ae09385e5ead865f470542ab301dd64b0de9b2a55b98ca68c423880654e86ea3

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
Size 1.3MB
Sample260709-b36dvsct4z
SHA256 ae09385e5ead865f470542ab301dd64b0de9b2a55b98ca68c423880654e86ea3
MD5 fb60b13cbf9980d7eaaf742fad8157e1
SHA1 4b7c2afb14a7dfb1a86c97400676d1780c8c4151
SHA512 64e64dae80d25ac89a870e2771e6852e381bc290696a8378fcbf90eeab0dc3a3320c26a059f0077ec5cb4d59624611e26cc82ddebadd455701baedeed6c5efe1
SSDEEP 24576:uD+/YMvvvp9o6jauPbLqAzcRPLPWTI7yBwSnnrFb4PM4MYgLxEVyGLt:M+/9vnoQLDLqAzcRzOTIOBDj4MYPVyGZ
TLSH
T1E255BD09F58CE0A0CCEECD30BDB3846D29267DA05A215B7E0E5474676FF17CE9429E26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1876	elevation_service.exe
3084	elevation_service.exe
4840	maintenanceservice.exe
4208	OSE.EXE
2336	PerceptionSimulationService.exe
4388	perfhost.exe
700	ReFsDedupSvc.exe
5464	SensorDataService.exe
796	ssh-agent.exe
2884	AgentService.exe
2424	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ee2b6020ce3e03f1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118546\javaws.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c98b8615440fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3fbdd5c440fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b5ee50e440fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5015b15440fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001be9f614440fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000f1cc0e440fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b4b6415440fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004cfd400f440fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
3084	elevation_service.exe
3084	elevation_service.exe
3084	elevation_service.exe
3084	elevation_service.exe
3084	elevation_service.exe
3084	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5744	2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
Token: SeBackupPrivilege	700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	700	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2884	AgentService.exe
Token: 33	2424	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeDebugPrivilege	1876	elevation_service.exe
Token: SeDebugPrivilege	3084	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 5964	2424	SearchIndexer.exe	99
PID 2424 wrote to memory of 772	2424	SearchIndexer.exe	100
PID 2424 wrote to memory of 5560	2424	SearchIndexer.exe	101
PID 2424 wrote to memory of 5444	2424	SearchIndexer.exe	102
PID 2424 wrote to memory of 5768	2424	SearchIndexer.exe	104
PID 2424 wrote to memory of 3484	2424	SearchIndexer.exe	105
PID 2424 wrote to memory of 2904	2424	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_fb60b13cbf9980d7eaaf742fad8157e1_amadey_elex_hellokitty_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3084

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4840

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4208

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2336

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4388

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:700

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5464

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:796

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5560
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5444
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d5169a066f2dfddaaa0dc90e983d433dbbcb457802e8b6e1ba73dece2a0395d7
MD5 293fecfcc2ebd11a0d091696485f003b
SHA1 960e8c19aedfba3393a37cce443ec83c938f985a
SHA512 abff2040fa731ef2800ed27f60771925d1b25fb7552aceadb3a8e2b5716838118da050032c55e4c5ef3c5aa169520886045b30262c14aabfe3725e75e4d2a52d
SSDEEP 49152:ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxndj4MYPVyGLN:C3q6HjBBV5
TLSH
T1A0D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 69d54837e1f80485ee500031ff63706c23489b2a444d03c8f49ac5c68ece0397
MD5 6199ac3fcf440393fc5015534e4956c3
SHA1 df2fd8b4bb30aacfc889e59bb3e95cd25fded243
SHA512 f0f741dc40dc7a84904de0aa388393cf0c576aeac0f0a467e2c8660ea174093c5398056fcfbe5c42ce7fc2ce9ba935924ddc51dae0280b3cbc8bf47974c591a2
SSDEEP 12288:N1XLsswWkxy2lRq2czAM34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn95:jXYfDtczAXSnnrFb4PM4MYgLxEVyGLH
TLSH
T1DE65F12977E408F9DD6B8278C8A28545E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5b2b23d2fe4126c7bb283f3fc519ad8ee67afbe02f30a62947002aa416654fe1
MD5 150ba7ac8486efa9f5fc4396dceb8590
SHA1 a5ec5682112263e9424000ea738c9c01216e324c
SHA512 48afe2349104f8d648fea0a40efb23079e7af3bd640db49d371892af61a476dc8e815d55e8563f6b60191ed4e37582c5cf47222f7a040bfaf4a7c04e66d33043
SSDEEP 24576:N0Le5ji0hmxirM6SnnrFb4PM4MYgLxEVyGLT:NPji0AcSj4MYPVyGLT
TLSH
T164859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4283015df7379edbef143458f7d8a6f571dac101ac6dafe2e00c9073b5b3d53d
MD5 3251ff8929db02f143e1b31bd0684931
SHA1 fa2a95c3dcf6e06e854b616125732f79e1e2f45c
SHA512 70230e95e6f3e132b2923d7a3ceca7dfeb39b27559cc3952fd5aff3f69f3dadf5a3aff6755ec2bf9d0b34f3d1076ececc5e4d3c60365cc951423ec892081fcbb
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyugSnnrFb4PM4MYgLxEVyGL/:E/ezSC6vUzPvxHjyOj4MYPVyGL/
TLSH
T1FD755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2e0c727662cedc3f5619020dd2a829d25100ba85eb96e14da00b87415af648cf
MD5 750d5fe4a90f036a137dc138c6f4c54b
SHA1 b720475c7737f3a1c2e18fde2c8ad6ce3767fa82
SHA512 e43fad5a3a23336aea2809905ba73489008c104375f0a5276e64aafe667ea8e29cd308b541c04e9a48df2f6489fb88b68c9e3190db59b70c50cfc29e58a1fd6a
SSDEEP 24576:RVbqPb88hv/l+6LSnnrFb4PM4MYgLxEVyGLh:RVO88hXl+hj4MYPVyGLh
TLSH
T15B559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d0d189fa5f1d36385cb348727e3d59f23169cdf792bdcffafe1f2da5031bfba6
MD5 464235c404dd0d0786f0edf04b96628b
SHA1 b568e0ebea956fddce9d0c2468af281eb8fd2f90
SHA512 bba23450558fa1a553cc3627f5a383b86e661901a72afb14e1c8d74a65918b290d832a3a75587e8d0b8fbdb036efe4e118043ff5c1097e74b364750dacb7bc5a
SSDEEP 12288:xRp34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il1:xRuSnnrFb4PM4MYgLxEVyGLj
TLSH
T1FB4523A62BDC10EACFAE15B0D1F96AC8E215BC61F875B10B6751785B3A3B20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 6b510b3eb58899d07282ce2d7483931ddb6924a5d81662f71772135947679a6b
MD5 57577b78bcb81c1202a2063d5e0db458
SHA1 0538dccc985e2ff50c8306bec012c2281859dc3b
SHA512 9db5c82adcf705fa4d0dee96ae457e6ed783d9afda4b43864f3545a3f1be3aadc42c5c82cfdfdae8d3589ab4e8bf7bb95fdb147f74fc8584f28db00523ee6c73
SSDEEP 12288:reBNUbTVO86Uw34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:rJIUDSnnrFb4PM4MYgLxEVyGLw
TLSH
T1DE65D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 439509c2c2633d114bab9478226f6a86e6ab911e48f50096c07632f36d68de81
MD5 0a8999b29385d0a2330652918dd3f5a9
SHA1 cf946dc210ca982aab9440e33048e19b5d77b524
SHA512 73c361b54ea20fe3d056183da0c7d34ed88a99d2d579b4b39db53a0016b70c9f1073ccc72654bebabe77a3873b492b164ac07ac099b5c2794bd3f3e713e4115a
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH0:OQvGAdlCEL8c/yRNw5CQVs
TLSH
T1FA267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ef3358ead3823e13b98ff0d88b56ea3a1de507385476c5e3b1990f41aaa412ad
MD5 01e307a9d0668c1ecb7350a444a6cda7
SHA1 003ec1dcdda4a6fe9c1ef76c5ad1792022b1adb1
SHA512 45f9ed163dd860c083e182798119389140d442fa63dba0e1e4a8ece8aea879419b77257acec10f02cb2f718ae51ff646c1a71f4ec82da999154bc12ac48e1afc
SSDEEP 12288:XAwSfxL/2Dc34DLLmt0LDQewsAj634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAv:wdewsAjpSnnrFb4PM4MYgLxEVyGLg
TLSH
T10B75E031FE74E036C7BF0DB21B36C716542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ba648141b12c47c5c20453c85af25cbe52edcad3ea8530e28003cbaa2a9edacd
MD5 405d82308f7f091296bbd1f1e536fcd7
SHA1 cb4352b029c85d25a42b9691911a729a44d2869f
SHA512 bb1118c59b7488ef83ad972ec503e147b6b911514af99a551d97134e7557bdba85fdb18da333beb34fe38f065d25b125aab6fc92940173f6a2cd52801c79c5be
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:LUEtQevvqc2W1cpV2EI32
TLSH
T15C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 662eeb7f94d6d74526269d0a9aadf0f732434d1a57a8a70535fe181f15fde99c
MD5 091f8d739c721c39c8ea461ecf3e5552
SHA1 f221b5925517784ca4e3c0be41cd25fe51862530
SHA512 551014f888f7d9e2a0b1ba41c0f18041d45592d7f5dc8f458da4839737615432cb99a5da654763f1222745cee8ff0d15dda64eb12cf21f585a0ffdd38aaabd7c
SSDEEP 49152:CCbRquA/m2yL5zQfFiV+XenmE3/zCj4MYPVyGLT:HoqtVjnmcV/
TLSH
T124D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 76316909a3404a7ab5ef2b8e7d73d84433f69aa8dfa174d6bba2b5ffeadaabd2
MD5 94147482a3143043a2d2a6c12a2692f4
SHA1 9b90111d164cfffdb8bcb36eceb668ba3a729e18
SHA512 8338101f405cee34bfba8dadea64960e1fda0251725c61977a2ee07ee86a402bb0c13eed24f18667ff3ec6f4b0aa5628a56751db8fac4d10d9e7669fe47e03c3
SSDEEP 24576:wAhGLJIFoiwtA5l7S53sSnnrFb4PM4MYgLxEVyGLM:wAMyFoiq5Pj4MYPVyGLM
TLSH
T1D835AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 a6c87b906d6b049e96a731f9e32133702d51347f4205ab383a4d21b306d3f02b
MD5 6e4e758a1150b375e70d95707258c7b8
SHA1 742d5b62355084739051c063633af073a81147f3
SHA512 292357fa7e58252f086636ed9fca0471936f7fa486621b9f9810f2e83ea266161e27a94e56d4581db1f44708b2617131b2ea3f3a2296b3f6e7df369c81fc9b0e
SSDEEP 12288:Gmw5HEjsChNVBFgl0WDm+C/34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqe:fwuoOWVSnnrFb4PM4MYgLxEVyGLU
TLSH
T1CA65F14637E81CF9EAA74638C597C535F7B2B8122A21D71F1760C65B2F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c35deecaeab6fd00801782c0ead6ad60aea7d72ffcb87d070fe7eeedb34b8aaf
MD5 013b2e287ba35512f248c3519779dd1f
SHA1 1fe22d21581605207ae0e27bef14c6053a1e15b2
SHA512 12e1356d8f02c9a91f47556a8c52251a1fd999f25e4c58548ee36efad0d0f17243be216ae1d41f433a2ee9c7f99def4fe7a3b2640fe40f481be64cfc188428c4
SSDEEP 12288:0BZ1IyK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il2:SZuySnnrFb4PM4MYgLxEVyGLo
TLSH
T1C75512AA37E820FAC6AB4274C4F55688E3327862B77293CF1650655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3c15988b7e4b758006c7e8c4c45c8a9684cc0b2e2d7aac7fb78cdc3b3e92e518
MD5 0e15d31fd2f9b14a8f91452810f6bf15
SHA1 b7031e42a541409d0099343d09a0bffb5ade31f0
SHA512 2d653ea9bc67f58e0af5d38890b8f063fff8d31c26b49dcd17dc707dd8a1c0f9fc3d3688595201880d116f51328a0cf28c090763347bd5545b8d84d429ef462e
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:1QRQyi36YOcPQLvw2gAf+PN31VO
TLSH
T1DF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cfae66bfaa5c3e84e62fa673f869fb47d0416d2e947b322c37288de5e4f52aa3
MD5 cef1c6c72a0a61f3a5189eeab30d9342
SHA1 2af7f5e983b4e3bec5d287cb7fb79cbba08be152
SHA512 beb0370a333da7e69882be841f960add12fc1ed617cf0ee8e778664a8c9a2824478ff4b954ee368300d0623c7891e218158e67d4deab03d1ff651cee32db8204
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:OQRQyi36YOcPQLvw2gAf+PN31VM
TLSH
T1AC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 396a2452a2724582cb9544d1e5cb554c3f03221d5f6b2b420acbbbbdf2ffae25
MD5 eb493e85772693bb915df757d130d6bb
SHA1 19ee702e93377ecfb029bb04960e55e2a685594f
SHA512 f87d330d4ed8af812f4fd3d58e2a6251fdb83bfd3e2d70b113d588f29fff3223ef05a49f340eea7265d26fe0c5661e95106be9a7582f7850afac310dc80f99e3
SSDEEP 24576:7wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0iSnnrFb4PM4MYgS:z68Qg55nhheWu7PNU3/Sj4MYPVyGLt
TLSH
T114B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6f82a7aa34edda7ecd7bd65ccaabe49967eb02f935d0232b78e6137feb4704b6
MD5 ffe9bf5f581abdda54976ba708b33869
SHA1 9f09f8b6f59edb498c6afab6abffbddeddadba60
SHA512 8db338f4808c01b16b7271ba41dc51356118454b15d22d3c0790ee21066f700983b19fc5a5a43cf97261037b80d425b1087f0abab9e300a9117ca98bf715989b
SSDEEP 49152:K3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99X:by5112gYy5azzVvL69nLKnhZSVx
TLSH
T1E4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 823992f8adaf63256696643ec4a80ae8567f166da7d0b9b978303056f2822b07
MD5 fbe2fd01fd05d4829db73594ff5b86f3
SHA1 0862dd9aa7e383b4d428815f419d128c96bf6c0b
SHA512 bc7b9abd38e3af09f9ebb591580cf77bd431ee62cdfb66aa6442e0125dabbfa4af124d56fc06d4109776813123b9accb0494616a24c7ee8ae3b39853fbc9efd0
SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glAj4MYPVyGLm:Tu6JmVxd2ddVq
TLSH
T11ED59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ffeca2eebb54141f0b6f950afce40a7416c523f5cf5f3ad50b143b853e438e27
MD5 807400c81d7267a0c2c9926b9ff577d3
SHA1 09970a4dbaff8fb3433d4e03bb07374d917c81bc
SHA512 21f75a01b217c8bf563929d3e1c12d477708f4c02c627cac32cb5778744cf1bf5856af45e8fb4faae69a5fe8656d4d0cb9de08c5718048f860a404af29561340
SSDEEP 49152:x1hpsNoJpF1A6UU44CwH7R4xsj4MYPVyGLZ:xmifPbRcVl
TLSH
T130B5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 521a5689cee0bbc6ddf3095a946f664bb912d684daf65a2d3e4da51ac2926e5c
MD5 5544b41c91b42d34a25f3576bf9ef779
SHA1 69e4f0582dc1ab61535308f695b358d865cf41cb
SHA512 dc87b3a57a93a6088eceff1f6c98a5bf3904101878b0814c8de3426e13c889dafbd7e135db6532e9f76e27f1c2e0e105f50f0ab2b57dbdd1727aefde4461ba30
SSDEEP 49152:WSuZQIY0Be2KRRVtOnks6NMHqtj4MYPVyGLM:45dKTi61WVo
TLSH
T140C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 147ce611d44ae87d129bf6d2555cbc1dbfc8bf71a009b2ee9a75ca32a95c9768
MD5 2b19dd571e4b64bb19aacd38fc05be38
SHA1 988be0605543d83944ea44cf5abd53a4e8cc0115
SHA512 1416edd8bb0c64dfee9e7f600a5704c566e02d9c66f2014ad98931a3706b6acd97c593e20de53aa86dfcd4a2fb2d299f8641560eb768f67870e91f379b457820
SSDEEP 49152:4htSn8EApI0figngiDn0AP5wQj4MYPVyGLz:pX2iyphIVH
TLSH
T17995BE13F2D900E8D05ED174C7568632EA62BC160B39B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 108768d212c11f1b2d0e865f67c443ef6fc0626f53a64c8bb2cad014877e413f
MD5 c8c23508cdb16b31599583d2420aeacf
SHA1 96e00585f33c8c947eb36030543458ece95f717a
SHA512 858c766eac95f0feb1195256de13a3a8b099021b15a421948ed8d47f349cee17bc99c49c859ed2558f890ccc66507b341aee608fc753d2d03a2d749571633ad9
SSDEEP 12288:oB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilG:oGSnnrFb4PM4MYgLxEVyGLI
TLSH
T1414523A62EDD10EFCF5D16F0C1A966C8E2097C62F976B20F7B4574173B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8e3f99b54cf7adccac457abf724f56fc885851a326bb683894d246a5765eefe6
MD5 d249dfb916e4026d10683df5f3003f34
SHA1 725d3c997bfcfae806f2b00618973346337aeae4
SHA512 7be50784101ef7189b95d6f8fdc601ba9bacb5c2c220566a14932cb0f48cfc22a795e14c85f40261c43b0e7bc2344d72452410b58d1b8812b1ee6ad6b0630a6a
SSDEEP 12288:KG34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilw:K9SnnrFb4PM4MYgLxEVyGL+
TLSH
T1F84523A62EDD10EECF5D16F0C1A566C8E2097C63F976B20B7B4474173B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 851c7acfc3069c6d257b1bc563a9747fdf80a3ca60f3b1e7d3398d2d4154b10e
MD5 f9643b9da8a77ab74c4529baa282e335
SHA1 95105730e3bc84901e9b414b58f195837375abcb
SHA512 6caf5b4c4ccba8007870e0eeb7753d9c9258b39af9a9f8b90d7a85e308d30c1f9983ac59b07e14cd407db03d2338288d01e1ac7849c69a350874f32d9dae71d0
SSDEEP 12288:Ko34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilO:K7SnnrFb4PM4MYgLxEVyGLc
TLSH
T1AC4523A62EDD10EFCF5D06F0C1A656C8E2097C63F976B20F7B4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 2cf9cfc6d6bdb5526eb9f09358fe9edda0a7cf49c14db8affb5a8d3944bbde65
MD5 afb0623dfda106c095a41963ca1a803f
SHA1 3f6611fb4310441caf46a473e201275d342943aa
SHA512 992fa3b4f09d2139c395092b9870312c4e8b26cbafd4410f4d6a60404801eba286bd13a85e92bed3a76032853ff86f26232e06342014506f0c8b2f624240a22f
SSDEEP 12288:FVz34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:MSnnrFb4PM4MYgLxEVyGLF
TLSH
T1CE4523662BDD10DACE6A96B0C1B556C8E2257C62FA72B35F6740381B3F37348AC71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 366ba61f8c60f510eca65f2e8df4cb0b856e2aec46bac861acabfe4eb1812cd8
MD5 2ec9952f077159808d793c2d1e1f42ea
SHA1 677287660d90c035582d02be4105dc4f9dd24cba
SHA512 d36fed39913b41480e882f2f04a8b943b34a8c2bf3b8ab90171da4ca2c89d91e50eedc1579c5f02dce48ea69a99eef2317d5466e4465da4d071a91e28d0eee61
SSDEEP 12288:T734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il+:T0SnnrFb4PM4MYgLxEVyGLA
TLSH
T1F64523A62EDD10EFCF5D06F0C1AA56C8E2097C63F976B20F7B4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d311d3c32b4f72f827ab462b46337643d171a57d8a91ff264c4f13e2089c2ba6
MD5 c51049cbca8b63e586b6f025aa0932ed
SHA1 7a3d99b74f2303fd0553042257a3f2ce35bf28e7
SHA512 0159f01870bdea1916a4e9b3fe2e7a051bd5175465224f1e794201eada94b1a28b2fd372a2e628999dcd8d8aa40b48b048f6e87e60ea51ac2b40e871bb474f0e
SSDEEP 12288:xS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iln:xhSnnrFb4PM4MYgLxEVyGLF
TLSH
T1494523A62EDC10EECF5D16B0C1A566C8E2097C63F976B20F7B4574173B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 87604f6efece842b2a3b4dd46b8c371980176bdd20eb6aaa5849b907e3d5aa6f
MD5 51917d3064c5094292bf2ab74d72826a
SHA1 2a64d75db6325b35d689874b6095289ec6c34b23
SHA512 db92bd387091658e0d7daef6b40f8b336e4aff67199e83f17e3d011b3798b0d7b3d4912f21500c13fac4669d9196921d0641816c908c8bd814ce6e94fec8d2e4
SSDEEP 12288:cO34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:cFSnnrFb4PM4MYgLxEVyGLc
TLSH
T19D4523A62EDD10EFCF5D06F0C1A966C8E2097C62F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 550048674791690ebf1a917193a27f7fbd927902f0aaf8c0078487506b03e8fa
MD5 0ea514a5e9ec8e8c12ae803780874005
SHA1 cf2d881bad127d8c0eb1ec4e0e80f2b7a7df0cf2
SHA512 01ce0c3ebfbb4154177ad40ac8e7b8a536dae362cad1173f5dbeb46b17d16c5c881bfa97e5bbee280df265d8ab73e52c27c6986407da9fa23afb211961405bbd
SSDEEP 12288:/iZwb6zzFEoS2cPvym34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2P:aZMSzFVSOdSnnrFb4PM4MYgLxEVyGL2
TLSH
T1BB6502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0772243f419742dbd4647e052acc31768a004cbe530d170280922f3d13ef1b60
MD5 e4b0c6e4d3f176f7753f5a76c92a27f9
SHA1 5ff1f62648f8b2589db622f759c4a49213aeb8b1
SHA512 2623f1fdde03c81a486fa94f1226d81227c591b6aabaa44a95582a95672a08f8eb92751ffa544480eae063c63ba91e3e605e426ff0b2c423dae9ca2a8652e9b8
SSDEEP 12288:oF34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:oCSnnrFb4PM4MYgLxEVyGL+
TLSH
T13A4523A62EDC10EECF5D06F0C1AA56C8E2097C63F976B20F7B4574173B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f2a4ab6ac8e35ccd57f57473754f233d180dc4612541d256217e8dd0676919c1
MD5 5e273c3b5fb27e222ea77d603d6a7d4f
SHA1 888bc045a6581ffc3f33e63cc08e4f961115e60a
SHA512 5de4da73967ac089c72a8fb739d97b3bb9992ec563f1e6bf60391eb8697a3cf9ecef1506aa4d5d8c6290fca2013f68200665c5819b57238c8b9a2b23891067c6
SSDEEP 12288:L534XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:L+SnnrFb4PM4MYgLxEVyGL+
TLSH
T1A84523A62EDC10EECF5D16F0C1A966C8E2097C63F976B20F7B4578173B3B60D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 1e51cc3a37d2680aec13f6a3ccb3367b624d0cd9dff599e3705b19d17400eb0e
MD5 c7e0b7cd68106b6a49ae6585baf3d5b6
SHA1 69b6953cfe90cbf292faaec80a9517462a61d9c2
SHA512 e63b96f113b6d6a4a21ea45ff572a401f815e11dfdcff47e45ab157141c701c4c50ac79812226411cb4c01daba22be20806cfd9e19621ce43131b846fd096e93
SSDEEP 12288:iyPz5L8K34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il+:/zy5SnnrFb4PM4MYgLxEVyGLI
TLSH
T1E555025737A530FDC67A8274C4A21A45F336B8329B309A5F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 02fdce602f8b6f79a32f8436c6e5bb844450c9ab05a22234d8cbe530afefcff2
MD5 4dbe87eacbbde077e6c44b01be04e230
SHA1 9803ff176d42994967fdde27fbfd285f6374f4e5
SHA512 105b278759f401ef824d302092dab764e90a2cfc8f7677541579fbf2ff1bf1efea22ccc192045ef44597ffd4071b3899430e9238d3b36390a01d351a6a63e30e
SSDEEP 12288:0F34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il5:0CSnnrFb4PM4MYgLxEVyGLz
TLSH
T12F4523A62EDC10EECF5D06F0C1AA56C8E2097C63F976B20F7B4574173B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 441cb67a5687072fc984e413567a2046dfcd523df758bed1c1770c78d68a3af4
MD5 bc0b29a716f8e3008b9bc239629b6eb3
SHA1 7041ec82b8a65476f7930cf7ffd36875acfacec5
SHA512 b6c378a12c7ab7bbe4ce8323a687a09c555490bcab0feb26f2c33eca5bb13bba1a65bacef23645dca4e9ae927e001adbc38f940446e6d9bcd4a37efd0f597bd7
SSDEEP 12288:SF34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:SCSnnrFb4PM4MYgLxEVyGL+
TLSH
T13F4523A62EDC10EECF5D06F0C1A966C8E2097C63F976B20F7B4574173B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f7037c38c4c027fbf0b07f559cc08abf895c0bec59cda87262a8766ba20b47ef
MD5 003e17980d5f008d86e93e91dbc041bc
SHA1 39febe0b5b4734534b65374db6b85d6c64b10ff5
SHA512 ddbc29bb4fc80048c413f8e84ec6fe200649c0f6520c1f6c508abe446374b7a2511bffd8e7c02647f01c46a4bcf9ed1c5eafcee29a84307f0cad653dc5d64f3a
SSDEEP 12288:AyPz5L8K34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:xzy5SnnrFb4PM4MYgLxEVyGLu
TLSH
T11255025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 45e3efcabc691e40af242e9ec05d1d7564d8aa6b500b51b865bbc21c6bc3b37c
MD5 448cde6573e5a7ad6b496f8a310a1dee
SHA1 1ef02a175c881924a25d70076e798d011c078c4d
SHA512 ac9447835e6f7a690d3e8ea35af5498151fcab224a693386da73bfae0c3c8db7a7e24c6b0d0a04d06b525b36ab432725cd42b075a57abc81414bd8744f44753c
SSDEEP 24576:4THaLl3z0zDrSnnrFb4PM4MYgLxEVyGLW:4T6Lljzj4MYPVyGLW
TLSH
T1716502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 9c2f80637fdd07ce9fcd6484d66dafcfe47ad53352bf1b2cb1585d9b2a028ad9
MD5 5ed7b2bcd2758af957228eb91a5dcc77
SHA1 3389fd2305c4a729830af049810d8151feda7164
SHA512 608717c687ec2cf4e1076867c07d8fbe841c132e868e811c35974bbe702dd0d15c79dcf905f376fb854211821c1387f49364ba31214c6aa9fd4d3423489f26f9
SSDEEP 24576:/37d9CHKy7GZPSnnrFb4PM4MYgLxEVyGLI:P7d9CHKyaqj4MYPVyGLI
TLSH
T14075DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ea493611d8ba3eb2dd003d367e843c473afdb3d5112f4aae72b9e14bc0e2fcca
MD5 36654291aaba3baac6f8ee7e3ffeba9c
SHA1 d95cc8444d50e2da3182f0aacff8a1ee47ab0b94
SHA512 43bcd56f9757a6c029f9f1b6f475ace6a35336b6216b96325d98d60b3ac66f0060c1af8db105af379c1afa33fea21c222999dee7a6fe331a148273a0ed181a8e
SSDEEP 12288:1I34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilQ:1bSnnrFb4PM4MYgLxEVyGLu
TLSH
T1224523A62EDC10EECF5D06F0C1AA56C8E2097C63F976B20F7B4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 75755c31dde70a90d89d1b1173c6a6bb435039b90ff6f99b87a99b7e2f8852fc
MD5 076fd459d6d9e088da5ce827559af918
SHA1 2c69c98d037ad5b63ccf8e41abc4b30a7420ccd7
SHA512 051aee0fc8ca7a7cb46f44618cb4dbeb69d22eaa735149a392261307810ef8451b9c00e92392fa1a6278f564d976c0d0110e1a2d9f91640c9ae4df5a3f76c0f8
SSDEEP 12288:Eq34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilb:EZSnnrFb4PM4MYgLxEVyGLB
TLSH
T1464523A62EDC10EFCF5D16F0C1AA56C8E2097C62F976B20F7B4574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 059f2bb240c0cb2a69d8b8fb4b6731a6c6fc354f1a68d0de9746bc7dcd49b0b2
MD5 82894201c4352ea27780c9d03f407acb
SHA1 89468a12a6e7d031befa226a0ef793321a960e76
SHA512 66a3f026aaab0111c3aa894a7145a70968770c70dc43a5b27e2251c945b5a313dbec99496076d15ba21db279b7ecc1d8e0330f1f7b2331515808a24d5d7caf43
SSDEEP 12288:fH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilR:fISnnrFb4PM4MYgLxEVyGL/
TLSH
T15D4523A63EDD10EECF5D06F0C1AA56C8E2097C63F976B20F7B4574163B3B60D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4335200d79e484d354fc961cbaffe056227c44d8478ecce5f60181567eb2158e
MD5 88d61b2e74443bce26cd5be1ca6528e6
SHA1 0698500497f90624da59dd9c9b58eed4e35da8e6
SHA512 030952cbea239f0aa63cae56336e587da95b0dfcce4365ef18b5a7519db6d59a8ef7349aac2777740ddc401d5f1471adfb8e15003e7da58b6f3af569ebe3255d
SSDEEP 12288:oF34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilV:oCSnnrFb4PM4MYgLxEVyGLX
TLSH
T1B94523A63EDD10EECF5D06F0C1A566C8E2097C63F976B20FBB4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 bebcd9ded223362a9eb1004e5551fef0c8df7e9e336fcdddd92308224deed308
MD5 e742f59b183a3abb8f56fce475613e10
SHA1 e0e0034f91a61e53e8211c019923d0a59d2c9d30
SHA512 5df3bdd96ce0c3f0a3ae249879e01becfcd8c4dbca53caeec1d68951c1987e340428ad2b7fbc313d2b01768833472486094f7ba0e6fd4e3a0fcdecc6bda39a6d
SSDEEP 12288:eI34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilC:ebSnnrFb4PM4MYgLxEVyGL4
TLSH
T1D14523A62EDD10EFCF5D06F0C1AA56C8E2097C63F976B20F7B4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5753b356f50a06ee50772fec887ae004ef11ca873564dee668af06e5f9dff7d7
MD5 16e213f8c9f1769fc7ed8275504e549e
SHA1 5ee684f85a00672822aa6e35f36d674a07c7642c
SHA512 8a2e3c2fa26f267ca89eaa6cecd0d1c74aa5ac3f86f05d489f231d674d77ba5125385f426e22a75b8b5df0d002abced3d283c268218dc6510da48cd7f0e18704
SSDEEP 12288:Ut34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ila:UqSnnrFb4PM4MYgLxEVyGL8
TLSH
T1BE4523A63EDD10EECF5D06F0C1AA56C8E6097C62F976B20F7B4574173B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 ae918e0f751b9d354a3b1410360f881b1c453669a3a6e959829e8aba916f789d
MD5 4b76d2509baba80fd75b9eeeb5111312
SHA1 e86bc17ff25cadc495cc89f53de5b0e2bc884565
SHA512 e7aa6ff4b5f9e8a59b58d52011496896e6ab8d78958722b581b9cf1d83699ddd44b4a82932d2ca763d5bc00362e4abbbae60c8a34add7f62261cf98a40b153e1
SSDEEP 12288:l734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il+:l0SnnrFb4PM4MYgLxEVyGLc
TLSH
T1184523A62EDD10EECF5D06F0C1A666C8E2097C63F976B20F7B4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 1bc946be47b94a908f5e10780ecd1b403293b5bbeea57eda1ad6ebd81cc884f1
MD5 b8651e5a2bbb7086963032468e1c8505
SHA1 17438bd66882cfe186c9b83b8843a4295c16e024
SHA512 43dbdad5c56681e90f7c792526d8f49cfc9a1e9eb9868df85fbd3a18096486f8b970972fcf7c6571936c6a08db43135739e5c10975bbba9f8efee55d6a8cfac3
SSDEEP 12288:MA34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilx:MTSnnrFb4PM4MYgLxEVyGLb
TLSH
T1E94523A63EDD10EECF5D06F0C1A956C8E6097C62F9B6B20F7B4574173B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 8acf797acf576ccc768547dc9e5392b5a7a80aed1ab5c6bdf5dcbbd8e3976f25
MD5 6019f2b3758b601b5ac2b1e3d866477f
SHA1 99d057344a29538a8cc5f527cbbe51112c231399
SHA512 bca2a7caaf747e9e29b575d540d1120aa47fc90741c2606579169c7dfe69a36bdb2451a50a5455124c4ebccde12b007b7a722d19de8afc5427a64c004681353d
SSDEEP 24576:Ffwvok9RX6wkyAIOSnnrFb4PM4MYgLxEVyGL+:DMnYIpj4MYPVyGL+
TLSH
T15485D029EBDC04E5E1B7923C89B3460AF2B178695B31C2CF129A536E0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a377fa9cbba8c8cbd017993fb39e760b806722c9a28f6a9467609a18fc3f349c
MD5 68b08307e8b1e46acbf2f3cf2597c6c1
SHA1 6d4837f1050d2696dcc75f804f29871bdff0748b
SHA512 54bc1c2463a9b089edb4c98d632c0c685decb823f9ca1045d710e57474d0406fc06030a50bc4cd93544d62766f7445f3830b174598e8d1ccc7a13bf2f7e070a7
SSDEEP 49152:MYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wj4MYPVyGLr:yySzPVV3
TLSH
T129066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 032aaf5a29b7ae4d50a1ebda05751be68297a14e378baf797a84d0c64dc678b2
MD5 2d029da887d87549ac7a9e6c884a4b44
SHA1 fb6d3666e1385f476e15ae8d90214476290eea27
SHA512 095fca422ed5a4e8214123658599265dc169a347657d77277500d46ff186ec37426cf33c989b21aac041938cc6853ee37833c1fef4e8c2b14e8e089ed18e0dbc
SSDEEP 24576:G47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYtSnnrFb4PM4MYgLxEVyGL0:G47JUQj1irIhCnDHUPfF/Aj4MYPVyGL0
TLSH
T16065BE1EA3EC01E5E1BA827885154A5AEA71742E5F31D6CF2270837D6F23EC45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3214282454b3533207d4e93172fcebfe45ca4d7a0bfd289c62958ea176a04e09
MD5 54f5d72294d7b8ec56d38fc658cef827
SHA1 157cfcb0ddb031f5e7f1477663c4d7852611ad05
SHA512 8a8b371c71e9fbd1961c419ff3be9cc45351ec6f3298f28f031ef637a576a892ae2a7db59679c6a57f22fc70c9419c752aa557139e1da4700f11d4ef36b02d78
SSDEEP 12288:eNsf134XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilB:HySnnrFb4PM4MYgLxEVyGLX
TLSH
T10355F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 12KB
SHA256 4ebc1cd952a7d5d044ba92635ff2e8f7219f3161052f347119c08fe7a5ac89c8
MD5 a4c85d69178b50057636e0019c8f8890
SHA1 39106dac79fd88149b037c1f9352a768c99b4af1
SHA512 df333fc49a2e1bfd32abc5f4addc0d37dcce0f553728d0d4ec632d0c65ecbc536874c3e242d7429f7b29e723bd2f23603ad1f4141d04a2464f734d2d60b36046
SSDEEP 48:p1SUREK0kENRu+UKnTTdZn7fXllbXllNDzJhJ/:p1R+LRTXTpZ7fXllbXllNDVhR
TLSH
T14E42DC21FB84F620C9EA09B6CCA1B7D51F6AF0285CA4034331C97A5ECCD42E60D6EA90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9df5f2f88d224f19211cd21baa56b7ee19f458d2ca08618be34595e28156e092
MD5 53b4a808cfcbd96e12c8c6b65d65fe35
SHA1 c84c2d4ecebf6bd1d5ab7cc97c31b051e4945e39
SHA512 77774735e76df2e92f37090afdaba3eabcf504dbb79e089b607797cd281d578bc38b6bb5c5f00f78fadd06800f20c0c3edde71011e651a8d5fffd2f57a9864ff
SSDEEP 12288:JM7d34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilA:CaSnnrFb4PM4MYgLxEVyGLy
TLSH
T1E74523622BDC14EADE7D16B081AA5698B209BC21FF61F18BB7407456363B6CC9CB1713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fb1e01befe55dec11d2c6be3d2aefef267b619adfb845e293d9790ce2400bfea
MD5 d1d5fb1f370cf8f15dd8bf99e4ac6783
SHA1 6804b388c5d5f12477e07c85a853c2acaa3cbe64
SHA512 e3fb017df048ee6824f2cc87296f82f21386d45b4c85a5108f999a11cd3a17a1f1d4474ca7cc56275199d0fd99836ab3b7fe8cc56363e099e99c1164fa9fb9fa
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYgSnnrFb4PM4MYgLxEVyGLm:4gb4mBIBhGFGj4MYPVyGLm
TLSH
T1B465AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 4da034e8d12159768f9e88ea14a0bf82e151461f41b09313011d24a3995b31b7
MD5 96a9bc9f3678904fcf019320f17e7e92
SHA1 4037490f7f9b039a8fb37c5d974146c0ca6e9e43
SHA512 3c7794fc844781b59d58a5f56617509f6280410ae310985a2e477ec549b858847f06bb16010cee860aa23f826b1ab4fbc6a8c9271132c581d999bb19d08637f7
SSDEEP 24576:cG88u8FpJqH1bzria7/mdSnnrFb4PM4MYgLxEVyGLJ:f7ZFPqVea7/7j4MYPVyGLJ
TLSH
T18C85016577E001F1D47BD138C98646A3F672B8211364FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 6a56b3177f37ed757968494dff7b2ec7d082cd068c6b97b2284e53071e9e2284
MD5 43a4f5c6feb396b8dc75826d42330d2c
SHA1 95e25536d00cbfba2c80cadaaac81778b744c21d
SHA512 043363a0e9548b22de94a61a0e8c1dc8849ce4b3600f638f83da6cc6fcb9835c3bf1ec465dadc5778843a58c93dee565c076c0d53126f117d505ca18cb48e31f
SSDEEP 12288:SHvUrBFrEjwaQi34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilZ:SPUr+NQxSnnrFb4PM4MYgLxEVyGLb
TLSH
T11865E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 456969d004c9d0e371c2e4eff1eb2353902fc3f66501a110cbbc5940d1a1116b
MD5 71c1d7e9e524605a7a83f54a4cb276c1
SHA1 d1d25f0f042e02efe18b9242729c20ddaef02611
SHA512 5288735b265bba1e178e52ae0dba2a8f43196c81fdb1d831f4bb2eea7403a58f0b20f712b52c580a166b04c1de431bd799dec2ea4724db61540907df7745edba
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjaj4MYPVyGLK:ZG05lO43bKV+
TLSH
T153D5CF6A62EC11F9D1BBD17CC9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ec3dd5e4dc4763cc64e0fe6cc3301ff79c0fbd4dd89db0753106011072ddcefb
MD5 b2dab6d154315b61b4aae5015e63b22a
SHA1 b491215cd15980a19e14f85541c08f09fab6321e
SHA512 4624f2f2b34418cd5d2f510cbf95152bb68d19354c2d592a1c39f73254ae60af45ef98198eeb3881c3f727260dca821a4b6351f87fb6c6998e1257e48c184577
SSDEEP 24576:ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidn3SnnrFb4PM4MYgLxEVyGLO:qa5POZ3+Jt2pasx2+mSj4MYPVyGLO
TLSH
T13665AF5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d6f74f798cae10b7e96559a5f2714d382b1421e6aca11d12be8d0098267dd414
MD5 31bd1f1820e0513d5d0372c91020fc2b
SHA1 cd57f298d1d07a6b44f704a9e9dabc2dde5560cb
SHA512 98123e23fc0534f30209bc3caa1a601eda7a009d534e2e24575a557c4cd5bfae46bd9149cab442c5d7ccae1689272b14e4ea7e3b333dd8118030af3aac9c8dec
SSDEEP 24576:+NcwHdjbyQ4nLC18lb/EOjowL7Fk1SnnrFb4PM4MYgLxEVyGLJ:+Nc/zEOVHFbj4MYPVyGLJ
TLSH
T164858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a004a892ae09c79c8d1cd8b69bfee52fa0c11aed24a73c09270c3dff9f575447
MD5 0d7e135d882d357316ca94e71d9fcec3
SHA1 0951dee9cd8d3f8c040d983e0b4e67762454f1eb
SHA512 b2681b1ad811bfb3e3c8fa15e08501563c8904401e55bde50a88a21bef5113e79b50bee73df4a56caeea305d981e7853e3c428e0d7ed268e27a8a65a5f58dbab
SSDEEP 24576:C8kNvNnaFeYhJNtmZBmTSnnrFb4PM4MYgLxEVyGLl:C8MwBtOmcj4MYPVyGLl
TLSH
T180559E6EBAF806E4D1FEC6B4CD238512E6727461173292CB5290C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 22eb61bc995cc8c9dd43ad22298f5a6dbee0a1eaeb141d2ff9ff7a5f80f93559
MD5 de296a86771b4def9a53c698a93553c8
SHA1 37f697aa17a6c33e4ceaf4bf38a97803df132c9c
SHA512 93a412401e2940f6247f572c76f947d2bc214c91dde7648a8c4dad697099e8fc79c169c17c2a8ec388bfa55279e31c83a30e72745f48b6542f478670d2f8cc66
SSDEEP 24576:ZD3FHshBIYQgAmSnnrFb4PM4MYgLxEVyGLE:ZDVHeBIAABj4MYPVyGLE
TLSH
T1B675E17EEA9C04E4D57AD1BCC6638A06E77138A9033266CB12D491B61F2BED47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/700-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/700-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/700-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/700-90-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/700-382-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/700-97-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/796-315-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/796-116-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/796-122-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/796-114-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1876-22-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1876-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1876-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1876-15-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1876-23-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2336-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2336-74-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2336-283-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2336-68-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2424-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2424-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2424-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2424-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2884-128-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2884-139-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2884-134-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2884-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2884-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3084-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3084-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3084-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3084-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4208-256-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4208-56-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/4208-62-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/4208-55-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4388-85-0x00000000007F0000-0x0000000000857000-memory.dmp

Download

memory/4388-298-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4388-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4388-80-0x00000000007F0000-0x0000000000857000-memory.dmp

Download

memory/4840-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4840-40-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4840-41-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4840-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4840-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5464-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5464-316-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5464-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5464-109-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5464-103-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5464-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5744-0-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/5744-78-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/5744-323-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/5744-10-0x0000000002200000-0x0000000002267000-memory.dmp

Download

memory/5744-9-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/5744-1-0x0000000002200000-0x0000000002267000-memory.dmp

Download