cca04a11040a63f8ebbf1810ad0586dbc32e1676ab3c1a353359802b856c9754

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.8MB
Sample261009-1yrscaef36
SHA256 cca04a11040a63f8ebbf1810ad0586dbc32e1676ab3c1a353359802b856c9754
MD5 0536e0130df5f2a9a617d5afdf613ed5
SHA1 c5ed6220c89ae1fa05e12bee3572c4ded2b19a72
SHA512 ffa7bc02f56b74f1e0e1e509df9c04051f2fab270a3f955f4747fd8562d84a6b72ff5ef79a7c5b871336ad695157b998a03f06eb868db50f7b10182515424ef6
SSDEEP 24576:O3F/vaRk1zTs7LwYnNM+PedCN/j2GLl3iFSE33b9Y:bk1zTs7HG+PhN/j2U4FH
TLSH
T1C395D010B999BCB9D2B638310675D1F2092CFC302960964F93D83A766F74593F53AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4624	elevation_service.exe
5376	elevation_service.exe
3708	maintenanceservice.exe
2144	OSE.EXE
5536	PerceptionSimulationService.exe
4544	perfhost.exe
620	ReFsDedupSvc.exe
5268	SensorDataService.exe
1360	ssh-agent.exe
2448	AgentService.exe
5540	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\36e4df7f612dd39a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d375435e3a58dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c27fdf1d3a58dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000054bd31d3a58dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000805c881e3a58dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003445575e3a58dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005253695e3a58dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000660bb5203a58dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe
5376	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6016	2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	2448	AgentService.exe
Token: SeBackupPrivilege	620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	620	ReFsDedupSvc.exe
Token: SeBackupPrivilege	620	ReFsDedupSvc.exe
Token: SeRestorePrivilege	620	ReFsDedupSvc.exe
Token: 33	5540	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5540	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5540	SearchIndexer.exe
Token: SeDebugPrivilege	4624	elevation_service.exe
Token: SeDebugPrivilege	5376	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5540 wrote to memory of 1732	5540	SearchIndexer.exe	100
PID 5540 wrote to memory of 5644	5540	SearchIndexer.exe	101
PID 5540 wrote to memory of 6020	5540	SearchIndexer.exe	102
PID 5540 wrote to memory of 2800	5540	SearchIndexer.exe	103
PID 5540 wrote to memory of 468	5540	SearchIndexer.exe	105
PID 5540 wrote to memory of 2824	5540	SearchIndexer.exe	106
PID 5540 wrote to memory of 4656	5540	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-08_0536e0130df5f2a9a617d5afdf613ed5_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5376

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3708

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2144

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5536

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4544

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:620

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5268

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1360

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5540
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1732
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2552 720 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1896 1900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2552 720 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1896 1900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 daadc8a315b5510150ac7e3cca9bc0fba52fdbd080aa4648ec99a1cbd44a5482
MD5 41a2898cc00860e516676d0e1b220a5d
SHA1 84e85961fb2ada0df984db668a9c56030b919384
SHA512 667580b14d81de2e1fc59317af81b28c765235054d5fa5c15c5a96f425fba6989eb4461df693c80ea3ca74ec21495b25eed89e10436dde71829aa78981774b18
SSDEEP 49152:Tb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnLN/j2U4FH:x3q6mjBcj2jF
TLSH
T1C9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 75a5dc0eb49d6ff51db3b01f44ee04f8771a4125e6b2087f2c30aabe1c1f283b
MD5 fd4651305aae8637d9f0730458171bbb
SHA1 ad2d96f8f8657bd78af749c5cb2eb526f80aa91d
SHA512 7c4a7d367352262c1a4404db706176d038744f6ea6e4bbab4f4e099093e52578100297df4ae1c52869576417c0f8b1c4482d0053f172366e64d78cb360070e1b
SSDEEP 12288:21XLsswWkxy2lRq2czAXJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:0XYfDtczA3dCN/j2GLl3iFSE33b9
TLSH
T11B85F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 ca6f086bfc99d6b57d0878b917473735080744c48d6679e176d49cc659199d5b
MD5 3c7fe660b4f91da5421bca5c203c4d8b
SHA1 83b3153b6f5b903f2763650e35f12a9cbe957ea5
SHA512 8e9caf7f1189ac80305503232fd65dfec3e2c92555ad7a1d96dd3d93a3f2ca14344a993513c4ce60f02472b47ea45b601933de7cd4cb0897927838346849c27e
SSDEEP 24576:a0Le5ji0hmxhrMIdCN/j2GLl3iFSE33b9:aPji0AzeN/j2U4FH
TLSH
T173A5AE26F6748335D073C0B9C5D2A69AE97130865B308ACB4286D77C3F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 989fb6d86c37798d1d0f6de708e052f4e6eedc688ff8d063e0e9de87065859ec
MD5 48aab96d59c2e7b448d131725772967c
SHA1 a7b558d91c2e37dff312f9f1326115ae3799a844
SHA512 994a4bdeb8de75c9955223c791b06704662df69133d305cfdd8fe1a3c846a10f60144962d35a3b14c11efed613d92177f4dd68d4c3689120fa7474e600a5bcaf
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWj6q8wyuedCN/j2GLl3iFSE33b9:5/ezSC6vUzPv+HjyyN/j2U4FH
TLSH
T1DA755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 312b2d6506c62967494f1c5ddf0d6dcd12fcd791693518632d454a78de2b49a1
MD5 572b84efb772e836fd3046d167aab153
SHA1 b2207f30db8c463541f813a13b60e5145c65ef7d
SHA512 aca71b5df75a58986ca51b13461d9b31249a9df7160b6aa3c773874c352966f616643191ad11b23d39b41dfb8733a66856941b77176bce338a9a070fc922e6db
SSDEEP 24576:lVbqPb88hv/l+BTdCN/j2GLl3iFSE33b9:lVO88hXl++N/j2U4FH
TLSH
T126559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 ec0d18c07d1ea25e6cca269909af3cc7c5e80778c72478a1b700cda396877d5e
MD5 8a93bb7fb40b86a9fbe89427e41ffbe7
SHA1 8e0a618d8065b151de646d8dbca914ac0fe70e79
SHA512 6c0e5ea964888ca59529ca159068145cde0139a2792a866cebc8f6da52907f7f80f5fd75dd350ee6ad4f6ca8148aef275987c618f13e33a45c34bd19e14d30ef
SSDEEP 12288:lGMJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHN:lGkdCN/j2GLl3iFSE33b90
TLSH
T1CC652364DAA5B565F26F837903ADEE615200FEE8E525884786917BEF117CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 9195d7eb3c266558dc962cd3186082d9a4d2f5a735001fb0b760eab4d219ba9a
MD5 9dab0c29f690b5277857423e135cfe2d
SHA1 50a864f9c4e58ee22a336194541d15c7f404ce75
SHA512 f461026adc328eee0c0bb05fda61a7731d42f0876e6458d0244e06ef709e6e1bc64c7b48a0d3f4e05ff440e4e0be378b073b081354ffab26521d2f3422534fd8
SSDEEP 12288:zeBNUbTVO86UjJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:zJIUbdCN/j2GLl3iFSE33b9
TLSH
T14285CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6dba12159a0072b1e1f59d5175fd588bf6cb7665c2ba24147eebb4098a79d5d4
MD5 6ac135f49a717dc9772b18a530bfbf24
SHA1 35935c5fd7cb68e1b22cff31c1b228744a03c2b4
SHA512 4a93921ddc583709c64467d5a2d5441ab58910839356011a02dcfae331daf433a754444540f917980d4a3e31e8c431ebec4fc0643192f48d25a1f3afc74e07e0
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THB:tQvGAdlCEL8c/WRNw5C/j2jF
TLSH
T11C267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 c2ca9a7c72408e54e22f1104ac8749d9784a6ed39bf8588b1cb1b4f0b32a65e9
MD5 bd2efe0d477a8c9be2610b5db9040342
SHA1 c5de8a54070328c42560e473805ff11c9f8e2673
SHA512 41768585aa14f71a02c39b6873fbf42e842310f8e483c57ec110f2e6420a23ee1ee79953ed3609716e9a3b96bf91a569e9eb69e8e66b404a9e31d415cb215031
SSDEEP 12288:zAwSfxL/2Dc3mDLLmt0LDQewsAjtJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9E:sfewsAj5dCN/j2GLl3iFSE33b9E
TLSH
T15095E031FE74E036C2BF0DB61B36C716142CBA608B6119C3E3E84E9E59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 893639d7f939bc14e913e8741d3e5f2de9adf031f6b3da79fa4fc9fa03e01dae
MD5 3a39974551c56c5cdfdbbb891a276075
SHA1 bf2c77172f14413c30068a8767b9b7cf014264cd
SHA512 c84372b57dd7e7ca72383fc1211db53dca2847c2fe6bd198f6ee98cfcc2143ba04ce0eff677521bda08499c81cee873289c7fc5b510ec5a165834de051850958
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH+8F:CUEtQevvqc2W1cpV20I32+
TLSH
T141474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b794a70a96a1dbda393fe98cb523465a7f3d552e0bb44c8d1e0eac35158efd79
MD5 05cc12c02eeaf128f92d513c5a286256
SHA1 c7942b169e86ffb8cad138c8760e781eb07361d7
SHA512 5b4d1c1f738f09b9659a2bc0236809020e1aed6b4b15abc4575164b0c781736d99ff8fb47e6682c8528310f22a01e495c09f00e24c311f3c8fc596322e578a55
SSDEEP 49152:QCbRquA/m2yL5zTfFiV+XenmE3/zuN/j2U4FH:5oquVjnmLj2jF
TLSH
T1B4D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b4ee4630f9b0f441898928290f7383ba070e3d2044336a028c81791d10c8d074
MD5 07110ed35e258940bae5a915df601ddf
SHA1 e19d00830dacbd01e4b66447494ad52b7836d0c1
SHA512 8a112a15d0c7e2296f05deda6f67ec28316e708fd82f29377ff6efd04a6df28f911b6f69bd9309e67bc7c9df3ee2072b9db654af9eb9f79a14bddb88061dc0ae
SSDEEP 24576:hAhGL6IFoiwtA5l7S53CdCN/j2GLl3iFSE33b9:hAM5Foiq5VN/j2U4FH
TLSH
T14135AD80EBF955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 af5dc1271a34d17ab5f04dfde590a21d7ad321a2e7eb63a3deb73e1b56dd00fe
MD5 d5c0142f2ea363b7944520f37ef6f339
SHA1 8f79065f09bbca6347528fccfcae111dc7be3f81
SHA512 7422f5e46808be28b683e1a9a393e53b5a45db074812d4c2440f2b3225c2065b9c34725b795bda65398c823cdeae3d183984509111332dac955a62f3ee8c1d7f
SSDEEP 12288:omw5HEjsChNEBFgl0WDm+CiJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FwuROW9dCN/j2GLl3iFSE33b9
TLSH
T10F85F14576E41CF9E96782388697C536F7B2BC512A21CB0F0360C69B5F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 c558b06c420f3757bcf9907556b3d19a30003b5ec6f926db409d72abb912ad51
MD5 241fb281ba13b652822955873ca06697
SHA1 f5b7a8cdef930b1a845958013a53491e7736cc77
SHA512 048bff2cfc5b984ca3ecfc54fce996497ad294b27c1ccacb632dc682885ac9c9151cf07c9250bc7839cb8ae83327cbd1ce763e44ca66a477cf7949e611933214
SSDEEP 12288:TyZ1Iy9JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+ZuwdCN/j2GLl3iFSE33b9
TLSH
T17575125933E471F9E1A7823C8AF59A05D321B8A5A73243CF026146EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 010e9d57fdd17565fb8ece315db64e3b72ef12963c82bccb2fba7772bbf3108c
MD5 70086a78425316a31cfca4b0fd37bd07
SHA1 0d733e3d8b8b48db684c6c241bdce4da2a53a22e
SHA512 619491e535665db1c0dc5fd1ab376d649d39ccaac4bf5d275321d9feaf41f7c92ba390cde8679c2cf6ba01dae043af580fe5e052d8433a30823f781c91d30957
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ul:YQRQyi36YOcPDLvw2gAf+PN3gj2jF
TLSH
T155667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9d2c120273ad63a0d91761991d508c79223c6fab5b820abf489b43efb7914567
MD5 e5aff55a9ba82fa977b5430e798b7529
SHA1 98ffd8f8dd516411afa48652218f25c3ef82ee4f
SHA512 4cef651f300130f5fe7eb46211b35d99978ee9aefd7a50f47a6d6477f92ad3981dd20f81408bd06620859a5bd53d5836e4c098d674f3bac754f5dfce77c6c9d3
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ul:8QRQyi36YOcPDLvw2gAf+PN3gj2jF
TLSH
T1B3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7adf2183da5b7c902a868ae29460700a026fe9eefb3f32aef142dfdf4d9d3496
MD5 09971e4f72eb722e73da30be361bad24
SHA1 b2b98c402aab07eebd596d4384f81990dcd89421
SHA512 3fac701b54c2841a7793a96b2c47287482084884019d4670b4768aa4dc4c5cdbca968914d14ddf6def63a3bf936753fdc45128f6759055e78e6cbb33c160447f
SSDEEP 24576:fwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0AdCN/j2GLl3iFS+:H68Qg55nhkeWu7PNU3/eN/j2U4FH
TLSH
T1FAB54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 540fcfa9ac6151eb9dbd6014352bae225d42189366a4afbda1baa81f3afc02f4
MD5 c90de43b43e4ac53d60f79eeaaf2efe1
SHA1 6425d7aaf0ed9bb400d052f1794a56a8c210397b
SHA512 4fb04e0d307ee5be022791feca408eb5c0e51db81036c89c1b176c837caca57d5e5fec81f221e8c6cdaf1813cb3a4d8f38702a96560d3d0ec314ff00c9772607
SSDEEP 49152:73aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99n:ey5112gYy5azzVvU69nLKnhZRj2jF
TLSH
T13A168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8b846a751083f68ad2e14e377883bdb123ed0a3b5aaae1192b5a72ed9f0a8a68
MD5 c2f3d1fdaffec60fa986ca384e123f1c
SHA1 c21f72d26ded49e08cfa2acd8617597f36341774
SHA512 b0b1241166302bfa74f8e233a1b3de1ebe7b137478b52c82d348c1fa9293a106d8cec663fc260d8be180b028bcaf2a149833635122c5f85fda3568766529ec46
SSDEEP 49152:1B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl0N/j2U4FH:7u6JmIxd2dYj2jF
TLSH
T122D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bc3f418b8b36b4743efbca45dbe3d250ff8a5ec3212bd6582cfa1182294ca542
MD5 abd994465c8571b0285a5ffb3ed2f4d5
SHA1 08341ce05b5150a12112aca147b449fe261e61ba
SHA512 63353cbefa2df8ead097bb1d341fa17490587c2b49e219f28ae53512d0e74dbeb1ab718e1024f31ea69dd01a99d23a1f1ad80276a420bc790aa3c7a819d3e5a7
SSDEEP 49152:11hpsNoJpF1A67U44CwH7R4xYN/j2U4FH:1mifPqRLj2jF
TLSH
T1F2B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ceed0da31b710b2a7402b002447f302fa2dc0b8da5f173c4e7fe15665a3d0896
MD5 4b690397c0a48ed1c7238dee4681b40e
SHA1 64cb2d4e1fac56724f4f2411c8295327a8225fad
SHA512 64282fa7da93fddbb2960c6e4b93932d85f49663aa4369eb36b291889948b1a532a296a4fd8c78d7cf23cac4479143756af8d000c012f2445c9bc0cb5cfe713b
SSDEEP 49152:OSuZQIY0Be2KkRVtOnks6NMHq7N/j2U4FH:A5dKqi611j2jF
TLSH
T1D0C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0f6aa7cab7a3ffc9e7c2713286b9fa40781649d7e9b1c6f0d708760ea452bf24
MD5 9502600f3e44539f143d6dcb28825423
SHA1 3e7f96b1ccf16e3d6a08cb1cc83600f536218b27
SHA512 e09486cf96253cca83eafb5e9fcbeb7552a140a998ef3281f9be037d35bf6ea024c127edadc90b6f3fc61b15419825b5ee7fc81e07a9d7d8cfb963d6cefb49ea
SSDEEP 49152:hhtSn8EApI0figjgiDn0AP5wkN/j2U4FH:wX2iWphHj2jF
TLSH
T1EB95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 27e79692428dbba73100cf6da0f2f9709f14bc5c72728165db23ed806ec3477a
MD5 a59b65686753bc2aad9d30931d74c7bd
SHA1 3510282a1fafe0e89d3774a9797f9cb2f2872657
SHA512 ef240ee7f54da8e690a8c7c65f1bcd9ac5a991d9fba9b59a4153a5bfd781855806b35173f4e9c0967d29baa7d58b98d26827506ad0593725c9dfc15b7e6e02fe
SSDEEP 12288:FkJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FMdCN/j2GLl3iFSE33b9
TLSH
T1A1652364E9E6B669F15BC37943A9DF515100FEE8F6264487868166EB237CFEC8033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 ba0d18f4cad143317249fa71229560ea2690d08d5f0dc540080f09b983e6dcb1
MD5 9acef59f1d2a4ca7b492a51e988064cd
SHA1 8dd82dfa3655bd64ce84df9e07f460829b30ea0c
SHA512 6926e32471423373c0b45764c8022c582ec762c1e227072147d9d16380275abe7e5c3509c494ef4e37262a6f314476d88a9d40e0436b2deec07c33ffb6984f4c
SSDEEP 12288:2hJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:2VdCN/j2GLl3iFSE33b9
TLSH
T1E4652364E9E6B669F15AC37943A8DF515100FEECF6264487868166EB637CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 629404263b3a3cbc665d2d87ef26988b31e558184967e38922656c6af1dc7980
MD5 b130f7ae103a1639edd877950861071c
SHA1 864e4ba944f8792449a7f83c91ba37c830396c84
SHA512 f6ba7d735cd95e29966b9d4a3352daede4eae2d1b1d1cde6a3faa14dada0d572dfca795e0a2d5d220b4daa78736132b698053516af1a7a351cbea10bfae753a0
SSDEEP 12288:N7JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NjdCN/j2GLl3iFSE33b9
TLSH
T19A652364E9F6B659F15AC37943A9DF515100FEE8F626448786C166EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 4f442a3c4b8eae30447fe982d8daf3c99a66f9e443f773262db27081cf49f72a
MD5 e67ea6ef887d44aaaf03b97c928cbb48
SHA1 88f75ab8066f47a998d15961dc0015fa9f9a6804
SHA512 99eeb691bbcdee7d6b6d83e1094a491f6453dcfd304ea5e1bcd4f51a81bee3b3ad61870418b13d338f1b238a95fef4f77044d9ed7d0898d677b82e60d185f13f
SSDEEP 12288:LVOJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:AdCN/j2GLl3iFSE33b9
TLSH
T109752360ABF561D5E46BC37C83B5DA11E220FDE8E73245CF87410AEB1B74BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 05e4d9a45a816e9a6524314bef7c8f62ff277edb0dba6aa490aca799fc6a6a54
MD5 8dae9400339ee673bde167224202a0cf
SHA1 4616ee37cf53563cd25208d38828d19d39cfe896
SHA512 1782c00251eda454560667826b60842541823a4ec44f91373482be0ae32158208c58bc2a763a42feae5ea79d68f999f95165b73f27926361d518bef58a6eec29
SSDEEP 12288:E2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:E6dCN/j2GLl3iFSE33b9
TLSH
T11C652364E9E6B659F15AC37943A9DF515100FEE8F626448786C166EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 9833e47099d462f5290397cb1e187b8dc4cd718fd0d1df7ae16c9da2993682c4
MD5 8825165638cbd31c8c7ab3950b33e0ed
SHA1 f0536050aa95a62c76790a0cea77b81ca1ee084b
SHA512 7d570166fd6ac1e523a059bb4fda33dacc235381b04f858180949af2a69df016cd9d5ce9e73e55f1e6f248a1cc326dab697596c59a872d29524eea6fd8c652eb
SSDEEP 12288:FlJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FhdCN/j2GLl3iFSE33b9
TLSH
T141652364E9E6B669F11BC37943A9DF515100FEECF6264487868156EB637CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 2e392ce60c51c6864816169e681cd4ffd1542103533453a7ca948dc00fe6955d
MD5 76c42907693b0b77713bff39f9331c7f
SHA1 7cd20a31d2336f9aeac6e0de76fec1fc93e7064d
SHA512 705426a39dc3703f3e50487cbeeb0a9f2b1180bf2cd25b633e1132732cd42b4a2e35fe63a64818463b5178b8442011b4965a93db509c6c657b85a179375f348d
SSDEEP 12288:oJJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:oNdCN/j2GLl3iFSE33b9
TLSH
T1D0652364E9E6B669F11BC37943A8DF615100FEECF6264487868156EB237CFEC9032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 1e3c35c1078ac1e651d1f4ab8e175748be1e34a7bba488fb5294a2d748060f5a
MD5 53be17c5b0ff6f6f1777c78b9a45bccd
SHA1 e5de484d00bc66f8690fd06ea1645a22ddf24953
SHA512 1b8d2449f8787c24edbe997f14e1bb96a8e4243a67e2a1e62c7ba2c9b6519fcf2032a5ad33ee05cbd05d6c825a89ce8ebaa867e948c245acf32fbf32b98b6428
SSDEEP 12288:piZwbDzzFEoS2cPvyBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:sZM3zFVSO1dCN/j2GLl3iFSE33b9
TLSH
T11A8502A4B3A018F8EC67823EC9658916D271BC594770C64F03E4366B1F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 0315799e018a986be737b78bd1b7e2d1097c9fb2e5a58a41e47e4a5f4cd94f47
MD5 548cfc603adc59c0942b6ff230137804
SHA1 47b24e1aecdd444ce391a7a89faa7d70fd8b664f
SHA512 2c58736b96d2f84cc6f0f4888e812afb384181871b292a821bf88b7ce7ee9a10e6e771a839b3e7a98fd97dea4efd3173b0ace63dd5aac1c675819ce346a1b736
SSDEEP 12288:yQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ygdCN/j2GLl3iFSE33b9
TLSH
T114652364E9E6B669F15AC37D43A9DF515100FEECF6224487868556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 9941c741569b5d632e95dc0848c1eb66ea998082f911a1c079d230a84064bd69
MD5 f65aeaac773d75a563796c562192441b
SHA1 8cddfd143e0f58d3629fc4e552f0a1a850db0ca6
SHA512 b35248cf5751491e0bc0f8c1ec7c52ad105a61578b92ad9abf9d43fcebf8db9f406235ddab9f93f81361a469c0bf80076318c955ce0b1f4b1625ebe48123cab3
SSDEEP 12288:+cJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+UdCN/j2GLl3iFSE33b9
TLSH
T124652364E9E6B669F11BC37943A8DF615100FEECF6264487868556EB637CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 936856694607491d4e373f9fa0c1d3473eda5fbcc52e0b56a1e352d7468d2650
MD5 5f6e3667b939a7a1e28bcce34f98494e
SHA1 4ce296df60a528ff18879737a5b6480005b247f8
SHA512 6fdc2b906b51f5f1e496e254334d883fea40981e93d8e5539cc910ec767b859fa9bfea10d95b49c9fc947b2c248a911c8b30c450276a0988e52ad1ebaf373eb1
SSDEEP 12288:EyPz5L89JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:dzypdCN/j2GLl3iFSE33b9
TLSH
T11F750217B3A131F9D167823889A55A11F331B87597208A9F43A007BB2F377E49D3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 9295b07d5b720fc8050604c6b49786bc874673ef6c800a20531d15960f1dcf75
MD5 9f768a3026b28af928ab3db7a17fbbba
SHA1 fea246c75b253f0daf05275d2aab4b703086a9ea
SHA512 08a805088b404009b93aaeefac542818c9fb080b1e7e29c9614abeba9decf8c5f6acea4d1929299c1724da7a5a4e4d926c3e6cd67426d5ba9ae5d610fcc1b948
SSDEEP 12288:IQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:IgdCN/j2GLl3iFSE33b9
TLSH
T16B652364E9E6B659F15AC37D43A9DF615100FEECF6224487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 306c809610e0f6969b6fdaf586199931229e27b117719559f8455ece3c4f5e90
MD5 1a91dd0d99b4fd192324d3274e3baf27
SHA1 49874304a52d1434624e07902c2800281875d8cf
SHA512 cb168764ef7f8f0f38f4779f46dbff6a458a96d1157438fae60dd3826f1b38e8156394928cb46df02f042529e6863708bb27300e7d887416562a65d9d24223b5
SSDEEP 12288:8QJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:8gdCN/j2GLl3iFSE33b9
TLSH
T1E9652364E9E5B669F15AC37943A9DF515100FEECF6224487868556EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 271a131f0829b037c4587047b8b5078e73117d5b9cf623c529e44b01f3112ec7
MD5 1d02cdfc0ed03e215365c92eb47f3701
SHA1 d61f90f2f1ace58f5bfe4bb7def8d05eccd1e59d
SHA512 b38687d0d605fbd33f6014a068e8e0116de1619df1bec0588b53ea4ea001baca81d722d1a932ca3c1b944a51faecf4757103408401da37e5f3a951d0ec83b758
SSDEEP 12288:/yPz5L89JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:yzypdCN/j2GLl3iFSE33b9
TLSH
T14F750217B3A131F9D167823889A55A11F331B87597208A9F43A007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 4976ec6b2e339ec1779d44fe75c78b03f187165cb4cc3617c03f9f758f28f292
MD5 365ae11d12c4201621941578a69bcfc9
SHA1 fc80492edc3a24652a9cf0bbb81804992c116b6b
SHA512 44da62663683bcd775daf8ba8dd838e57786e9772ebf3813fc76c1378e1b7683c2587a29c314a951db77c846e1b4a41dc8f3c1ae7bed5cb0bb6a66c87efedca7
SSDEEP 12288:2Cd91WYoaLHF3z0z04PDvhrJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:XT8aLl3z0zDzdCN/j2GLl3iFSE33b9
TLSH
T1448502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 3f8419426db4802b559a39f21c1fc7ac94de2aa525044e31bd23fcbf3d3be42d
MD5 b39d2ceb047c52226deafc41efac289b
SHA1 7cc5f426082e189f33ef62eccfb4e8eca6f5981c
SHA512 f7ec2f9130769749c0cfa4f54e8f1e7aed137963520c68669ee7e3e2f586a86f39d3f6caaf58f52c999f5a4511b1fe7db2d49e13c7b284e697f26733d151f262
SSDEEP 12288:bi4e7+RdTfgwCHKy7GLbbdIvKJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:b3rd9CHKy7GZ/dCN/j2GLl3iFSE33b9
TLSH
T18B95CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 3019ddf98a7d8c32ef7096d85e86fb5c4e2cb8d614d78e2a499a357c9ab0dc51
MD5 1f08eab33b60853b65e036614f2b6bb4
SHA1 1978cc48a7d086b52bb5383d5f3f9ace9bcfe8da
SHA512 afa567a89036c5a1978d21a1f8631891b6c2762f0e87dce592d9715217f52aa063f866bee2c619393f33014f7c3448131d011eca811a1ec00dd65aea45833625
SSDEEP 12288:BbJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:BDdCN/j2GLl3iFSE33b9
TLSH
T168652364E9F6B659F15AC37943A9DF515100FEE8F6264487868166EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 218353b970264b29cde43132323b1ffa34f7e043cba39826adf8cfc77c30263c
MD5 cf1636dd2102f8d8d616df4f42fb233b
SHA1 2de593063edd3d816df5bb53ddf8013daf6d4891
SHA512 9ac99b264318410eb9c04b736ffa6a35eec1f2d0049a28a8726b3bc7b4d9d8d52ca661ad1cb21bc296dc15dcd3eea9d17d3ed914ce31d001ebcb6e108eaeb938
SSDEEP 12288:IdJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:IJdCN/j2GLl3iFSE33b9
TLSH
T145652364E9F5B669F15EC37943A9DF615200FEE8F6264487868156EB237CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 763115a8c4f6e0ceb36c4d81391fde7b06a62efcc3afca95e51a48464cfe2847
MD5 5ffb86410b977e96f433ae29c7a55ab8
SHA1 33dafc6f205239c9b9157cb72cceea3da6fbcd53
SHA512 d9bad497d2d8550839955a8c1bc55b05bdc37ad2c5da51c67f7d7d22887d05617f788ed5bd0d1fbe0d4503fb242ac6130d07b48d998c1779ed2a4523d9f82412
SSDEEP 12288:1KJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:12dCN/j2GLl3iFSE33b9
TLSH
T18C652364E9E6B669F15AC37943A9DF615100FEECF6264487868156EB237CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 0117b961258dff305a480cd21860c482559bfa854c029d55dafa8106a3d1ce88
MD5 82d18382d102805f22a04e981a840342
SHA1 2aaf6c0f18d7c0657bbe613c11acc2b7328f149e
SHA512 4cb3e338de1314af689c2b2dee14010bd727155f8b8d6353238e7be2ac034d0d61fac5aeac74321c20236def718e55396565fbe7508d5d8e16d3082a0bb22532
SSDEEP 12288:fQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:fgdCN/j2GLl3iFSE33b9
TLSH
T100652364E9E6B669F15AC37D43A9DF515100FEECF6224487868556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 1c8620274642c2db8ba8e670fb7db36ea5e895c8933835230ed0ca599cc2f580
MD5 c5f5efc1478a87d362aab58609296443
SHA1 a77f8b184f5615fd5a3bc5a804778eb507de2191
SHA512 4036f4b14912ba39fabe8aea999bf59bc8475c6b9ee509ab9dbb099f86b1ab9921281b3a2b592ebb990f58c424116964db857e2093ebf8b5beaf2aa09e04088f
SSDEEP 12288:1bJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:1DdCN/j2GLl3iFSE33b9
TLSH
T1CD652364E9F6B659F15AC37943A9DF515100FEE8F626448786C166EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 1c3d63bca8e23cc2544c1801d3f45c099ff74da5c78ab4bf0273413d2d745f6a
MD5 39e2aa246280b207f0c6d92369928a7f
SHA1 68edbe24f950411c2f433012c8667092e2987486
SHA512 8e8a6722da78b0575d63a8bc7e9e4f0f5377067068162fe434b9c135e505a2c6a2d1f63f9a076eb3a183fa6381e2b8ce5a0e7fd611c37e0864b0bc2f9c712bc5
SSDEEP 12288:jYJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:jYdCN/j2GLl3iFSE33b9
TLSH
T15F652364E9F6B669F11AC37943A9DF615500FEE8F6264487868156EB237CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 3c0656f435b0002f5e07dfb5ffb23960dacca08c4bb6b71117d0e23709bae560
MD5 a07b7b9057ed8b25caf2fe9af8fec2d2
SHA1 e7656b68cec74e1e68023c4824390e4868e22ea3
SHA512 b4aa7a1af8b320df3a07e4d35b1e1c782acd5f421cb5952444b3d0529698682aa2c503c3714e58b6ea806ad9631578d1cb1d74b6ecf486f594ecce0990ecca80
SSDEEP 12288:o2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:o6dCN/j2GLl3iFSE33b9
TLSH
T1C6652364E9E6B659F15AC37943A9DF615100FEECF626448786C156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 150739bea9224b6fcabce8c185507c1bbfd093b38c43a851c413c3980eabbf0e
MD5 4c64de8e50baa98f0f9ab45e6489fab8
SHA1 b31d0402060c9a0e8313c6d40036a618856a44ae
SHA512 15e18fa6bf939cc255396c8097aa23983b1f814477f36e0d4cbacebee0cb60996852aa6923c64a732134fe0ea21852a665db6818741d0bb30083e7deefc8e9bf
SSDEEP 12288:JzJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:JLdCN/j2GLl3iFSE33b9
TLSH
T133652364E9F6B659F11AC37943A9DF615500FEE8F6264487868256EB237CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.5MB
SHA256 1b4fb3a9ab92008aeda314045b547da34a4b1802e702068dc74832da5c194a6e
MD5 db5ffdbb97bd64388f50e0e33ddb47b6
SHA1 616556e76f905edf27d43d0879197dad9a107f41
SHA512 75ff2d71538a0a5ab4beadb6a8008323147b3e0d15a97472ff7a50e4760b13cafdd1ddd2426da1c613730981d5cb099b23de927bd33cfad06e64c483907f7267
SSDEEP 12288:f2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:f6dCN/j2GLl3iFSE33b9
TLSH
T182652364E9F6B669F15AC37943A9DF615100FEE8F6264487868156EB137CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 5b4d9f26b4e754115bada1cf90b4d92bea67d205bbd50423e84e0741442eff30
MD5 d1fe0904ea608843d896e8832add7302
SHA1 52cea6b8f06d9bb3fdee9d23b6c13d8d9c3fa6f4
SHA512 18fd903a95eb2ca1698c305794174d50a599426014b708da4651d74dfc1a0440188952f0fe6489115b30e3ebddd4835a8eabb4da8e8b6886366e8da5c0db6ab4
SSDEEP 24576:Rfwvzk9RX6wkyAIEdCN/j2GLl3iFSE33b9:QMnYIvN/j2U4FH
TLSH
T13C95D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2479022bf66df991f612a77feef61b53ff85d91153f69434f8d27ece69941607
MD5 f98c13baf4748f224de478c13c26759f
SHA1 976b38a22d8e6f9da2d56dc5d3e2c9f63047b204
SHA512 0043b0ee25941b5a09f612566ce98489b47a070e3dcd34179ef64d6f3c46a97c7fa0fec70f80f004bf9685a2d3cc7b1b81aa81942b1bea2a3a3c8b44b983384e
SSDEEP 49152:FYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0EN/j2U4FH:0ySzPAj2jF
TLSH
T156067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 27bec4500df5c50ed0d6f497995cd476169ec96ae1720210f26afebfe41573a7
MD5 0ed19d257245c06481bd995d045e5798
SHA1 8aa8e621d9e4f416fc71fc025d2610fa088ddc13
SHA512 cb98c9127f597fae38415ad53939e5462a3320cda98791b524261f1f31b3de0da0900c2f268b6d52cece4ac0a78bd26362729944d8bf60653065a614a0c93589
SSDEEP 24576:I47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYldCN/j2GLl3iFSE33b9:I47JUQjqirIhCnDHUPfF/0N/j2U4FH
TLSH
T18E65AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 ae08fb6e6224a95bcc68c8c8fce142b78640b9d02df92c2f956c8fd3a0c6b91a
MD5 b888a9855fc96197c859b3706c3d47d3
SHA1 db28737e9e5ffad93dcd30d6a9536e9aa9d21426
SHA512 c7b3a7cdd6ea91fbe4c92d51b7e2a8c875ba53d40c91770a6cc2940062c7c13caea5545eecf2002c1a79dfd7ab01e1df7ac42dfaad84fdf11482145307d9a43f
SSDEEP 12288:4psfAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:5wdCN/j2GLl3iFSE33b9
TLSH
T1C3750119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 509a053197baf4bfb8eb753f2eb4a459e940fc46e6ad7e2f4ad4843b18468328
MD5 ffa04af21e0bbb32ffc45025130a0a50
SHA1 34cb27eb140198ac7414705a6331a385f3761f28
SHA512 4b47b8e11b13e4a8059fc230b543497cc96a0ce66770dbaea8b028f035e6eb1983be32afea6169c2f5aa8b33ffdccf98b97d83eb64d02dffc11f49e20951e9af
SSDEEP 12288:Zwlthv5gU3ftlrRephUEqYBZa6MGM23RM221ch:ZwtSUPD2hX9Za6MGh3RM2gc
TLSH
T1F335F7007666CB4FC6AD40321E72D2CDAB707D41EE44AF0773C9873F9576658BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 2141fd7f40999ac18c6c005a75af20eb8f64ed4161a0f87f72b82915b982b8a2
MD5 3e8c9007e4d036d10ac28c8d2237dfab
SHA1 23ca70a75540daf0d1bf784342106cfe67007f2f
SHA512 420669731237dc496415c81e9b046a21af9009ff366573b3d78ba2701afa2e86ad03e27e079a15ee7f7ca9f8378ef8072d6767390fb6dce5245ebf8233747931
SSDEEP 49152:g7yXB2zo5pDzkcBvmjBi73mR8KklOomPicz7jzjp9ME8d4X:T4X
TLSH
T1A575FA40A137E78FC1B75032072A5B8D7BA4EC17B7456F26B3C9443AD86AA15B0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 d64ab90f188554ac866257b7e492807bac129e40997f765af5dfd18f927a369e
MD5 9aefd29db2dedbb1f18eacb20bce92a8
SHA1 acb9f6dd680dc7d1e243d0c711f82124d1235548
SHA512 63a72688708e3a516f666e2d6e34c2f7a5938338f703aebd1200dd7d0c76c614fe4eaf766c1d15ae4c33d6d2ad2dccb9e0488e032635fdd5a494e08fe04c4fb7
SSDEEP 12288:A07IJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHI:todCN/j2GLl3iFSE33b9h
TLSH
T115652360D7E9BA55F47E837803ADDA216200FEF8EB1184C7C54166EB6278FD8D832563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4aa8da664a3628a0b91371bc95d89558ddac93d8f83eddbe3ac4c69f4f72617a
MD5 8bf411ec389020696643ec227eacbbc6
SHA1 abf56ae2041726d404ab56d776412dd540d24100
SHA512 68f0135a72eb887e3d578cbeda86f4a6d22963271406d6bdd39510c2b72261809afc9fa084980a903e8c4d66de1b1ce685d376fb4341a2c973c4408769ae55c4
SSDEEP 24576:3gb6bmBIi49WNNFpg1rSvFv7bYedCN/j2GLl3iFSE33b9:3gb4mBIBhGFaN/j2U4FH
TLSH
T10765AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 4d797db8143786fdb2a9abfff0a83cf6702669d9dab76049d6225fe6a797db06
MD5 b5291d067b2f679a63d8098a167e0b8d
SHA1 9a27a1c1a978551ca29b5b5532e696a9b9f305b9
SHA512 3b07352e46601bf42d6b8ba1e35b85e388e7699069690989455eb0c88f243c8f60b5da43820660592a5bd8b719e214f4dc66a39baa420995f87e877a3362718b
SSDEEP 24576:YG88u8FpJqH1vzria7/m1dCN/j2GLl3iFSE33b9:b7ZFPqVya7/ZN/j2U4FH
TLSH
T166A5F16576E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 c844ec6b9b5dfd89c953ffd0cadf829c723d9f2ae7b51fbc77bbe59e5d93bb24
MD5 dbfb25b7d8e62ab4d920a188271000a8
SHA1 6d713ec3153b8bb7eba0e61e8d95849f44087df6
SHA512 4a16eb65c45d7335ecc0c2196d7dec1598e9e07f190f60c4b1f673b2d6a302e10e6ff335fdc961350a57339d0342e07cf1e673297918f29bde5d020c7f2ca15f
SSDEEP 12288:NHvUrBFrEjwaQ1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NPUr+NQRdCN/j2GLl3iFSE33b9
TLSH
T13385F22E62E918E5E67AD17D86868719F731B8615312D2CF02D0817E4F77EE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5816c92414fc87b47efde7dd35a07b9296657f707b4a6354bcb4b0b0d7203891
MD5 5101973619d4d6af8c0abc61f7a01d0d
SHA1 84fb153f6047585247ed1a09852a01065cd3257a
SHA512 376c8cd700aca85228fcebfb6d4bff315951c438ea13f9524d44fc024b956c84f56463e037e736f1eaa339e2fd165f2028efae63f3439a1d68f3926fd7e4f523
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2N/j2U4FH:SG05lO43b5j2jF
TLSH
T115D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e3aca6aa308813df25de62956f8616ae99a13f71d75f15eecf07f13d7c53d328
MD5 f0b3171dfc449f1b2664f2927a64f04b
SHA1 271caa1beb01fa039af45919514c681c999bb204
SHA512 35f26feefd9e390a9885307b643235d677a99be4b3d5bd1b84b9a276ffd393ee454b2976351def2a72d4af4774c02776cc2e7f6e6d7b0c5279ffefe28680dbe2
SSDEEP 24576:vfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnXdCN/j2GLl3iFSE33b9:Xa5POZ3lJt2pasx2+meN/j2U4FH
TLSH
T12465BF5EA6FC01D5D179D17DC5838A1AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0bac151022d2e2b3043a465a9d1928844d3e2b06cd650e5ae25556f4c2b3f38a
MD5 6b7f6bd2d2f0283765a5c4e8aabaad9a
SHA1 8ad967da7d1bc6d6ab17ea3963b3473c97a893ea
SHA512 a13d462aa8e6cbaadd45816cb7667f3dad18745410a946d7b201764d48ad778c5be2d1bcd9cd1ef6ba1e73e9bc8fac0953ffea85013955d79f9c377edaed0d9e
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7FkddCN/j2GLl3iFSE33b9:6Nc/zEOVHF5N/j2U4FH
TLSH
T1D0857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dd657b2437a5c29f5829c322b3be42c7f5d6690bc17302f60b0c22a3694d65af
MD5 29944a0614b5eba68dd2244bd2b76487
SHA1 0604176988121ca88afe642581777b243afad6db
SHA512 e97220dffe3f960a4182b472965bbbaa179b50a60b3dc6ba031c0bc5af544509ca1c9aa7f565a0e88dcbd0339915336c4e866766cde022d6a79719cf5d827743
SSDEEP 24576:OzkNvNnaFeYhJNtmZBmLdCN/j2GLl3iFSE33b9:OzMwBtOmoN/j2U4FH
TLSH
T1F055AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 46843e09f9ab262987932602b4007279dad8639c05c7f1a7791361e7af75e01b
MD5 a117bcab53f8f2f6601fdc61a1074d81
SHA1 b8c78ffe7876d90b5c046ccdf622d8deae2861cf
SHA512 fa1d250ab5da2a8ed904075fc5c018baa08fd9e356c4ce5e41d79dcd8f4894662ae9d0ce01e946a58f3447f83faeedc43b82f9383d70231776013f2a5e8169c5
SSDEEP 24576:gD3FHshBIYQgAsdCN/j2GLl3iFSE33b9:gDVHeBIAAXN/j2U4FH
TLSH
T16B95E17DE69C04E4E57BC2BCC6638A06E77178A8432255CB02D481BA1F6BFE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/620-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/620-375-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/620-373-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/620-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/620-88-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/620-82-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1360-348-0x0000000140000000-0x000000014030B000-memory.dmp

Download

memory/1360-108-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1360-114-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1360-106-0x0000000140000000-0x000000014030B000-memory.dmp

Download

memory/2144-54-0x0000000140000000-0x000000014029C000-memory.dmp

Download

memory/2144-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2144-198-0x0000000140000000-0x000000014029C000-memory.dmp

Download

memory/2144-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2448-121-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2448-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2448-127-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2448-131-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2448-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3708-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3708-51-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/3708-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3708-46-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/3708-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4544-78-0x0000000000400000-0x0000000000664000-memory.dmp

Download

memory/4544-250-0x0000000000400000-0x0000000000664000-memory.dmp

Download

memory/4624-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4624-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4624-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4624-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5268-330-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5268-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5268-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5268-333-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5268-331-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5268-95-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5376-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5376-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5376-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5376-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5376-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5536-231-0x0000000140000000-0x0000000140298000-memory.dmp

Download

memory/5536-65-0x0000000140000000-0x0000000140298000-memory.dmp

Download

memory/5536-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5536-67-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5540-362-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5540-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5540-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5540-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6016-6-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/6016-77-0x0000000000400000-0x00000000006D1000-memory.dmp

Download

memory/6016-246-0x0000000000400000-0x00000000006D1000-memory.dmp

Download

memory/6016-0-0x0000000000400000-0x00000000006D1000-memory.dmp

Download

memory/6016-7-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/6016-1-0x0000000002590000-0x00000000025F7000-memory.dmp

Download