dd83fdc3f21fa9e3dfb
SSDEEP 12288:H0sfq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Dqyxknw4FYnshx8OfVe247
TLSH
T155750128E29852E4D06E2276CB625641B3237C6597F1C3CB97E0F53E1F719909DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 25ffddcf15c4732e25b563d917489ce0fe45a4d82eb8bf073c6ade934d6fe882
MD5 b1908ef454d76bc7d0c06de56d6d6a0e
SHA1 34f2e61d726d7cbae3abddc91e362405a1bfdea5
SHA512 2c310f25b5c99c7c3d664b394158699c25fdab55bb7d077533132d7d3a2b213fc6a1a43169709bd300149809bd139e0188eec0b76e74cfcf6131132ff30d2d5d
SSDEEP 12288:2Ml9PhU3f41RhAhmQ+NSX+O79TPNODQLTw7Qb6+hkoz:2G9pUPg3ZkTPNIQLTwMb6gkoz
TLSH
T13E451641762BD78FC6A950321E36D6CCA7707D01EE05AF0773C8873F9576668BAE1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 9f6c9ecc795badec155bbe449dfd717a67f51c247e79f6fb83bf479bc25ab1b8
MD5 0b535339e5f52f3fa12faee838463453
SHA1 7b25d2f87840e2be0773e491c81e559471bca62f
SHA512 2beb44c518a6733381aca43d43f102a9235e9075b46f399dd97aaf031fcb4de793191d21fcee2005d973760c647b77d4d44e01b4d3731aca71353daf32acedec
SSDEEP 12288:REAcfQPBnTxtpJKasKmlisw2om+7tXsLoJYy70:REAcAxtDX5QIBXgaD70
TLSH
T16B452941A4A7E35FCDFA9037073686CD7BA45C06B7463F0573408A3C9867A7EB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 fd2b5d5126e9aee1b5d3a28041b1f86a5398e725fdad5979040fb98f7090ee24
MD5 26a278d27434958de410c486016ce04f
SHA1 74dd210b8dc4d1f4ccf54ede9c915000a86bc27b
SHA512 71fd7bfea58eafd9349f81b6465f2764c1b9af9de792aa5896ac4d2508e00afdf4ce9fe2ada5fb0482a925dcecccf243a7d77457f68a27cfaebf5c91fc9d946f
SSDEEP 12288:cR7i+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:siyxknw4FYnshx8OfVe247
TLSH
T1CB65237CA7DEE9D2F46D11730676A221360AB5B49B70C09BDB28B14EE4B0CD0987DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3deec13a6e4f5370586319ed6d6039852b2f28184e8522aeb17706e9653411d4
MD5 40973b2954b1c40fb5ef01c08bde4643
SHA1 54cf52365f9e6a5d14f8947ada1470cad3f3f621
SHA512 a03a9f5c9879115ef186f1e968b6d040048de3a07f5a58aeff1c8b65397664d3c20c275472105dfa5c594fe6539189b3313a608f5e26bee4b924daa31cac895c
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYAyxknw4FYnshx8OfVe247:Xgb4mBIBhGFkx4x8EVep
TLSH
T13165AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 287a90a66e27b926c89f8b8ac9d91071a3ef6525e436fecd700157437bf6fdff
MD5 dd91f70b4554efe6e982d4bebeb6e8a8
SHA1 17d4b87616174e723231cc9167b62c92a486ae7d
SHA512 d90eff2ebde2afe2df2adf899af91b3bb2987e62a81716e379325ddbc4cb32278bc4f11bd2b5f529a58d14e3c24b609b6bc7c0e58598cd5a64343abe368e9501
SSDEEP 24576:vG88u8FpJqH1Izria7/mxyxknw4FYnshx8OfVe247:e7ZFPqV3a7/7x4x8EVep
TLSH
T1DA95F16977E101F0D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 03a19a81e4eb9ec32ef00600917310018690a4594c0fcbb0ab59964a2ed98a8f
MD5 90e8030b4767df62306951179d46554f
SHA1 508bc68cc83f4fd65cbcd30a12ad3387ef4f8f7b
SHA512 76ca1247f5dde6607f732bb1efa939146c92c5da155bf8827fd1049544689df8031fc332074b6ba5f95aa30824ac23acab17adbbc77a895d229b35ad14f352c6
SSDEEP 12288:sHvUrBFrEjwaQl+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:sPUr+NQlyxknw4FYnshx8OfVe247
TLSH
T16F75F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2048178e514b0acda360957299b6a7101e7bf006d4ed86fcfb58f591c1a229ce
MD5 9cce2737412578bbbfbde0868737e1eb
SHA1 ff0ad422f9341d9b3c6a9594f91fc3bb5f59a8d2
SHA512 c339314c1a7d203777edfd5e98a442fced706b8e66c5c99307bf481360885aa5bed5611647bf9d16e710332829559344d024a066c46a95db9758b4d66199905d
SSDEEP 49152:uBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjAx4x8EVep:xG05lO43bhix8EVy
TLSH
T12ED5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 43bdb89abcd5a5198721c47be22838c398660e03194ffcef55ef69eeb95e67c2
MD5 e646429dc641d05922760e4b7511122b
SHA1 fbce982d93fd72e34e8b013a69b65c4b7d1754a9
SHA512 8be6200ca5691326e530888566fb5d9e03919f43d0b3f6985ae3adb130a0f3bce1bd07c12a167cc0efdf8debae348733aa3d1672735a63bc65f6c26ed81ef16b
SSDEEP 24576:tfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn7yxknw4FYnshx8OfVe247:da5POZ3lJt2pasx2+mox4x8EVep
TLSH
T16265AF5DA6FC01D5E5B9D17DC583461AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 14e1049c96ed6a4973ab04de78312573ba4b4c7569e971b614e46301dbdd3a43
MD5 5281a4308f5d6ef96c9f333abe2cbd56
SHA1 ebd8c5cee51601f8f66a0c00145f2aaf258130da
SHA512 b8d61ed9a95c901da810b2a20327faed78e20b6970655c618f3874e6f6f8914512067cdc6643fda6981ac20c6dd62fdc46bc71d9ca98ad1774176d6c28bf7cf0
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7Fk5yxknw4FYnshx8OfVe247:xNc/zEOVHFbx4x8EVep
TLSH
T1DD857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 af422ccbba2c34e2dc51282dadd0c4a8bae0f4c221ca79a0eca5bf6b3ef03eea
MD5 9adef5c789ead1676317e8acffc32b48
SHA1 6bc5d070c73b6c78b26a3417ab1a00a6df9e909a
SHA512 b077ee1f81810b555d3cc39d1875009973ac9beb6338bb5486bd023b3afb32472202ee07cc14233bed81d2f7a5916c5d8854cd1970287ac6696a8ebb4cc30166
SSDEEP 24576:hzkNvNnaFeYhJNtmZBmnyxknw4FYnshx8OfVe247:hzMwBtOmyx4x8EVep
TLSH
T15D55AF6EBAF846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 39668cabc73f2af4bf82b767c80309154c0e8a0dff1d969c3edfc363b806fef0
MD5 2951842c12c3f7818fe920a22e9dc54a
SHA1 dd381ef336e94e580473fa4e769e5ec9543e424c
SHA512 5e62f8b664d37ae95c68e35c1dea43d0b2ed5ffa027a11a4477f11aefe1dbe5dcd561404b2abcd3103897316806a445c420b1a00db1adc17a23816e33c252789
SSDEEP 24576:XD3FHshBIYQgAeyxknw4FYnshx8OfVe247:XDVHeBIAARx4x8EVep
TLSH
T16485E17DEB9C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1340-311-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/1340-7-0x00000000022E0000-0x0000000002346000-memory.dmp

Download

memory/1340-75-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/1340-1-0x00000000022E0000-0x0000000002346000-memory.dmp

Download

memory/1340-6-0x00000000022E0000-0x0000000002346000-memory.dmp

Download

memory/1340-0-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/1488-120-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/1488-367-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/1488-113-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/1488-114-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/2124-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2124-136-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2124-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2124-125-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2124-132-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2144-82-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/2144-76-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2144-308-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2144-78-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/2328-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2328-19-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2328-86-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2328-13-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2516-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2516-99-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2516-106-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2516-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2516-364-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2556-53-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2556-291-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2556-52-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2556-59-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2744-63-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/2744-65-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2744-71-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2744-306-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/2792-50-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2792-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2792-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2792-37-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3060-25-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3060-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3060-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3060-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3060-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3884-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3884-362-0x0000000002F80000-0x000000000321E000-memory.dmp

Download

memory/3884-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3884-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3884-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4412-94-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4412-365-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4412-381-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4412-380-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4412-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4412-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4412-88-0x00000000007A0000-0x0000000000800000-memory.dmp

Download