0f7dd14128b1816e2befbe3001360c52dcd48fb5efc6782eeb1b0ac82835584d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 2.0MB
Sample261011-hcprradb84
SHA256 0f7dd14128b1816e2befbe3001360c52dcd48fb5efc6782eeb1b0ac82835584d
MD5 a40d53bb5cf3d20b75accea912dfc394
SHA1 1c6b65f868a90e593d1b8ed2dba90ed28a03de15
SHA512 1f6f985fda344a60bea03f8d95fcb219d5f499477375a189857e95e5a612199e4d4b0133f005c7c155e3ea3cbd3bde295efee69bffcf4b88f53c14ed1a2152d4
SSDEEP 49152:nfb4J+XM8VRXc9WsoN/j2U4FHpVsWJe+Zs6GFL:n0J+XM8V2bUj2jFvsy4
TLSH
T10CA50127B5A1C03BC17909711E5973A126EDBD29892ED3A72A9433BD1F789F00E27533
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2416	elevation_service.exe
4876	elevation_service.exe
4888	maintenanceservice.exe
3476	OSE.EXE
1396	PerceptionSimulationService.exe
5776	SensorDataService.exe
4764	ssh-agent.exe
908	AgentService.exe
4352	SearchIndexer.exe
3560	perfhost.exe
4256	ReFsDedupSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 52 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8cb4b0bbf1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\8cb4b0bbf1788cf2.bin	perfhost.exe
File opened for modification	C:\Windows\system32\msiexec.exe	perfhost.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4280-0-0x0000000000400000-0x0000000000A8A000-memory.dmp	upx
behavioral2/memory/4280-49-0x0000000000400000-0x0000000000A8A000-memory.dmp	upx
behavioral2/files/0x0001000000009323-103.dat	upx
behavioral2/files/0x00010000000093a7-104.dat	upx
behavioral2/files/0x000100000000994d-108.dat	upx
behavioral2/memory/4280-112-0x0000000000400000-0x0000000000A8A000-memory.dmp	upx
behavioral2/files/0x000100000000df1e-113.dat	upx
behavioral2/files/0x0001000000009cfa-111.dat	upx
behavioral2/files/0x0001000000009cd2-110.dat	upx
behavioral2/files/0x000100000001b9a6-109.dat	upx
behavioral2/files/0x000100000001b9a6-362.dat	upx
behavioral2/files/0x000100000000df1e-364.dat	upx
behavioral2/memory/3560-365-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral2/memory/3560-440-0x0000000000400000-0x0000000000554000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	perfhost.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	perfhost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	perfhost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	perfhost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	perfhost.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	perfhost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	perfhost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	perfhost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	perfhost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	perfhost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	perfhost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d97e1be74a59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025599ae84a59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2d74ce64a59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040637b294b59dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064b48ae64a59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c85fdee74a59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000283ab9e54a59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000dd9bb2a4b59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2416	elevation_service.exe
2416	elevation_service.exe
2416	elevation_service.exe
2416	elevation_service.exe
2416	elevation_service.exe
2416	elevation_service.exe
2416	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4280	2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeTakeOwnershipPrivilege	2416	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	908	AgentService.exe
Token: 33	4352	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4352	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4352	SearchIndexer.exe
Token: SeDebugPrivilege	2416	elevation_service.exe
Token: SeBackupPrivilege	4256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4256	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4256	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4256	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4876	elevation_service.exe
Token: SeDebugPrivilege	3560	perfhost.exe
Token: SeDebugPrivilege	3560	perfhost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 1028	4352	SearchIndexer.exe	98
PID 4352 wrote to memory of 5736	4352	SearchIndexer.exe	99
PID 4352 wrote to memory of 2096	4352	SearchIndexer.exe	100
PID 4352 wrote to memory of 1484	4352	SearchIndexer.exe	101
PID 4352 wrote to memory of 1940	4352	SearchIndexer.exe	107
PID 4352 wrote to memory of 3580	4352	SearchIndexer.exe	108
PID 4352 wrote to memory of 1672	4352	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_a40d53bb5cf3d20b75accea912dfc394_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4888

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3476

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1396

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5776

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1028
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5736
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2096
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1940
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3580
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1672

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1cf597e7687f019cf7b538373ca1222e36f41bafbb85c56046ad37e518a404bb
MD5 8f7efa96c2adf5b6658694eac9c72a7b
SHA1 bf2e450c71dbf30dca1c61f0ba823e44ab9a085e
SHA512 97c7f37cfc254857eb98b96bc85eaae735722faeba5d67148ae7cc790703feb427b0db54e85255e1e096abc0d843fa22c0d524ec57172ec7aa64c8f35d425bdc
SSDEEP 49152:tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn8N/j2U4FH:z3q6HjBtj2jF
TLSH
T1E5D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.5MB
SHA256 d10edb3de0ff182c82544ac37c91f9a17effdc4e0053e461f26b5387f60f6a88
MD5 7eb81c9a1dd12e931d53d7741ae93741
SHA1 8af8047f50b9bdcf9d9905712c763eeea3e26e09
SHA512 05d400d6a5854136a84482991512fdf559c9302ec3096b316ca6b07c7939889da56bb44268ce13fbe01e484094decbcd7ac942600d34ed9080f79fa9cd23c2e9
SSDEEP 24576:hXY/cEczAUdCN/j2GLl3iFSE33b9AVT0iKG7O42WJPmN6sDL4ckCArx4iZsfyGiK:DEceN/j2U4FHAVsWJe+Zs6GFL
TLSH
T152C51238B3D408F9DD6B827CC9A28511E6327CA48770D78B03A4A5B61F336D85D7BB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 3.1MB
SHA256 f8b095f1d420349b33ad43aba42b92fc8762d2af5049a3f4ec75bb2ab62b551a
MD5 c74d948b1c87b1955c6c074bd1b80dc8
SHA1 b77545f4ef36800b123b9d1c005b40f015c0aca4
SHA512 3875a6086f0579590fc7f788208186fdf9dfdddea008819b67918dcd2f5b937a84879f0588c21ec4522864b39e62273ad979853d28acee0594f17241933a195d
SSDEEP 49152:SEceN/j2U4FHAVsWJe+Zs6GFLjN/j2U4FH:S+j2jFcsy4Zj2jF
TLSH
T1D1E52338B3D019F9DD6B827CC6A1C511E622BCA48760D78B03A0A5BA1F337DC597B752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.5MB
SHA256 da3a40c3d3d9bf6633b420a3b1102c0cb6873c5bdab40e69b9eb696e6222c92b
MD5 a2f6757df1813017450e6478d167f1d7
SHA1 c90c2ad7f94f9666cabb0c650cd4f77b6197b26b
SHA512 03f5fa43ee465bfff181731012982785cdfc0a8598269093b36d3aaf0e2d2dba5651802f02fcd7b2d9d82372f8a09ecf7ad6b344bfe9b717b5e1bfcfd2c7141c
SSDEEP 24576:qXYfDtczAUdCN/j2GLl3iFSE33b9AVT0iKG7O42WJPmN6sDL4ckCArx4iZsfyGiK:xtceN/j2U4FHAVsWJe+Zs6GFL
TLSH
T1F4C51238B3D408F9DD6B827CC9A28511E6727CA48770D78B03A0A5B61F336D85D7BB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 810e5bef0084f9bd9fcfc6766629243bbe3fb38584169d6cf2d05530008e7bc2
MD5 888f1f0bb557c3f397ce7b1ee680854e
SHA1 b27c96e1b5290cc74bdfcf773b37cb21e97b629f
SHA512 1517afbe2c514d5a35d59dda82d176eb7167ce4609e30498ec7d0dbc0b87ba2cb278f3f03b9879648ac920fded00eba869626ad83ed7470763f4d9d8a15bb52a
SSDEEP 24576:10Le5ji0hmxirMQdCN/j2GLl3iFSE33b9:1Pji0AcqN/j2U4FH
TLSH
T113A5AE26F6748335D073C0B9C5D2A69AE97130865B308ACB4286D77C3F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4bec162359d16c7affe6a6ef5f59d293be4922c3483372df0fc04603f5d34632
MD5 0c0191924300074bfb5601132c173a8e
SHA1 ec4e3fa726da21c37c8e5a46aec28708e1c49b98
SHA512 0b2af9c1c48042d7e060aa28db537d41739da03f2eb8caca10d9b69b45562a49587a6d5ba9f2d0fcb2696f85d15c921d8bb9840843ec29892779928193213c72
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWE6q8wyuOdCN/j2GLl3iFSE33b9:H/ezSC6vUzPvxHjyWN/j2U4FH
TLSH
T15F755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1e6f381b848d5e5e49ef78955ed56372bbeda1de2bd9a036588f86ca3508d14c
MD5 4f0cd2a6749164ee206189e31bf59f08
SHA1 ef3ebc1e7629038fa944437082463b1e0480207b
SHA512 ff7d00dd72c04048c51e20da708d0706838228cbc3809ef546c210867d5db2bdcd1267c4cbde754d0665a2fb5f31b85e4b5c1eeb080e3b6c3cc843cfb0734da7
SSDEEP 24576:kVbqPb88hv/l+6vdCN/j2GLl3iFSE33b9:kVO88hXl+HN/j2U4FH
TLSH
T102559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 be71915f037dba7c6d8506db838bf65e88fa665322e18e0a0770887f5d1bd15b
MD5 089ee1c2b0670abbeb36ca064b199fe0
SHA1 2d817715d1072037ca0ecfed7f0739c4b1e7f674
SHA512 6f3908998f3fdb01c2cb16d32cf8320095a060b1f336b14ab2659eabc9097a367c91dc05623958014908a11053006d16e2e845ca08dc0536fe4a1d0853259b82
SSDEEP 12288:PR8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHD:PR0dCN/j2GLl3iFSE33b9S
TLSH
T1FB752360DAA5B565F66F837903ADDE616200FEE8E525884786917BEF117CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 42903a94fc99d473705194426db6903ce46c0916dcbef4d755293c510d329732
MD5 1d3a7901f87d55641537fbc5181d172d
SHA1 0909922431255ee305346c361e6b147628a82a1d
SHA512 209813029c9d89c81826a9c92ef24005e42301af3ed735f7113203fad8f96e18645def93cbfd2d5d3a34f1d22955db931dea6c71d18ece59db9bc46bc053f70d
SSDEEP 12288:FeBNUbTVO86U3JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FJIUXdCN/j2GLl3iFSE33b9
TLSH
T1D985CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 83c956f540e51dc854357cadc8249587f5759769edad366217f8bd8e956f1669
MD5 e29c6f2a5b797463c0977c3f24f1bac1
SHA1 15d3919c97d82ecb00a44ddbb278cab285012158
SHA512 721900cc562a596aba9a4694e6439de108ff97aa5150d6a263908e38943a1c31d7bd4e6c523bfbed7d4ce0a0ebbeb4dbe44822ab19cb52dadaad4b18a3bfbe35
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:xQvGAdlCEL8c/yRNw5CPj2jF
TLSH
T14F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 61f82199686d7920afed01e6d29ac8f1d9438d772e69a8904b778a73c9379814
MD5 55cdfdc3e825fb10c938a980ab165c99
SHA1 96758f1d5a555aea262b9fb08cf4c98121f7ba88
SHA512 e9915b169668528bf97b3f9872e60377e2401cc1c685d0b3f940fa7cdeb1216213d0b8efb8e20c179888739cab603c3460e3b98b68baaf575aa57462beb85d99
SSDEEP 12288:bAwSfxL/2Dc34DLLmt0LDQewsAjxJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9l:EdewsAjFdCN/j2GLl3iFSE33b9l
TLSH
T15995E030FE74E436C2BF0DB61B36C716142CBA608B6119C3E3E85E9E59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d0910c8d5f054973106e639cf5470a868745ae8558d8f94fca7991884a5875ff
MD5 0b58556da95c276255b435cfc7113b76
SHA1 47b30ad323ddaab6f7b6d1e78341cd1e6ea20dbb
SHA512 49339096c2f21c9f382af953bad295839f74654def37d47864e878a339fa8ec182d001ea00f1f14b0bab9dc6341d6dff431a78959fe1d491ffbee7d4fcf2f05b
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHi8F:/UEtQevvqc2W1cpV2EI32i
TLSH
T1DA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e80cb29f5fb8d23437dc0bd069cbfe441a5e5d275ab2d521b10ad19fa03a5404
MD5 a36c8b633429231a9b26f049c2849a9e
SHA1 50897f6251c036c59604a866bff81989575aef8c
SHA512 3e5a112d5c10943245a47813a6cbf506baf7e770ac56c285e432fa6c13abcda6ffb48e6c14231faa49bfabf1cf43276e81771a86164b43133b2af00d350da64c
SSDEEP 49152:OCbRquA/m2yL5zQfFiV+XenmE3/zaN/j2U4FH:joqtVjnmTj2jF
TLSH
T1C4D58D0976B8C2E4D1F6C77886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7af5c69a7c50eef373b5a93643afdb3ca7b169dac49d68b4bc7b446144671e3c
MD5 229bbbc9abc81db08a62cdba6d77a5e3
SHA1 8a5fa33595e2b3db238ca01f9a09e5880d7bf13d
SHA512 ad829ba3f49fff7ad03192d5825a33f7cb57930dea510d43f6b16e02d263bfaad9a3b6be2d56071363e3e72166252d9f3c976da0051ded027cd3d6bd7618e4f3
SSDEEP 24576:8AhGLJIFoiwtA5l7S536dCN/j2GLl3iFSE33b9:8AMyFoiq5NN/j2U4FH
TLSH
T11735AD80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d34fabd24c98d0e70aa3bec51e19b00fbdefaa94e7a56cfcaf4e8dc2e6e10523
MD5 3bf72ea22e25c2bc990922baa9d42d6d
SHA1 279daf55cc374fa8d55647d6c9f10728279d1e25
SHA512 1e08b52a0539743e8d23a48efc8d5c114cfc8f02726bcc5612b246e9114e2a9f6e9f49b519309a7184b0024f84529b5aca75536915eb9aafb4406062ade86641
SSDEEP 12288:vmw5HEjsChNVBFgl0WDm+CNJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OwuoOW2dCN/j2GLl3iFSE33b9
TLSH
T10485F14576E41CF9E96782388697C536F7B2BC512A21CB0F07A0C79B5F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 b389933d019a9038239104829dcee5f796127583a268b494a2d557f5355dd8b8
MD5 d18e1f547a8235a7f5cc3f84da78d01d
SHA1 5578595bd7e33c6e7449612a86c573cde6b6c86f
SHA512 c705d7b6209468f3d57d916e59f789d7f810d831315fdf7c7ab8fb4d5339aa97dd2c2172c40c54c16c71ba85ab51d741e2853880fe25957c04856f7b3b2636ce
SSDEEP 12288:eBZ1IyhJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:YZuYdCN/j2GLl3iFSE33b9
TLSH
T19775125933E471F9E1A7823C8AF59A05D321B8A5A73243CF026146EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2f85d606d485fd8084947828befc80cbc638a00e7233fd86a5e89bd500a5e24d
MD5 51960a69ed8918f6a023de4ac2b43f9e
SHA1 1be3abfa239fe3386d5fe6d13c15d96594ecd417
SHA512 f2a85ee9bcaee0ce79308a579ee9c2358e73472c6a580d7f30f399898f17271aa7d858682f6ff4c76a601cffc8fed3f755aa72bfae40dc739a31a1bdf578bd3f
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:dQRQyi36YOcPQLvw2gAf+PN38j2jF
TLSH
T1BF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 145e61be46c4fe1b3c9f263ec0f0f43009456927beb0de4a747da5f91e40cd75
MD5 4aa207932bc06c6ab90dfb98d52d6465
SHA1 2e362d2c563ce8743620cb240d024b17a5ab140a
SHA512 0b94919c30f080830cea82c2024bc8f1c76c989fa77afa82d5f688d110c95c985c8abf598ae75ef43eb6013f07cc4b5aca4d1a1d4f100777ad62bded54f478c7
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:EQRQyi36YOcPQLvw2gAf+PN38j2jF
TLSH
T140667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c3edec58bb158f9562e715be5b158da18f91e158e1e0ba751eebedce380433fe
MD5 4842186272466bac98bc440842b01b10
SHA1 e3d299821bf1a0135b3b9c24d416d17e7f48feb3
SHA512 a5779f549f5e8d8df6d663332d2718ea91ef4668594852c77026aecf6c720614212c538d210efa26a490100de7926c4aa71a247657b75aaaafa822ff2c9b3393
SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0IdCN/j2GLl3iFS+:568Qg55nhheWu7PNU3/qN/j2U4FH
TLSH
T16FB54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1eed80964714ca5f1ae6930c77b8e77f8bcee35fe8272a8fc3f3bbad6a61b137
MD5 4938e26fc361f06ad9884feb394cc691
SHA1 6076ee290fdb3cf1e8c2a76c9d9d75fde8a7c953
SHA512 01f70a467cd8c84589e1df64d20dc7ce9153b4eaf534dd192cfc1dfb13a5741810af7f6232b6c2291042697ccaf680d011b07fe88d56cb2f85227e072bcb7a9f
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99j:Dy5112gYy5azzVvL69nLKnhZhj2jF
TLSH
T1F1168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4494c369b06068d9897f74400a1d297ad1d708821232fe73000e2068931f0116
MD5 2a08d76030bb706d1150f4167638f961
SHA1 5e8ad4f885a0bfefb46db88c3f7b2077610e6093
SHA512 f6599ec60925816cdb200cbf174b66feb27104857bf03e09890d8670c5dafffcf0a94e79f49ab250f0f02afb562843be0d909c1fbda7cc42caba5a1249b45d6d
SSDEEP 49152:mB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glPN/j2U4FH:Uu6JmVxd2dRj2jF
TLSH
T101D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 12beecf43ac9b39b36fc2f3a4f323034a95e7b19c5bb4f8bd6a11bea66283bf9
MD5 cd042bfa7517a1ac522f253c486cf0a6
SHA1 95ef37246302cebf0b2d13f643e7cbe953dc2c9e
SHA512 8804a062359013c7edd2c2350c8dace04dd5bc611ee62e1ddb44e987fa41e154a222a87e141b6a24fe99f31ce278d1de6c50cb7753ca67cad44c738155cc1880
SSDEEP 49152:E1hpsNoJpF1A6UU44CwH7R4xkN/j2U4FH:EmifPbRTj2jF
TLSH
T123B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 16e9638e139e3333605aab287794686796487b3de262e6070835801b7f631b5e
MD5 224c879fcc86c583c0826826b9c5635f
SHA1 7c3a4c3e02d8dc99b96c552e4d1e0a2f0e4ca8a6
SHA512 2b222ca2a99dd71f8f3bc9360f2044498c7874bf27586fc0e87800c74916a7208e33d4eeaab3f1a95b3b647d891c2ca8095e686764cd187a3669b944d0f9d243
SSDEEP 49152:8SuZQIY0Be2KRRVtOnks6NMHqDN/j2U4FH:+5dKTi61Nj2jF
TLSH
T10DC5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3c3c035eda4ad1ee0b981e9349e501c8e7ea68f6071ff880c239f8cd4d904299
MD5 2b45da1aaa06be3232c58269385cf896
SHA1 6135bd4b31ca0b91a75a13f869bc20b4619995fc
SHA512 013c24104bb85b7184090582c7bfdfc22e0c8248dde5abefd72723c267a7bd9192c995a5e3e5c421ad0a3791650def93cca5800ab847d5dc5a77d65e1263e77f
SSDEEP 49152:9htSn8EApI0figngiDn0AP5wYN/j2U4FH:sX2iyph3j2jF
TLSH
T1A295BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 eca48a13361b4cb141a1a78821afc1a35ca7912a8511620c7d5041454132e7a2
MD5 b42545183246a4321f62984dbf286d2c
SHA1 4309557959ea5afb5a9b60298b71361a1818eff8
SHA512 6a283aefab5b0cf4dfd7ac447e9548014cf865223d3b6b4d53c3cbc0dc153d0dd50c03b107b85209facd6d68938a2a4b161ead3a151455a987eed142c7169486
SSDEEP 12288:xUJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:xcdCN/j2GLl3iFSE33b9
TLSH
T109752364E9F6B669F15BC37943A9DF515100FEE8F6264487828156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 2a56cce98174bef0ff36b5326e9f812401d50a0431320a815f96fbdee1a7f573
MD5 fec93cc230a57d7ca2dc5a9c4047d397
SHA1 892d8dc050aca837f4d653385a48e1d3eef1af1e
SHA512 286e9aaa4b05c8781e9e8dcd7ea5c3a202226abd75125c7f0c4c97e609692a96cf7629d9d5c081f04f98ffe147ec2312f50cc56171f7476f23cc3558ba3aff83
SSDEEP 12288:TNJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:TZdCN/j2GLl3iFSE33b9
TLSH
T132752364E9E6B665F11BC37943A9DF515100FEE8F6264487868166EB637CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 f2b33982a612245e2323f7ebcdbcf5ec595b371fa7b4d5e6ffa37b8875018e7d
MD5 5480b372ade2c4392c364cde7b907c59
SHA1 61be85070e4c63ae55518a201044501ddbd77b69
SHA512 3d645712db3e52cc2dbb4fa3d87833cf33a54c607fb6a3d0fe1e9b35004f53b3e7d67b3b2591bb6c996e7614c3873986938d90b80daf6d4b3ab8392b1d7131f8
SSDEEP 12288:3PJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3fdCN/j2GLl3iFSE33b9
TLSH
T1FC752364E9F6B659F15AC37943A9DF515100FEE8F6264487868166EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 8cbecd98de465271f8bfd301a942ad8b7b329a5d6522a74c5857da6bb9c3758a
MD5 31bd4a2713324aef6164e57838c5a0e4
SHA1 b75ed844874a90e30a207d536e6e89968216d34f
SHA512 2e1c636553cd01a1e94b349e924537b97c183fc3c5c6429ee21b6a1f9b578381f60d2511560bbc57676b9ec7a51b0d31a6adc4e585007a76fd4123bbb5bc9865
SSDEEP 12288:qVWJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:JdCN/j2GLl3iFSE33b9
TLSH
T19D752360A7F561D5E46BC37C83B9DA11E220FDE8E73245CF87400AEB1B74BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 80dfbbd7eba05a50dcc5842e366d9692f151f0ef523b3ce21b1103000674f09b
MD5 4a3d8749d326984f64f47e6fe231a583
SHA1 028deafd868d0436ab1f7da8d30b7312a40d30f8
SHA512 8aedac1511d617ce8927a5775c364fef31e76cbe787520a49f5e3674341cb97affcdd5d33ccf21ad038c05391a8c1fc94264a8debb112249207f53d7e63d4580
SSDEEP 12288:YeJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:YSdCN/j2GLl3iFSE33b9
TLSH
T19E752364E9F6B659F11AC37943A9DF515100FEE8F6264487868566EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 c5e14b15f6c4d19e8180f61a46ac0012b365e95f3e9bbd8be23e1c6d09002cdb
MD5 28b92dbac49d764994379a4c7fcdd3de
SHA1 4a914e7fe96a46130ab2cdaeece8480ddd886830
SHA512 862cab28c739ecbb6c5016342f3c440fab5cf17507d520fbde19fc98265ced43b77693027ae247950cebb777cfba8276c2ee4feb2dce2a7786f2a1bc09ba039a
SSDEEP 12288:8JJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:8NdCN/j2GLl3iFSE33b9
TLSH
T128752364E9E6B669F11BC37943A9DF515100FEE8F6264487868156EB637CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 6b5a0e0a629e222f223b8154062cdf8f2075b645decaade24ceb841b79525c9a
MD5 965110480e22e5afaf091f6005cd1db4
SHA1 a2fcfa9f5924826dfcec546b29f8f1f580fb0697
SHA512 909b6716f1bae29af0b778661beda8f435a4be16b5db5627c406dd89d8a1112283b5735f7d0772f4a40cd844e6f1e0d5a924954781762693d9dc1e93e41224cc
SSDEEP 12288:P1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PRdCN/j2GLl3iFSE33b9
TLSH
T18F752364E9E6B665F11BC37943A8DF615100FEECF6264487868556EB237CFEC90320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 f4db58f4d8c450938021410486ad77721497160f858c26aa0d8475d1766dccc3
MD5 583cb3b93ff4add64cf07b76d5ed02b9
SHA1 ca87d6295d2478b79bc705b598213f88eedf9420
SHA512 83e247c9c1276f58d1203d22f45f77b0c31b0921d863d4ab9282b5722202288f77e55d2cc439c3a3a037122e024d3d8fd526d31cbc24f265a66101640bab2e16
SSDEEP 12288:piZwb6zzFEoS2cPvytJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:sZMSzFVSO5dCN/j2GLl3iFSE33b9
TLSH
T1E78502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 38ce308c7c04451a60cd1d8439d39afa214712b642e0b259e6f268bbbdd060f6
MD5 b616490f4d16625a79e160caf7e33b32
SHA1 23e63f75d7b079871e6d679e62b1a955351202ce
SHA512 3db0dbcf5ec33961b46e03cb8a7a83c50282e1347beecf1e1423c40ad77bb70a178ca32c5b28b8e7430ec653b4cb51b2f50f6a0e06db5fcac1bd7bc34992e845
SSDEEP 12288:yIJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:yodCN/j2GLl3iFSE33b9
TLSH
T1C0752364E9F6B669F15AC37943A9DF515100FEECF6224487868556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 502bd58d95c73661bc8dfb5deff2d08b2f71fe54189ccaaebc8b6369ebd459d2
MD5 a65a5f20b3e73096a925ca3d08769297
SHA1 1d91b74643a28301d59dedd3a6934e39589d2e8b
SHA512 aceb7047f921fc8816ae88c35e7d4c813b970e478b2f7452b0428a323cb5212dfc82eaa9ff6abae68e3d1ba12ea18fa95bccbf92c3a0dae399052a2716a22300
SSDEEP 12288:QsJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:QEdCN/j2GLl3iFSE33b9
TLSH
T1DD752364E9E6B669F11BC37943A8DF555100FEE8F6264487868556EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 72b3d842cc4d5a78422016c660f6e69c5b623d2fac54418f0caaf43208d95e7e
MD5 c185232a41102f3fc3e7b3034b4f39f2
SHA1 975517d3adfe8612dabc5442fec8ec99f4d0e631
SHA512 a894480ec6f2d43562a291a1311598033ff772d54b5233fcc12b17b9bb0a63f67812ebc54c37ae7202b2efb8b1f19a33f0ec932983e7b10662da2453f26cb980
SSDEEP 12288:GyPz5L8hJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:7zyVdCN/j2GLl3iFSE33b9
TLSH
T1A985025773A130F9E177823889A55A01F331B87597208A9F43A007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 aa741b55172a2b89601ed036e27f64806bb08769d0252780e4bd04e96e260625
MD5 337bc0e6b971d83396dc6f1ff574ce99
SHA1 45304b0caefc393934d98e4f8382ba1ccd415ee6
SHA512 e5a4b032cadae59da3168215ec95f40125eeba6a3b40530eb65027da31b82c72b5a5c345896cbe009ff89be0f9171e12ae75d4cd9a52cb98eba37d4a3a644202
SSDEEP 12288:JIJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:JodCN/j2GLl3iFSE33b9
TLSH
T1CA752364E9E6B669F15BC37943A9DF515100FEE8F6224487868556EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 fd52b32f72ca7298c7fe15b56d3bbc2d5336082a7e69d404effc22b14198a875
MD5 e144b6f3093b4f52edbbacf4e89fb7d1
SHA1 09654f01f83d5f2417bc7346973afb800148ea32
SHA512 18f1d835e6930269a63b53386cc7ed2d2e052c019ef2fbd71371790fa4bb081febd1127690f336cd634fd1db1af826d41cd4c9e6de0f19d9fcaaf00de139d35c
SSDEEP 12288:cIJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:codCN/j2GLl3iFSE33b9
TLSH
T131752364E9E6B669F15BC37943A9DF515100FEE8F6224487868556EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 8df5b29835b723c6195bd867e5c381b07b3b899a9ff954c0c5f3429cff06c6b5
MD5 1addd3abd61f6ee3241a413ef74c4f0b
SHA1 2af06ef9e09ad0fbeee737bff6dfb8422d75be0a
SHA512 017283b0548be55d8f4cae47d591889625d8c073d5e7aec7e49baa9b88ee5081bcfc5e58fcc811af965462ff905cb09fb0851b0bedba8991822036de89302a88
SSDEEP 12288:8yPz5L8hJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:lzyVdCN/j2GLl3iFSE33b9
TLSH
T11485021773A131F9D177823889A55A11F331B87597208A9F43A007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 00c43d0dbbe81587683cc24682fe221146bee08f4d28170bd05389fba88da72f
MD5 024542e42cb608e7f3c41177017fff0a
SHA1 8e6af1b61909734b6a9c92d89760230eefb2cef1
SHA512 72dce71e71d8abcec9c307ede1678239e4ceacc6007d9b27758dbf5ede4d8e30e536695d954c01680c76a69a42eda26bce1eb9af366375214e16270925d33a47
SSDEEP 12288:jCd9eWYoaLHF3z0z04PDvhfJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OTHaLl3z0zDPdCN/j2GLl3iFSE33b9
TLSH
T1338502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 4f836f0acd4e9e83ce21bdff3217380a063410689e627473ad92c1ee8a67f5ff
MD5 d0fcbb3c4762ab1409378ca8157ed45a
SHA1 8d330eac66c047a952f4b8320e07ef74892d784f
SHA512 d0f762d362e8cc833a6074ad26186cb85e7bc9b7ae468ca8312853de2162af5eb969eec3a2c26869003a76c97c54c4ac490dabe9528350d4fd0e601e07d10c6f
SSDEEP 12288:ri4e7+RdTfgwCHKy7GLbbdIv6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:r37d9CHKy7GZjdCN/j2GLl3iFSE33b9
TLSH
T10995CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 c748a0d9560be886b50b5a6642422ba36428a7fe73f02db069e20af8a827b6f2
MD5 8a609fa528c878eb8904a1f182261a84
SHA1 7f271676fc8a47af162b2511a58616a3e0b05b81
SHA512 9e0ce07fa54c0998df674d9addcd88b07ba021e8ad0e72f18039265e0a7e32b66d70e802324a6f65b6067d97eec8af5370f75866bd6ee90e03efbb3c508ca998
SSDEEP 12288:PvJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:P/dCN/j2GLl3iFSE33b9
TLSH
T1A2752364E9F6B659F15AC37943A9DF515100FEE8F6224487868556EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 d9028ecf576464daadc653f68742ed006119b932544fe9f576420f685a47ac36
MD5 ca98864115b12a53bea1121d0f895e75
SHA1 58c368f9e4fbc2ab3f9076e1c5d850a04e057e76
SHA512 8b75da4a2f2081ff29ea6faaadcace7c6050d2b101dd877f2b64ee05daaa9f68088369a01acfec967fcf02af9503e6abd0012bb6dfcdeb48dcbfce41c1d461e7
SSDEEP 12288:YBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Y1dCN/j2GLl3iFSE33b9
TLSH
T163752364E9F5A669F16FC3B943A9DF515200FEE8F6264487868156EB137CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 4a8bef9f21f4ab22275ca351309a6e3d42e9531ff2900eabe9c2ff27f61f6709
MD5 91b0bb8495419b3b9dcd682d936665db
SHA1 6959eca9194898c744573a1026e7a74eef6f8cb1
SHA512 d4980719200a8e1859cd92a7372b8fd2e3cc797c5507fa5b96adab06b5e9d2a955fa89a268c94ab3deab8cb4ed6c9a8dd76ea7d60a386c11a0591828b6b81d65
SSDEEP 24576:Tfwvok9RX6wkyAIUdCN/j2GLl3iFSE33b9:1MnYI/N/j2U4FH
TLSH
T18BA5D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 51cfc849f2aeace672e70d0f8eac7c90c990484452397a23ad5775baffc9e4c3
MD5 1d8930f52e81cb225b07df6954dc2e5a
SHA1 2587fb377104af90c3c89fdc7b93ce3d144d91a5
SHA512 4c33818f06f7b6b8f9b89754a61ffc4fe21fbab8a0de8e2bf0137ebffd2118a4f47d4f1a9436adfd4ddbdec366f19c4ed073a51aa7dd457a13532649bfba84cb
SSDEEP 49152:AYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04N/j2U4FH:uySzPcj2jF
TLSH
T1E0067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 627f2285cd1162006288129494dbe2a546a627664c36daa11a0b2ba090af4aec
MD5 7a029dec0e5e9735af227dd63e72b450
SHA1 9568510b73d364b5b88ce2f7ce230c555cad9332
SHA512 4e29b5d4f6eb43c751c8ac4e440911a67c9079fae248b1c306b5d4a5d99e37159ae2f2ed85b71c8163002a7bdb4392ad96dc84d9857efb9a431e75faa836b9f3
SSDEEP 24576:e47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYJdCN/j2GLl3iFSE33b9:e47JUQj1irIhCnDHUPfF/IN/j2U4FH
TLSH
T1F965AE1DA3EC01E5E1BAC27885158A5AEA71782D5B31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 96cab74fe5aff3da037c0fe9595e23d10035b455e667d99efaa894d811abca71
MD5 32d23e8f3c3835e391ce09f65f4fecf7
SHA1 1da2a1badba66f2654613c88d81dcc653fc152df
SHA512 84d0b8708e7cb82bc258919189e3ae9ad8453808568843b1b771858579e29b81e13ee7d785dc4bb57534467638d20289089f72daf1f079b577de036b2c6c984f
SSDEEP 12288:DNsfYJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:AYdCN/j2GLl3iFSE33b9
TLSH
T1B8850119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 14ee5c63493ddbc6b8906f16c7190eba6b06ccd57f720fa2bbf0e666090bc2a9
MD5 5adbc47dc2f28855571d5037e81f8ced
SHA1 3a5cf01d6e42a4400d28eda83acbe0ec3fb814dd
SHA512 9066d6610fd3d1ac05173c1d4662b5a45836bcccedd934732e55f9acb691b75ce20a460930dc5a37455da82185c0024a6ec1ff1f2cf8aad14c4ec209a4d80d37
SSDEEP 12288:HpeTYv6U3fWXwTCVoA6gxP9Rverd4RM5eEyh1PKCSD7Q:HpwYSUPVsHP99erd4RM5fyh1SCS
TLSH
T1E93508417626DB4BC66940321F36C6CCAB70BD46FE499B0372CA473FC476658BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 8c86332e2fcd4a32efc10f1a45e30a3801526c443a2341a0bf4f72b21ff8ca43
MD5 57485ef68517152f6337075d8a0eb8ce
SHA1 5554c0d2b7f3207115ed5fe000f2cb8f5de9d1e6
SHA512 5bdd488ea211ae1b648759979331b2ae15527bc258c1e1f4930d3438dc5d75449694c5979218083050d8bb0fcd7c7442a5d1ef5a404607d75b4efe672d5577fb
SSDEEP 3:OlH/lGwdjXlg//Pe6ll3yjJ/llS3mCllltGlslslslslslsl657tl:KUwdTu//Pl/OjlEmCtEEEEEEEwt
TLSH
T196811261BF540799CDF364346F55CB685395C46930C4E7D7314030751C0174C4C8A73E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.8MB
SHA256 3beac125648826e2d544d7556eac2827a9a6610bba251c31729dbea3d5051932
MD5 15547c349a2126edc2bcf3d239f3a77e
SHA1 7e39ea4f9161f0abee9c83b14c6d6cd24a26dc5e
SHA512 b8e723a91a8c93ae236ab3f3da2f4367e994ced1c2454de002fd2b113548dcfde78b0c8a2e92f714a23f30e32548590e6da51572eac0620683d69c7de6edf20e
SSDEEP 12288:RG5/8u4WJ6YWnoTrXwqnCUJPXrG2HEohXb0l0sRCfUj9Ro+CV930ltCd9HszkOd1:RB2QnoT8ml5778EAOzfcMLbir
TLSH
T128854B415577EB4FC5BE80370332968DAF74AC06BB492F057385883998B7A5EB5E23C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 62dcef017e3c5909bb632f385ae7d67fca39db059934e8b378f8e4acbb3ba3b1
MD5 d1fc18280ef468fb76f36c00d734918b
SHA1 a471b9613a5c3374b12dc5dd258d6fca17f31eb2
SHA512 a418c992ef82cd6013eabc561d77811c8f71e4cb8c02118068d9c1f3f1c9b191d7d4db627a3543c2f3a49440f80482320a73961f97e0933b34f2aed7cc1d2766
SSDEEP 24576:wdDVT0iKG7O42WJPmN6sDL4ckCArx4iZsfyGibYtLLdCN/j2GLl3iFSE33b9/:wdDVsWJe+Zs6GFLoN/j2U4FH
TLSH
T1F2553378E2586921DABF577C035A96213644BEBCDF248287422072EA7774DDC98F3263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWow64\perfhost.exe
Size 778KB
SHA256 43ead079950adaa96eab7f6558d2149ae7778a83ee2fa5c9940890d4d714fed0
MD5 c37a6ca4e31c971e3b9e69e92f167077
SHA1 2ded9828b5295e3a6435bf5064b8c392c3e103ce
SHA512 2857faea396f72832bf87bf8943773713c70e604fe2638055f1f4037eac14e3451fb26e5450160b1645f59512e7681a4de76ffb0c2ac00d6a8bb03d5c7cadd92
SSDEEP 24576:zdDVT0iKG7O42WJPmN6sDL4ckCArx4iZsfyGibYtL:zdDVsWJe+Zs6GFL
TLSH
T144052379E2581831DABB2A78415A422539DE7E3D4F64C39B0234B1E97B608CC6CF3766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 56a0119ed8e40d69d7e8df5b10c25d8aead79955159d5930ad7ffe53f4daadf0
MD5 e20e286aae551b3f54f7ca80977b3af8
SHA1 f53eac2d35e0607fa4749e397e9d7683e33d5b01
SHA512 2984016d41337ebb67ba681cc2eacbb6f04b7dcfb12dad31daccf6eabb0b3c7598be7ba26bc704ed763dfb3378085e09b0b761ad2ffaed669a07dc16a5fd5e64
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bYOdCN/j2GLl3iFSE33b9:Wgb4mBIBhGFeN/j2U4FH
TLSH
T1C965AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 7a858cb509556238332ed7f0f690bd78bb06453c2a2724616049062a58f31a3b
MD5 31774a1299c6f46daaad6a66bdecad34
SHA1 67510899c8b843dcaaf4acb51e357917b3afd83a
SHA512 cae2af4cea690692852d6dea3e8c922b7fa60221fb2a34d72c275dc127a40bef88e5a1c3a0e09bfd339a2ddf52d31bc507ee84af92e07c4908744dcdd10a51c6
SSDEEP 24576:AGmVT0iKG7O42WJPmN6sDL4ckCArx4iZsfyGibYtL:AGmVsWJe+Zs6GFL
TLSH
T1A505223D71A934A0CA7B9A788126522379E53E344F2453EF02B0F1B9AF508D879F6F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 55f5b63fd0d62c29e6aec50b487fee4a5f32afd9d63781edf6398827752de807
MD5 a0985fc4caea062bccbb12c4ad613a0f
SHA1 72b012cac84301bfd2e72e30f542c1bd29aef540
SHA512 12358abf3e88ca4a230cba0865b6de5cc4540ebffffc502a6cb85dc4df763601a729ac344ef643e694cb861ef1299d508f1f40cfced52dae573472c0c7c03456
SSDEEP 24576:KG88u8FpJqH1bzria7/m5dCN/j2GLl3iFSE33b9:x7ZFPqVea7/pN/j2U4FH
TLSH
T1B2A5F16576E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 f9feb8440766b3feac765e1a7ba7fa884797f27a1f57d177864d8cc6181cdaba
MD5 17d9bb76f49b569e69430eb417355884
SHA1 fa6ab93603592ab4859ca545dc33f9fa471101c8
SHA512 c18ef352dba9b9e08ca567280f408c2f49a8fca9ad3304f606559e86071855320d8badf722ba5a12fe0ec984bf0f68db213b41821ecf7af67ec963f9a57eb15c
SSDEEP 12288:3HvUrBFrEjwaQOJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3PUr+NQidCN/j2GLl3iFSE33b9
TLSH
T17685F22E62E918E5E67AD17D86868719F731B8615312D2CF02D0817E4F77EE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 435350d7e4afa54f7d8d9b3d708598af8c0c11d109e03f9807235f0e2c654946
MD5 4715651f2e15688eabffa6737926e144
SHA1 0934f840cf0c32ad9996330ca1028ca5bc6d7c12
SHA512 564344b2122918fb32bcff36f49643e7bf30fdaee250e63e362d2ab7f5461454387a1d1d82f44c448f0b4fca2abb013b7909828c7ded4be77a38c0d90e28e0b2
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7N/j2U4FH:WG05lO43bOj2jF
TLSH
T126D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 181eabec01a6b5a6a77073e85ffbdd831d1e3cb8cbf74b9434d9d294ec0c7efe
MD5 57feafa718389ed37d25873309d5bcef
SHA1 7d136def98accea6e7a5710f26e8fcfe7fe7cf57
SHA512 406bff9c5530ac6bf018a6b1fee9546340ba5ff63b245769440649d1cb5484c90fa0621559f40dce6df37a292cd426c5745195e3365ea05a1c66b0b020351d0d
SSDEEP 24576:ofa5POZ3dpFWVM50JicR2hG0lasx2+47eidnbdCN/j2GLl3iFSE33b9:Qa5POZ3+Jt2pasx2+mqN/j2U4FH
TLSH
T1AC65BF5DA6FC01D5D1B9D17DC5838A1AF5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 51526f1ff4e355a4e8dbcb9e19089de3e598f64bdf762da8009298ce1db2346c
MD5 a5bfa1e832ad40814371cfc4a0ba4eab
SHA1 fe07421168c044eb12593b212df98b83b1d796f5
SHA512 eb5d8caf46ca2130813851c74880b6910e8e7cdb2cca212eceea68ffc7066299176d5eeb166a682d6467b728a219971e13d236ceafe8b77d48c5647d4da3c667
SSDEEP 24576:+NcwHdjbyQ4nLC18lb/EOjowL7FkBdCN/j2GLl3iFSE33b9:+Nc/zEOVHFJN/j2U4FH
TLSH
T140857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 43def8be17c78274927af9aa6fd5c946bda8f956dc430b08149378db1b3e3fba
MD5 f5899149d60265d51e27c531cb4b7b60
SHA1 3c3b2eb7eb06036570a40e7a8f9f64dc9c406507
SHA512 8407fddb2a8a846b65b29ccc404fed7253a514c3c0f0db9f436f1835db7467accc71b2b25aaff748ffc5a38ecc5dfec6c97a9180c8612edc08ada26c58f3d161
SSDEEP 24576:66DIB3VT0iKG7O42WJPmN6sDL4ckCArx4iZsfyGibYtL:66DIVVsWJe+Zs6GFL
TLSH
T14225016C737A10B5C1AB903D82830112E2F2B9758B6256DF07A4D1B95FA3ECCB879F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 d683b3bebbe49fe2eb5e30a74a47187880a8161b9b31f318ecadabe76ad9b9a6
MD5 b40995a5d7129696451c543f91547d85
SHA1 bfa26439560d38b255226cce523ed189d057adf5
SHA512 870b9cb2c788b3e83e8617f5f575281933ec3ea7d6bddd0553c196477e9faaed1756a7b01c038150631044c54158d70668be73703963966442eee53584b66345
SSDEEP 24576:vtyUVT0iKG7O42WJPmN6sDL4ckCArx4iZsfyGibYtL:vtFVsWJe+Zs6GFL
TLSH
T149152318A35424A1DBBB167C866342616EB57C355F6193DF02A0F27E2F31AD87CF2B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 2ba565b71fe8809081aa1f9fd1d3216fc09237e9ffe86e7bdbf7d678eb6c9dcd
MD5 508d559b41833aca84f7f057f862e207
SHA1 b8300ba2fba5f2cc9522bb657d28f381c05425d9
SHA512 7bbb0827c1f3bfa2f311656ba179cda7635a1f28bcfb83d3f3537abb3fb5082c0a58a17574f848fff5da0c43dfeb8d57bd8735360764d5d983c8fe0815bb6fde
SSDEEP 24576:oTkNvNnaFeYhJNtmZBmvVT0iKG7O42WJPmN6sDL4ckCArx4iZsfyGibYtL:oTMwBtOmvVsWJe+Zs6GFL
TLSH
T10975BF6EB6B806E4D1FEC6B58D238512FA727861073293CB4390C13E1E679D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 d838954bc55aa14bf73b84bff6451f5a6fa42dc7d7b583c465f84029430479de
MD5 f8447c1ae3edcc682cbce58a6420506d
SHA1 fa6bbb6af439d3df8735058c43a096408bcc161e
SHA512 b9aaba727558ec95caa42e240507a50933c65dff37459715d2de103c1237d9e8eb5a994fb3a7430d4198d587989ed941a9307df38e0ca2f4eac12b6aa5dc0a2e
SSDEEP 24576:9D3FHshBIYQgA8dCN/j2GLl3iFSE33b9:9DVHeBIAAnN/j2U4FH
TLSH
T19095E17DE69C04E4E57BC2BCC6638A06E77178A8432255CB02D481BA1F6BFE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 4c5f083e09675f963115b936af84bd7e7730ac5e8c5f139d2352a7fb85c4a183
MD5 30714d5553ed3e95b3c0272d25b8cda1
SHA1 dc6104325949971f23a1747d510bc13338961833
SHA512 6b3f4960af8816473bf272b12357bfc5eae04d5bba590a1ffd6aa73c40d04e03a38d23f4caa7ca71a8ecb5bfeb002ed2d56068a92da2fc9ec137b739ab4c71ce
SSDEEP 24576:F6Uqjp2VT0iKG7O42WJPmN6sDL4ckCArx4iZsfyGibYtL:F6UdVsWJe+Zs6GFL
TLSH
T19A25236D628424F1D57B5638C522822655F57C360BB493EF22E4F27E8F319C898BBF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/908-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/908-150-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/908-154-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/908-152-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/908-144-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1396-96-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1396-88-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/1396-312-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/1396-90-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1484-345-0x000001A6282C0000-0x000001A628940000-memory.dmp

Download

memory/1484-452-0x000001A6282C0000-0x000001A628940000-memory.dmp

Download

memory/2416-34-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2416-117-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2416-35-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2416-33-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2416-27-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3476-295-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/3476-78-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3476-68-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/3476-71-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3560-374-0x0000000001590000-0x0000000001615000-memory.dmp

Download

memory/3560-378-0x0000000001590000-0x0000000001615000-memory.dmp

Download

memory/3560-371-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/3560-366-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/3560-365-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/3560-440-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4256-391-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4256-384-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4256-390-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4256-441-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4256-448-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4256-450-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4280-112-0x0000000000400000-0x0000000000A8A000-memory.dmp

Download

memory/4280-19-0x0000000003790000-0x00000000037F7000-memory.dmp

Download

memory/4280-1-0x0000000002B30000-0x0000000002BB5000-memory.dmp

Download

memory/4280-7-0x0000000002B30000-0x0000000002BB5000-memory.dmp

Download

memory/4280-0-0x0000000000400000-0x0000000000A8A000-memory.dmp

Download

memory/4280-49-0x0000000000400000-0x0000000000A8A000-memory.dmp

Download

memory/4280-14-0x0000000003790000-0x00000000037F7000-memory.dmp

Download

memory/4280-6-0x0000000002850000-0x00000000029AE000-memory.dmp

Download

memory/4280-8-0x0000000002B30000-0x0000000002BB5000-memory.dmp

Download

memory/4352-160-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4352-332-0x0000000002FB0000-0x000000000324E000-memory.dmp

Download

memory/4352-333-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4352-167-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4352-161-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4764-130-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/4764-328-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/4764-138-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4876-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4876-159-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4876-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4876-50-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4888-54-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/4888-60-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/4888-53-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/4888-63-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/4888-65-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/5776-125-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5776-331-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5776-329-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5776-118-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5776-124-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5776-327-0x0000000140000000-0x00000001401BA000-memory.dmp

Download