55266e8028361bd8213c90063af158552196fe69e889415ec2a7211b36e87c01

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 2.1MB
Sample261030-becrmsvtas
SHA256 55266e8028361bd8213c90063af158552196fe69e889415ec2a7211b36e87c01
MD5 7feaeac7ed6f5a6c069c38448a70f88c
SHA1 63bd2188b0e1a384fa419d7a24cfc3085f50221c
SHA512 4e0c9eb2a4953a5c93c899a189743d49d60ea38be5cccca504a0bbf92d5c461b738282a27782c09a6c93e5b4d95a86f378c6feb140d79a35aaef3f96d9f86cda
SSDEEP 49152:F8SpvEhgOFKFQgBbbeMHfdVesRWjNSibOyyk5WQ/lFTjN4:a74QAfdVesRMhLm
TLSH
T1EBA55B1177E95A29F1FB2B31AEB841954A7B7C616F35C6CF13801A5E3930AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
39	4852	Process not Found

Executes dropped EXE 13 IoCs

pid	Process
5732	elevation_service.exe
700	elevation_service.exe
248	maintenanceservice.exe
4812	OSE.EXE
4564	PerceptionSimulationService.exe
4728	perfhost.exe
2848	ReFsDedupSvc.exe
4692	SensorDataService.exe
2796	ssh-agent.exe
2240	AgentService.exe
1404	SearchIndexer.exe
4568	Reader_sl.exe
4388	RdrServicesUpdater2_x86.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9305a6d8b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RdrServicesUpdater2_x86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Reader_sl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Reader_sl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RdrServicesUpdater2_x86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrServicesUpdater2_x86.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f951feb60a68dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000441f8d760a68dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009b5900770a68dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094f574760a68dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af7449b70a68dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb526e760a68dd01	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4388	RdrServicesUpdater2_x86.exe
4388	RdrServicesUpdater2_x86.exe
4388	RdrServicesUpdater2_x86.exe
4388	RdrServicesUpdater2_x86.exe
4388	RdrServicesUpdater2_x86.exe
4388	RdrServicesUpdater2_x86.exe
4388	RdrServicesUpdater2_x86.exe
4388	RdrServicesUpdater2_x86.exe
4388	RdrServicesUpdater2_x86.exe
4388	RdrServicesUpdater2_x86.exe
4388	RdrServicesUpdater2_x86.exe
4388	RdrServicesUpdater2_x86.exe
4388	RdrServicesUpdater2_x86.exe
4388	RdrServicesUpdater2_x86.exe
4388	RdrServicesUpdater2_x86.exe
4388	RdrServicesUpdater2_x86.exe
5732	elevation_service.exe
5732	elevation_service.exe
5732	elevation_service.exe
5732	elevation_service.exe
5732	elevation_service.exe
5732	elevation_service.exe
5732	elevation_service.exe
700	elevation_service.exe
700	elevation_service.exe
700	elevation_service.exe
700	elevation_service.exe
700	elevation_service.exe
700	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeBackupPrivilege	2848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2848	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2240	AgentService.exe
Token: 33	1404	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1404	SearchIndexer.exe
Token: SeDebugPrivilege	1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	5732	elevation_service.exe
Token: SeDebugPrivilege	700	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 3084	1404	SearchIndexer.exe	102
PID 1404 wrote to memory of 1544	1404	SearchIndexer.exe	103
PID 1404 wrote to memory of 6024	1404	SearchIndexer.exe	104
PID 1404 wrote to memory of 4160	1404	SearchIndexer.exe	105
PID 1252 wrote to memory of 4568	1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	106
PID 1252 wrote to memory of 4388	1252	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	108
PID 1404 wrote to memory of 1060	1404	SearchIndexer.exe	109
PID 1404 wrote to memory of 2644	1404	SearchIndexer.exe	110
PID 1404 wrote to memory of 5424	1404	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4568
- C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\4417\RdrServicesUpdater2_x86.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\4417\RdrServicesUpdater2_x86.exe" R32
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4388

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:700

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:248

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4812

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4564

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4728

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2848

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4692

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2796

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3084
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2744 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6024
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4160
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2744 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 1.3MB
SHA256 7743210b655d2907102e96023ced6b0ea257dd1028944764b04b477b1706c140
MD5 bc38f206be5f87280858bfab79053ef3
SHA1 13c95169d70ba74871fabb55260d0f71f258afcd
SHA512 c7285c0bd5c20cd795982beea37ea6e31968a7785902914a10a5050cde2857ef638ea7a3903dbc8db9248140376edb9de32dc19dbc9b32f08b50659e2930bb53
SSDEEP 12288:HF5XGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:l53nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1BC5523273B46EB53E91205B10C9287A5A3BFCD90BF9567D76744222E89BC3C019B734E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 84278e6d26a7a6c9f23add71aee3a17fbeb0cdf6e679e74ffd0143783c026b38
MD5 754491624ddd5d61679ae5ab504c12bd
SHA1 b1cba0289f853d8d669579f3a6ada9b8b874ca7b
SHA512 6ac0f2f18d0509310082a0053cdb1a1290ad6840ea1a0045eda763c8baa665dbd188019238e9c8b591bce36a140756a82e13cddb6f7238a565c55fc85eb88dbc
SSDEEP 49152:xSgouvAeFfenxyQTXS7uQ0NIdQ/lFTjN4:xS1uxaxnS7uhLm
TLSH
T127856A0267F94129F1F37B71EEB993645A777CA1AE39C50E5280025E0DB4A90DE72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 bed5535ce31668e122739fffd5dd69bb504023821378f4cd5fbe8a2bd9aca709
MD5 c0457084a3db9baea1f663a120f2b6e1
SHA1 b0e1625c6c0768402fe503e7b13c6b4821fee37f
SHA512 01a0dae1191de8abe57648e2fdbfe29c7d40c520dde8a9cb5f84d324b4856c0d476d0b9692f0f6d5d118fe882ebffa3058cefb82c8c917ad5ea532d8e2fe462b
SSDEEP 12288:l6dVWnxlMzn7nFKbltn+Ch/m6XLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0D:07TAbD+Ome7nQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1BE75E11037D0C036F1B329768ABFD724556DBDB15F6882CFA388162E5E706E0AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater2_x86.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\4417\RdrServicesUpdater2_x86.exe
Size 846KB
SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
MD5 a447c3cf3b7547e5a1e12dbb92d8c052
SHA1 d2b246eda6302534b21b2003719d9f911d0c77d3
SHA512 ce7446e337cc13a560a12b0b789813bfb5a96a6a9d25a8b3e2fc1ed884f0c4950f01937714614666befb9b92123d359b9597116e9ed9e8efd46b77a640d002ea
SSDEEP 24576:uSU4vrTQA/gK/c8DV5Wa1ZmPEKBLeiGA5nEJ:uP4j5gKU83W3FLeilVEJ
TLSH
T10C059E22EAD18073D563143102A66F368EBEB9310971D98FA3D41A4E5E705E1BB3F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5a8c0dfa8f7df2035946e0381e836edc292e628a686d50eabeee71528d940c42
MD5 bd553f2b856ff5b73e388513761ffec0
SHA1 a067a4647847f94323b35f21d73b8f3fe2545656
SHA512 7a4e8c9d48b044063b4ef320d0b7f00e0d021dffe14733662f590a279cd072b8df868298ff1a9031d6f0360dc7baae3d0b0b9c86878f7d5b1020c53545981847
SSDEEP 49152:Fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnxQ/lFTjN4:b3q6HjBtLm
TLSH
T1E0D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 e574e0a548b687554b9a64a68c048f4d3de4d9270eba22c1276b882d5163734b
MD5 136db8b7ccbe4ef063987563d85e8863
SHA1 c6c1b009c90387cf88f96cf97c85fe237fec875b
SHA512 bf4b8ba3e2e722e6c42ac10c9c4ce4388c30c0a5be5c93b682439de084cc0341bddb324b8163e3a19e65a5e54ae60d46335288999b4814eaa07b9c02b1a77fd0
SSDEEP 12288:F1XLsswWkxy2lRq2czAWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:LXYfDtczA2nQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1F465F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 9edf8ca5a55d1617fdbc66d851d4f7dd2abb7ff501b24d6ce66a1bec8f75509f
MD5 f072d929e7b9ec4d7b24d6f55bf44970
SHA1 748ec65b1974a96b8bdd0417513780657df35383
SHA512 15aa83806594f4e91974020eaed8e9b3cceb7e53f7f35ac486b6ec54482004dd87946f330c62eeac4c97b1faff919b0b6b6902aa9afecc1c659f5441c42a741e
SSDEEP 24576:60Le5ji0hmxLrM5nQ/tbw/2Mkjy6Fr7g0ot:6Pji0Al0Q/lFTjN4
TLSH
T147859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 044d19b52cef6a62617d55d580a18d8ff974aa62648247d6a81044395d098f25
MD5 5f15bfa7bd59455f9116070ac5cf7ad9
SHA1 8878cbd4934793a063224429a60977ca4afb5c9f
SHA512 017e9e5def7255967bf93e44cb93f5d0a1e72427b0920130661e80a4b2c816461395fe942eefe66fa6483146c1f569d423b420e85591f2e79c9ef6e3a5fe1d9c
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWE6q8wyuDnQ/tbw/2Mkjy6Fr7g0o3:U/ezSC6vUzPvxHjy4Q/lFTjN4
TLSH
T167755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2ec104f48957e29163d2f5cab508aa31d45714bd5369df4bb07ca2d03fa8ee75
MD5 1c8d0834060b26046d758dc9ca29751b
SHA1 19cf85827cae66350f6c3112c5c6757001bd751d
SHA512 ff675a493511e6ac355c95875c6cc8f6d00f5dc2c827d60a2b609461b89cd599b30795766815287dd5441c5d926f89efab1fa894227acfc79174e3b14dfda91b
SSDEEP 24576:BVbqPb88hv/l+6ynQ/tbw/2Mkjy6Fr7g0oc:BVO88hXl+dQ/lFTjN4
TLSH
T10A559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 171f2f99f83f888c33af5d1fc744e9fad8811b458053a0e939b63ef85833afbc
MD5 a1002a3dd26617cfab093107d5f54a9c
SHA1 3e1ae659da9e4be595040069558fa58158ca88e3
SHA512 8b7dbf169359b1be518d85f0231b510f43017e346b08be31e2ead60ea89fd300995f2e75927358c8697f50c1c229898266858499aed044ae8109b5aeb75412b4
SSDEEP 12288:Vz1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:VzVnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T16F5523796A24F897FF2B06B15CC284826B3B0EC1BFD4A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 fa20d86aba807cd9ccd23178058097cad5a3d3a7b3b8540483a360bc6facad97
MD5 68ba67ff26f793b43f16ec5de25af662
SHA1 72d708a719694ded7e39df129cec0e0b125aed73
SHA512 94488f83a3e63b92637785da2e8e9ac4fb138f8a55f9f01d89e256bfcc619795b467f1e124552438d78fbf8f57bddd1b55f5a1d5673b524a661a2ac8d3d8c2a9
SSDEEP 12288:seBNUbTVO86UaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:sJIUanQ/tbw/2Mkjy6Fr7g0oc
TLSH
T19875CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f47e41c7b722871c9b2108cd303726a5e3e25a5d856524688842aa53e872e6ca
MD5 ea44cfc463ec589046ce13f2d09a4024
SHA1 09417f6796c629fa3fc249858ef343b1d5475148
SHA512 7a07f4bb10bf462417f029dc2f676c37835b356d120f265bc4436a9bc19934274197f8cc132c737e6db779eeb612cd3535067da716d4da1c1807c352d693d163
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THg:1QvGAdlCEL8c/yRNw5C4Lm
TLSH
T121267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 2feddebb975991f72bc94baec6d6856fe7e75bc775d42039a2326bed20097471
MD5 3310241dded8e67a367eb7c2c7e3128d
SHA1 d74468353df9a7dab34c2fac43d2cc96868971de
SHA512 0ac40622bd9e6e430482e636ccec149c98f982d14fd81d3a6b5ba254badb2514f1de0a62a367572320fe417ed664174ff7f9ef0e60b032dca0c72622bc15bba8
SSDEEP 12288:5AwSfxL/2Dc39DLLmt0LDQewsAjkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgD:qQewsAjEnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T12075E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2e086a4ea80084a327627436192b6d2806a1de326724ece0f8f5f5da65e7fc7f
MD5 5091a2b26575afa9d9c68a827f7b5d98
SHA1 c4c33c8a58097dcb8ae16ddd946370d048c174a5
SHA512 86d049556a9434e44861cb1066d7172217d887c0f859cfbcab7cfda45d2b7a792dfe829e7ab7c26dca3c1013e9df40b1f8cc0dccd2ec33cd6f8655dea5760cd3
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHfL:/UEtQevvqc2W1cpV2EI32
TLSH
T1FF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 be53f1fe051fa2d29ef810f51c44ed0a842060cc64d598822c9af4053816d773
MD5 45760cb4aa5097835ba1f5c16407026f
SHA1 8f1d071d758e2697745bf10e056f8f52b41c9bec
SHA512 7e70c42c7f0505ad5e86f36f6e08f9732ba1af705eda04e012d052cf478492ac0fdf10aeb7f60a86ea5a261e611c7e3fcbfe267949b1d674d1b33da0e3f1fed8
SSDEEP 49152:0CbRquA/m2yL5zQfFiV+XenmE3/zkQ/lFTjN4:doqtVjnmMLm
TLSH
T172D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a00bfad9755528ba1ac5eb2c2b64cde41f9e285c51cb6a32416e5172018e4bf9
MD5 0fb8c2c308d9032bf928eb47c01183d4
SHA1 69c8610f034c0d56d8d06dd106b7ead0b6a1173b
SHA512 224f8fd4b76c703f4eaa4b042a3b64b4aebfbd050f2ee927355deb033f09c214412e969a52d048a09ab044f2fa762f72fb68fec6fe140d933ccd6ed9764b1a23
SSDEEP 24576:YAhGLJIFoiwtA5l7S53HnQ/tbw/2Mkjy6Fr7g0oW:YAMyFoiq53Q/lFTjN4
TLSH
T1D335AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 6e9f9b963f6c12343a7bcd8462289a3f5bf82a14a5f893f1aa155156700aceb8
MD5 73b331ed38ced05c931c749033eb586e
SHA1 86a63c409dfb6e17be62a9cc90a1b0bb6fb487c2
SHA512 518b90ddec90bb836d151afa04ea721df6a4a2ab2c37fbe095339548830c8552d661a9531f1521b6123675b2214d9836723bd8a4e325c68a7719e343da1fd059
SSDEEP 12288:+mw5HEjsChN2BFgl0WDm+CzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMr:XwuHOWYnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1FB65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 24c823de37e1eaf0af0102706465e914a88c7052812fda7876ff31e65b516f66
MD5 93aae37a6592d0207dde71933a4d183e
SHA1 17998d54e25049c3d280ba8d40f4cfa410a5f103
SHA512 f3ba1a79529f85872de6e8a98dfbcba54354707b64a1a5ca10b50d32ef191e63c62a780ca61c38e69723a5e364fd9737b2c83aa00483817b0f36a268eea716ed
SSDEEP 12288:mXZ1Iy0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:2ZuBnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T19F55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2507029884ebe3f738d37a3fceec1fb52683c0b9ae6df299021eec525524ed90
MD5 144c500f5368e1968bd3956cc347dab1
SHA1 25d5ab5cbe962bd43c6175aa0a9b2f733b2d0439
SHA512 02ef2d708f796507af569efb1a8d34f29cfec53afb041ed4928dff245269dff5a77c5dbdc9a3b953a9d1c9635e7a643180a473c6f5605cea90e56f5b6e03e652
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:+QRQyi36YOcPQLvw2gAf+PN35Lm
TLSH
T1A0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 716842b64e1846162ea2289fe73ffbc1005f16dc9f0227b835520a868bc7b8b2
MD5 caa739386e23b229fd0e4f3decf88cbe
SHA1 fd40f0eedc54587677a5ed5fe28629cff102c5ff
SHA512 89ecbe2e32ce031e743825e5984dde89f49720576f8ca88bfdbecd7b844e3bd783142f6f297226dc5b32668744392be6cd00b26862cebace8976a6c009ecec3d
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:XQRQyi36YOcPQLvw2gAf+PN35Lm
TLSH
T149667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 59719445b69074985ee413367b24c3235f4c07d49214182fe67fc57341dd52e7
MD5 6fe1a41720ce81ecc7679cc4e390308b
SHA1 932efb7590cf23403d78e3188e8296b915709a5c
SHA512 fe71b2741c09881417f24ba1169d1b5056af245328235f1d68504bb0249ce4957d550ab73cfc0b4f790aadd04c88bb4d21c5792c0a11a98d9b4ddf7416939b11
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0xnQ/tbw/2Mkjy6z:w68Qg55nhheWu7PNU3/0Q/lFTjN4
TLSH
T147B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 12cb5671088299034f15193aa6173b8acd6be0553a82c3cc82aff9086ece998a
MD5 0b43c65d1030d65b0f295ca91be0ca7d
SHA1 0099b7a20ca6c5b1a2ff680faf1d301f6e3a78fd
SHA512 9e3cd8ae1726b45bebb4f012fe4dd5629c81fdf3dec526ca9afa4a31e0ecf1cc991351e18bfd823dc9ce075da11df43f5dab048a290828d8181acb9172577075
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99K:Qy5112gYy5azzVvL69nLKnhZ6Lm
TLSH
T1EC167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c4d79eed530222f5139b2a53ebdffd233aaa638bc3c9a8a8248bcebfc328111c
MD5 01ac037762a03b8636f538d27fa6dd4a
SHA1 089a0b40946446ebec0d68b62ec989b385c034bf
SHA512 b4aafa28f3c83517c5dfad2e47910381545fc79fee2d23dad0e5436273c55802cbb9448473e3e3f3c94b943869a87b8606d4b1efac4dff2fc614140e8da802a9
SSDEEP 49152:eB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glmQ/lFTjN4:Mu6JmVxd2dxLm
TLSH
T170D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c58fd9466f31ecdf511c5b2dbb28d62088e1b87ac91d27783fe4aad71353ced0
MD5 3d6891b82d5c025567a3403608bd154c
SHA1 32424c50d124ebd4cd3b8bb089bb824b6319e579
SHA512 7a1585178d1bdcb05401010f6d0290731fb349cda1b578c2ed5ab12eaab69ba4fdf979d9978c628567a8fb613bffb5aa9b99ffd3d3d2db3ee21fdb9e19ede247
SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4x6Q/lFTjN4:nmifPbRMLm
TLSH
T101B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8b4578e932b97624f0052f5e4988a9bdd7e434c7ab6dbe4ad8b7615fddf949f6
MD5 7d004808f57aeee6f65e405a426eb973
SHA1 86d246e707bc894c567415e16c1e02fdd07e3d94
SHA512 ce0db59960b5850ac965f940990d3846d2fea7262d4b711fab420d76b9f30222792837e3a12d1795557c8dd231a75b0353f9337c4f5c16b05ec7343ad0083034
SSDEEP 49152:8SuZQIY0Be2KRRVtOnks6NMHqBQ/lFTjN4:+5dKTi61mLm
TLSH
T1BAC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bd43e782bb069e4b0ee9246f3b7875779062e7f019cdaa4ea20cfe3a70025d74
MD5 a8159d0ed9eeb143e4feeeb5863a2eb6
SHA1 43bddf46eab8eef877b16d8bee012364b22fb825
SHA512 91eb855c8f39ed5d082eaee38d771f9492bed05c7c84bc09ca4c4d84a4ed7d66684a2bc45676474adc480bb72d2efed5d206abaa0063c24c8641ec1af4359fcf
SSDEEP 49152:zhtSn8EApI0figngiDn0AP5w2Q/lFTjN4:yX2iyphgLm
TLSH
T12695BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 22eefdbbf309f6e7ee1b09960518fada78a809b52c9babf85e3fd7cf5a1cdc3a
MD5 4bec513c329bfe229f02800abbd6e3b4
SHA1 5e866729ee9274145fd85cf39de26c54be80f8f2
SHA512 41ddfd646623723cdcf63393e9f6919957c3fd48d1f4ab04f1fa3a9103ed282987f466f7b50e260966766a42fed21177f35482c6bd9f384d94f8a2ce2ff71a42
SSDEEP 12288:V9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:VdnQ/tbw/2Mkjy6Fr7g0om
TLSH
T11A5523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3632cc84b3cdacbb1cc1083b6b3900ef1bbc693cd4b711842b0ba5ed853e69cc
MD5 4303b3b98807977ea1468c55a15a6938
SHA1 77a851d67887e51c5a28b06b7b8be1d8001445ad
SHA512 07981b78a8e66ec82eaf0f08d60b998e85b442b3aaf4cc5dbfc2a8160d3c6be5a45ea77d5507b9ec9480eb80fe966d12f1059e3f7dff61bad5e71cdc030f68cf
SSDEEP 12288:XwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:XQnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1525523797965F98BFB1706F14C828182A73B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 090c241609f1070018d8624c7ddd1c0c0413e703d413cfd1ac3b667486c10166
MD5 e2c2ee307d7c15db218db25c76a17b7b
SHA1 0632a2cad71b2ab97fecc82b17ef537c27a3d24c
SHA512 2835e208981d4c16b5321f38e8cac76cd12675154366be9d2c454cba8747257496b477d26032bcae04dd08f436f7df2ac560dc291e02c8567f0250c414a48613
SSDEEP 12288:miGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:minQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1FD5523697965F98BFB1706F14C828182AB3B0DC6BFD1938F7B4C2128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 fc0222f991d18c8991e140f14635392ff0996529eb1cb11d0d8e2bcb4b851349
MD5 07961b6984f39fbc0cbfe5e763e1f96d
SHA1 85b245bd76c07e51ec55d18dbf0cbbd5254800c6
SHA512 b1189d0ab9f6e6fcc4915167ac37b2936043ec07bf11fa3d46906298ed5bbff61b4b0c2cbac71ff544fb16d7bc34d4295cf79f1d8bf8a6c1d47c3f010fef34fd
SSDEEP 12288:AVHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:qnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1AF5523693A69F4C7FD2742B4CC928142E77B3DC5BBB1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8d3a7b42d4c0191e2a32b8a2228750c0d2df7b9c66dc0b4fc068dfb97d7ea765
MD5 ed3d4cee725739cf496c5f06951310b8
SHA1 c4d1e6713a0ce40384e118336a9717348f443098
SHA512 250ef6b392803c1f16aca4d9e7d51d5854830c44762a07ff3e38bbcb893f7da7ff92424d82f3120e89e720c50859fc8d5063702b1ad60e1939e8217078556145
SSDEEP 12288:6/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:6fnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T13F5523697965F98BFA1706F14C838182A73B0DC6BFD1938F7B4C2128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 78d3372a75278af1dd3da849e64f27bdb5a5c748c9ea12a2a2af0c166a4a428f
MD5 fccbae9e7c0fa568f7c6653820805ff9
SHA1 5cea4a131b598da89c5d7fa1d73ec88dcb673493
SHA512 7424040dec8319b3d0171b2d9bc0aae9eff7c60ddf7cfdcee5a7db3f1cbe92e52f5791b29732687ca8b5a55163893721cb114062f78ca0af223663aff27420d6
SSDEEP 12288:uMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:uMnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1A95523697965F98BFB1706F14C828182A73B0EC6BFD1938F7B4C2129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 01b2e5849c54aa841918f88ad1338e754f883a0fc74362e09188205619c30cdb
MD5 3bb8c9fc1fc9bcebfcc35cc410451b9f
SHA1 c65db7712c3422e02762ed4ebff03cbae3e5aaa1
SHA512 b259f2fdce6d05f4eddb27ee1e35bc0c8a44d82d81f1be1313d19430fbf5bced9f10bc10a8349e9c2d1e5f41e01e535e44383a0cff6321d49263d8a987313451
SSDEEP 12288:0IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:0InQ/tbw/2Mkjy6Fr7g0oR
TLSH
T13A5523797965F98BFB2702F14C828182973B0EC6BFD1A38F7B481128967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 f3be46dc468e20a3a146bc0d73cb0b335d81970705df9ed1c9043df72a8e14aa
MD5 650d426666395540c0090b88141f2783
SHA1 1d9e3bcd7fca2d0cd51154172d5f11ccd5066d03
SHA512 834f73db4b79a87df67109131e49fd2a111a7b2a55c58df73272b3b62198af00b84d244f5becf5e2fa0acdb8a263c53fbc1e0e8c763be3e2e0253512b31359b8
SSDEEP 12288:BiZwbDzzFEoS2cPvyQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:EZM3zFVSOwnQ/tbw/2Mkjy6Fr7g0og
TLSH
T13A7501A5B39058F9EC67423ECC518906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 11d24b0829bf09d17391c691356bf2517bf9d0d2376f83df0e1022ca802a2546
MD5 fc53a25b148fdbac86712a0c8e7e0249
SHA1 aa7e0a11a2fdcc07355d73707c4cf2e203054d2e
SHA512 06d343c8d38f2dbac228f8eefd0cb689f780cbdcf8a6efa221dc9a6c955167779c1d706f86838e854713f2486b91082ddccb4be1cb7d982c7a86d0672e1c0060
SSDEEP 12288:MBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:MRnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1E75523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 cec57fc380e093ae8eddc786b2eb9fb7f91381237db0e0fd6069a3122cbb1081
MD5 b3d9f7a8334c6886d2be099ad20111f9
SHA1 8f1bfcdea41ec3090751dad5bc2ed2d6c6ff5fec
SHA512 2be04692d0ba8d6fa5c639227f498c6341f823fe3c290ede5ddc4b8f608b9d221de1b17a0de15025fef9d936516e138918fed8477bc22f33fcf8552162af7eb4
SSDEEP 12288:CFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:ClnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1DE5523697965F98BFB1706F1488281829B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 ea429e163d03dfa3ab5105c105e5c39f58c92ef5d69883ab9aa91cdedfe0cbb0
MD5 2ddc294faa232f068e487da5b765e861
SHA1 69e1bda7b63560fb3608b5183db2bacaeec94acc
SHA512 887e854e1011ad7260dc5956f7a9d73fbf3d15870c5571d8b7440aa8db4248f9c4a9cfe7fd5db3e0789b96a5e461aef0cb9ad6500465b762414e607e21aea0c2
SSDEEP 12288:6yPz5L80GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:nzyUnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T16865021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2f3740193830e3d2d4757baf8699d7f58c7cba0015ccd46ca24991e22632ab6b
MD5 afe4ce28a6223a0c634b70f8ae589987
SHA1 8dc94e9de7e5c18b8e4d678a22c345c32b036bec
SHA512 a672f4c0841304e8e45582f0aa4b0e98521843ec03046286cf7c9b96d44ea337aaa041a07673c7d7791563a725721f1f452bd3ee35e8d60f081023f5d0eda7df
SSDEEP 12288:TBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:TRnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1745523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 dcad36b073727b715b51b7a95d3855fa3654a5dc46fab6b355767bed4aeeb186
MD5 686a282658cdbe256de423afbda601bd
SHA1 2c845032daeabd826714fabc6472be7935898939
SHA512 36c4ac3e2b16cf6a0573ced183bb3f2aeb9d9c2989c33e5a79f227e8d9b01488a6ceb587c4a937401ce6becd3013ce8e86bc2f471d7ce76e275ce110a86ded7c
SSDEEP 12288:JBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:JRnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1B55523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 596a806cfa70d2ce6f07a3be9ca36f510ded92b6d54b0c877a98ce3015397163
MD5 4a8a720f4e64480496e27d891bca9818
SHA1 be97ab00246d2e857af4a451cee2e74246426785
SHA512 d289c312f3493d32e02ca2b5ebf5f669599993ce7bb933adb42cb08d6e26f14bfe01a1bbc4116207f9a641b18b76f2bd4d81a708f9d00ad3c9812f6319b77204
SSDEEP 12288:WyPz5L80GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:rzyUnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T19965021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 6c24c2c4ce49b51db3dede2e710a5c44a24de8189233149552c7beb53695b4ed
MD5 a34ce3e8f5d811299aebca8045d19366
SHA1 e0a2a7205627297fb94b7adc5e545432ccb3c2b7
SHA512 7c02657baba0954b7154df1a516a2f80625af91642ce9ed8bdbde56655405bd242c45392e8abc78d2232d05f68c7a27c04778e026bc108d1c997bd3912d90265
SSDEEP 24576:pT0aLl3z0zDSnQ/tbw/2Mkjy6Fr7g0oL:pTDLljDQ/lFTjN4
TLSH
T1A07501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 3cfae71c985087b3b3186c4913faf607e2dbbd7a87fb016ac6d26528f328b781
MD5 86aa1d9e5f77dc7dc0d77b4707ee9889
SHA1 f7c1dc61361854ee8f8a02ed49dec4d4aeb0b83b
SHA512 6f3b6252ca8b71bb328f443f127841782e3cedf2768fe2f0c361149807b67a85a9ac1e04ba827e874cc36056f3bb48b3dc80b7fee9eb67dddb2d8a6db1636a96
SSDEEP 24576:031d9CHKy7GZ+nQ/tbw/2Mkjy6Fr7g0oQ:+1d9CHKyacQ/lFTjN4
TLSH
T12985CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8a6f06a42c97fe8afab978c847ae83a07c59937848618ace8ff746d3d7f9ef7d
MD5 f7f5ef5c2dcec5161d6b3461f740181a
SHA1 d71d38a11a7279c106e252d3317786e0fa4f0bf7
SHA512 08ef0270af5a34963d4c45227cd774247f61523aa5dae4180b9078285f722ae71a84bffaceb7acf88feb0da04b70439de5c5a725df19917247d9d7101832a4d3
SSDEEP 12288:fCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:fCnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1FD5523697965F98BFB1706F14C828182AB3B0DC6BFD1938F7B4C2128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f825d42ba1d21f023a69d728b69c0089c977bd21a1aae2e2223bdee665e20da9
MD5 1320e2603d65be36987988393daec5e0
SHA1 94ed865a67fa6c93caf0eae1d87f781cf4dc6d1c
SHA512 6609f55bfeef847759bbc3667478a3530e923beee520f0b5d78211fd049633ef57cc0fb74b91305ec9b193def29295c67483b65ef431d45594c1b66ecccdcd5e
SSDEEP 12288:LUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:L0nQ/tbw/2Mkjy6Fr7g0oL
TLSH
T16E5523787964F99BFA1B06F15C828182A73B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7e16adc02d0fbe70c55585aebb6d42bad290649f913f0e8f9e0a922dd6746fd7
MD5 2d8cecad204c4c3d631cdb9c9193f942
SHA1 ead7c7b49659cc6198c05bf0460142556c7e78ca
SHA512 71e54cbc9f5423ead6b3e5a3c02ebe396878f67791ddc66bda313d763d888f74ad52cb658d445ccc070dd4cfc6f33d5eebf00410974001ac95d6792455674ef7
SSDEEP 12288:eLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:e7nQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1445523697965F98BFB1706F1488281829B3F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 72f6715473599b3870a05ec2c4962d1db628e857a7a007aef668f51b65916c90
MD5 6c475dc0882b70934fe116aabbc7e84e
SHA1 6c157f5a4abf702fb6111ddb727338cd326a2d94
SHA512 49e217d4226c182c2afa22b74df921b37fbb1f65eaf78854399bd482998d4cb78fbeae93b30168d60a59b0521d49ea4811159d1cb424dd35abe74d2023898646
SSDEEP 24576:Gfwv/k9RX6wkyAI1nQ/tbw/2Mkjy6Fr7g0og:dMnYI1Q/lFTjN4
TLSH
T14985DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7e48457f3f3d90f0758c20762be4d55f46187ac0d791d41b6fda28d13ad306ac
MD5 5ba9f6b8e91c8e71b720d85a05ea0c80
SHA1 2b6cbdc3f69832d786355201db5fa8d5b2a0ad96
SHA512 fa0df516543c4e4ef919d143fcb32898a47eaccb200dacc8c4283900478981089e7b654072ae4005c0cb65f5d7ecfa3f35ef1f51420a1ad362c210cb17ccc73d
SSDEEP 49152:nYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WQ/lFTjN4:DySzPZLm
TLSH
T1EC066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cae751d308114feaa1703477950a10c528b12cbcb6e94f3aebbdd0fade0c9426
MD5 4f09b10ba95a55eb7bc2d988ad2ac212
SHA1 d3941ca023a0c73273dfc3f7eaacf0d8ae5ba7db
SHA512 13d67b7588a5826cb0cd620780efd6045b8bd2182ed0d18f8064d278fa962bdc7f928c734ae592f2eb35629165072a3562b53246025782e8a5ba62a9bc39baf0
SSDEEP 24576:k47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYAnQ/tbw/2Mkjy6Fr7g0oi:k47JUQj1irIhCnDHUPfF/mQ/lFTjN4
TLSH
T12465AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b5193b5dcb5cf16a4552befd6f6379d5847e89fcf981ebdd0f46dd0d671e33b0
MD5 6ff193d65479120f21f8aaeff92d42fd
SHA1 532af5a1a2127b5a06a2f1f03727f597127553b8
SHA512 ba60ef8c46a1670bd6e1f0b6381a0d755937336515a034c191939ff2feac779a3b73f3be3228bf0b601c5f15e1cfb5c984a2028597ed3f7272dd99dfff434c22
SSDEEP 12288:assfxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:cBnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T12665F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 bc16da951bf08addac59c4d36fbe67f409f3b52709359450f1370dc0d6979787
MD5 f057d48232137cc7585f26586706a1ea
SHA1 4d167d367d8c86b83ec89b74d3a5e3851ae6156c
SHA512 152200d2a0c95b5c72241c129e2f168489697521994c28c11ef19271ad2129632167bb2fe1c5ee466d70f457e4a3fa5c7957eff2c8a659be8560bad936515d40
SSDEEP 12288:GOyg/Re4mwQtaV6abEH07kmwShjK2/iG:GURe/aXRgmwIjK2q
TLSH
T1C13517107666DB4FC66940325E37D1CCAB707D02EE45AB0772C98B3FC576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 b7aa40c2634988f04fb7379816441305c4482ff8e64021a024d31576caa42f1e
MD5 d14918bc281abf77060d0c303d8a4c4a
SHA1 7b49186d69955a45dd65f3efbd8f64c122cceee0
SHA512 51b65816d96e0120097d1741a9a4b5b90e8525fb77082f7ccb688efe3981d71beee538d6767e755676b196835e0f00eefcfcccd603848ab80b16d5eca87581a5
SSDEEP 6144:O77ioForktlkTnEIAtI6/EwTfPbtXEaSRnNyny1xytMxA8ytMxA24A2ziuqriL1l:O77RCOfPbtXEaSRnNyny1Vc1fOk
TLSH
T10565F781A137E7CFC1BA6032072A5B4C6B64AC17B7085F26B3C5493ED86AB5570F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReportUpdaterPolicy[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2T8DCGKW\ReportUpdaterPolicy[1].txt
Size 4B
SHA256 69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820
MD5 455831477b82574f6bf871193f2f761d
SHA1 f44217a81173869e08671753c52553646ff5d95b
SHA512 cbc0ee58e447428bdcf72fc8b03c8cfb086edbb14205b918e75ebeff1d85ff1dd254e9dcb387afbd3fa766c803937c306e0a2a79870c0d87abcb7ab93661cf85
MD5 SHA1 SHA512

Submit Download

Rdr324371.txt

Path C:\Users\Admin\AppData\Local\Temp\Rdr324371.txt
Size 13B
SHA256 b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
MD5 c83301425b2ad1d496473a5ff3d9ecca
SHA1 941efb7368e46b27b937d34b07fc4d41da01b002
SHA512 83bafe4c888008afdd1b72c028c7f50dee651ca9e7d8e1b332e0bf3aa1315884155a1458a304f6e5c5627e714bf5a855a8b8d7db3f4eb2bb2789fe2f8f6a1d83
MD5 SHA1 SHA512

Submit Download

Tmp4107.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp4107.tmp
Size 5KB
SHA256 b2e41f3d236f5418f702111b610f382663c8893d82d5284462d2133f0e0c0fdf
MD5 38c0245547bc1440fb56c7308c2bb222
SHA1 8ccf6f27b9644fad1c8f13d98e9d680154c8d572
SHA512 78da2e84d0ebb47faec6999320198da63e02f8653a0b0609a16675592ff26b2ecc8de6a3210c31e28b72d6ee340dcdd792207cba96e1ae92b72c07d1d9fec897
SSDEEP 96:HX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yJF46R:3ULc8pq8RuwdmL4pUQrNyH4o
TLSH
T14FC13BA388946C45EC27ED00B4C89A23EDF576591DC0D1C33248C2A58B923973BDE2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp5905.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp5905.tmp
Size 5KB
SHA256 512146b59d21f56f01882290e8b1e93e0553b85435b4d31e4c51d3d9ccd14df5
MD5 8de699a7d8a071e752e129d70525fcc8
SHA1 da6fcbafb68dd579195ff775afcf64f4209ef52a
SHA512 43697eaa55d5b7ca68036110d2bd12e01f6fc45fc7e3d4baf99b1de506170707a4eb801d6460dfcdf491fd58bafa3c93b8aeb5e2b36435e5249a2d7fe6a30be5
SSDEEP 96:PX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yh54pD3D:fULc8pq8RuwdmL4pUQrNyh54pzD
TLSH
T1F8C12CA349907C45ED17ED00B4D8A923FDF2B6952DC1D0C36258C5A58B823973BDE5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp60A7.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp60A7.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp94AA.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp94AA.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9305a6d8b68fd3f0.bin

Path C:\Users\Admin\AppData\Roaming\9305a6d8b68fd3f0.bin
Size 12KB
SHA256 d086d6213c35cff64b7335c05188c25ab178db8e9a9634f3e0254f736d65dd4d
MD5 a21739f9eb806a5624536e92fcfb34cb
SHA1 cf6d8d68944f06ab66bd76fd919c22b49de22dd9
SHA512 e291ff6b276899a9ce12155287a6ae12ee848ad65199a1ccbf49ccb7e8c1b08d0d157b3287a24082b823594e81510168d709ae7feaa81f56e0f244186d912d8c
SSDEEP 192:SFvr12iQ7viFB3WsGUMpZ+macrfqc2Io77eWT7ivqNiNfV7ZV5jWjnZrk:CVzbkZnrfqc4uWKS095ZVeZrk
TLSH
T1D442C0A02E89AD327C7C44C2D5B5C63E61C1DF735E77D394E8C44160EA962268FAAA90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0d129c800072d49dcd900a36d5f9f8a388d7e0d1a6419c5fef3adc32ad3deb4e
MD5 be3d7d1618636c387855b87559c6d3a9
SHA1 59390f18df61e7b4d3dd6386cacf0f6a593c3d50
SHA512 12b694ef45571d94274ff87f012e3fa52c327ba6a4a7fca99b7c94aef4f70a9418c557bcf377a91e2546ef5acba04355679905ac4be6250bb0c99a7fe03763ea
SSDEEP 12288:267JGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:5ZnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1E55523796668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 627f305c4f69b57e0dfe531a6b373718c726dd2f076313f59a79b948c4700215
MD5 660d0403d7f15fe3965f9a752867887e
SHA1 83c41a547ad6a50653ff385257524e6026c69729
SHA512 5140a4397e8a5faaa767d98a967228fa7494d7fb291b9831b0af5458f5299c3fa36325bcc61243fc734d5c3aacd2ac5168677fe9c63dd4f62214890a4984e831
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYDnQ/tbw/2Mkjy6Fr7g0op:ygb4mBIBhGFAQ/lFTjN4
TLSH
T19D65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 ee5d788fe6a0142062e596658f3f14ab461c454d4f1d50a20c57476403a3e031
MD5 dce7c5a6c4784b4a064db4f9b5abd417
SHA1 83cb6f4a244bb728bfdfbe48c88c269a6735aa6e
SHA512 e8ea51de45d383112e5ab7ef03fdbab3728e94986c0f678ea703365db8a9da38f9fffdf084055b88f5ceb7c4ceeef8d9c852ca56bc9f1483f48c28c348eb66aa
SSDEEP 24576:fG88u8FpJqH1Qzria7/mwnQ/tbw/2Mkjy6Fr7g0o2:u7ZFPqVva7/bQ/lFTjN4
TLSH
T1FA85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a27e38c9b102b977c468a137a48ddb295cc3b8cea629d3f4b8313f64a1550ee8
MD5 02db79460996ddec12056b031ee6c53e
SHA1 bed96b3492171d12854aa506eac4885563dbb0f9
SHA512 1f8e8c099037c3598ab672d6ce0ad6abf79fb0c35d94a4c28497c9ba9a559f45d9cc799b8f36542cc41e247a002062e3985edef2a3059880f76272d28a04a0a9
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjMQ/lFTjN4:dG05lO43biLm
TLSH
T17CD5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 350c767c00bfea4b7daef5de6e895691e21877c9f0d01d737de63e9126a86cab
MD5 0bc3720baa58d3f7ece9a6ba3e66a140
SHA1 928c6b475310586b93e30bfddad420adce9404cf
SHA512 7f331456b72cc6fda28be1f015a3a17564a281fa1cc90055707ba192719a04529c0c14217e9ba2f9cbcc8a5fb9f0b7be081f3b2f539e3eed8eb1e7472749372b
SSDEEP 24576:8fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnWnQ/tbw/2Mkjy6Fr7g0os:ka5POZ3+Jt2pasx2+m0Q/lFTjN4
TLSH
T14A65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4e545d468750df8ab1690f5df14e15f018be91e2ee3f11f88ff4c38ea9ac7a51
MD5 31fb708f2e01b00b2ba0cb923064d507
SHA1 a34507f6b36cc340d3d006b242a58d389e79e2b1
SHA512 d1b8115443fbcee02d728f9b9195271aed656bc1467dbf3898b43dbd44560b13e6d9fe4ab97bfde0acd8e52a1d02c95955b1563a4fa3742df7235dd1cb686657
SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7Fk4nQ/tbw/2Mkjy6Fr7g0oR:8Nc/zEOVHF7Q/lFTjN4
TLSH
T1BA858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 472B
SHA256 9d7407b8bcd4af6820eae7da00db7598246d0f58dc502ef3c89aacbd9cc8a104
MD5 150650f8b4ce06bf6720a55c29275c38
SHA1 c69a908cd7138d119f38c8db07031364b1d21388
SHA512 fcfb7f30078c6e1c43cf272b96b5fbd599fb6ea694cbb79a7a3e40de0eea9e031a4b67d1c2f348d3ab19760b48b67758fd7b4ddd921aab9f3e8d3a064c662bd4
TLSH
T198F0651725F54655E0F75F11DBF990B35B367C456D18846CA0C8031F0CD1A51D872BB3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 596B
SHA256 550a13ba1f49e521874c12f8908b48d130519016d3abd734b9ba3e3695f2a8bd
MD5 dc1ecc554b3f04dc9600236cdecc8a5b
SHA1 5ae617e99bdded544273928e3e02147405e6a032
SHA512 5c18ad0696a910c5806e952965b6ea6a7943443714eab387cfe0437c5546b6b43c87d70495e5a21ecd284faaf545ab0b6c7fbfc5f89b27ab4779e3cef124f11b
TLSH
T168F03A5726F54668E0F35F15EEF994B31B367C026E19D4AC90C8031E0CE1A61E9727B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 726B
SHA256 c89ff4970db3664d4435522769ed127af57f09ba648689de94c00a60572db3c9
MD5 66912ae2193d013c3bf5b8b031c7a36c
SHA1 e5288840baebf03420e92c9deb1a60121f24467d
SHA512 c519bdc0aaf38be5206f763c6ec85e3b1d245ef900c36f2fdfc8865783430e62e09c53fb344e4559e939e4ac40a2fe4e81b79e396264be2dedf9a237cdfb1462
TLSH
T12B01D6962AE91235F0F35F45DFF994731A327C131E18C89C50C8410E49E1EA1E871B7B
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 910B
SHA256 29aad3c953b84d978bd9c489ec6365d819b090264d3f63d55b4dce568fffdade
MD5 a450581a2a8b8beb8dd3de0a9d645c63
SHA1 1bba5a58b4ba51023c189f482055bd4408b20709
SHA512 603c344f420bfcd2931ec5dce59a6bea8e078d8056ebb86f61a6a79c0e4f3b3410000d67e20fa5dcd840d2b9cfc304028d69682b1e118d1c9d7ad9ce27d65a4d
TLSH
T14211C4862AE91275F0B35F45EFB994721E363C532E18C89C40C8510E0DE1EA1E972B7B
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Windows\Temp\ArmUI.ini
Size 234KB
SHA256 790b06745f32e0f56a7af24c871ffce225ba05ebf0d8f8a71a00c727c97dcf09
MD5 cd12a965da4fb66e7f8a07e3f421196c
SHA1 f6377f231362acbd1063aff829ced283a2660b89
SHA512 3fa242c3f573c706e0f36b477ce03f47d9ba0712ef72b94eae4f426dfe21ebbaf1dbebb0981335970b5186d416b4d25e175773796486f39e17de1df0a68a9b0d
SSDEEP 3072:03IJ8zcVOWmxltum8PMkufNWwhEIrKNCpNugYWKOlCIr0YxbFKRWSp4Vf37FbAjO:BxJvW
TLSH
T124342A5667FD1209F6F37F41EEB852944B7B7DA2BE3AC14D1680014E08B5A90DA72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8ed734c25dada800426dc0b823e2bcd0d6af45a964ee3df0b3f10c503f7f1b3b
MD5 4370293196a6f1738bca3018932fad4f
SHA1 70a238984160838ace7025f52caf45dbb6c2126b
SHA512 a639323dee98089f96b07b7f56247a22636c736f5ef97d63901215d73900fb2d0587e7caa57f7ad3f78c3d5b30279bd9ab2bdaf7d6f868887192f42849141bac
SSDEEP 24576:G8kNvNnaFeYhJNtmZBmqnQ/tbw/2Mkjy6Fr7g0oI:G8MwBtOmqQ/lFTjN4
TLSH
T1AD55AF2EBAB846E4D1BEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 22498f4fca524c3d3a21188070546651302d7d585b3a36d342e5b9b85c68904a
MD5 632817ab16c49f3bb0bda1474a8d210f
SHA1 a338ab8afebdda953bab2e68e48ba2dada0f3e8f
SHA512 999510199c64cd1346dbf8c299c6c24f7ec3ba8c031ff768866c86aeb1362753c159ad64bc626df0ce8e138413251b1c7483d30e16772f918fc9547c1549d1c0
SSDEEP 12288:QHvUrBFrEjwaQcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:QPUr+NQcnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T11C65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 27623733de48b59f5748b90dc733805291f08b69e0ff7866e3b73749c52d5584
MD5 8daa9483d7a53167087c606024fa6ea8
SHA1 e1c995070df2c1a6ad9865b8cbd1334bbc0e46e4
SHA512 db0ca9da178e8d6d5f13b34cf9fef351157aefb0ac2b3e4e32673e50a960bb685c6e00c5cb983286b0a31fdf5bd5c6d0ffcb6ead2e4e608144eada460b249071
SSDEEP 24576:QD3FHshBIYQgA9nQ/tbw/2Mkjy6Fr7g0on:QDVHeBIAA9Q/lFTjN4
TLSH
T10E75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-129-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/248-133-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/248-122-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/248-135-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/248-123-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/700-118-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/700-225-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/700-111-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/700-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/700-117-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1252-0-0x0000000000400000-0x0000000000616000-memory.dmp

Download

memory/1252-7-0x0000000002560000-0x00000000025C6000-memory.dmp

Download

memory/1252-170-0x0000000000400000-0x0000000000616000-memory.dmp

Download

memory/1252-1-0x0000000002560000-0x00000000025C6000-memory.dmp

Download

memory/1252-6-0x0000000002560000-0x00000000025C6000-memory.dmp

Download

memory/1252-651-0x0000000000400000-0x0000000000616000-memory.dmp

Download

memory/1404-226-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1404-399-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1404-233-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1404-227-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2240-209-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2240-222-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2240-210-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2240-216-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2240-220-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2796-395-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2796-196-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2796-199-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2796-204-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2848-171-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2848-597-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2848-599-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2848-178-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2848-172-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2848-393-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4160-566-0x000001DA009D0000-0x000001DA00B9A000-memory.dmp

Download

memory/4564-150-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4564-377-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4564-148-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4564-156-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4568-557-0x0000000002570000-0x00000000025D6000-memory.dmp

Download

memory/4568-707-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/4568-545-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/4568-552-0x0000000002570000-0x00000000025D6000-memory.dmp

Download

memory/4568-600-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/4692-191-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4692-185-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4692-184-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4692-397-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4692-394-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4692-398-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4728-392-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4728-161-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/4728-160-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4728-166-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/4812-144-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4812-138-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4812-137-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4812-360-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5732-97-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5732-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5732-104-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5732-105-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5732-183-0x0000000140000000-0x00000001402E9000-memory.dmp

Download