db3b7027189e3880d18fb137986e2150ea825a082bf6e8037bdaf586642e3b43

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 11:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.6MB
Sample260715-nsrh6sbs8q
SHA256 db3b7027189e3880d18fb137986e2150ea825a082bf6e8037bdaf586642e3b43
MD5 9ecf7d9a816b5c16efe793ae6bc0abc3
SHA1 416ae56c8afee75a575b862f8f709a47acd76526
SHA512 c8124a03fd8536b97584d5b7875df340bba769c649e0d8c2703446c36172406c5217e1f4f80771dcb1f856091b48071b6f991fe8bd233273014120248282b9f7
SSDEEP 24576:RYJ9bJ79iAV7dYdReAdoS6jjHhST9SlY:RYJtp338eAdoSk9STUlY
TLSH
T1EB75122577C080B2EA73183109E896719A7DFDB14FA85ADF63553BAE4C706D0CE39362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4876	elevation_service.exe
5708	elevation_service.exe
3780	maintenanceservice.exe
3984	OSE.EXE
4296	PerceptionSimulationService.exe
5560	perfhost.exe
2628	ReFsDedupSvc.exe
4072	SensorDataService.exe
748	ssh-agent.exe
5652	AgentService.exe
3944	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\69d47451e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdf91fbb4e14dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009823d7f84e14dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000152cf9b64e14dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bfd909f94e14dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000593610b84e14dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001431aeb84e14dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000bc4bb4b84e14dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	2628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2628	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5652	AgentService.exe
Token: 33	3944	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3944	SearchIndexer.exe
Token: SeDebugPrivilege	1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1304	2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4876	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 3144	3944	SearchIndexer.exe	97
PID 3944 wrote to memory of 4820	3944	SearchIndexer.exe	98
PID 3944 wrote to memory of 2604	3944	SearchIndexer.exe	99
PID 3944 wrote to memory of 4224	3944	SearchIndexer.exe	100
PID 3944 wrote to memory of 5876	3944	SearchIndexer.exe	102
PID 3944 wrote to memory of 5068	3944	SearchIndexer.exe	103
PID 3944 wrote to memory of 5108	3944	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_9ecf7d9a816b5c16efe793ae6bc0abc3_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5708

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3780

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3984

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4296

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5560

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4072

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:748

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5652

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3144
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4820
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4224
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a777e77772af0aa589963a7e004a56cf0901458bcea80b4dd0f1f0ef8f05c99b
MD5 16b77735fdf4bc6efb2eb488b63236dc
SHA1 fce18b8a7e8db2c2be42571ea375a9dbdcb5c1d4
SHA512 8017c0ca919c4a641dca401f8b0baf775c7b37299f9bf9b6d9427aa9914749dd2f31e457bba7d7fa10ba1a175010dd9cf77b1e835e611fd0af78dbcd016b3dcf
SSDEEP 49152:vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnPD338eAdoSk9STUlY:t3q6HjBkzsXdoSk8TUlY
TLSH
T178D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 1a15b324aff0bdc6ac6f8adeb7ae427d297ad242a3c10e7f8a61d843f2a9895d
MD5 d2105b6ffd130e5c11f837d720670e66
SHA1 7bd97139ceb129757a7829230623642874cacbc4
SHA512 6ce30e0bfb59dbabbebd04088444b4646d39ed54d680ac65fba3dbef32bedcb4cf80834092b2b5c5d9cfdbb6082962024f99511e502f3bb324cac638c38c93cd
SSDEEP 24576:NXYfDtczA4f79iAV7dYdReAdoS6jjHhST9SlY:YtcJD338eAdoSk9STUlY
TLSH
T19D85012977A408F9ED27817DC8A28401E6737C9547A4F7CF03A4AA690E337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 08c606be4b19d291ee9a071fbf9d9d1dd6e29b253fa8e98b4fd5ecc566d87926
MD5 ccd50e4a42f201adeb5043a82bf1e0dd
SHA1 346c2bb83b9ab9b139f467739ff84615bb402822
SHA512 92c51cb8fcf48bfb3758ec4792fedd311a5ebc171da1d6c98c05913255b7f769a6de2aad039b9bfe7a7fe8be81a80c6ded2b7769aadd59291d6a4197315f97d7
SSDEEP 24576:50Le5ji0hmxYrMnf79iAV7dYdReAdoS6jjHhST9SlY:5Pji0A22D338eAdoSk9STUlY
TLSH
T1FE959E16F6788331D073C0B9C5D2A68EE972348657308ACB4286D77C6E67BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1c2ad9b66ae09bb1dd8af4693b33629924c2c2720a9789e382745995f45d2a0b
MD5 08e784d5a2b4c132a2d6cdbda2048770
SHA1 2c29ca6a8eba025e8c9581b2d0045b05a004c1aa
SHA512 6447842342c23c6890984236f16161da6ce47d9eb677f62a1e5b6832f6c9fee22a8d65610ed002bf0855f3b4ecab22064aba4f25b27c5da2ef2332b673e16695
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWE6q8wyuZf79iAV7dYdReAdoS6jjHhST9SlY:b/ezSC6vUzPvxHjy6D338eAdoSk9STUq
TLSH
T104755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e671ac1ab99d2ad9ea3f23a3b04fa59b48ef4dddec8015adf12cc3dfaeafabd4
MD5 13dad31dbc2551e065d4ed329d91a829
SHA1 e221a696189017aee12e2dce5e633b1a36dee965
SHA512 d60db1e0d994bbdbd7de3c02c45a6d2dc847278365125c570cd351e01172086403b7f35dc02036589b469dacdd1dbc9b842c6df2554513bfdae4cde061571430
SSDEEP 24576:hVbqPb88hv/l+60f79iAV7dYdReAdoS6jjHhST9SlY:hVO88hXl+7D338eAdoSk9STUlY
TLSH
T1FB559E66F6748331D073C0BAC4D29A9AEE3234425B318ACB1246D76C2E77BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 ae6a6fabc1e48ce0453b3ffdbf531a4c875e31c75400663c7e9d9209446d51a9
MD5 789baca9cb39d3351341bc046222a436
SHA1 797e2cbb357d8ee67a8128cd24a5ebf69ca056c6
SHA512 da232f1cae94ddd8123b56506759441ace68e93879a84fef0ba439228e0c814d17e189336e6c4506b48861827ed9d4202a41f71019f26d116ae5810b439b5d1f
SSDEEP 12288:wXjf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlY:wXjf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T1CA65235A6F1C4091E73B78BA14C9404996B74FD898DDA3DE6526BEC984FCEA7CA12300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 ee358291b106999348c81252c537436f1874028d334df667447db268724a1e01
MD5 686d1224158b1690ba227c4b06416f82
SHA1 6b82c9254182132c6486a5e3f209a8a20be33323
SHA512 e3872d799a900e4e522b05f49ad6bd54443eb2bdde10bb22525488f4174394ba29f87aae50b751ffcaa27e96400eb8193cdae4f58544c94d6880a4b2c3e101ce
SSDEEP 24576:hJIUsf79iAV7dYdReAdoS6jjHhST9SlY:hJIUsD338eAdoSk9STUlY
TLSH
T18385CF3BEE28ECD2C27E9CB95A918200D77278704F61A3CBD165C34ECE235E15E76925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 40af9c915981ef937796b23b9705a97f237fa23f40d87dabe064a8eaa6c48a60
MD5 6567eaade62d18d9db304f8e9b22189b
SHA1 6e1425bb4b6c80c287aa3a347f2af629f25f89e8
SHA512 381c952752512ebb258ed91c984703ec6620401f35da5969f719d38f178ead47509692fdbb0df1a676fea21d0ad9453c22f8cfb70ec83ca827efca4d9f4da245
SSDEEP 98304:7QvGAdlCEL8c/yRNw5CpzsXdoSk8TUlY:0vyEYc/y3w8BMGSj
TLSH
T16B266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 470524e8be15f36616653d2aa5ea3624c861aa7d921a26c5224fe9f3622710cc
MD5 2dd7a1500522600658739cde6b71482e
SHA1 b173ddeda9ac9b3f0554f1513868cc4ac6938bf2
SHA512 e0ca387abb7add4f1296c2576e9e4cc2d5a9de2aeb6ce828de4506a5e05438dd2369a42619d5cb25cb0844c823015c847233296b3de43db26888af7aed743825
SSDEEP 24576:/7ewsAjGf79iAV7dYdReAdoS6jjHhST9SlY:DljGD338eAdoSk9STUlY
TLSH
T1AE85E031FF78D032C37F0CB61B26C716547D6E604B952AC3E3A89E8E48742D26776A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 549ea32fd44e26ee42db5a0a62acac865f1bea05d5e79481e5199b9118b1bc01
MD5 ed9960f9743016eb836a5fabe7da29b7
SHA1 8b2df94e4230086c7273790bfd40fb103eb1f976
SHA512 55d6a649e20b26a46c6187ba0270e0def920ec7c31ab299703c450861f7f1b09120862a8a0a9e7eca7d4bee03293a536a1513b7c0ec3d7587fb33d9e860de31b
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHIMGSj:ZUEtQevvqc2W1cpV2EI32IM1j
TLSH
T155474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 45772f210e32de1df50590a58c880611f72b3bbc9ccd737b36b12174d51ce4f3
MD5 e06b1eaaeadd4f46f0d0527df8c47c11
SHA1 c62fed0e3ce5f570a28fb78fe175e36d55b11d3e
SHA512 aad7b7be3d69a4c66cc9c8ad60aed7f017115873faf44002bf2d105ce4bb7739c625124d61683f34a071e3907bb5533f1e62696a452b9b4ddf10234c45ef0b2e
SSDEEP 49152:8CbRquA/m2yL5zTfFiV+XenmE3/zmD338eAdoSk9STUlY:1oquVjnmtzsXdoSk8TUlY
TLSH
T1A8D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3d5de10eb5f5dfd8f422a25ec1dd0d7add0b501af3772b826a42d877f20a2d07
MD5 f25ceb9b0f2cd10e44dfeb1e04f6d89c
SHA1 7c411091f1437847db646617ece85159daf27278
SHA512 114899a9958d07892689164eae7704164ebf1be0b6748896620a712c3809643faa8a633c830c2f1127627af27262551d6b62e43064a42a02261071ca328666fb
SSDEEP 24576:EAhGLJIFoiwtA5l7S53Nf79iAV7dYdReAdoS6jjHhST9SlY:EAMyFoiq59D338eAdoSk9STUlY
TLSH
T12D359D81EBF945D4F5B3AAB899B68171EA76BCA95E31D20F2160D10F0E33E509D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 20f06f95cca2e3b219048118a81320ed1b156b969d1833bfa592db4c4080129d
MD5 fc5ddca107e5fc116f93725670cd985d
SHA1 ddf2534b9058dce3b342273542f5070de2420bbc
SHA512 b48e832b5a5785f8ba272c30ae859dab68c25612e3adc304d039696996d2b1cc7ad9885bbd7e9bb96a8919f95445b7499ec0cc32ab23d4befc79a8edec05f0e2
SSDEEP 24576:LwuSOWaf79iAV7dYdReAdoS6jjHhST9SlY:Lw9OxD338eAdoSk9STUlY
TLSH
T17585F04A37A80CF9EA6791398587C036F7F2BC412A65D71F1760C65B4F37361AE2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 65c2fcf77e03710f722942376016b02b9000842a262c7c14b2004bfcd107d744
MD5 7ba07e864df8c3baead0d67c1d114fe6
SHA1 c5509b458cfa6edbba6dbec0d4a2e6eeccd80b22
SHA512 3b28b3b2dc0b2cd8400b82703fcf37ba632d4959cfc0dc441961d729a4b271d8ce4f0048b56e7c02ea1b2c04cc71615b6c86fa660958052d00e5a6fe13ca8c19
SSDEEP 12288:WjZ1IyWf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYz:CZuff79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T1E075124E37AC20F5E237A07D88D44105D3B37CA667B993CF1625A69A0E77ED28E35321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b572d232012489d9a25112e1ffc5829df9110497eed9238944a4796d3cc52eb9
MD5 fa807bebeb09c0c37b503e4073abca39
SHA1 f76f51f45690ec8f3fae43017639c8b7fb15f7c8
SHA512 aab42406494104f18bc4d5cf886240fe3bee8dede13d6e1bf94eb715d26bc746cdfff0a4e9031ca2a2ea58eab161c049d273eefa470066147b822e71fce8ce44
SSDEEP 98304:jQRQyi36YOcPQLvw2gAf+PN3QzsXdoSk8TUlY:yQyiKayX+PNmMGSj
TLSH
T12B667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6b4a582454f15bda65896ae08e6bc7ceb9ff0e68375846279e77ae5ea9965874
MD5 c630a12e128c2fbe3750d499f3788ca4
SHA1 dd5ad150649417c78e600f27721148c95a582182
SHA512 ba2e777e2717fd473be78fb405eea1fe076084bc0ce502da7c3d2864db34865473382985cb80bddfb9dd95d684e2691b1271c97993ccfd4125ffad4017cf121f
SSDEEP 98304:aQRQyi36YOcPQLvw2gAf+PN3QzsXdoSk8TUlY:RQyiKayX+PNmMGSj
TLSH
T12B667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3aed43edcedd1d26cf7ec985f412b4d53699f93c47958ceec45d32ef110683f9
MD5 38595c410cb074df90d00d0120016d41
SHA1 e35fe9257cb8756cbc23827b59d364f0b6f593cf
SHA512 22c28c42de85aeee7d53f95b0682aa77384967d232d45e6fbd80bcebf78082ecd3d20929f4d2857d56bf13dc7641d876ebe7124216a78df364175fee1c91bb6d
SSDEEP 49152:Z68Qg55nhheWu7PNU3/2D338eAdoSk9STUlY:nthWRc/2zsXdoSk8TUlY
TLSH
T1A6B55A33B2F60099C44DE1769F4A872196D27C75CFE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2e951583c6806c4bd455a45eac5bebfa46bb792b0283aefbd9655c5e8f982caa
MD5 a0154413fc40941e754f2e1840e4c916
SHA1 a92b0d2e217ae7825e92d62116bd81e774d21e1d
SHA512 2d556ce6695aaba60bdffefb8405a1e07818cb180bf303d574ef00f25284695859c55623e455c8ef09e93e547d472f0167a6ac8e2d23d62c16dfa5d087abfcb3
SSDEEP 98304:5y5112gYy5azzVvL69nLKnhZjzsXdoSk8TUlY:ULIHmWhFMGSj
TLSH
T124167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8ced39e828f70fe29bf6e4fe0e31cf97271acc804689c293526871d4e555b91d
MD5 7f3c090a05eb5c02e24671dfb93c727b
SHA1 b74df7f7144fa7ac5c74773bd1d50cc23d3e56dd
SHA512 24d833b60618dafdd1a5edc52e4336a8693fd0a2c4337c12f80aa69921d2606a248dbdb4212ff59babad264fa49f85954034e2b6ddfb127fe5b664ab9e089a7d
SSDEEP 49152:qB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gloD338eAdoSk9STUlY:4u6JmVxd2dozsXdoSk8TUlY
TLSH
T1EFD59D13F2D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 068193efc206b1caee8828202e300a0e2056355f59e13d825ed0da4586c7066c
MD5 edbdff4461f64f3af2abb6214e5cbe73
SHA1 37696aa4326c2705f2b16daed6bb36efbd30950f
SHA512 8724fdc313dde2eab4872a1dd0de4857201aef99e2b6c216c398d08c915392f6d647a14606530d6933ab5ef3a3585ba2b220fda84c25055e2cb03ae000b05a9c
SSDEEP 49152:I1hpsNoJpF1A6UU44CwH7R4xMD338eAdoSk9STUlY:ImifPbRtzsXdoSk8TUlY
TLSH
T1AFB5AE13F29900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 606a7b6f2f46ef70acc098c77816b306810e439d1a53233bbcc8c0666281647d
MD5 345894fd3cf47e3c954c6ef8319469ce
SHA1 d783c6772576e9e1f24ecdc10fa16d95bb66ccab
SHA512 6b943d61f178752b27e598bf2bf088f9e9b8362c1d953e7451f4d17c41fede3ea863a0e04c5115296c31c6422a8d784e0b7447b331144ced03f4e41f397f07bf
SSDEEP 49152:4SuZQIY0Be2KRRVtOnks6NMHqfD338eAdoSk9STUlY:i5dKTi61fzsXdoSk8TUlY
TLSH
T167C5BF13F2E940E8E0BED67487659236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0d0454016f195074fdf6715962ba493c931787be138b99d8455d15251e24c608
MD5 9efd5ed85c61e14c1d31b99ae2c87209
SHA1 3baa0441a9d310a26510c0fb58df8ff0bbfcebf3
SHA512 3cd80b3f2c28b61d3bf9385336ea5b5a4be5e317b3e8810bb1e7e0c7a16887e9ddc7f65622901d0120011625cef277cfa58768069a8e336b804ddc99c25a6868
SSDEEP 49152:qhtSn8EApI0figngiDn0AP5w4D338eAdoSk9STUlY:LX2iyphRzsXdoSk8TUlY
TLSH
T1A695BE13F2D900E8D06ED179C7468632EA62BC150B39B6EF0A50B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 7c1615bb49d5dd1afe247bd4208e652cb7cda815e4a93c0082946492bcabbed3
MD5 0ba2d3ceff312c233fc00ef539b72f13
SHA1 c53bb9a83d012a3f8cac1a9c2347f11f6fcea034
SHA512 90bb5f92cdbf6a0526efbb6b2844030e686c05788e3dd982f0fab836d67acddf386666e9641e40368f4012fa136bfc6a85ad065210962b268029c62d501fad34
SSDEEP 12288:67f7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYe:67f79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T16365234E7F1D4081E22BA8FB04C94049D5AB4FDDE5DD63DE761ABA8984FDEA3CA01344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 dd5eb686b7db6351ec01efa82e62137a30ce32f9d6d47fc9379c7727e4abca21
MD5 a70221b70b8b6e78763ad6955a4383bc
SHA1 e5d29655a60edbe72845d88c2fc44e594e51becf
SHA512 005c40529b75a0644432230869711b5b73758047bdc557858c466eee884fac614f9827520059e052aeacb97577f963d91d3f8e18ba648cddbc64ff90379393ef
SSDEEP 12288:Yif7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYm:Yif79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T10065234E7F1D4081E22BA8FB04C94049D56B4FDDE9DD63DE761AB98984FDEA3CA02344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 feec68e8ed474caaaabc22c643063e9c88ac7a6fdcadfa40bc0b8bc9f483c4e1
MD5 e10691197cfb7cd499f7e12d3e03d168
SHA1 8f5e30b683b0dbaad50de6999e2c8970fd165258
SHA512 4fb33cdce5e647cb09e7288dd97ed50409b2b06cf0c5e29d848f6e5a4074629b4d25ce7a8c6e055e93f7d66fc95aa39d0e0021f2ee18c62127bfec061c0db4c1
SSDEEP 12288:lkf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYL:lkf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T10865234E7F1D4081E22BA8FB04C94049D5AB4FDDE9DD63DE761AB98984FDEA3CA01344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 06e681f36b6e43873a38bcca06a63162d88cff7b064a18bb9014d39c2cf58457
MD5 4bfd72aa973c2d34a827d53f2ebc8365
SHA1 4a83082cd68716f4cf3be3ab82c4156317cf4f3e
SHA512 2b1c2f03aff4bed61f3737dcc5e83aa4073ee6853534cdce254b215ba1dc1710c305b5cdee7a22ff8471f21014efd06ea44211b9ea51f265613db752cc61e403
SSDEEP 12288:wVtf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYl:sf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T1C965234A3B2D40C1E537E4BA44C54045E2BB7ED9E6E9A3DF6A117A890CF5BE2DE21310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 8c4a29179f9220ce83195b4e8fe45ae8d03bdc4b6951166537f875ae4edb3da7
MD5 d6ba4cf005df360e0ceadef86c0b5049
SHA1 6405d371df7775eb48833781796d70824645dc65
SHA512 062637dbb5a73edc33c7b187eb637b4e63b213bf12af8b17cd6eb73100f4873f54c6e1c0986eb001918cea5a88b55586023894c5582e8e883426e3916cc120dd
SSDEEP 12288:LVf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlY3:LVf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T14D65234E7F1D4081E22BA8FB04C94049D5AB4FDDE9DD63DE761AB98984FDEA3CA01344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 41bcadacc64d7d4a7bc3f3038db5409f856dd75b2908e0af795b758e15ca286c
MD5 84ff1fa417488454150b2904b6007f4a
SHA1 e3da499d97d562375fa8130d8750d8f7efef96e6
SHA512 a8cdeaf4754880311e6ac9f344fee5e9f907b974f259aacdd044e3949f679b33e8212a00e3e5a3fe98ce4c81bfc539cdfa2fa314d0b07747b9c89f4ca9da64f3
SSDEEP 12288:z+f7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYN:z+f79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T13265234E7F1D4081E22BB8FA04C84049D16B4FDDE9DD63DE761ABA8984FDEA3CA01354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 62f9e228f99801f43393feb1b989e6e73c69742b15bab28a23d0b78663151115
MD5 6f28a244bc0942378dbe8602faec5c8b
SHA1 c28ca51f6e93a1cbd1aee4d7643536da7d986037
SHA512 d25b388b1213ea0c7ce449c62bdec956885b48f0007767a015f89de07a1199a2e6de3bbdfa9f9128e98839f7e8b1dac07274969f915a02beccc21da8b462f78c
SSDEEP 12288:VKf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYF:VKf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T1AB65234E7F1D4081E23BA8FA04C84049D5AB4FDDE9DD63DE761AB98984FDEA3CA01354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 e8ce16095c4f594df18e6e1b09c49d1fd850e9cf8d9d6db19b34a0c181797fa6
MD5 7a58bf092d7e90cb82dafaeb115532db
SHA1 817580c0865eeaa63272a830489782399b49e24c
SHA512 4d6fb93164cc85768fc8749d7afa059ad8aa77c62fa8eb08e677bbad9fca93a0f9d51d0e210b7f2c41106782fc2e72e9c97a2bf1a37571b1788324ddaa2d5eb5
SSDEEP 24576:pZMEzFVSOCf79iAV7dYdReAdoS6jjHhST9SlY:pZMEzfOD338eAdoSk9STUlY
TLSH
T1A1850199B35408F4EC77817EC8558806D2B27C9A0BA0C75F13A8366B4F737A24D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 ceff292e15f79c27aca676af84f0188cd658d29f6019b33331fa943b27d9fd72
MD5 8768972218d11454092bbe94b95e8507
SHA1 60312e7115c3530ece634226e8a75e764c59320f
SHA512 a755264b8383888548cf0bb4caeaaca7896779f4b234538ebbfa6247199df55f9010aa67890117d2c7a74a2642a056f277f198412f92204a4c411c31b626659c
SSDEEP 12288:fvf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYr:fvf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T13765234E7F1D4081E22BA8FB04C94049D5AB4FDDE5DD63DE761ABA8984FDEA3CA01344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 05c546e71c23ea407cc2dd9fbec9f7fce720b48fbb7d24984d447edb27c0f49f
MD5 593c7e2f02033078e0b1a04df3a444e8
SHA1 d0b82f8c34789bffd4e81ad64624f45122c3defa
SHA512 93fd91f4e1bbd6a55f9672decb1d061a7907ece87381cb4c73f1282417122e0cb08cb9ce317bcff3c080dfc63e17792acaeb741f64c3c7d58347d6addce67d8a
SSDEEP 12288:wzf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYF:wzf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T1AC65234E7F1D4081E22BA8FB04C84049D66A4FDDE5DD63DE761ABA8944FDEA3CA01354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 4eb41257b70d5bcb71887eb2cef0f0fb30ce736215062125166b770cd9faab95
MD5 1d3a64c95a087a13b1dc4d008cad3971
SHA1 9e2d3e392c669447720fcd6f14af58382f50ff5d
SHA512 a0d6faddbfb44ac20410bafca4e0cb7a028b02b86f1cb8033bf3a962aea9bde3b6f82fd6b28b26e37f30bbae15fda5b99de02a7c46ef132aafa99e411b09b1d5
SSDEEP 12288:OyPz5L8Wf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYB:TzyWf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T13B75120B776920F8D137917988820902F3767C7647A49BEF136467BA0E777E19E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 2d2591b858fae8b78f038f0ac56897a63376c759f01c59cb1590c3328999f26d
MD5 dd0a4eb782c9015dad7841a4fe6cfa42
SHA1 b6ba1d77a1b8fab3ca3b2e3c1da5d952fa8d15c0
SHA512 eab9346aa7d5183b618f37cd9f4c3a71ab6d4bddcdb5fdebfa067f95047d5cd286591115e8d9f74685a41a3cd24e57f12040af533793952578cbd8e2e218cc13
SSDEEP 12288:1vf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYI:1vf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T19D65234E7F1D4081E22BA8FB04C94049D5AB4FDDE5DD63DE761ABA8984FDEA3CA01344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 2614893daf949f00b978cac64469c965bbec1830778533e78d26b58e4a1a5dea
MD5 0c2582c8b8e3292a57ce0512a57daf43
SHA1 a99b0075d7f254104280e90ffb623754404f30eb
SHA512 8fb919d8f3e922eee7d51a3cec4a37e3536fa76ee70be5aacc60ca67005f622913633d23ea7517b8d1cfc53500009f24fd119067eb91439674fc2990cdf80796
SSDEEP 12288:qvf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYS:qvf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T11465234E7F1D4081E22BA8FB04C94049D5AA4FDDE5DD63DE761ABA8984FDEA3CA01344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 806b9de1ce5b43a5b37aac12aaf724701587e6b790a33bb394d98318dd28b234
MD5 f6ab945b4c3b4a490d123c8daf69c4db
SHA1 5f34636074e07f71710e475c043805b5f589515b
SHA512 f00f1f2107bc4609ed22e0acc30c69fc70229b3752fde0c03a238d2856cfd9906dad0691d11d12358d1ab70edcd6f93fa76221a311bdaf9f5a11dc1824da0799
SSDEEP 12288:iyPz5L8Wf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYz:/zyWf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T14775120B776920F8D137917988820902F3767C7647A49BEF136467BA0E777E19E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 58aea52dfb724c2d36d3f37d3b5a16bfc34a35778543fde76744e494a33ffa74
MD5 8518495ce66a361a4630fba05b50b5aa
SHA1 be1d288b0d01f8bc42a2d40af8ef3d18a0f49fbb
SHA512 ec8eab05cd58cc957b32c3fc4a8f33babe592fbff4d0a6b6837310bd3d2c875b1a3f2d6b19d0aca1571017e12afd4a403b46d3a5b60852553069d4a590078554
SSDEEP 24576:ITdaLl3z0zDUf79iAV7dYdReAdoS6jjHhST9SlY:ITwLljZD338eAdoSk9STUlY
TLSH
T1DD850199B35408F8EC37817EC8558806D2B27C9A0BB4C75F13A8366B4F733A15D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 f215fe0ffb0d149cd4b239c374df8a936dd9e8901427b36b2e186f9e3beea31e
MD5 736ebdbc9193f2399d00265e5e76610e
SHA1 ef637988995a3563f883802406fb2bb53acd28ba
SHA512 51cf16f4a3d474b37c3482312087776ab4c64e74ab8e7683f8bef960c2a561d3ed4b3247661cd823dea0298d0e6e155b85019ce6d9ac4cd8494ad614dc03922e
SSDEEP 24576:635d9CHKy7GZwf79iAV7dYdReAdoS6jjHhST9SlY:c5d9CHKyaOD338eAdoSk9STUlY
TLSH
T16C95DF90F3E810E4F077DA358D664511DAB67C9A1B71DA8F03A8265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 4ee0678481b965594e6bf16f39ce11ac3c95983df5eb4d59ce2db6850c92442a
MD5 aa1fb399c9976b322af145cc37568830
SHA1 19d5d7a3813b465d638125e35a4886f8da55b21f
SHA512 176bcc65c8eef680e9452f6c9dd6a948624d37ece38cbb7d3de3ca1a8a4367fd91e222eade5b3d44c7a6c52c1dc7787dfefbe4ccaf6bca269d0471c37b1a9f5d
SSDEEP 12288:rEf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYc:rEf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T1CE65234E7F1D4081E22BA8FB04C94049D5AB4FDDE9DD63DE761AB98984FDEA3CA01344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 073f91280029d7000d14a49d153d712be696f7493fc792e2835c99f7b5c1d170
MD5 2c12346c3855a196cc85c08766a3ab92
SHA1 a4eef244d636ff0aaadf7f8a62351d45c14c5c8a
SHA512 6bbaf0c36bddfe799b02c2841b375e868f81c29a9ffe9528e06cf8e0b09886b2b84f3c487168a1a6138d96663228f7794f01e9ef76365f3aef768ed2bd99bcc7
SSDEEP 12288:R2f7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYt:R2f79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T16C65234E7F1D4091E23BA8FB04C9404996AA4FDDE9DD63DE761AB98944FDEA3CA01304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 3847d96f5fcbb57d0fac9d77824a325eb31b6468dc3ed71b64b4810780019004
MD5 7960d116a1966d81c2565599ee579521
SHA1 8831b383632206e0297991cb4196bf93631b279b
SHA512 91783ca9cd3784a0eaa4670300eb7db4da1ec33630503c475f18ee2032d3c377cbb6280b9c9b02df696b702d8ba76d2cd1ba52c156efcd011afe96eb4b206f94
SSDEEP 12288:Ghf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYe:Ghf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T1E965234E7F1D4081E22BA8FB04C94049D5AB4FDDE5CD63DE761ABA8984FDEA7CA01244
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 22b753a1f046589f357e7ad969e0aaa6bef55bccb8b0f3f023e0baa3568fd935
MD5 7919bd0b3219316449c3145d0afedfbb
SHA1 1fe3f67b50fd8bfd5b672d70bf16222203ce90d9
SHA512 1689f17079abcd8d4831994fa7b3c1899770f25a56343f039b729687cd4635c9180ab27cef29622ccc10dc827f2c083844132f79b04e2133a3a58522c2445d06
SSDEEP 12288:ivf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYC:ivf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T1C365234E7F1D4081E22BA8FB04C94049D5AB4FDDE5DD63CE761ABA8984FDEA7CA01344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 b072b287ca18714977fd31578f6020b01cb62de15eda68ab2b15cf870c874ed3
MD5 6b222be37de9067e41d103558033350a
SHA1 d874ddd644597fc5695a4adbb5b8f711df660cba
SHA512 5858265f6210437615a4b47848415626dd2458965180406fdfdbe0917e7f31cf729808079b60af34964c1b8a434bac3a5d9aa7c0a98bc41d0367d709115dac87
SSDEEP 12288:zEf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYf:zEf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T1B165234E7F1D4081E22BA8FB04C94049D5AB4FDDE9DD63DE761AB98984FDEA3CA01344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 1dd9669a840542222897c24e897653d5c307b47d07feafb1a988ab70b34f60dd
MD5 dfd1f49f69130f00655e636982fe3b7e
SHA1 7813a07a652f9283694dd2122b57ec2c2bf3645e
SHA512 f8bf30439df641d5f60230b3ac032c53e13ee1c6f8bef73120d1dab44946a24e92cf106e61a6b25c9513f9e17a3131a1b3d313f46315aac5316284f0bbb0dcf7
SSDEEP 12288:BXf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYh:BXf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T18265234E7F1D4081E22BA8FB04C94049D5AB4FDDE5DD63DE761ABA8984FDEA7CA01304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 3a79f610a409bf4252b4a3dc6be38c88a1d34eb52c11224f673a879b47cedb75
MD5 683daa9a400c8791174d9b6e14f6ae78
SHA1 f4163f6c6a4d15ffa68fe6ec237f2d914652dd2b
SHA512 5400c98be0f6a6be302e2528a766e551f34cba4dee6d741817739bc3f8e43f56292b8353c3ed7d08cb653833540b91c19bed8de530520f53a7afa3e3368c0cbc
SSDEEP 12288:KVf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYe:KVf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T14165234E7F1D4081E22BA8FB04C94049D5AB4FDDE9DD63DE761AB98984FDEA3CA01344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 effa08564542c5fdb75bdf3613c0f9d3341fa93359255c7cabfe56c80bd4ffb0
MD5 25b2c62b120f4d340453a37837ed4d24
SHA1 06acf11ee5a3dbaba15716ee9d76a7307af84ab0
SHA512 f0fcaf58132d470237fe6c62a4d856e042f644133938bccc1c61f41fe7a9da5a549738fcf6f6d539b07eb66eeb3544569b22c76e4584c715f32bc87454c1ece6
SSDEEP 24576:vfwvuk9RX6wkyAIDf79iAV7dYdReAdoS6jjHhST9SlY:vMnYIDD338eAdoSk9STUlY
TLSH
T1D095DF29EBDC44E1E177913C89A7460AF2B17C691B71C2CF125A53AD0E37ED49E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0c0ebbcfe642ec353d23af01130f98596eba595673fdc02dd0622a2a4ffe9e76
MD5 8ef81989d5fe5cec3b2d745c5d64f27c
SHA1 c35b431bcc63267a4b86820c8a28d52e4b9a8557
SHA512 79627250c8be0b67f3af077f53761af1e16a23e66f6519b16ba3939dc61c57ecca50113f960b545dda6cf3dae5fc6f577b1b8162526dfe4c6ab614698bd9586a
SSDEEP 49152:wYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0YD338eAdoSk9k:eySzPwzsXdoSk8TUlY
TLSH
T198066C96A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f44e9d7efea9f3e286615c0d85e44d6c227ffe0500ed323497b59794b9526d52
MD5 984d48bf18d0e1a29d2db55fa944c316
SHA1 8ef1eb097d5aeb87411df17cfbdc928557e1bb68
SHA512 8072d274b78bec49aed496cb1d48b60d23501190a5370e66b7a9554db5fbc65280f66a3963e5cb47c778d9d2649bd0187345c3b01d9d9b0fcadbaa59dbbb241b
SSDEEP 24576:D47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYSf79iAV7dYdReAdoS6jjHhST9SlY:D47JUQj1irIhCnDHUPfF/oD338eAdoSN
TLSH
T1A265AE1EA3EC01E5E17A927885154A1AEA71782D1F31CACF2270937D6F63ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 9ce7fe0f702d508a94a252927c347aeba9a56f42ba599bb65fa35300754692da
MD5 1827efcc6ad1b3f5aaa2970931b4177f
SHA1 f77b5ef4ecfb87d9d6298760a93efbbb0de0ff9e
SHA512 0b1ed5720c1525777cee8135b48177cd7ee0117478bda384171d91c6f61ab9958915984dff35ebc75616ffef8eef1d6d1c5502ff0fe87fa940b410f6bee0b589
SSDEEP 12288:xzsfff7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlYn:Yff79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T1E775F00AD35801D8C02E617AC7854641B3377DA997E5E3CB62D0F57E0F7AA919EEA303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 a1fb90605e42ce71d66b0e7d29e43e8321daf8c09d0fdb8cadf399ea6e1f6ea1
MD5 acafbe5bf2323bfc696b087b3410a359
SHA1 27955ab7e865312f02dc2c31cd71b4b983d2f15e
SHA512 4ad445d229bafd65cc84f37e74ce78e7318a842a5b419847db6f085a5a05f0c41d5e30e731058470b2922205ea9036f2134340e40ac16a5dab0e6aac30bafb9c
SSDEEP 12288:QO7Hf7ArcjuAV26D4Ipop/4kO/6lz94zinwOoDO6jysw5TB+McdUNTgMSlY:7Hf79iAV7dYdReAdoS6jjHhST9SlY
TLSH
T15965235A6B1C8481F53B78F9048D8015A26F5FEC9BDCA3DBB515BAC984B9ED2CE31304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 573d6618f0757522c60a055ad8d179eeec265e737255d7251281211ac7d4b2ea
MD5 c658ce17ecc5a3f7eb78841894729b6d
SHA1 cec20fb6fbd9b46cfc1ee4b7cfe0caeb9a221c99
SHA512 ccce69617655800f454d234de21ccb6c9fbb654c87c291407f688cd8c969957bd1f4cfeb607714b5bf53a112c8c5426ba757b389e3cd15f7100b042efcf00b43
SSDEEP 24576:6wgb6bmBIi49WNNFpg1rSvFv7bYZf79iAV7dYdReAdoS6jjHhST9SlY:Fgb4mBIBhGFSD338eAdoSk9STUlY
TLSH
T1B365AE1E22EC02F5E0FAE2B89DAA4417D6B378160731D2DF1151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 a14ee64b5fcde6baeba9d2b76db412d856a874764d327b82ac552d1116352588
MD5 c98c0d468f5d374f9a4c77356e7ed8c5
SHA1 6aaf20fa9fcb43daa005ad1d0980475cc9df05de
SHA512 f0721ca5f8accc26bfcb9b7bfb844c1527ebac15b4a998752b7bcd2f4ad9934e7645ca3d5a46f2ab20e08f57616fc2b03ecb4576cd57bf4364315ef714cced33
SSDEEP 24576:JG88u8FpJqH1hzria7/mCf79iAV7dYdReAdoS6jjHhST9SlY:c7ZFPqVoa7/BD338eAdoSk9STUlY
TLSH
T16695F16577E501F1D47BE03889864663F6B2B8251364EBDF07A88B550F33AE54B3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 9cb19e4417aef43cf601ecd48019df939c5129e71ad5a4df45db559c600f5fdc
MD5 9a868935283199e2cee75372f3407f87
SHA1 e9d0e6eac3b006d755d806240764d7fda985ef63
SHA512 4b9497df42622755552b4c525792e94ceca5f1819127df409aab2a0aced0573e5a6369da5c9cf5a6b0d7f5f8b51610391d43845703abacd5b2d5a08c02bec39d
SSDEEP 24576:SPUr+NQOf79iAV7dYdReAdoS6jjHhST9SlY:SJQOD338eAdoSk9STUlY
TLSH
T1E285F11F27AC18E5E63AE07D85868209F7727C621751E3CF02A0917E4E77EE8AD39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 86d728423980c30c93596360e032397790f3b4cdf7af6df1b0233bcb7668cdc5
MD5 c4020e8c3a3e19ef4b9c014689d2db70
SHA1 f03b6f9752ebf8963aef874ebf7a068dfbfa55f0
SHA512 58906625bbc65556b1bf781407579222278fc1aada98aa31b3ac89d1e10fe3c57711f0c78ef22c0d1ad382d916e97d9cd2c0cb12181bff3845534bbb1fe75ce2
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+D338eAdoSk9STUlY:YG05lO43bLzsXdoSk8TUlY
TLSH
T1BCD5CF6E62EC11F9D1BBD07CD9C6460BEBB23815032556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4ca42d937cbd9e479e63908e5972dc2bb83f7ddd1adda38ba2ba3faf6eb007fc
MD5 c4547f60a5358d282e76da8481993300
SHA1 689362d6bd2cc4eb049d7e5d1073996e0c8caba3
SHA512 9d97652369ae864713ef6745e899583c468c1931a4b6751ae1742079e0649addbf8ed40c46e99d515954a09d10c9250126a0059609c25b8a6adf10c8354b4b98
SSDEEP 24576:vfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnYf79iAV7dYdReAdoS6jjHhST9SlY:Xa5POZ3+Jt2pasx2+m2D338eAdoSk9SJ
TLSH
T1AB65AE5EA7FC00D5D179D17DC583461AE5B2386553319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9ea556155e63aa3e29303abbe7b0396fe2152c0c3bc4c400140b160fa57c0352
MD5 8c7a6a96f0463eb4265e3a1ac2b6e63a
SHA1 792e8b163f54745f2c3b23035acbef8b68d7c5f0
SHA512 c621e0eb693e3c18393cfbf32edf1bf7a796a37c329e7746d8824ce7d2788c280e489c8d0b933088eca0462a0d23012a65eba8eaba34878600e9e11f2cb2e280
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7Fk6f79iAV7dYdReAdoS6jjHhST9SlY:xNc/zEOVHFhD338eAdoSk9STUlY
TLSH
T112858C1A23E901E4F1BBE1BE89679546FAB17869133486CF0291851F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b265973c06f943d58e410cd55829d435bbbb1ce3e61b4d4bcc179bd1ed7e2bba
MD5 19e17b310611e9cc4464ba1c16dcc5ec
SHA1 9d210a48992853374c392875f886186b0b45fdc8
SHA512 d50d92318b2c02b9f1a5c820ca886c533734a1a3c365f03a5e22269925ddad69a81121401a783f17cba7d190e645af8a631be2553cadbf4ec26d8d70902478e6
SSDEEP 24576:O8kNvNnaFeYhJNtmZBm8f79iAV7dYdReAdoS6jjHhST9SlY:O8MwBtOm8D338eAdoSk9STUlY
TLSH
T1C155AF6EBBB845E4D1FEC6B58D238512E6727861073293CB5290C13F0E679D89E36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 2bacd5279db184ab1a1b8a5062de0394e945c3b50c57a77d63a47b0645afa335
MD5 0f4e793a54e08875475f947173581b10
SHA1 124ac2b9b4d807ea93ddf7db5f3a8fb2c9081cfc
SHA512 181dff1d483d6ee32ab368a0e80e042abec0d535cc825cd6f3bc3f502bc07c278ff4a7c468be1d3a99eb9f356950361f36538a31e8c9ba4a71b236a6339ad334
SSDEEP 24576:CD3FHshBIYQgAbf79iAV7dYdReAdoS6jjHhST9SlY:CDVHeBIAAbD338eAdoSk9STUlY
TLSH
T1E295E13EEB5C00E4E57BD1BC86538506E7723CAD036266CB129491BA5F7BEE46D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/748-108-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/748-308-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/748-106-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/748-114-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/1304-1-0x0000000002460000-0x00000000024C6000-memory.dmp

Download

memory/1304-7-0x0000000002460000-0x00000000024C6000-memory.dmp

Download

memory/1304-6-0x0000000002460000-0x00000000024C6000-memory.dmp

Download

memory/1304-0-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/1304-77-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/2628-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2628-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2628-321-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2628-300-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2628-88-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2628-82-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3780-39-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/3780-47-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/3780-52-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3780-50-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/3780-38-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3944-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3944-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3944-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3944-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3984-54-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3984-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3984-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3984-212-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4072-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4072-305-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4072-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4072-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4072-101-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4296-73-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4296-65-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/4296-266-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/4296-67-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4876-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4876-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4876-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4876-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4876-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5560-78-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5560-289-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5652-130-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5652-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5652-127-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5652-120-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5652-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5708-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5708-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5708-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5708-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5708-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download