1467c40b5fa068de49d00aba1795e66c3805fc491bc4dc2e633e0d37aceebb90

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
Size 2.9MB
Sample261026-tydgdsty9m
SHA256 1467c40b5fa068de49d00aba1795e66c3805fc491bc4dc2e633e0d37aceebb90
MD5 abd1b98d0f8b664161c36946d66e9ce6
SHA1 f09e89d4aaab8d3b9514da10cb0282992c12c95a
SHA512 0fcaaa6f28a4034868d83aae8f56bc7cc2d15673cefdafb95e61893bb7dbf034136e3051194b838d4e61d38d71541ce777cdd67cfd40a6b58b4c7f87baccbc22
SSDEEP 49152:PKp1otlisaNT/M+wPyMRYmJzxj8Z9T/M+w:PK1wKYbJzl8Hw
TLSH
T1D2D52333B8F18063F632A5305AD2AEB2DC2FB5320B7419675740AB2D5E390F47DB1992
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5688	elevation_service.exe
4344	elevation_service.exe
4264	maintenanceservice.exe
5588	OSE.EXE
3376	PerceptionSimulationService.exe
3204	perfhost.exe
2940	ReFsDedupSvc.exe
2172	SensorDataService.exe
1116	ssh-agent.exe
3768	AgentService.exe
4280	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\60da85443a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2368-0-0x0000000000400000-0x00000000006E4000-memory.dmp	upx
behavioral2/memory/2368-77-0x0000000000400000-0x00000000006E4000-memory.dmp	upx
behavioral2/files/0x0001000000009952-171.dat	upx
behavioral2/memory/2368-168-0x0000000000400000-0x00000000006E4000-memory.dmp	upx
behavioral2/files/0x00010000000093de-161.dat	upx
behavioral2/files/0x000100000000934f-160.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da6631f56665dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b2344376765dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ccd9c7f66665dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078f71e376765dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000624f3a376765dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d6c66f56665dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5688	elevation_service.exe
5688	elevation_service.exe
5688	elevation_service.exe
5688	elevation_service.exe
5688	elevation_service.exe
5688	elevation_service.exe
5688	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2368	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	3768	AgentService.exe
Token: SeTakeOwnershipPrivilege	5688	elevation_service.exe
Token: SeBackupPrivilege	2940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2940	ReFsDedupSvc.exe
Token: 33	4280	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeBackupPrivilege	2940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2940	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5688	elevation_service.exe
Token: SeDebugPrivilege	4344	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 4304	4280	SearchIndexer.exe	102
PID 4280 wrote to memory of 1356	4280	SearchIndexer.exe	103
PID 4280 wrote to memory of 4256	4280	SearchIndexer.exe	104
PID 4280 wrote to memory of 5892	4280	SearchIndexer.exe	105
PID 4280 wrote to memory of 3236	4280	SearchIndexer.exe	107
PID 4280 wrote to memory of 1136	4280	SearchIndexer.exe	108
PID 4280 wrote to memory of 4212	4280	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4264

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5588

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3376

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3204

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2940

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2172

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1116

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3768

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 2948 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5892
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3236
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 2948 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7f3ed0d037bab9eb67f54e5548ee72474b434b3f6e2625ad3a8541c0595c92ea
MD5 91c4c6260e393a3ca054de271d86d034
SHA1 3862979dda17be3c9bfa02c131c39c38f66537bf
SHA512 b0f3b37be356cbcc5bddbc3a629b6464c9aba32ef8ca8bb75f77a97ba63791ab50a05db91aa12c8247a32ac21289889ee8246717388cc00faf351a3a7daeb21f
SSDEEP 49152:7b+632BuPkFKRrdE6ohmstBhuXjfS4LWxneT/M+w:J3q6HjBPw
TLSH
T158D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 4593bcd6571d60355f5fb6cc2718e2c35a44470c9aad037ae9fcc7b29f18163d
MD5 363846c646ced923aa5330e7e3c77363
SHA1 87faa71634f2de8a89aff0830b0de3b86316eefd
SHA512 78222acbe708bbfeab107dbfa80420bb883799a60e26537c39e979db496218b40c42106ff3db1ba2a7d97eba9384cabbe6c6130c9abaf4c59c21ceb0fee56fd0
SSDEEP 24576:3XYfDtczAGoHjto1GFxlXutIs1WZX5AR:itckT/M+w
TLSH
T1FE85F12977E108F9ED678178CCA38511EA73B8554760E6DB03E4D9290F332D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 88b5ede191619b83250384cd4aa33e90de49f59da5588db66f1a0bff291e7d0a
MD5 2a3e75f4941a444192ce33f8d1e64b2d
SHA1 245fd81d4d16498c75c65fccd911bdcfe4bac355
SHA512 2af394da264eabaaeb813730e82ce9822a5dfe11a40c809e0c5bac700c71078a118b97ba4f95433bf8276d3fb7120f2418444938d56936c26f617f1b82dac798
SSDEEP 24576:n0Le5ji0hmxIrMkoHjto1GFxlXutIs1WZX5AR:nPji0AGyT/M+w
TLSH
T13D959E26F5748375D073C0B9C5D3A69AED7230861B308ACB4286D77C2F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fc665495bdfbb5f83dd22450a3e8d088c07caef11ae1752c32c213aca5a90471
MD5 5d02f695417a2881df8fbc923e2f2662
SHA1 18db6265c626d45a3420fad418eb7512492ba283
SHA512 8dc7c618d34c6e53d13330171d151b7899f5f44e5649c399fdcdfab88e141105f6d9656d4fd355b7e71419b21f175921b11e5d63db76fa412a93c2d2b1ec608c
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWE6q8wyuCoHjto1GFxlXutIs1WZX5AR:R/ezSC6vUzPvxHjyGT/M+w
TLSH
T17D756C25F5788323D0B2D0BAC5D7BA99FE3230465B3089CB0246D76C3E276E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d7f844e89d5922a1bc273400dc3bc51ad3b65cfa9a3c979f73acc7aedafa66f5
MD5 873bb22c0da054e8e484a2858c5c888d
SHA1 c470d2f0ab24fb395029f738b8e03ef28eef9db4
SHA512 29e21528501f7a7dfeb2fb56be9295639340df387d1e2e08240eed76fb4f6fc4a1445b2b2e005a78a1f9f6bef3e0807eb205429b8070f8cacc57e7eb6d5da313
SSDEEP 24576:sVbqPb88hv/l+6joHjto1GFxlXutIs1WZX5AR:sVO88hXl+BT/M+w
TLSH
T15B559E66F5B48331D073C0B9C5D3AA9AEE3234425B318ACB1246D72C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 50b50733924f674ff503fb8d2635132c51b6cc5ab9e3b7f2aee5b7071537c000
MD5 83e8dcbb5e95133d589fb3196deb3645
SHA1 00d074d395562c05c03c850d7048cbd70bf1ee1a
SHA512 a3366637273480f49627d2c4c9c459cf543ec7b90d62e7cff4250ff17c8ffc7642715cc03ad28f552996c5fb9288c467473777eeb7cbe0abe87884eba0f391c5
SSDEEP 12288:BHihKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYLN:BHIoHjto1GFxlXutIs1WZX5ARGN
TLSH
T14465236399F250D7F77A11B039D77A61ECB7BB06094824BB8B50FE190E3C060EA766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 9c241f2ea3be54206b28501dc00622e73b2c1ab5f15ea1c892241737d4e5d6cb
MD5 5a02ac2e82c25c3cc70dfb39f1f4cb94
SHA1 ddfb36cdd1635a2a660b4a50ca3a65185cb22456
SHA512 72d67a877cc53f15c1e8d009c5e969f0eab2bb53fad28d6c83ca2779dfa9c4b794941dd4f757c002af75eaa09d9421a7060fe23871376087b48e35c4ad73e6aa
SSDEEP 12288:+eBNUbTVO86UlhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX5Z:+JIUboHjto1GFxlXutIs1WZX5AR
TLSH
T10185CF3BEE38FCD2C27A5DB85A928640E77274314F51A3CBD164C20E9E275E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c64a78981454f4bb8614e7ca008aa0f354a140c2201331a46dbcc74d0d31bebf
MD5 b998735f9f99600db423fd33092ef201
SHA1 e7e7d3b2e70615914b819c4b7262a86e6ba641c5
SHA512 41ca9986115d19ffde16018928bb6af057eb8b836eca030ba28449dc6f6b9a4c383969b12d56efb9f1c57a7882dd9d45b47c3ea0f555236dd3314c6abdab7db9
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THd:EQvGAdlCEL8c/yRNw5CXw
TLSH
T116266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 d85c1466877eade42ea6836d61822b4f2e960f58a22b6d1089ae22f9263d0ddd
MD5 16df2d5447c315a3bb4dbe1924a71bef
SHA1 d69a0338ca7d196282cf7dcfacd788233bc97627
SHA512 7242de15f471d0a8c409bb5ed2c94e7ee01c8bc46f8ed8614e092885995d5997fad8d207ff621f351d6eb5e268a65a7124d40e46e8dc83b6158d627e63085c31
SSDEEP 24576:L7ewsAjpoHjto1GFxlXutIs1WZX5AR0N:/ljiT/M+w
TLSH
T14385E031FEB0E036C37B0DB12B26D716687DBA204B5119C3E3E89E9E49341D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6e838957a1dce2d5f857f87ea47ed1c3b658a56ef3dbbd0fc6a737d4a3ab5849
MD5 fe2b95def82a3249434fe477aec3577f
SHA1 d7d5161c79729f9fe6bcaf67ebaf3bfb3f0b6bf2
SHA512 2365a5043efc40d38b8edc3fc7677bc0132e9541a14bc85703681f77da3bfafdd44b5c0363138e0ec62a028805778986776db29f764c212b3d9a324be0f6aa6a
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHD:4UEtQevvqc2W1cpV2EI32
TLSH
T1D3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e638c1f2f78b665c122c4a5e7b1a6d779ddb0bc82df00b50e302b9ef084e29fd
MD5 7d5344538aa56416a3ee8578fb5cb281
SHA1 87664677822bc16bc872b85190d141e15f746634
SHA512 caaa589677aa9973063848017db9e30355cdc9265d6aae56e5c7e6ab761e8d6d51d1a22586c2d260565c5a8ccb98ea1b1e6259aacdbc08bd40c0efcfb8af473e
SSDEEP 49152:bCbRquA/m2yL5zQfFiV+XenmE3/zCT/M+w:EoqtVjnmDw
TLSH
T134D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 746c6a278a0a443352d7bd9781e8e68fb67c664d3bf8df306b4a8742a6efcf4c
MD5 26ab259365f1d28047a6a71fa194230b
SHA1 6e51f226c51893a20cf076e5dbc5fd64a1c050cc
SHA512 cbd6dc01b913282eb849098b2c758d161d0ba4e377e4e5960a0b69f329d0c1bfecdd01a9e5d719bbecf7c852083bf258d5912ad8a9a59479e55ffb4ce7fdee29
SSDEEP 24576:DAhGLJIFoiwtA5l7S53uoHjto1GFxlXutIs1WZX5AR:DAMyFoiq5fT/M+w
TLSH
T18B35AD81EBF955D4F5B3AAB899B69170EA77BCA65E30C20F2150D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 e8ab6d395a35c42df0927cbec39e3e4e4450529cba6cb0cd763020bee7664f4a
MD5 834ca2e2bb62e3459a27a5617d0a01df
SHA1 35284cf29038e748821833205ec091738d0c09f8
SHA512 2b26a1f2cd429a66fb2b90b94bfcf7750d89abfff904efa3cd9ded201b237d7dd022ae14ad37ead4643b8fb86cb79b8f9b5fada68dfa079625955cde35ea04f8
SSDEEP 12288:Zmw5HEjsChNDBFgl0WDm+CVhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09z/:0wuiOWkoHjto1GFxlXutIs1WZX5AR
TLSH
T17485F14676E50CF9E96781388597D536FBF3B8022A25D72F0760CA1B5F37220BD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 6a71ebbf4def118d50b4984263eca652e91d96db363e0182d7c9907df234a021
MD5 4eec25fc9c75751f388234dd62717a78
SHA1 df94f4848d44cb8136c002e4611001474f5724ac
SHA512 82e905c76c5dd39d8c4346423b4976c27f74eb328cc63e021c6ddb7f8ca66b06d57ac1e2d06222a6a7844c9107af4d6263781c60bab4aab3f995528282801f9b
SSDEEP 12288:FTZ1IyfhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:hZucoHjto1GFxlXutIs1WZX5AR
TLSH
T1D075125636F020FAE2A752789DE35A55EBB3B013173503DF07608A2A0F375D16E3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9dd0fb457b6510a241b284746919179cb902785bfaa8c2162e930cb6e6bbd5bd
MD5 8dc5905aeae9f2a5d3d2d21da673173c
SHA1 698b0def39d5f87b597388437de7137c53001047
SHA512 3cad2226a631f38456434bb6386659bf1cd2738a932b6bb83f38bbd102b63f74d1b7640e5e038d807a412df0a2ba71c43e775c6fc21c68320b2f2cbab4b465eb
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:kQRQyi36YOcPQLvw2gAf+PN3yw
TLSH
T16F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4aeba10f65cf40e334a40300b2488b4d1d14e6efca3cf3659d23d32eacd893c0
MD5 35b2db98b0518c3d1892feef9bcad7ca
SHA1 72c6d82f7b83ccee6b4e2e0b2a2a4dec9764f7ff
SHA512 0b4017386ac5c236db1d8c245d25d0a75505cdf16a9a93c9ae83b60d627662be9f2c9dce6a4bff45d3c9e24bb872bac89167450e8da1af7d1abc3355b10e035e
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:wQRQyi36YOcPQLvw2gAf+PN3yw
TLSH
T121667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f3862a6e8fa5451ffccec79343467e23b60fb452e44eacd4485b0f3eed4bd061
MD5 81ab96b20280203e9029bf10259c0657
SHA1 b52298f5a409294fbfc9ee5260f75ab2c87c46de
SHA512 034970085ebf1039706e16065ce76975ef0c1ccffe988b685f437dbbf936bb120cde82f9a33caf5bb38f67d5191c28cb73b8b83d58ed360bb88996b61dc134ff
SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0MoHjto1GFxlXutx:y68Qg55nhheWu7PNU3/yT/M+w
TLSH
T1C0B54933B2F20099C44DE1769F4A973196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a05fedb6914607b0da0a4b15cc85828d9694c536d5db034111b31f9d588fb636
MD5 9b43fe73216f485e20bb5d3064ed50e7
SHA1 787e035204da02e4c01fdd6dd09957f4d1a29ff7
SHA512 753238e143680942025aa4d91d127438a4c083d495affd800e3198bd067ecede5a1f67eed8177803fc37dc1140b4f3e3ab9b148dad46a08db35afd1313ab830a
SSDEEP 49152:a3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99b:Ly5112gYy5azzVvL69nLKnhZlw
TLSH
T1B6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 34297f24ee1a437d4d37366ad1196ff992bca4e71565e2a698f8eee4713f9f9a
MD5 ada9ab1eb92ae3dcc759344725058ff8
SHA1 bc71933468025fefde121f5a397558fa2e89dd9a
SHA512 f675d47268ea6f14031f35d40451cc2b7032b9d97c3801f61295984fa0121c2d3a50df6fb0732feea51605af4e032a3881783f988f121b8641762fdcee1d7f45
SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl3T/M+w:Tu6JmVxd2dbw
TLSH
T14BD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ddc5e029561e0d99d0c715cd67ff315f7aedb60ea281daf199774ff038e995e8
MD5 8347d76504de1d2327fd6ffd26fbf159
SHA1 59547cea6c83eee7ab5c575ff0655e7627900845
SHA512 99f9f0e9eabc78d95c32f1ed771ceb9615c53b81dfbe13a76d7dbe80db9d8bd2a5b24fc8c96af69b5b0f207f235f666526f24c7123b4db3f27cc876591922a8c
SSDEEP 24576:whv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3LoHjto1GFxlXutx:s1hpsNoJpF1A6UU44CwH7R4xET/M+w
TLSH
T1EEB5AE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f5aa289ebfecb3b0441d60758b322feb5c22998468e6ff854002be40c10f1018
MD5 2e0674a0231a24b0fad295530197ecd7
SHA1 3c1691fc3ab6810ffb83736367129cd31cd555cd
SHA512 f484fa9feb305936bc1e2d92f12076739482048e4cde22c201ffcb005710317e7afe6717a28c44a780471e542144b10622ff3aed9b0dcfa1ec0d537ae50585ee
SSDEEP 24576:M4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnqcoHjto1z:MSuZQIY0Be2KRRVtOnks6NMHq1T/M+w
TLSH
T126C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 12711ebc27484013755b9746839d5dcec6b7077a9c52550ede122bd2dbdcfa20
MD5 a8e0cce96fbc38b9633b35f34d3c87d4
SHA1 86b1bcd0a4244aceffab76e5d51e766fc24dab20
SHA512 299eb8c67be4aaf832896a88915f788416932d5bcbb7dabed944767d024291def98cb511e025e46940c846df1118519e58270b53bf70b7ace81d598f6b4df8c4
SSDEEP 24576:MhiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLLoHjto1GFxlXutIs1Wg:MhtSn8EApI0figngiDn0AP5wgT/M+w
TLSH
T11695BE13F2D900E8D05ED178C7468632E962BC160B39A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 a89971d12b85230fbb5090faf42c1049dd1cbaa2f5e76570b994b3f7055a64d4
MD5 eba97c0ff1d3bc385f713b6f13d7383d
SHA1 d4a7763567c5b72188905d3a5dd012527ae7b40e
SHA512 0f1e1f1692f05315122c894ba5e444494c6138309186fd47f12902ac4a741e4dd0e7169d1bf8deb585fa78c955988851886acd187d318ac1c7aa57a8d0a3c1e6
SSDEEP 12288:m6hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY9:mAoHjto1GFxlXutIs1WZX5AR+
TLSH
T1776523639CF340DBF62551B029C77AA1ECBBB347594920BB8B50EE190F3D064BA766D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 47f0cede52342526f2670e6444b4e48bc1bf57aa8dd72f62c8893b6eefeacae3
MD5 f2cdcd3c34619eee98b9914f23961960
SHA1 8cee6f5a7cf90ddc15f98a0662c63bd3e024fd23
SHA512 9833b9670cef5d5378dcf8e224ff38e92120655c0da3d4f43b42a39ef37bd7ba78a1cc55e374922c853affd7dd609e04735c2ba67ba4f05fa5be39a4f0905bc8
SSDEEP 12288:iThKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY9:idoHjto1GFxlXutIs1WZX5AR+
TLSH
T118652363ACF240D7F62551B029C77AA5ECBBB307594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 a8197dcdd8ce608b09831adf9708326ecf06bdd04ab169772c9be50cdd6158d2
MD5 e928476bb1ab06097196238673043b89
SHA1 013bb61d71c414374b551e7f9ef3810467cb1ffb
SHA512 f3ee975078efbbfd36cfa11e8171400750750cecbb78cf795a9bf753a637f1c865975c71da2f88591087050ed5a5cbe0ca8917c19570ffe71506a9e7ddf21614
SSDEEP 12288:KdhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:KToHjto1GFxlXutIs1WZX5AR
TLSH
T1406523639CF350C7F62551B02AC76AA1ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 10ee805ec8a56b6272449056032c2cc913a1c131cdde2bfcda8f634bad2cf830
MD5 6e6be25bf9eabab64384563968c160c8
SHA1 398c59c36af53c9c6a18fca9c0ee4be674846354
SHA512 5b5f4dc27df081a6c1d43e2877319e569c53bf4afd322c872552df7b882ce5c00a7e0e6681116b7014db52fa92368386b1ff10b3441787d842f5256a1eb99122
SSDEEP 12288:WVchKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:RoHjto1GFxlXutIs1WZX5AR
TLSH
T1CD6523236DF200C7E53692B49DD36661ECB7B6565B2522FF8B009D190F391A0BE35BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 a6f741f30381e1a80325d3fc67d582631c9b69bb19a99f6b1890a1f3c9e38680
MD5 11f6e4bda04a3709bf1cc6ac870767b1
SHA1 d9e92378159c7aa9ae21bd35be1926e467c2fd01
SHA512 b8d129270a375c0b73e33c8162827178830b82cfb5eae73cdb3fbabdb687c904544092801dcc6ae65ca312aacd2013245d8f289824f9c2c3a4c9a0a85ecadb4b
SSDEEP 12288:3EhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:32oHjto1GFxlXutIs1WZX5AR
TLSH
T185652363ACF340C7F62551B029C76AA5ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 70e06fb35907209971b59e86eb9fc686d9a54a52a551b3c3905651b72963e01c
MD5 294578f064d7bc56f845c622c0bd3c33
SHA1 a086beaf3f5946ca0eae94e408abfd7df4a90fac
SHA512 3bc38b04979ea842f8dd98e3b645a9bda84bb99301e8556030983ee837862f1ac6b181c78f1ad64259f3d21ca8018ff0025e5d3508c092403b69e4aabea92bb3
SSDEEP 12288:DnhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:DhoHjto1GFxlXutIs1WZX5AR
TLSH
T126652363ACF240D7F62551B029C77AA5ECBBB307594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 0c241dad3cb8f7ea5ff22b1f7e2656e409dce96b4c84a45dae071f76672cd0d4
MD5 1f2ef61499ff7d8e9cac4502e36e1925
SHA1 03e13b3f20378acc3dbb7c72d36745e753936abb
SHA512 e12ba7cdd025bca894d843609645ddfcdb0f8499eb0c1c29924caf29ee601aec43a8c8959fc5f9c89f76ba0d19416828362b276674cece0e3ba10892a2d7bc57
SSDEEP 12288:wbhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:wloHjto1GFxlXutIs1WZX5AR
TLSH
T1CA6523639CF340C7F62551B02AC77AA5ECBBB347594920BB8B50ED190B3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 b740eea539aa0cddcded13a561469a51ddb94219db8734dca788ce8a067298fd
MD5 bb5e34bb4e3edd3d554c9868a51f69b4
SHA1 cf413bd1537385358b38c8a521b7632be9ef05e8
SHA512 e42e96c3927fb0e5e1699306009ce42fb1fbb1d176deb024c5c57c0489b77f702756b1e067d52575c8cdbe36a47961129d8a041506561bc71a26c9749e427e30
SSDEEP 24576:UZM0zFVSO9oHjto1GFxlXutIs1WZX5AR:UZM0zfqT/M+w
TLSH
T18E8502A5B3A018F9EC67813DCD569916D5B37C1A0B60C65F03A43A2B1F373A01D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 78b3ede221cd157b898936499663f7f6fd19f0a1ce17805008ebae17aed98360
MD5 c755945aa29b2de17bc9079659f858c0
SHA1 28a908fa029e277390b1753710a2136dd5f775f7
SHA512 db0886c8ccd3ab193aa53ee863ad5ca5ef5c9335ba40af71faaf122b02fd32ee561627663cb94d88b66543a7a8b245b25aa891a3018f484bd2322d9ac74802e9
SSDEEP 12288:IGhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:IsoHjto1GFxlXutIs1WZX5AR
TLSH
T123652363ACF340C7F62551B029C76AA5ECBBB347194920BB8B54ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 229a22953e36d443005a7bfc6c9df99972e69a141b0544a6f1c924e27cd2f881
MD5 9cfd27230257ffe07c4d64ebd82324fd
SHA1 f1c463431543778f7ac759407a73798fe8f9f677
SHA512 58eaf4b6e0e0be443636cd6e8b39df76cd040bbec2e039c1c5cc9e6c83192e632b41dd030d3b00996bccca3821f902163b7850e9fa6a539f35a405b820b22666
SSDEEP 12288:nShKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:nYoHjto1GFxlXutIs1WZX5AR
TLSH
T1F76523639CF240C7F62551B02AC77AA5ECBBB347594920BB8B50ED190F3D0647E766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 324076f570a6c793593c77d549ce368c10cbbcbf2ea8c99532866e4f3c7d0d4b
MD5 e8fd593012fd8967a803915519ffb090
SHA1 97b13c390bb23ca5e65bbba377a539547b2b59fc
SHA512 e70b5d1c8df2af27658de2e413ae6d7cf69e33e72053d17eaf48dca7566be4cf723b5bc7a6fc3cc6494a8ff4694ad64ecf4b7f5a22383086ebc13fcdc037d456
SSDEEP 12288:ryPz5L8fhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:Gzy5oHjto1GFxlXutIs1WZX5AR
TLSH
T16A75021776F130F9D136927489931A11F777B43607245ABF57A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 e5170c414354c35ea2b98eb16295eaf88f8a9c1130a872e94d5d05c74bf10f8b
MD5 40a57c07ade7903474ea773c359e9319
SHA1 82ac6ae9ac783eb287025cb9142d4f4239034063
SHA512 bd213e2e1082f12d5d4a6a943ea4c1b823f988b12da4cb67a706b824a44587cd83359dc9c3e4598299c7631185126739085848d421c993e05a798128a9913776
SSDEEP 12288:sGhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:ssoHjto1GFxlXutIs1WZX5AR
TLSH
T15F652363ACF250C7F62551B029C76AA1ECBBB347594920BB8B40ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 f529cc663e70930a99f919efb0ea3bdffc38e26267589f2c7b59ee6f8fa51bfe
MD5 39af8fbfc50957605618500824df23a0
SHA1 2c6c2ebb1545eea3a65f638406385817c335f2f2
SHA512 118b74dccd48c68e1d785e9d5a2648bef442d45978390cf43e00f8d7f4613ea65e5910ebff46938b53205c2b8713ffe8ed2dab19d3f3a5d33ccd174aee1bab45
SSDEEP 12288:AGhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:AsoHjto1GFxlXutIs1WZX5AR
TLSH
T164652363ACF250C7F62551B02AC77AA5ECBBB347194920BB8B50ED190F3D0647E766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 310acae57f700a30fc2c7d1bb454f138af2ba2977be5f41fc2e80c8b4cea95d5
MD5 6df6a3299fe84432fbb8b42cca222cac
SHA1 e588a1ddf0aadcc60ed096fa6d77bdd9edd2d3d5
SHA512 6281e93963b37794eaa8c66f4a41ab13db490a3642e6e1d07586f11279e91a81a69a08a01f0c455c0a64d0f39856d6af7a2e4b78eedfd292be20332b2d4c6290
SSDEEP 12288:PyPz5L8fhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:izy5oHjto1GFxlXutIs1WZX5AR
TLSH
T1B275021776F130F9D136927489931A11F777B43607245ABF57A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 5448cb1db60e5341c936b3e4c5a420ee9077f70f4062b0ee2d2e149569482c3d
MD5 11014986b00375625326bba2eba2b710
SHA1 5d190c4ab9ee7eb2474f80cb9ea2b7075c4f0196
SHA512 98b56146e1b5d2c50474be7e0f6123d64c034510483fba9c5ac1a5c8edc8fa1c782e3445fdc8e4d242a656371512421bfa00232eba8ece5465fbdc5a30b87aad
SSDEEP 24576:2TNaLl3z0zDDoHjto1GFxlXutIs1WZX5AR:2TALlj7T/M+w
TLSH
T1D48502A5B3A018F9EC67813DCD569916D5B37C1A0B60C66F07A43A2B0F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 faa6cda3e665b7215396b567c945cc804728009196d89857fbfdb8e71e3fd184
MD5 0b02b82d16e0082e6b8d8e948dbc3d0b
SHA1 af1ea3b654fb274c6d3d97af85b3c2ef03873f1a
SHA512 842430c90709e31a155956adfa529621a8290c52b5223a6ea48459436c94f8f2dd7bbdd1220d5547a111bb0a14850b992b2cefeb4c35b5eb28af1695bf32b81b
SSDEEP 24576:h3pd9CHKy7GZ3oHjto1GFxlXutIs1WZX5AR:Rpd9CHKyaqT/M+w
TLSH
T1DE95CF90F3E410E9F0B79A348D765512DAB77C5A1B31DA8F03A4661A1F336D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 3f1c7f71eb7628fa302aa4f5ad45f1a22d8c8c3b91e203eebe04259eb1433ab6
MD5 9df3fabf096be3399fa8aec8a6d1bc75
SHA1 0513fcd922365621b9edaae24b8257ea0502f1dc
SHA512 231cfe718ec6e865dd37e57a4e4eb592c61dca7a4a81debc6b72aa3069630a3523a43bd4837117e56314f0f7fb8c64551935731e27c208ebf7803b87e45e88b5
SSDEEP 12288:j9hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:jzoHjto1GFxlXutIs1WZX5AR
TLSH
T11B652363ACF340C7F62551B029C77AA1ECBBB357594920BB8B50ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 f1608b8d8bb28292819bdb8098152fffbdb63aa54a9d94bc2a739b9772e8cb94
MD5 bd26bb25002c5732828b4a367c1eba6c
SHA1 e6614222e46e49ac2c4903fff56754b72d697b49
SHA512 ae92dfae063d3752e366ad7ae7df528c688efd1f331340c6a3c53362e14f5898e56c5dc2923075b7e8433eb965ece4eba2a094ad5cf6a64aa7c75430ca7e026a
SSDEEP 12288:w/hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:wZoHjto1GFxlXutIs1WZX5AR
TLSH
T1B86523639CF240D7F62951B029C76BA1ECBBB307594910BB8B50ED190F3D064BE766E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 8f23de8f607c505786ea648cdd838c65aed538086fdbbe2c2da4fcd76c51577f
MD5 339ca1834e9cff100bd41316dc2cd037
SHA1 cab5e7c9072f38f86584224cd2ffc130c7dc9aad
SHA512 f7015ab8f5012ca72499df3333a4b65d7c1d870f173903dd6d7673b7a29aaeb8d024efaf3d2a5c6c09c32f12b786ffa8fb58049af5b60875eb33f69b2e198cae
SSDEEP 12288:yYhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:yqoHjto1GFxlXutIs1WZX5AR
TLSH
T1C9652363ACF340C7F62551B02AC76AA5ECBBB347594920BB8B50ED190F3D0647E766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 0588438a89f389dbd17e1095c37117fac80e244001324dc59c3f966e07369fb4
MD5 10bbfcc794d0afa2e52ea2ff39f14e2e
SHA1 91faa4c21631126892be073c1613c8fd3dd15df2
SHA512 d6ed75d58a907f3bef9903a8c11b8dedf1aaec5a14e42ea2bb4a585912ee43eca9ba3f1a1b3d281ad3b9d67ceafb2d6ab63fe515c06a7b1b67df08c76fad217a
SSDEEP 12288:CGhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:CsoHjto1GFxlXutIs1WZX5AR
TLSH
T1E3652363ACF340C7F62551B02AC76AA5ECBBB347194920BB8B50ED190F3D0647A766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 bd6eafff41955ba7ac57e922a6bcad200403ef04738b462b36884ad1d1c8f3ec
MD5 b833117e2f75fa682e959374a213aca2
SHA1 ce5b8b08d436f3cfbed015216a37429f628e5b37
SHA512 acb1b9e0ee8a7ec486eedbb53e590c8477930685b8bf0c1ff1ee10d3a277706f3c3032356aa27b4950540a655f5d7fe92ae90510676099682fe9b82bd6c79c29
SSDEEP 12288:h9hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:hzoHjto1GFxlXutIs1WZX5AR
TLSH
T147652363ACF340C7F62551B029C76AA1ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 228aef006c47262ab521aaeea7a85df470e6f22d9098996057e3df300978f324
MD5 8c5d4e4e2fb9d0520f74c22ef02f05d4
SHA1 5f296ea00c2604aab77a520373b0f1a1513adffc
SHA512 498b40349f5fc98150b8fe6d06b365147932dec7713e64805a63f2522be3c3a31d1c276fb4905a7d8e959254e5e9a8cdf4fa453443d808d82103374c57261119
SSDEEP 24576:Wfwv+k9RX6wkyAIZoHjto1GFxlXutIs1WZX5AR:kMnYIyT/M+w
TLSH
T1F195D029EBD844E5E177913C9DB3460AF6B278591B31C2CF029A536D0E37ED46E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b8628aaf3951d9ef7bf16bf7daa7f3f2903c26be884a883f0e04401d2a7f8e8d
MD5 1d02f391274b2b4d61e106e47d6a23fd
SHA1 f9fddd7fd560884d10fc196300f85ca087b48f3b
SHA512 af285d75118a4c7b7d70be89e9af89da2390b99764cc08dcc8d85b4e0640593a774a776ab9692cc3581a7a428bf786932490f1575a20cb8498a0cf55bf2756c4
SSDEEP 49152:KYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0AT/M+w:kySzPSw
TLSH
T1C5066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fd02bf20998e58b6c66478390c8977d250b408d6b3ed759787b19df765aa9533
MD5 091ac754dad94f19abdbb8e7b6166dbf
SHA1 fc6784de16dc38d7df68aec4654c05b631c622f9
SHA512 988ea7bb6939e8826417be00a60448a2a08eb4498958c55276d0c92d0b35e9fb817bda2b814718fbe8ebe9d891730595f2620b31a4837cfe947da8d659866193
SSDEEP 24576:T47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYNoHjto1GFxlXutIs1WZX5AR:T47JUQj1irIhCnDHUPfF/wT/M+w
TLSH
T1E265AE1EA3EC01E5E1BA927885164A5AEA71742E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 76e1d651c490bb0d10db261fac970b7a18396f6333c0156b99ca75cc04dd6c8b
MD5 e6fb4fdf10f78e68ed9417afdf93c12b
SHA1 c9ec735d07111173eae7e38e761848a2dd945afc
SHA512 1f50db7e1e1d98bfc9fd42c55775e8aeb9fec2fae08f911705d3a120c681f2a6c4fcf8c27c84b162799e49aac68e9d9e55be9d5da7d56a972af6aa06c7aa990d
SSDEEP 12288:1zsfWhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:scoHjto1GFxlXutIs1WZX5AR
TLSH
T11675F11AD2A401D9D06E6174CB865A41F7337D2647E193DB57C0F93E0F3A190AEEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 d19423ced0357dc9fa0e0c3b911655297cc689658a67bedc57f766e11ea008cc
MD5 11fa12d59bf742f5a690a62a2a252df3
SHA1 ce994db20f087e41ba2f4ecf055fe938b84cd22a
SHA512 397de16b2aac4238c820fb54ea3fbd27405a5a81a19f61bcff07a9999042cd07f504efae495cb68e2d02d7197c1c546b49dc347961bf8d11241252f357553cf5
SSDEEP 12288:Wc/3aBqHPNvSoH1zAi8azVdd6hewFk6mwFltgROUV2X5T:WIaEPN/H1MBhtxmSqRJIF
TLSH
T1555518517626CB4FC6A980321E32D1CCAB707C41FE056F0773C98B3F9576A59BAE1682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 3ea648f904bd5eb483922e0435168fa098e3644bf6a5431015043b074dbf7866
MD5 89141a4d4c7ce908e5eb581ad8cb2921
SHA1 9e1317b66909a1efe3c07967a504842185786b90
SHA512 d9fb909449680408c296665ccfda2097668d4eb8859798a676ea7ada1cc2f1258e0da99c08fe2400593b58817e69bba1eb207b03b3d98e42943c8c863caff730
SSDEEP 3:OlH/laTWmJlcln32FGCH5vQ3mCllltq3mCllltGlslslslslslsl6oGCGt:KISmo3iGnmCtSmCtEEEEEEE
TLSH
T1F58192D88F098A60C107303A1021B7480330C08A78A287EB252F24535C8939D0C02A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 ce1d994a696e189c46f509eb94b3409dd58411ae62fc48aebd062895c5a9de62
MD5 eb555ad45f45f54cb2f8c01632abd43d
SHA1 b6974cd7f5ab799847e2e5d9008eb30a4cdffcbc
SHA512 48d620dada79196d5711101ef97545ab2aa7da8fbf9da8dd3fc0becc7a5d501b5adb398bfa658de091658b7429152835b44b53efda07009fa851ba0285fb6ecb
SSDEEP 12288:qqECjACkvA1EIm9RL+XvApmLptC9b6ur+q:1ECjARI1En6tRu
TLSH
T13055FA415136A78FD1FB6032033A5B8DBB64EC06B7495F26B389053ED86AB51B0F87C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 5f6ed2206cd11795869f90752097fce1899dc9924ca4b77e78984adbc6886222
MD5 2df9a4b29368323e1862f605b01cc83e
SHA1 917ca7d8bd6a01a5702349409f4734fea1e14a03
SHA512 edf69415c3c467e22ac91fff98ef1bf4721bb0fb8b4f5956afe514cfa88ccc5a34e547eb7f8916916dbccc234e1036387a87346a7df80f68e5ed8c817312829d
SSDEEP 12288:r+77hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYKN:uFoHjto1GFxlXutIs1WZX5ARnN
TLSH
T15D65236399F254C7F57961B029DBAA31BC7FB3160B4410FB9B40EE190E390E0AE766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 48ba6c5fc2373644abd14f89c6ffa1caea57edd4dc8d4dd0ae25ab1ac6b78f04
MD5 3d2aa7f11d6f4d288fc94ccc5110ee21
SHA1 72af3228df1caf93fb189767b19e8ea909968ec9
SHA512 bf785c581bf3d7eb203a268fa10538c1324ef8b1f8be6d00a310d4516c776db93f7c20fb6560496e8abf8b13b4ab044b9a794d2819fdfd2a179d429146673717
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYLoHjto1GFxlXutIs1WZX5AR:1gb4mBIBhGFVT/M+w
TLSH
T117659E1E22E802F5E1F9D2B89DAB4417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 2.0MB
SHA256 0347277dd38814aada438e6d714c2ac8ebcf229eb87762b16175b60c48e359e6
MD5 900df6592ce0814f4b297309ad569f55
SHA1 979ede1c01553bb1b2569a7e7144c6fb9a1b84ec
SHA512 8341cfc3e860fc5a59c72f7f4e273144db722a465624d1a2b7ac7fce6ab5bf3cfd0f1475c2a02cf135aa93073173973656c4fab04a105b301c73cd1733986028
SSDEEP 24576:y8kNvNnaFeYhJNtmZBmyoHjto1GFxlXutIs1WZX5ARjjvM3yReRdqmCAzxj884:y8MwBtOmLT/M+wVCyMRYmJzxj8Z
TLSH
T148A5E16EBAF405E4E1FAC6749E238512EA727461173293CB9390C13F0E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 9a37bc45ee0a2ca81d9262d1e578160978d34b75d9a0f45b3d3cf4edf42e1fe0
MD5 c23c494bfdb9d2fe3b8787173d52b28a
SHA1 b7b51834f46d4ce5992195d5b915fab487088e2e
SHA512 df47497f71ceafd7cdc1546900f709978a1aba68fd5dd136e067bb2e2097863289491ec904dbbba24273c74e1a7f0b08f8408b0a0dabb6bcbb86d898b72088fe
SSDEEP 12288:QfGbnyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:iGbQvM3yReRdqmCAzxj884
TLSH
T1DA05233EE2F53028E6709A3552604AD7F9B1742A5BA4FEDF9190B03D9F323E06935C49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 a768e41d21650c19e8f8f2c9481798e1d7a368c22e1ac18befa1343260fbffb5
MD5 c34060cce9b23d2b4dfdc94f983a0073
SHA1 ff6cee1e0b0d323e3b00c5df42c023f0bfee1d78
SHA512 a1f281d6446e99d34d3abc801a45ad4360d334ab6452f79e93b6a435886994249d367d393db90f5e1bee109b9d417db4e014b51c801faf8699b00b7b6520559c
SSDEEP 24576:VG88u8FpJqH1xzria7/mMoHjto1GFxlXutIs1WZX5AR:Y7ZFPqV4a7/cT/M+w
TLSH
T10295F16676E101F1D47BD13889874663F6B2B4250364EBEF0BA88F151F236E44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 d8b2ddf7962c457fa6908020c740de9c70ed3a945b18300373012c9e0cb22756
MD5 fbb5e13fe30072e29fbf3dae9383096e
SHA1 ad1af43545dbf7abeadbeb02152b33370da1c5e5
SHA512 a7cc3f4ae17d0e4d012f169d00f8f480a8ea30ca34f0c330e2eda55419ae5b6d3836dc3b0b8854cc6c050f711b4b497023b72b3451b449874551ffe7d135f35b
SSDEEP 12288:gHvUrBFrEjwaQKhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZXb:gPUr+NQwoHjto1GFxlXutIs1WZX5AR
TLSH
T16285E12F66E918E5E676A17C89838719F772B462071192DF02E0813E4F379E8BD3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 eb6ddad4c4f516329a051ba5f2169435e1e01b1a4a813210f8d5dc46a87fe54b
MD5 67c58188bfb4f502821c6fae2340325e
SHA1 40a38659f5775d1c46ce5bca1b7c0145ada18f02
SHA512 d7da9d3767cd28139b1c76e39a2290732838c4190738bf22cb5ae66ba5df30eabf29ab3db3239a040da6eb93e2c0bc0f8494618eb7e52aadb65c84339f4009d4
SSDEEP 49152:PBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBT/M+w:AG05lO43bsw
TLSH
T115D5CF6A62EC11F9D1BBC17CDAC74A0BEBB23415032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 60a8c6d88e85a9b058ace54d6b75d8c4e9f6900a49cba6694af6709f423673d6
MD5 19ee3fec9358edb773d8c1f06673b66a
SHA1 54239b65e2ff1bc8221ea04f27c3cfb2bfd83d38
SHA512 c5ed1eec137e9b664c3c34e0bc3e81724220d4626e622043de1a897fb4f7ebfacfd5c878f50ba0c4d2b1d7c93ed7f1b1bf4399fbf19a33b71cc7f7cf8c1f42c7
SSDEEP 24576:8fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnfoHjto1GFxlXutIs1WZX5AR:ka5POZ3+Jt2pasx2+myT/M+w
TLSH
T15065AF5EA6F801D5E579D17CC583461AF5B2342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 024bf53dc442a7a7d87f4a24e08b364911f1a4d187c672d8f6ee5b5aab7e417d
MD5 88380dee22b02db6145ed2fab80b8e12
SHA1 1b3d5eaaf5f9a13056cddb5a52b7ee0394f4bca5
SHA512 7f612d336abc40b57fac2b870ba98af4c22b0633b5fce507925b362e3720da0bc47f8830a595391074e1d16fbf148eb6a7d349e69f9bc569f97b2d5cfc5b06ba
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkEoHjto1GFxlXutIs1WZX5AR:pNc/zEOVHF8T/M+w
TLSH
T127858C2622E901E4F5BBE1BE89779546FA717865133086CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 baca72348644ffc01035d1ad2d2989ce661cd33914a17535b1df1a42b81ae557
MD5 ed5614242629b9a93f7e0ccd253b125f
SHA1 53a07655835812eddc66dabb4db7825510fc444b
SHA512 8a1b0c98ec70e0241da3ece2cb58597d9b54149af7a48847ebff0bc46e51b3f7a9e02cba3cb6b1301e6edf5f58fd40bb02e651f792605365b43297adf509f2eb
SSDEEP 12288:XdHck6j5ZI7jSyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:L6DIfHvM3yReRdqmCAzxj884
TLSH
T11A25126D63BA10B9D177E03E82830543D2B2B0759762AACF4694D07D5FB3ED8BD38A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 0c6a9475bd3c8e2d4a4b4eb0137b22063cb088524f9ae62e245e836fd3baefe6
MD5 2761b9515cfe8834f154972b537a2bd4
SHA1 aa901ae620a96d862ffc86e3b031abdf1a490bad
SHA512 49db786af4a24ab60bdb48a0b7e017c861c7c9216f6169677211744053620b56936104db1b41444155c387b46e23a81a633c03e381941e67595e110c5e531f2a
SSDEEP 24576:kDkNvNnaFeYhJNtmZBmyoHjto1GFxlXutIs1WZX5ARjjvM3yReRdqmCAzxj884:kDMwBtOmLT/M+wVCyMRYmJzxj8Z
TLSH
T18EA5E16EBAF445E4E1FAC6749E238512EA727461073293CB9390C13F0E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 b25bd855db0723a4284ed2e9531b514cce26f704467e0759884a1f2c571a0004
MD5 fcac158748efbaaeebd8c57d467de1a5
SHA1 c9db6f06e8c7180d874b9ab6dce5a6cd0357132d
SHA512 d46bbbbfec98e09d62f1124fc64dfe6401fa5880e394b77167bbc1b0c39f3086a9a3802d541524a5ba02fd33d5d924a6f27867bc347605158404b9300cdb5a17
SSDEEP 24576:pD3FHshBIYQgARoHjto1GFxlXutIs1WZX5AR:pDVHeBIAAKT/M+w
TLSH
T14A95F23EEAA900E4E57BD1BCDA538A06E77234A9032165DB06D0C1791F2BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1116-351-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/1116-137-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1116-136-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/1116-143-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2172-123-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2172-350-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2172-130-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2172-124-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2172-354-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2172-352-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2368-9-0x0000000002E60000-0x0000000002EE5000-memory.dmp

Download

memory/2368-77-0x0000000000400000-0x00000000006E4000-memory.dmp

Download

memory/2368-0-0x0000000000400000-0x00000000006E4000-memory.dmp

Download

memory/2368-1-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/2368-6-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/2368-7-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/2368-117-0x0000000003DF0000-0x0000000003E57000-memory.dmp

Download

memory/2368-112-0x0000000003DF0000-0x0000000003E57000-memory.dmp

Download

memory/2368-15-0x0000000002E60000-0x0000000002EE5000-memory.dmp

Download

memory/2368-168-0x0000000000400000-0x00000000006E4000-memory.dmp

Download

memory/2940-367-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2940-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2940-107-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2940-101-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2940-369-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2940-349-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3204-90-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3204-347-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3204-96-0x00000000009B0000-0x0000000000A17000-memory.dmp

Download

memory/3204-91-0x00000000009B0000-0x0000000000A17000-memory.dmp

Download

memory/3376-78-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3376-334-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3376-80-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3376-86-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3768-157-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3768-169-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3768-177-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3768-162-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3768-175-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4264-46-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/4264-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4264-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4264-53-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4264-59-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/4264-57-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4280-355-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4280-183-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4280-189-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4280-182-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4344-156-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4344-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4344-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4344-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5588-73-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5588-62-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/5588-67-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5588-317-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/5688-22-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5688-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5688-29-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5688-28-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5688-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download