868aada1950f5f875028657ad019113e27b7d84c8f274172e742368ae2c4a988

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Size 1.6MB
Sample260708-kaaadsds2v
SHA256 868aada1950f5f875028657ad019113e27b7d84c8f274172e742368ae2c4a988
MD5 d283ea5d080824077b14cad2cb8b6e0b
SHA1 831611ab938ca8abbaac6a810d07fba1a3538549
SHA512 09da574b0b0d6a57ec026c2034edeba67c5e6dd9c55190000c219b2f763c9de7970fa62ead091e6b10b5b21ed64c9a5b79ab53259c2fdba951f7adc1c46b5e95
SSDEEP 12288:hWnjatxvGtHf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:hKGA7I4kKAl1Q32dxD+sdHm
TLSH
T19175DF58FE4EB551E81FAA3CCCA2C475DBDAAC20EE20D473B251F768C6706811A7493D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
2864	elevation_service.exe
2236	elevation_service.exe
3968	maintenanceservice.exe
5988	OSE.EXE
2016	PerceptionSimulationService.exe
1632	perfhost.exe
5048	ReFsDedupSvc.exe
2008	SensorDataService.exe
4272	ssh-agent.exe
2892	AgentService.exe
1456	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9da27790f4cf0ea5.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120750\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014f7be16b30edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8b5fe56b30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002340d916b30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071c9dd56b30edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4affe16b30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf2be562b30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe

Modifies registry class 40 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2377119455-1173575704-3843639301-1000\{95F0B4E5-F47E-4EAB-AA7C-C5EB9AEBDCA2}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2377119455-1173575704-3843639301-1000\{FB451329-08B4-4964-B227-F8E28D95E8AD}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
260	explorer.exe
260	explorer.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2236	elevation_service.exe
2236	elevation_service.exe
2236	elevation_service.exe
2236	elevation_service.exe
2236	elevation_service.exe
2236	elevation_service.exe
2236	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4976	2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Token: SeBackupPrivilege	5048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5048	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2892	AgentService.exe
Token: 33	1456	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1456	SearchIndexer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeDebugPrivilege	2864	elevation_service.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeDebugPrivilege	2236	elevation_service.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
3972	sihost.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3932	StartMenuExperienceHost.exe
260	explorer.exe
2932	SearchHost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 2968	1456	SearchIndexer.exe	99
PID 1456 wrote to memory of 3296	1456	SearchIndexer.exe	100
PID 1456 wrote to memory of 1504	1456	SearchIndexer.exe	101
PID 1456 wrote to memory of 980	1456	SearchIndexer.exe	102
PID 3972 wrote to memory of 260	3972	sihost.exe	107
PID 1456 wrote to memory of 5944	1456	SearchIndexer.exe	115
PID 1456 wrote to memory of 5864	1456	SearchIndexer.exe	116
PID 1456 wrote to memory of 4940	1456	SearchIndexer.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_d283ea5d080824077b14cad2cb8b6e0b_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3968

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5988

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2016

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1632

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2008

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4272

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2892

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2377119455-1173575704-3843639301-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2377119455-1173575704-3843639301-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2972 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1504
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:980
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2972 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4940

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:260

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3932

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 35c70abeaf95960666fdd46a8ad82d10a8d30ea4e034b0ad757ad83d956a04ce
MD5 798d6ff4dda36821f272e8d51e8f182b
SHA1 6d07bdfc449308f673b03e95d3a733ad292d4d9a
SHA512 c9246ea8a0c536f553ee1bf5da14a58bb23824410c2c064fe43184c14e8516103f47af189bdc670f2514123f59dfcfc31941aba6bc93803778e6467089f68c7f
SSDEEP 49152:Mb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnFSl1Q3Yysd:23q6tjBF1A
TLSH
T1EDD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 d4e576e0c67846fefa88b1951b5f36cbee4313756acb279e2cadcb52c8bbee7a
MD5 06260cbb4d83211cac2390b89ec1c936
SHA1 e9bbc6b2d908501cd993d51b37844c2f06d99e0f
SHA512 af842eec2e7f88dc598e4296931051d132b163e5123a2edde509cc10fe0a2d457a2ea90ff3ef5c09f324811846ef58996f6072b8636f4244af1fdf876f1b3d99
SSDEEP 12288:V1XLsswWkxy2lRq2czAaf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:7XYfDtczAs7I4kKAl1Q32dxD+sdHm
TLSH
T1B875F12877D408F9ED67823DC8A28515EA337C8143A0E7AF03E4A9655F372D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 4a9fd217b13dcb57d7e3d4445fb2c0bda27831754d760ab2203a975c62265ef5
MD5 4d097e9dc2dbced4a10cc4a6a1e726a3
SHA1 73530a2354828a7be3caf9079b670f32d2961411
SHA512 02e69976a8e82c8d6e85f35f00433b64b3500cb9bd5c5fe5a839b6448e9dbfd4cf614f0e29fb7ff7c6cefbe951780a58642bf5f520ec24b52677efeccd69a89e
SSDEEP 24576:90Le5ji0hmxyrM57I4kKAl1Q32dxD+sdHm:9Pji0AwuSl1Q3Yysd
TLSH
T1BC95AE16F6748335D073C0B9C5D2A69EEE72308257308ACB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7970e8a49adc3c109a67d60ae9faa88d05303e86e02d097b1e9969e180fea98c
MD5 4dac00fbee254d80c1b88834685a5af4
SHA1 1340d967f57f50170d731bf5a08bd712f9f38faf
SHA512 b0da29f04dcf00a31885e3a82d70a547a8b3619681a515ad8a75fdd03bc4cdefc5eb06a252f644b6f6333c30a57d8fff1be819b53ddbceafadabf7622853a4b4
SSDEEP 24576:ua7/ezSC6vUyDZaqgrvWx6q8wyuj7I4kKAl1Q32dxD+sdHm:p/ezSC6vURPvMHjyySl1Q3Yysd
TLSH
T160756C15F5788323D0B2D0BAC5D6BA9AFE323086573089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0d342de33aa1c53ffe1e5ac9e2123dbba0e90a982d27223989f2960f38e11091
MD5 1ce0791d67682a24e6eb3ded99428283
SHA1 8474538c19d253f731f6c3ba2003699a3cf73bb4
SHA512 888e7513d0c9038f60a9d99b7c0d82648f51ccc9cd6b2550878d632ea1adbbf14f0137f1b19d61be1fc7feaffdbe5ea0ec6779a1308b9ecd450089c22d1708d1
SSDEEP 24576:tVbqPb88hv/lV747I4kKAl1Q32dxD+sdHm:tVO88hXlVwSl1Q3Yysd
TLSH
T1DA559E66F5748331D073C0BAC5D2AA9AEE3234414B31CACB1246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 6594f825ca8e73f7412bf9eca9115e79dd002f76eb6e576681c64cd3dc83061b
MD5 a6f482994da1790f5a45c660523cb9fb
SHA1 f52412426973ae6ce87381d8fe279c5e8f29269a
SHA512 0708ff48ce973a79229199e8eaee65092bbac40f3bef539711dee624f5444f21c41705513a32c7209e2f4ebca51f377280822e373e6bdfe7f7d018e349aa0ba0
SSDEEP 12288:matf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:maF7I4kKAl1Q32dxD+sdHm
TLSH
T11D652305AD88B895F75A233AB9929139FF074DC042D4E17E17B3BEC0A0BC0B4EB6D161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 d6a9a043d085006872e1acf98a1a2e0f4a8a0ace22347c52c16c5662b1d346ac
MD5 a20ecfc57a8f757cdc77bb7229692c25
SHA1 80e2f87bc36ba2f652505a8603c5f81c7f4bd777
SHA512 a69cd081f35d1e089b91e55e06bf2689415e0eee4c50a05ff251694a3c1c548f9fa2cbc6e1ab44e2f401fd6c2680351ed9f739f4240a2a920c65ea50fe729435
SSDEEP 12288:geBNUbTVO86UOf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:gJIUQ7I4kKAl1Q32dxD+sdHm
TLSH
T1BE75CF3BEE28FCD2C27E49B95A91C200E77278704B61A3CBD175824EDE275E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 09e16e19492cc61b3b88b03be0cbeba44e2b617445e4073a02d25b5cda7338c9
MD5 a746fd03cee580c92b96c8a4487d8f8d
SHA1 9560c2406fdef4186784c16414f7fff0ad7eb03c
SHA512 185d487e221332582dc619946657bc45c8ceda504ef0071a8bb7e1b3889bea9e0cc9805f6ed6f52cdeab3fe6412252f06226010d65ddf668fdf47c7192a20a08
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3TH1:DQvGAdlCEL8c/pRNw5C+1A
TLSH
T194267D656BF880F5E0A7E138897AC5B2F7B678420D31EB5F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 5ea39c6325f35d8013c69a9553f3a981256ff1b0917e9bd77ee5c278c0e50ab2
MD5 afd50831873a446666a7719baae4ab26
SHA1 cf2e397f7b08eaa91294e89585d9bc51f3a56c17
SHA512 89f21896cd5f50d9f21ab66ba356e809064a8bbd72f08fb44ff6144ba693ac69cebe6db5cf7d4df7ec88a360a265061eb6cfa29623d980f8cccfdb323358c5a3
SSDEEP 12288:eAwSfxL/2Dc30DLLmt0LDQewsAjAf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:DRewsAji7I4kKAl1Q32dxD+sdHm
TLSH
T10085E031FE74E036C37F0DB61B26C316682D6D604B911AC7E3E89E8D59342D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 17d7ebede0daeab2ae092222b339d1abe6cf3426f6068d255db773cbbc18fc40
MD5 ecbba28678d627ef86e4b3ef3b8deab1
SHA1 5b11a882d9b8bf86258c4514d321e14d796f92e0
SHA512 ebb0890036df35e126dc584414aeab2e8bb628a4c21cec020ad74e3288523ca59ce9ceb3f277b896090922c8dc8939c95802f6f8d3d2fb4a3f11942d7256a30e
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHS:DUEtQevvqc2W1cpV29I32S
TLSH
T183474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 003aa7d4ac4ba4b53891607cc1b9c38bb6687f27d67a9abfa6e278f37bc3daae
MD5 a6fbaf145f4656d760eb058e59cfc536
SHA1 d81825c407af432200d06d753b6a9db4ae435ce4
SHA512 af366b2595ff1373bcdeaa6456713c370c492f9f13a418e5714d7f9c3e99d7958f4c22959fff7199c487213bfa6ec6bd080092de8aea7eed0c583ce7b35b567c
SSDEEP 49152:xCbRquA/m2yL5zQfFiV+XenmE3/z+Sl1Q3Yysd:+oqtVjnm61A
TLSH
T1B6D58D0976B8C1E4D1F6C37896A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3d75a52ef44dc2e573a7346d3d58047797df8be198fbddf808d516e800675667
MD5 982cdf0df4d6430a46e540eefabf27ec
SHA1 ec6b50e22e74062fd72216e62163bc9d4d7a9655
SHA512 a911a5a0bfbd41188f52b6fd6da5a4966701f30163565f99affbe94bab48264c159591253ac0a1fc37a0c097ad8b43ffedd6b8f97eb22bf6659c947ab46278a8
SSDEEP 24576:iAhGLmIFoiwtA5l7S53X7I4kKAl1Q32dxD+sdHm:iAM1Foiq57Sl1Q3Yysd
TLSH
T198359D80EBF955D4F5B3AA7899B68171EA77BCA55E30C21F2260D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 7cd518b9109b31870993de2fed48c0fb6bedcf8ee3f7c72ee58a28b617838dc8
MD5 d418eca83d85bb21d6841ad87f2dc523
SHA1 072bb216b894c94237bb2043660a9a8b4cf5eefc
SHA512 4e5d373e1f3ce4386f5bdf1ad66f623c65f49bca4ef738d09d144a647eb96ed384eb78e066f0c08600f3bc4867662f136ef74e706236b1587840940f6db60aca
SSDEEP 12288:2mw5HEjsChNBBFgl0WDm+Crf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:vwu4OWW7I4kKAl1Q32dxD+sdHm
TLSH
T1B675F14676A81CF9E9674239C593C136FBB3BC412660D72F0760C69B6F37261AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 68a700b9acc9eeefcfb9f9ccbc05e85a30e2b5749708c16017b0d3b66c65dc19
MD5 e7b7ec43f0a595d47bff2fbc21a7e646
SHA1 efac2e0afd74f85f6b56b872d6bb17d47bfa7074
SHA512 9f73b0341d4590d2c3f50b8457fdd4efc575a53006cfd29dfdd1226770ecf0f9515d869b01b33b78c394665673b364c781ea8dfa0c9f9b69644dab8672c94779
SSDEEP 12288:RvZ1Iywf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:hZuR7I4kKAl1Q32dxD+sdHm
TLSH
T1026512093AD830F9E297133DD9E18219EB733C9113B083EF126166956F7AAD16E39331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 adae9ac1c03dd97960b09e38e38f5162163412d8dbc47745c76e785dd4896179
MD5 8094ff35c78096c3380bb523e8072a82
SHA1 4b79ee36cd1131896394dcb1786609bdaa070761
SHA512 9b6e9436d8a92323317aec53e8a6b67511a68953bbd41d4ca36e52c891f4d40ff5858950599803ba4e57a89c4fa45dc8a17a88b15aa3d9e756a01e6150c5fcf4
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UR:KQRQyi36YOcPuLvw2gAf+PN3Z1A
TLSH
T189667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0d275e2ef75a74bc8e2860e1b057c9bcbecebf16631dbf4de9ca41c2df894d6d
MD5 b02313119bfefe1fcfa5252fcf9d5dc3
SHA1 a8a480cb02130af6bfcd6ceca6db3290d4931b6b
SHA512 565f3567304a5a8627bc561b759c8840b0b5a7450d3ff59ed441992009e9a1c1039e9251e3a426aa74c942f4be25ab5eb78fc216a60cc64df42f9dc22e127a7b
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UR:jQRQyi36YOcPuLvw2gAf+PN3Z1A
TLSH
T1D6667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 aacc641f6d992cf7f727f4ccbda427b57c890b3dd384c5602a17ed3e3a154de2
MD5 310a05ead52729796b16d2e816c61eda
SHA1 144656cc63273f67b9e26fc9e727deca3da8edc7
SHA512 467bb0e87d9bbb76fd3caacf3f27bcd9f94f08165d1a199eb1385c89ec1a71a768cda8905eab1624d258254c2e20629131227808029d710ec1cbcd85c3d0160f
SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0h7I4kKAl1Q32dxI:568Qg55nhxeWu7PNU3/uSl1Q3Yysd
TLSH
T161B55A33B2F600A9D44DE1769F4A873196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 715c486684a5d5dcf08404a7f351e92753b4efd789ef1f98033cade5bd17c362
MD5 bfe5595e740b7260163918e96fabef34
SHA1 14b769eb9effba6caed8826c38a393c8814fc935
SHA512 64ee87607d1ed414d11a19b0acd8d1bd46e505a05e199a5b5b5f27b968d8f2611925a8d3fdf734495ba785184c7f312e505e80300053e47e9b3f86ea556a3221
SSDEEP 49152:r3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99P:uy5112gYy5azzVvD69nLKnhZY1A
TLSH
T16C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a6599b381c92e79fe638dee45efbc338b682fc1e678e59ef61a4096e8ecadfbd
MD5 41793498d1ac2bc356038daa83dc701d
SHA1 9eae5096ea5a9f094923fe15ae62bfd61172eb92
SHA512 02ff5c0371c98f7969fc7b807cf3f9a7be9cc6d5a5d71059c12b857f5a342b62b7b31f0401aa307a48b435ef17650f2a3cec5c2c0e3b294041afcbf3f2a04d12
SSDEEP 49152:fB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glYSl1Q3Yysd:hu6JmQxd2dx1A
TLSH
T158D59D13F5D901E8D06ED178974A9233FA62BC490B34B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 588b6103ae346a02571a9b24706747c11d3cfc0b2b28097682f7b14aed65184c
MD5 a028ed66f220e446160eeeceb8693428
SHA1 d4b8596ec1e1edafdf4d5d0cd512890e5657c103
SHA512 ce2c8c55a4eff1f973429dbebe99e8d5640b7f0be55bcf44c97ed9f09cb8c43b2f9c3068372ace623888949a4f55733e63984bd835d946ad2cd03feae7f16508
SSDEEP 49152:t1hpsNoJpF1A6yU44CwH7R4x8Sl1Q3Yysd:tmifPVR61A
TLSH
T1E1B5AE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0723edfbcd7863bba2f49a02e264dd83f510cd07c3a1f412545f3121f06517b7
MD5 1fd155e3ea5a41f4b33dc1a1e56394ce
SHA1 a631482ef199c182bf9e02e0a609b24eb36bd247
SHA512 321ecd705b273474401d45aac9ddd62ffef629efd4553327717bf1be394ba4388d1cc4ea23d8d090a7ec5000695e7ebbfac836f9de7db9460b7baab264802404
SSDEEP 49152:bSuZQIY0Be2KIRVtOnks6NMHq1Sl1Q3Yysd:J5dKOi61M1A
TLSH
T1F3C5BF03F2E940E8E0BED67887669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 00c511916b5a0198eca7bb1943f75544d009df1947d48d1793a2a5c3b09acc56
MD5 ab1f9bd20efe374cbc07cbf2e410e281
SHA1 d2d76819c943aa1e2935b7661a5ee82b88693c23
SHA512 d08a92b6e25c38f341705b8cd4f7ff185fa08082b7e01d4650766e192c144bad2a11c5e61f4889b3b1bddd0463bd554a23b8129fc5d330e90e447a390a17bf96
SSDEEP 49152:ChtSn8EApI0figGgiDn0AP5wISl1Q3Yysd:jX2i/phm1A
TLSH
T19295BE13F2D900E8D05ED178C7568632EA62BC150B39B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 5482053cc3e0f5a3e3657542f82c886df2317d6cd824df2fd868c63f43dc5247
MD5 71b4a297e5b063ce90ab925e33a9f2a4
SHA1 7c60dfdeca434980ec912563a49d81920c568797
SHA512 05fb3274cd2083cfac7f4afd5865165d3d23b1c6d69d213f662cc5f0b9ca17ce03259df9bcf5a77aa9c0448ec7d186652f6bdd5ee6f7ad381499d9b7f12083c0
SSDEEP 12288:8Vf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:8d7I4kKAl1Q32dxD+sdHm
TLSH
T1AB652305BC8CA995F509237AE992923DFF071DC443D4E1BE27A779C0E0BD1B46B6C164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 abc9257a9b27e2cf15a80e129837dde28e8f6c5e4459a3f4330e0ad90138739b
MD5 c10e538ba2c02c5f089eba89bdb8c3fb
SHA1 8f0443639cd75b86ff446dd88d3828b5b60c088e
SHA512 b3f8781c0e147f9c2d45fe8e66aee440552e1c9b530d6044e456b8735d00311a4ba6546e198713875024467660f8850bf07142f2d212b2f4abb1854db2d45e06
SSDEEP 12288:d8f7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:d+7I4kKAl1Q32dxD+sdHm
TLSH
T14E652305BC9C6995F209233AE992923DFF071DC543D4E1BE27A7B9C0E0BD1B46B6C1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 5cff026bb685aa9346631956989d52212ea4b0f7ee7c1af14c578c88fa4c4468
MD5 11a6e538b671e007d8de3cf9fc815874
SHA1 6479df6b1a05545c81b4a02face02c2c04683cd7
SHA512 964ca3037bce5cef8fe23849256e1c4ca5bfadec73b71063007a2eba580811d2a9c39e68ac2ff8c2dde3e1000037d1379d43f92dec0fba289f34652dcdf39ba1
SSDEEP 12288:7Wf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:7I7I4kKAl1Q32dxD+sdHm
TLSH
T1D5652305BC9CA995F209237EE9529239FF070DC543D4E1BE27A7B9C0E0BD1B46B6C1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 478a27992d063ecd6f5f691bac8d46ba68d9af05f2e12b8a9a7b1636bc9b57d8
MD5 35bcab94b216a1af833a428f7d4a18f4
SHA1 698f7abab83b894e59efbf51016cab5acf02d8c1
SHA512 067d04390d759b9db11c0179b4af64cbce901166b85058f3d018691fde4b100143a3d47cccccb22509628dc8927d90cee3ef95f0fb9bfa760a9056150f7875b5
SSDEEP 12288:OVvf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:C7I4kKAl1Q32dxD+sdHm
TLSH
T1696523057E9C64C5F456633DD9A28239FB677CC083A0E2BF176239C159B92E4AF38660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 3ebb5fa569447d809aa2e9a010a0500e09660e29095bf9c59007b281a9122e1c
MD5 645fa52b6424dd6460caff07d7e067e9
SHA1 d7f7e5587350c879bba5aed1b1a6d8bc76ba749d
SHA512 4afc315ff621ec0b7848032fd95c0b82633ee88e99f197da83157895a794a7c6769394e66d79349a64cd5dcbd01e2ccc917a5eaf87f82f339f78a9686b7dc3f2
SSDEEP 12288:Cnf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:Cf7I4kKAl1Q32dxD+sdHm
TLSH
T1F0652305BC9CA995F609237EE9528239FF070DC543D4E1BE27A7B9C0E0BD1B46B6C1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 67747390ed73b43ad76ba565fc15af512571de98a9d81dafab348189abd378f6
MD5 90911b3d5b878c9552ba54bec24c2e4e
SHA1 2efce51e1926c709e17a817a70dd17583090d31d
SHA512 8211e66eaa13a9526dd09ed7dab86eea4586cf48d60181f605827d8d2241ce885be3c7a7ee1afbe76c0cc1ca0ec41b10103bcc4d1ce63ebca381a88d03d72b79
SSDEEP 12288:7of7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:7a7I4kKAl1Q32dxD+sdHm
TLSH
T132652305BC9C6995F20A233AE952923DFF071DC543D4E1BE27A7B9C0E0BD1B46B6C1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 dd6ac6df318b27fbdbba0e4460a01638c2b057326a3051834c4262f2b06ff1cc
MD5 a829fcc2cd205dfa405ff114ace0813d
SHA1 9e1b8b0bf31958ea50dc204efb8013a4fc17dc14
SHA512 be4e2534727c7f03ca8d915ba6caff2fb89557e912c7c2ac0fb6673361fc9feda4c20e0ac35bfae965d0c8f5875c9ba759f7a8628ae928e01dacec4ea8fdabb4
SSDEEP 12288:NUf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:Nm7I4kKAl1Q32dxD+sdHm
TLSH
T1DD652305BC886995F60A137AE952923DFF0B1DC543D4E1BE27A7B9C0E1BD0B46B2C1B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 f6fd0344d9cc73c2222e8a4877b59efb5d998263f98c526683446e2074a36ffb
MD5 4d000afb7b4029985b610e76046a3951
SHA1 5254a47a7653cafb14291158b5cc9a7a22c8b78d
SHA512 48f292880194915245807ff2b9a106fa666f9aa05ba0afe91033cafa4a2a47c94d54aefce5c9b45ae99f404babb9a5b4c15cfc4a065c048ee819c4b1d52bf4d7
SSDEEP 12288:+iZwbgzzFEoS2cPvycf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:hZMIzFVSOe7I4kKAl1Q32dxD+sdHm
TLSH
T137750194B79018F8EC67423ECD618916E6B37C9907A0C62F03B436665F373A11D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 5bccba5f402af2034bc3546686ec1cc25cd23224337c3911074ad7fbd9d7dd89
MD5 5f87f698a743d148d609f39b5ce59691
SHA1 90e995918a43788ee295fa1bc782211a99990b19
SHA512 d2055eb0fdae0f4e1ecf27f32d0e6fe7aa9be1dd0b10e335dce56fba758484e7141bc26311f5336b1cb1e64eb36b50dba5db3cb37a016439198d8e946bed2eaf
SSDEEP 12288:CZf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:CB7I4kKAl1Q32dxD+sdHm
TLSH
T149652305BC986895F609233EE9528239EF0B1DC553D4E1BE27A779C0E0BD0B46B6C1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 7e5d39e567bb409db39a2287418836131b636e73d622502319d145011fdf6a3a
MD5 39683a7d4f8fdb77f160f438122c6f24
SHA1 77cdee0e9adfe910f8aa40e3ee1627f004427faa
SHA512 cce52552e65688d5799f0bdd17cae9eec7505ce518cc35f323fd12b3c7c8ef1a19e4b34fe42751816b860b689afe2dcbfcb08c43a443af850544607c21f065d1
SSDEEP 12288:Mdf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:M17I4kKAl1Q32dxD+sdHm
TLSH
T1E5652305BC886995F609233EA952923DFF0B0DC543D4E1BE27A7B9C0E0BD1B46B6C1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 3a13537cdf9e91485858b6c2da6243f24c9fdaacf64263d0fff8cc1be39e501c
MD5 12de0f968765d08f6a73a880ebfeac89
SHA1 8f06afc304cecf7fd70457d006dfa7ff6dae3015
SHA512 8696ec573884467134a262ae734859553deeb815aea13a8d6fadd234a9e4b3bf339edff2d6f8a47cf3e366fa7a3c90016c2668e353759d8a08e22a7c3500fedb
SSDEEP 12288:WyPz5L8wf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:rzyS7I4kKAl1Q32dxD+sdHm
TLSH
T1DA75020776A430F9E1265239C8A21615F7727C710760DABF17A067B26E3B2E09E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 299332d59a97484f0dd2580fcc9f3a101a90622d6dce71a667c3a0ba80badb7e
MD5 d655f201b01963ab8e11631372a7fd99
SHA1 9aeb20983fee2b9a9f1c9ff384f16d38b1475ee6
SHA512 5367f5fd4a25a1e121513fe2211a1185de19250944cf35cfe7570e7ce8b8f73e0b252710875def37136e7ec16f6e6194d0c6f785c9a0fc31ad0406f0683e8792
SSDEEP 12288:hZf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:hB7I4kKAl1Q32dxD+sdHm
TLSH
T139652305BC98A995F609233EE952923DFF0B1DC543D4E1BE27A779C0E1BD0B46B2C1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 e101e2efad95acaaa0333c8fd1a0cf6679b222db30082ce29f6f4fd63b8a58a1
MD5 b57385ee9410ba4712e94a847f3f1ada
SHA1 0c099ed3ab2fa86b3549eb4931634f5948d59d08
SHA512 7b24a25c55241e229fbd2c1712dad5fa6a64720290b1be45ebfb170883f6a40542597b9cb2b7636147c6d046870b704893fcab5fabe96cf2722e1b3d83b3b748
SSDEEP 12288:dZf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:dB7I4kKAl1Q32dxD+sdHm
TLSH
T144652305BC9C6995F609233EA952923DFF0B1DC553D4E1BE27A7B9C0E0BD0B46B2C1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 39f4e390bb115a6cbf4555276fbcda9cb0d44fce25985e6a6763ca31507a1952
MD5 a1b2631544cf6a2ae3c9ac91982de92c
SHA1 03aaa46bb0bd84c7e824e24f63dd563dbc16e8be
SHA512 d4af3cf4bce3465136cfd5bcb44bd000175e2246e2aafe6735bad4f058f90bee885e8685f934a1df9d647e7b7e19f08ea0d8bf9d791b528876e2a9dc6dc5c4ab
SSDEEP 12288:CyPz5L8wf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:fzyS7I4kKAl1Q32dxD+sdHm
TLSH
T1B07512077AA430F9E1265239C8921615F7727C710760DABF17A067B26E3B2E09E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 8ca89aee4e5cdbd3cfc2b8da07d67830ce9bb199e9ba83975da93b768ad824cd
MD5 f4c3a3693a64c0bf0630ad004596ad9c
SHA1 66676f9abd3180aa4f0d6abc248dd737c1cbee1a
SHA512 49217a22587cbcb9f0498e2092750fe84e4c10af2c34302606b05351f01151d943902271dac424e22521286b1b46ce86346852dcd23c4a88408bdaf21d01e3a6
SSDEEP 12288:4Cd9EWYoaLHF3z0z04PDvhmf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:hTVaLl3z0zDY7I4kKAl1Q32dxD+sdHm
TLSH
T10A750194B79018F8EC67423ECD528916D6B37C9A07A0C66F03B436665F373A01D3DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 ecaca0d43641f3d55d1b9de430c4fc356bea42662df8e1be4c65fecc862e537b
MD5 83f06010cbe426abbd7909890d7a8d12
SHA1 9aebc2e5863056527ba71e3b33192537fa0f8a74
SHA512 85a55215f83d1c5932a3da7c566913e2113a534845409260c2a9102f5238ff500b5ac84239ee908884e1bd43e91c86f38780d4bef75a12da023adba851f05bc1
SSDEEP 24576:v3Wd9CHKy7GZE7I4kKAl1Q32dxD+sdHm:/Wd9CHKyaGSl1Q3Yysd
TLSH
T1BF95CF90F7E814E8F0B79A35CD728511DA767C991B70DA9F03A4265A1F336D18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 7d0f4673d993bb2435a8e096c9298cdc9010940f18241786299446c8c593e1c5
MD5 0e495eac4fb05e0072f9ad8f942d74d3
SHA1 b9763db6db7c460c50795c09f8909c5bc58b8656
SHA512 b955518543120c13a624d7e52579707f1f8cbb0f923e3feed7fc1e748cc3efffb75d54eee787edd58cfd58e45185e50a4542572f9e6d3ad5816fa482f2cb9cfb
SSDEEP 12288:j2f7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:jo7I4kKAl1Q32dxD+sdHm
TLSH
T17E652305BC9CA995F609233EE9529239FF070DC543D4E1BE27A779C0E0BD1B46B6C1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 6884bec7a452da3ecbe50a561c2b289a632dc05765e35fce8354af5d7b7c6c75
MD5 3cf375180cf25b46831fa555227e44ac
SHA1 ea701ec54e4066efbc0615f356e982d02c2a29fb
SHA512 39e6844cbc500697ee92e93d1f5300bed0152d7e4a361f17d633bc7238ef0d378e7bd7347990dd206fcacf0688b8dd6b9733cfa1d900ae404289e8a91b4a39e9
SSDEEP 12288:vQf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:vy7I4kKAl1Q32dxD+sdHm
TLSH
T13F652305BC9C6995F50A237EA9928239FF071DC443D4E1BE27A779C1E1BD0B46B2C174
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 c53058681b8d1b90b755f96bbfe7098d8b2c6759147df08df42df0f50af15839
MD5 508e4a14307c4db5b321c784dd4bd0a5
SHA1 ed448ba93fde948b7f32b089f8c57d3bb41dfc2b
SHA512 47009a8c1c7302e5abd5d8246536eb647826c44ac5f65a5e767f762074cbc803cc63c602af1c7d3db31fbde5f83d552b85f7d2c524b3b4180f1158830121a515
SSDEEP 12288:wDf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:wL7I4kKAl1Q32dxD+sdHm
TLSH
T19D652305BC9C6995F609233EEA529239FF071DC543D4E1BE27A779C0E0BD0B46B6C1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 5dd00b5dcea303421fd2d918fe782154bae82df76ef8dae9661237ce163eeef4
MD5 05afa1cae5e82863601213314c8cd2e3
SHA1 66a4fd748e7f0b25e2ba50cdacd099f8e2faaa22
SHA512 1492828ce53d48ed89f9dd2b5961fb4fad150ce1b26373262c420926770ae131593cdddda54c5bb65f4517e859f5cd23ada0c6b861c89a20a3eaf95527f5dc36
SSDEEP 12288:xZf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:xB7I4kKAl1Q32dxD+sdHm
TLSH
T196652305BC98A995F609237EE952923DFF0B1DC543D4E1BE27A779C0E0BD0B46B2C1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 5dc455a6a88b51acd8ea325a01ae77594a64b9bad429462fd4f0f2f8f46cea0b
MD5 e64222ef9034b24ef4efbde4e7fea13d
SHA1 32a6ccc2bd61c2f80d8f3f56fbd90a9fdea11ceb
SHA512 94a4956425ca40e7d3870e4fce649028a872c37b9d508dfb5b4c43445acfccbbe647c1bbdfb3124d2a5fa285b736055c22fecfc3199947c828696fec6faee5b1
SSDEEP 12288:k2f7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:ko7I4kKAl1Q32dxD+sdHm
TLSH
T1E2652305BC9CA995F609237EE9528239FF070DC543D4E1BE27A779C0E0BD0B46B6C1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 0dd6805e58919b46e38964efa62dbf1c3bd3182bc4a9b268ae0e7b59bccd5835
MD5 690bb0d9d1e2df0947b2a0d52cd68a0a
SHA1 0d985573a64c61149e73cf43b59d3c89a408a531
SHA512 689103528475d9fe9f0d7ce3810c5ed40dddc32a5d540bd03c0c46195824cb8781b0c266d729816707936e8770ff133a4878dd3914c9b4c2b29f65bcb508e4bb
SSDEEP 12288:axf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:aJ7I4kKAl1Q32dxD+sdHm
TLSH
T1B0652305BC8C6995F609237EE9928239FF0B0DC543D4E1BE27A7B9C0E1BD1B56B2C164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 ab113c3cd4d8561a09402c7533141a988e1c97b25b10c39c5be8466b807823ac
MD5 50d795185579f88fc0aed4fb84d0ab73
SHA1 75f99ea15c19eb0a776fe8a00184ecbd288f464b
SHA512 3115d24f978ddbccdad785932d9a2c9d1badac00ad291cfc6884e07dd72adb2de5918d52379343ef5428d60b651362b2fec1e53fa38c214acc8c761ca4b97f3e
SSDEEP 12288:Knf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:Kf7I4kKAl1Q32dxD+sdHm
TLSH
T17F652305BC9CA995F609233AE952923DFF0B0DC543D4E1BE27A779C0E0BD1B46B6C1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 7d5c44f8e58a0532034fd68afb17a892c56b4e48038ddf3dac3fa46a19469ed7
MD5 d71c04be24a7fc18f4fd4284957c0cb7
SHA1 5e90f973d40f4472b8a2d6b343667ac1307720f1
SHA512 f9f8068ff45475e757efbdc68955424dd0f58cda874f53332e7c8464df28f5f2e2c9f183e93723b31db5f21811c11a37bcb7c6132e7e64a8cc2f05d8986c45e3
SSDEEP 12288:R+f7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:RA7I4kKAl1Q32dxD+sdHm
TLSH
T121652305BC9C6995F609237EE9928239FF0B0DC443D4E1BE27A7B9C0E1BD1B56B2C164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 2914a24d563bfea4b1d7880410a7188af85f3d2f4f3f4b4ada300342e0a4efb5
MD5 311b2c62a82cd67f156261fa8362a00c
SHA1 c9d1ebb59e126a7208307033e8fda417db7d0f39
SHA512 e2c66f6dbe8e6be048f14b1c91114eeada044231bd2441c0dbffe318a2e1b3545c44603f477c6a33073de0a86e461a7dc2e890ab4b730b2bc0204015470b6543
SSDEEP 12288:Lnf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:Lf7I4kKAl1Q32dxD+sdHm
TLSH
T170652305BC9CA995F609237AE952823DFF071DC543D4E1BE27A7B9C0E0BD0B46B6C1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 0268d79157c6e9a07a5ae017f09540951b2c0d854fa0bcda75bcdcccf87e8684
MD5 447a31d7e7864a0c5311a7492ff448eb
SHA1 bb7f7fd035a2772927466ebe37685f4da7d45e42
SHA512 3f7eb016525f0079aedc74b45ed5d59943ec1b018e1a0dbb194fb07c9a2077ff6f7f5be175b32fca6864bdb2c1479fe6ba8f0dda141bf27e964d94e9b2d32a96
SSDEEP 24576:LfwvBk9RX6wkyAIl7I4kKAl1Q32dxD+sdHm:AMnYIJSl1Q3Yysd
TLSH
T19B95CF29EBDC44E5E177923C99B3460AF6B178581B31C2CF029A53AD0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 163bb28cf23331b087fc5bb284fd49a43ad27684aeaf3652fa1af0338eca3b1f
MD5 09ae508ad8b43fe8f590899adda23cf2
SHA1 1a7333d01aa85780c9fedd5441e1494b56910374
SHA512 9085679e7d7477726bb222c8aa13a83f2088fb165d09e801b0f66c481665a869923112fee597be62ecc2a495e819b38b3316d8445b77889cff7a71106f80a789
SSDEEP 49152:YYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0oSl1Q3Yysd:EySzP51A
TLSH
T12C066C56A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 96336091fbb4fdb9b74828d2e3f2478487b793e9c0fc32b3146e5c4a316b7b0d
MD5 d42fc7ced0b15c08c8ac73291119c04b
SHA1 7fc44cb35ab90bae06599b82b2506891ffe49885
SHA512 20f9769c99085fa8a0049cacbfdf16700db5bc3c85a6d8ebfef61177ab42d1bde8c98737977b8b5ec90a3fb2da0c30d5337969836b007dbffa02a53687de3949
SSDEEP 24576:w47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYO7I4kKAl1Q32dxD+sdHm:w47JUQjairIhCnDHUPfF/YSl1Q3Yysd
TLSH
T10B65BE1DA3EC01E5E1BA927885158A1AEA71782D1F31CACF1270937D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 ff5fa059a77fbc51c912a0c71691c2f741b52ddc959135967632e8c382cefede
MD5 9f08016e99ef6da984e524469cb75773
SHA1 19722f0e8b04e513b36196e5f772c69f16885f24
SHA512 f7ff14438768fcdc76a630ebc448727a354a9c8fa2420a11b6addcc6689e1ce733bf9658c9c56240405e203d09c3c65e9a78065a3f6b7c9ba70c0f91c59c3a76
SSDEEP 12288:QBsfpf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:1R7I4kKAl1Q32dxD+sdHm
TLSH
T1D075F109D69812E8D06E2239CB528615F7233CA583E0D3DF13D1F57E1F7A6A09EE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 3cf1540ae1c08ed1e4dd16e5a9188c9288e8733272f3291af98668364ef6a0d8
MD5 9767e366c1ede2549a635e86ccda185e
SHA1 8edcac8a4e1953d2519b1ed3c924715be1d18bfa
SHA512 fb2877aa274f9af86de7bf32d5d3c4ee8449cc59286ec78dbe8cb4674080cfb362e7e88c3e2570c8f407cc8d3f8936e5713a12873d87bc701aec4df384eec569
SSDEEP 12288:xAweRU3fNM7naTwGccuHgi5YZBVbThvnAHtI:xAwaUPNM7Sh6DKZB1TZnA
TLSH
T1C4452700B226D74FC6A940721E36D6CCAB70BD42EE44AF1772C8473FD476658BAF5292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 7b2704bad984f9191e41250cf5b1d390626d9aa17b74e5947009ed9d3e66557e
MD5 99349d179125f1d6c0eb9536eced1dcf
SHA1 ea69d661cfd8171068e756c9385f9c71b6dd3783
SHA512 cfc4469d192279ac6fd8475483dbb711b5a44c91595b6e9e563476f82770804628edaf5e514e8bdc4d4f135b4fcdf7d847ac93cc25caa4bc96cc9d7e9273ba40
SSDEEP 24576:+C8MRgmVxFy345OKg9AEPiahBCpQM/0JiK4pauSFPp8SF7+yeSFCBtsSFUQSFYou:+C86NVxFyeSFCSFMSFPSFjSF9SF2SFJN
TLSH
T136654A426577A74FCAFA807303319A8DABB4AC02BF853F1573884875D8BA609B1F57D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 d16568f8882426ed310c6fe555beac2ab9978011687bf2f6e90a41264b10c4b2
MD5 9524ad5019f04524fd4bc4dd349cb316
SHA1 ac9147395deaf146a8c902467ff4ef158fb8c9e5
SHA512 d228dcbe976e87fb8783c0a15aa61f2994c77d05393d0f7505767351f19c4f020ac86cacd9cfb23cd1f74f22ca5cc19031a63f2e8c0bbe953da8faba6a3c6bb0
SSDEEP 12288:/47Bf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:gZ7I4kKAl1Q32dxD+sdHm
TLSH
T1F8652301AE9CAC45F56A2339A956C238BB0B6DD447D4E0FF375276C0A0BC5E4AF7C225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e5c18a3920579a53ed2a87149ebd477156839f2a5b3a30d1f9ecb664fcba9e25
MD5 2983c83494da7c309e6a23b8feb71743
SHA1 09735021b8853a3c056ff091cfa37a767768056a
SHA512 00a5ae224ab9acd0b8f2bcc6ca3ae818259a489a189b45f9c60576594003bcc4e68f2f626c158ee2c352a9ef557d2b2bcbc500db69509beb26c7145021b7da88
SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bYj7I4kKAl1Q32dxD+sdHm:Rgb4mBIBhGFqSl1Q3Yysd
TLSH
T162659E1E22EC02F5E0FAE2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 87851617125f0db3d1a97f2a75edeb56a7098832b78d7658cede7fe2df615ee2
MD5 f052d365418b967e81f4d5b85380b230
SHA1 3b6b3a5ea893b136211d86a6bee28ae59e22924b
SHA512 1e2ddfd78ec23b74756f5667318f9ed8dfb294dc40760b44f8f54646b546a0c63a91da8a2bdba6d9d2ea85c2e322070e572c205c5254f7401df4ef00e138683e
SSDEEP 24576:tG88u8FpJqH1szria7/me7I4kKAl1Q32dxD+sdHm:g7ZFPqVLa7//Sl1Q3Yysd
TLSH
T19695F16576E001F0D47BD13889824667F6B2B8150364FBEF07A89B911F33AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 fcea06ae9ae6d77f84d79c4199eca0d7bf0c1dd0603e33c7cd598787ccfa929e
MD5 8234a87f7b00b0cf89e089f2d2957e01
SHA1 28ad5db4623f9f40ee69ecb6084bb6e034a4b171
SHA512 62c41d1e09a7033bd71c5fca21c35c687cd4ca05dd6568417acd9b64a8ab8188f98f77d0b592c3790c3011c89e1709ccd1b517afd8f65300bb6b25d4a83c4c23
SSDEEP 12288:5HvUrBFrEjwaQYf7oOyZakKLcDW4r7X71QYy2dx3T+sLhHm:5PUr+NQK7I4kKAl1Q32dxD+sdHm
TLSH
T17F75F11F26AC18E5F67AA13D89828319F77278520311D2DF02E1917E5E779E8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 36004a4e5bee5fed21ced87b5825a9c40d2b7bd38139a1798f36b2608bb08260
MD5 ee398c555f211e07940f00c32b4bba79
SHA1 22cf8d4af6feb01b65a22207eb133ac8d6ed5047
SHA512 f73fe5353bafeee7ffea210cb181e50de19a5a78c52f64132da473485d51eafe3c4dd4423a878de52172057956838cccf263f33a4c2460bfa352843b79f4a3eb
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWSl1Q3Yysd:uG05lO43bg1A
TLSH
T173D5CF6A62EC11F9D1BBD17CDAC6460BEBB23815033456CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8a4a5ab91772574801007a20e31b9c4620d6155f44c0967f14e8356ec8ac2636
MD5 7dc28e0815373da3d02fca89028e153f
SHA1 fe4d58ac0fdce11983b00c8c47845b17e235dc31
SHA512 41853abaeb983751f140fd22333419668865f1eff6103095bbc0ed4b49b8dc877b46ef0d6abe21f63dd0a552f5be8e79718d22e7cf8d07f6bd3e7bf3299ceefc
SSDEEP 24576:Ufa5POZ3dpuWVM50JicR2hG0lasx2+47eidnM7I4kKAl1Q32dxD+sdHm:Ma5POZ3hJt2pasx2+muSl1Q3Yysd
TLSH
T1E165AF5EA6FC01D5E179D17DC583861AF5B2346153319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bdec75feb9bdd39e99b6f05c459c32105f0a271225da76e167ae1f2f67ae45c6
MD5 5210ac44ec24191f81bcaa2fc321c953
SHA1 07609a5a6c1d59e567e8a4da9d6cef2858b0c66d
SHA512 c09b0fae72a715bb1c3ce2c11582042e7efacda6ccc82ecca2a269571577ea7f3a7df5eb5e20a86c78129116b7fc3e5a22263c1b4aa968a5c35b40a9503d0a0f
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7Fk27I4kKAl1Q32dxD+sdHm:eNc/zEOVHFfSl1Q3Yysd
TLSH
T1EA858C1623E901E4F5BBE1BE89779546FAB17865133086CF0291851B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a48b23adf9781ae91b3039e8d03841747b632e5a2cf61a08481cfed216c6b51c
MD5 779a5957977752e5863ea59bdabdd9ef
SHA1 5196265e57b8106efcdc0fe06bcc2154ada62d4c
SHA512 c89d63fe49812c562ee59ea874e97a26f1fa85234d59c4d59d3eeec18249bdaf26a2e57e9765d5e274ba9a4cd31c5de49857b028894973c64aee4eef910c4eeb
SSDEEP 24576:K3kNvNnaFeYhJNtmZBmA7I4kKAl1Q32dxD+sdHm:K3MwBtOmMSl1Q3Yysd
TLSH
T1F955AF2EBAB845E4E1FEC675CD238512EA727851073292CF5390C13E4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 b0d00f847246fcc344a62e21047f24a993977e4a8199b309924f2ea7e06ab4e6
MD5 1e6e39e4dcf18e1fb06eb424607ff313
SHA1 745540b487e1abfe6bce6fe6da43027f176a2e92
SHA512 5b10fe0c2a3a9b7941dabbea1466c5d271f877de2c73ccf9511b532b4b2a1671bdf70a50cd1fbae07a7d63e2dc5fd452301be5e152c0a3b8e2c122507fa807df
SSDEEP 24576:/D3FHshBIYQgA97I4kKAl1Q32dxD+sdHm:/DVHeBIAAhSl1Q3Yysd
TLSH
T12485E12DEA9C04E4E57BD2BCDA638606E77238A8032165DB02D091B55F6BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1456-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1456-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1456-367-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1456-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1632-83-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/1632-361-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/1632-77-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/1632-76-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2008-365-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2008-104-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2008-98-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2008-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2008-362-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2016-63-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/2016-65-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2016-71-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2016-293-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/2236-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2236-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2236-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2236-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2864-19-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2864-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2864-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2864-13-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2892-125-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2892-136-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2892-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2892-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2892-131-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2932-396-0x0000026703FD0000-0x0000026703FF0000-memory.dmp

Download

memory/2932-434-0x0000026716840000-0x0000026716860000-memory.dmp

Download

memory/2932-398-0x00000267064B0000-0x00000267064D0000-memory.dmp

Download

memory/2932-397-0x0000026716510000-0x0000026716610000-memory.dmp

Download

memory/2932-390-0x0000026702990000-0x0000026702A90000-memory.dmp

Download

memory/3968-48-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/3968-39-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/3968-50-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3968-44-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/3968-37-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4272-113-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4272-111-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4272-366-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4272-119-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4976-8-0x0000000002400000-0x0000000002466000-memory.dmp

Download

memory/4976-297-0x0000000000400000-0x00000000005A0000-memory.dmp

Download

memory/4976-1-0x0000000002400000-0x0000000002466000-memory.dmp

Download

memory/4976-75-0x0000000000400000-0x00000000005A0000-memory.dmp

Download

memory/4976-0-0x0000000000400000-0x00000000005A0000-memory.dmp

Download

memory/5048-93-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5048-106-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5048-364-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5048-559-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5048-560-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5048-86-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5988-52-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/5988-53-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5988-59-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5988-276-0x0000000140000000-0x000000014019C000-memory.dmp

Download