ff9ae595d982164f4c148a2f1e363a609c25a2d2bf8f4c260f1deaa78ab68c16

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.4MB
Sample260718-ctfbrads3p
SHA256 ff9ae595d982164f4c148a2f1e363a609c25a2d2bf8f4c260f1deaa78ab68c16
MD5 b98e6fc50678be28f216a349b918b2ce
SHA1 e6df3bc155fb778fafd4ad9d506002821ee0b415
SHA512 57c912bdb105854a183046f2982d0d6bb3e79b829064f05a8a7f1cb56d04a7cfecb0e6f5ff1dbdb7d4a949df382c4419c241ffb5fbb99ea439bcf78b7cf1f92e
SSDEEP 12288:7UYJ9biDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:YYJ9bOnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T13865013576C0D4B3EA73053108E4D6719A3EEDB25F609ADF6384276A5E343D08A397A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4408	elevation_service.exe
2900	elevation_service.exe
2008	maintenanceservice.exe
2416	OSE.EXE
2852	PerceptionSimulationService.exe
5104	perfhost.exe
2408	ReFsDedupSvc.exe
5768	SensorDataService.exe
420	ssh-agent.exe
2012	AgentService.exe
2156	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3e68c909e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000c73e415c16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000102bf4405c16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b228c73e5c16dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000478ec7e5c16dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000bd74c3f5c16dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ee9e513f5c16dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAssignPrimaryTokenPrivilege	2012	AgentService.exe
Token: SeBackupPrivilege	2408	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2408	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2408	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2408	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2408	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2408	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2408	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2408	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2408	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2408	ReFsDedupSvc.exe
Token: 33	2156	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeDebugPrivilege	4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4128	2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4408	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 5644	2156	SearchIndexer.exe	100
PID 2156 wrote to memory of 1752	2156	SearchIndexer.exe	101
PID 2156 wrote to memory of 4236	2156	SearchIndexer.exe	102
PID 2156 wrote to memory of 2984	2156	SearchIndexer.exe	103
PID 2156 wrote to memory of 696	2156	SearchIndexer.exe	105
PID 2156 wrote to memory of 5968	2156	SearchIndexer.exe	106
PID 2156 wrote to memory of 4356	2156	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_b98e6fc50678be28f216a349b918b2ce_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2900

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2008

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2416

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2852

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5104

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5768

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:420

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5644
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1752
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4236
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2984
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5968
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5a7f7f8a7e90bca7a4f3ec737bb41fd6d8484d8a568908445c39e20e85aaf364
MD5 2632e9d14a6f6af70c3392d96052cdff
SHA1 bb66f9469395d9894906bcd4cc039592d2a52c6e
SHA512 1218d6e44f58d07f7ee767f20ba17d83dd185442a4b360103515d92362cc197b57b376ea2a98032b298156a0e82672e5d7f347977e561d80c41eec6de5026da8
SSDEEP 49152:kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn9Q/lFTjN4:e3q6HjBJLm
TLSH
T1F6D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 98bf1d1e9e225d8d16bfcfe11f1e6bfce290e32c12d9468e3947d737bef0298e
MD5 14f59977675c873f75897ab59542291c
SHA1 574b032671c3ecd4f7b7660e0a57f13f7b16c782
SHA512 09d19f50e7eef8e7d6adc7a2f41d461b46fce328ae98256d30679181aa809d30f8d3d7c8528ba0a7f92c5e2689485b4d87e4d299f8244446398fe3f45f202664
SSDEEP 12288:71XLsswWkxy2lRq2czAaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:BXYfDtczAanQ/tbw/2Mkjy6Fr7g0o+
TLSH
T10265F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 96cbe9f13011789a35cefe6f82dc295587f32aa733bf2953c2732dc2b128b788
MD5 f892fefec4ec80107123ff298857f7a2
SHA1 cbbc4007dc2b6b9d96b32015ec10c5fc886849cd
SHA512 e59c80a015ab91c4b46da8317ff995d6dd9786d14580406661d566d18e88808d6cfad7260e56ef74faa2f220263c108f1f51476e66fb58a9b9a8de6a3f0feebc
SSDEEP 24576:Q0Le5ji0hmxLrMFnQ/tbw/2Mkjy6Fr7g0og:QPji0AlsQ/lFTjN4
TLSH
T14B859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 cb85cec8c59500c4f53d43f568bf5d7fbd6fbae5a09b9263f4f76be7cbaf9d8c
MD5 802bd1ed1bc7fdff0439440f09b5a682
SHA1 c7139f4a1ab17e3823b1cd29a30b7cd2b43800e7
SHA512 d58c18f24d3acc60b121f4073a5bda16ed52ae4c3920582d3638f344f66f902c8fc72561b5edc7fd7e31ddb6099175f7cf61f2605d6e0f0d0a7dc3f93aa0f5f3
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWE6q8wyuLnQ/tbw/2Mkjy6Fr7g0oV:7/ezSC6vUzPvxHjyIQ/lFTjN4
TLSH
T1A3755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8248039b0b93b81d81733b01907993779f8e57dd49850996b2fbf8b03c7173a1
MD5 c96df53ad854bd24bda4ba2fb85bb65f
SHA1 4b81132a5c91422f64c09dca5a8a45a2c8fc828c
SHA512 a9050cee9948a4e949f17304640346bef6131ed4d14581f9b8e3a72f5d0b30a878cbd219159fd3a1383e94dbec42ede2ddf0f483942614dc12e5e402fd43eb4d
SSDEEP 24576:jVbqPb88hv/l+6enQ/tbw/2Mkjy6Fr7g0ot:jVO88hXl+xQ/lFTjN4
TLSH
T17F559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 bde273aeb7b72275b228aa8dea2c8f40eca518325e5fa428ee5e3567795a93eb
MD5 c143904bd293c0bbeecba9496ed4852e
SHA1 3ae336b37538acd7a28ca884f80a317da2546897
SHA512 89ed0927cbc0cf17745cbe5194c08bb78e50f4a4c5cb17248da3267645805e378c8529bd28f25455d5e0a9bf28d0cf70d259b2b1a4dc5e7769ff3442060d22a1
SSDEEP 12288:GzZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:GzpnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1925523796A24F897FF2B06B15CC284826B7B0EC1BFD5A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ee5b99dac2c133df9d6ffd40a1e09d95dcc8d847b3e717c109c4ceac45777e4b
MD5 0c8809917db2d7bfc7e120a7b2e43e92
SHA1 bc0fb1e8658071cbc6ec5742e61c0986e800f7e5
SHA512 d609a1df6dfe6705cb3432a187587dabf2f0fbc86c1edb3d916dd193ba8998baca49c47ac9ca4f7815d42fa3883ffdfaf4aff9b801b4ac3958de43be3c48452b
SSDEEP 12288:qeBNUbTVO86UmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:qJIUGnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1EE75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5ec6d635409a3254570c344306823405caad7a9e46696ace5168807dc730b370
MD5 6c200aebc973fd29635616aa8d22b7cb
SHA1 dc1f8d6864a60da8f6d980ba72a62159a130d430
SHA512 9bad2c56aaa1800abead7a07fbf8993bb5d1e356d099c6113b1097599eb86c98692f2aff902ac2af2cf8d537bd720fb788abf51680ff419d95c1493677ebc664
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THc:FQvGAdlCEL8c/yRNw5CwLm
TLSH
T170267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 cace3d1cc2f8d4acb3f08186a34b1e5e8430c7cabccc9633fc4d7d47f7efe127
MD5 507d5708eda9b2e670a7f39d0ef1c58a
SHA1 f3e78ac0f205b4e2c567f0c82f4672f609667228
SHA512 3186841260ede585e2d8e6c8cf685c3c94a7da9ef37c802d365c9ec7af3c91be0d21f8208ac4e591d44e895fd649c914c0f674a8f6bdad230166a48ed84608ef
SSDEEP 12288:fAwSfxL/2Dc39DLLmt0LDQewsAjcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgD:oQewsAjcnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1F575E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e97df668affa887e2d2551feacd54c4c21b448c066e8a2525725fbd8992485b9
MD5 09c04d56492d225401a92de234c47e60
SHA1 6ca56154178d502283a927b2f3c4a7a50a42d5ec
SHA512 87633a7a9a180f9d66147b90d5408ae3e98c49ce7cf90ee2ad10c5a4d483d3c6a28c55f3b2181c9b15e1e86a3a903d5c9edd28ba2ee7686d747f18292c75b9c0
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHnL:WUEtQevvqc2W1cpV2EI32
TLSH
T1E0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 78dcce506ce82f75a9bc18c8a7e09732e20fcb3170d40a9049c12c1108005e50
MD5 fa0e851f591c528a84868753e4b7013c
SHA1 4a934453e2c01863bfb0779466267986055894fa
SHA512 d515b9d02c588073650e573a49d0b26464ee4280aceb6a61c7733e9e94f3011c832a75fcbf5da558fdbeffdd5cb101d061e52764bc48bf4720f4f55e05e171d6
SSDEEP 49152:vCbRquA/m2yL5zQfFiV+XenmE3/z8Q/lFTjN4:ooqtVjnmcLm
TLSH
T189D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5df933e116c2ddc555090a72158a55c43fa12348d4c62ef26754ce556dea4924
MD5 f17b5fdd8740a4d3dc9ea3b9d6804bbe
SHA1 23ddd89726628e66af5d9ee5706179fc7e661f6f
SHA512 02de1a0a0b70f72672d3dcb450c070ac4ef3309bad1355745675e806029739627e9c953c703bf733aec8f8097f74ae1f855cc5e3017a03fd1bddabca234aad90
SSDEEP 24576:rAhGLJIFoiwtA5l7S53XnQ/tbw/2Mkjy6Fr7g0oy:rAMyFoiq5nQ/lFTjN4
TLSH
T17635AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 813bd5fed2fe245831a52f76d1552ccb7f891363a7571a4afc080114e209f960
MD5 37f888ebd08a81c80a0de40b7a56ac57
SHA1 d451400fc6cffb8424ff296845c4de42d9a8fc01
SHA512 86e59be81fc21b32494176f93e4712e0228736ad46951f1fba3135dbbd8ddd5c59c88e025c02cbe9f3d961efd0cd2fa9948e39eee9c20fe4bde796d50a265f87
SSDEEP 12288:tmw5HEjsChN2BFgl0WDm+C7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMU:IwuHOWonQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T19465F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 068f62859b38536b05757a8a7a15706aaa62fda8241d4318e4c35c8e6a4b9ea2
MD5 4514af76861bd90f4d471e250a110b12
SHA1 1ae917924ce487e1b0987dea8e5120dae2973c25
SHA512 59688c3acc0ef491cb8de71254aeee7a0489bd2b100fef7bf9ffdf92450ebcfe7414cb5165d652eb899506e454744742e412eb6040f2bf96fb0f9aa6e09e770e
SSDEEP 12288:WXZ1IyMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:mZutnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T10255126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 74cbe6cd31bed09904cd2a03c545de1d9cc6a601858389bdf058021b219e92c3
MD5 c88704bb5e9beb0e2fb492513076286e
SHA1 84c1bc8e27817c0de346ddcf6507df85d03e6022
SHA512 c430e1d04d8f404151cd5d36e78e5f428fad7bf50d2910d532cec4f7c57a737f175d55650d438b181079475195ea3c5f46e25923f8580712ad549eececa29f05
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:yQRQyi36YOcPQLvw2gAf+PN3NLm
TLSH
T173666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 236a6a6c62d3bc1a294f055b8d4f3bba497c3e74e1e6298813095f95067de671
MD5 5c6865e4584fa4f6fbf0fba5ca63779a
SHA1 941e4568586597cd170a1b12801bb0b900112047
SHA512 1d70776bda107bffc498033905106e8f4a03432ac29bdcca4abbea506ceba74a0804711a6b11588cc9e928238d75606eaa9de003cc5b2c925a6bf4ae740e7430
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:NQRQyi36YOcPQLvw2gAf+PN3NLm
TLSH
T14D666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 726dab4eb42912d780dd60e8e67d5717559bd342ac1cedfe2d5d98f818bbe1da
MD5 4dd8b8c17884f6d378be5122bacf7128
SHA1 f5366e305ae83e18a5225cf848302cfe210d0966
SHA512 911ef3326a07d15e36c00dc86e9dfb6edffa954dae00eedc393e056c3dc6a44c2b978c7ed16e5dd5f7d6d2357b8ce1b20d7d961e7213e0b02b4d22d3078c7256
SSDEEP 24576:wwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL09nQ/tbw/2Mkjy6l:268Qg55nhheWu7PNU3/sQ/lFTjN4
TLSH
T182B55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1ed302c605b3ce884e32e909e8371eebaf8b8d4f9db1072330eb112e8f19bdb0
MD5 90eee56925af67159b0ea8651ada2d28
SHA1 9f6f478823a209f607854b1b041abd86a0d26e4b
SHA512 76bdf9742590e131582e73596f3d707062a1d6ac792d18c4a7b68f595d5e85dd6c5683382a88c6184343f7528c284f1bc38edaf4c70ea24aa247c618f5f9f6b4
SSDEEP 49152:g3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99C:Ny5112gYy5azzVvL69nLKnhZeLm
TLSH
T147167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3db245500f4fa2d13f1e5b788ad459176c0fd7b30a1fa4c86042e5026306aa0f
MD5 fcd4b1b9ba8407583bbb4034688f15cf
SHA1 054b1add44cded8dfa4fa439231016b5c91911cf
SHA512 3e5813db176398fbc23aab2fa9f5bc86e8e5a867a451d064c21dd42a5652e01589edfe395e399bfa4d8493d8f0c6b0909cf0d8d196a801b4f988883344d05de8
SSDEEP 49152:kB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glqQ/lFTjN4:+u6JmVxd2dlLm
TLSH
T184D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 982021f73de7e21ea005c32ba3432cddf9f56cf4294a8ab774ecd9416975f5d5
MD5 3d8e2b5d971b652919de671517ef612c
SHA1 9af4c974ec01cdf9d8bf3b62f4e165f0d9b929a4
SHA512 38dfef5d3ea97a4b9d50b3a05a9d056bbe3d5cab67b45fa97afc3557351a6d8e5207ff4d00924efb46ba20aa171a3c814eaf847c586422435cc5686a2505f73d
SSDEEP 49152:e1hpsNoJpF1A6UU44CwH7R4xmQ/lFTjN4:emifPbRcLm
TLSH
T19AB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 54c03129d62a1dc6835bb4dd7eea535e9617298f56986de1719f1246c78bfbe3
MD5 7b8fb21481b7d591a5553a4e5b992cf2
SHA1 5de2f7ff1aa273bf2186bafde8dbe87b8a270a95
SHA512 d7495c767c887c2c8604434fefba38f9d8af18739c584f1958cf0448cf9750164b2052a2908a294406a6791b173657475d13818e351f4956f8a9526a9173ec19
SSDEEP 49152:ASuZQIY0Be2KRRVtOnks6NMHqtQ/lFTjN4:a5dKTi61iLm
TLSH
T174C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d9bac22ce7d015e307b2e4996b2262e7e73e25e46e027324add11ebb365f1a87
MD5 68255aeeadd356ac24c049a6489a2803
SHA1 24959f6c43dd90992bb7b1575a36726e1ab7040f
SHA512 99b24d8b10c178d807bf855e1ff30a73485f1e6cacdf07d963d646930bd9207856e4214bc4f9e839704eccac357b172e73b95293671569dc6f7322554e2aab9d
SSDEEP 49152:ChtSn8EApI0figngiDn0AP5waQ/lFTjN4:jX2iyphYLm
TLSH
T1C595BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8ed39760188c92ee48c1c2265df932b794a4a70623b5bd3adeee01f064d50faf
MD5 77a82365ce315e3801236ec83034c095
SHA1 631abd3af40721393d0cb42efba93251d7a9a293
SHA512 2d9c84dfd2d6b62000bcf918a132fffba3cb04445b3f19c32f986b9753680259b4659c86b5438eaf00780db196ae47cb88d5821d9bd1323466e03e13a65aa677
SSDEEP 12288:ShGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:SxnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T12E5523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 061be6f2fa645c85627ba549db9e53b60729bd968389b3c243e4713bc0917a84
MD5 91d27682e943317f655cb9a61773ca7c
SHA1 a25bf9d4a3081e7c7a71239bd38e20da8489a6ae
SHA512 c77365ca02b1370fce6cfd9ce75176e4c315abdc32b1383670f055311497184e5991c6e5066dd7807c50b829a7f1a753fc84daa4e6f25d2015b53d78e66e8e74
SSDEEP 12288:8AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:8gnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1565523797964F98BFA1706F14C8281829B3B0EC6BFD1938F7B482129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cbd303b16f46e8303a52b1192019769555e1c9367ca83b5245a43839a6ba236e
MD5 85f8193d32e4ebf8beedd4e3177fea46
SHA1 1b18b7c23d4481ef2414aad446c5e37f0778fe57
SHA512 15a4baed83a95125004e506875b973f8383af4b285d41a4dc057b2019f179aa867516cb8d5832a8c5778232564024ac68ad46d84d8b2055e23bb520dfbedad58
SSDEEP 12288:8uGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:8unQ/tbw/2Mkjy6Fr7g0od
TLSH
T1F25523697964F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 92e144aafe4216b6e58a582420be8c4b14fc30f888528fa0316198c7a14c53e5
MD5 d1cd7c3a4a715af2306598e7f810ae98
SHA1 ff0e0b1608ab45adbb08d71d0500ce5b8b9c4b97
SHA512 b52922f920cc3ff9bea64d6d7a085a5d62cdb834c61aab29c4e12a1f115530fc5183a7816cc62078ba917a00c62dcac07f91bfcab53ab723eff7d0121573c76a
SSDEEP 12288:DVXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:lnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1815523693A69F4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bfd1019caeb7cce807cda10bce67d317443aee14f4a18f111e2e9ce5e13f2c42
MD5 8a3ab1b5313dfb52d29d39c7b4951911
SHA1 b57b83f944ef510126582e25ff3a1a8d29378912
SHA512 00a1220615cd740e1d22325de1397ba9b703ac8300cd183174821e9df8070ea875e9529b29d92ca0180e9d67a01aaaa00c638288f56571cb343ee7ee10351f49
SSDEEP 12288:qvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:qPnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1A75523697964F98BFA1706F14C8381829B7F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ff9782047db6ff3a14cce838559546fe058a6300684062130daf9ef991a26ee9
MD5 5d3312cfeb472c3e26cc4b774f4e0c48
SHA1 9675de1be7e3544e4353d471b9bf6ef8b783193e
SHA512 8c8ed7764503bda6dedaec90cc6f8977755365a2c482273f1ba6a90c1d338cbc7ceb63cdb17b6e5f6f7f4bef14f63b8cfe5a4aae06780da0af41d79e1c075165
SSDEEP 12288:BEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:BknQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1AF5523797964F99BFB2706F14C828182973B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 320a6342788061e53bb0b1aa8def6421ed32435389fbf5963741936310307751
MD5 39079f588dc604e668bf75307c6cfb35
SHA1 e90538f45fb70fb17049806e33ffe7e2f9597019
SHA512 086ab251d391f4260f0cac1acb443ce0ae27abe09882a0b4394656d65805f0e73ecbf09f3778b1b3548043dca2360e6f47fa55fc5efa79d598a4fc7386e2c82d
SSDEEP 12288:h4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:h4nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1055523797964F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 5adbaacdddc2aae7726972be0ab9d82f6507e4b1d0c1687b4f0d2657805706ff
MD5 291a5469230f552b42f28fb480dbc44c
SHA1 4cbcd890ca775342a0515367057b07a3bffa3687
SHA512 b18bc4237a8742f1208a594f324433eccbd4986c2c226cb9238648b738e16d1d9d3f91b37392a5635de86830632a06599c19df537347d456c4192941ebc64c74
SSDEEP 12288:WiZwbDzzFEoS2cPvygGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:ZZM3zFVSOAnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1AE7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 793e10964b1dccc020aca3c0a9897a841c351765dd7f7ecf21cdbd779bea5af9
MD5 fce38b96df767cbb1903e4b2c6f55c62
SHA1 e424cfe3177d416b45346a9f093105b7b88a4b0d
SHA512 1ce97ca3c93dec1821f729e7edef11a53a98eaafc97bf0f5e1bb4f8c02a31b4d5223e9a7a2f6e668c7b5f0ece5e81849733e69a70587d495787e82a149553cd2
SSDEEP 12288:Q9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:QdnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1BA5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e83e03559c8b2cbdc802dfd1c26462ae682875ce13bbe10aa0cb85f69f73c143
MD5 b4f1a406f3acc574cdc75cfd9198e8a7
SHA1 4218469aef4227ab3d8f112860ad8683d46386cc
SHA512 b47ca3f42b0339e6b905d1acf5e74eb7626cdddb3344f76b2cb658aa3a6038bfc0dbce307a8a9a16ba45815d114df2c95d7f96a480593e0412a153be751f2b9e
SSDEEP 12288:9JGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:9ZnQ/tbw/2Mkjy6Fr7g0om
TLSH
T15F5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 45281c8f48fa2272a12f97941e8265c9306679a0eb3d03af21e767a521cb8d23
MD5 52862e22d3a3e1aee2c74f471c6c62bf
SHA1 b5c672b294b65a8c106e1cf2f448c173892a5327
SHA512 151478e54a83892cb6e51d057dbd2e1a3e3855f42416a5d8bb1f0c88571031be6888d9fd73cacf5707268e315071f56521cde8124bdb4490002e8e6a6876ae5f
SSDEEP 12288:+yPz5L8MGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:jzyMnQ/tbw/2Mkjy6Fr7g0os
TLSH
T10B65021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5258da9ec3463fdb60819c1ef0450d9be7a461e510482a8e5028ab78bfabed4f
MD5 00a8ea2842fe8ba24c15a3c81833c4d8
SHA1 244d96ac5b5e6bb778b869c9a995b6d9240c855e
SHA512 603d35d09786f828595f042c8c10c6486e15132255c51dbd3e75c774af196df5d4d9ffce1b06c88429cc59d011f9ba3900713c8ec97b14ca1a7fbdb5227c4fc1
SSDEEP 12288:T9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:TdnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1F95523697924F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 24f3f6ff69a4c09b9c80bad1c54d89d4d153f0d8ce3d6b83894398eb3fdf7150
MD5 329056ad2e0912af7ab7c1b23e03191f
SHA1 448bfcbee4e8b9e2ca081a29e36be8d6d43aef5d
SHA512 bdbd0d99941d9064e4c906184d5f5586fbaf4cd5cc92a32ff047f3f5a40008fea9b281c7755a8dfef00a0146a2d5c315cc3ed613e3f952c3d289d6bd3c1069f5
SSDEEP 12288:e9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:ednQ/tbw/2Mkjy6Fr7g0op
TLSH
T1985523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 8bb581cc41b115681b0928390af1a14633734754e9087d999ee88c2bf3c1918b
MD5 15fd482e0a3a41ff8ca202af68852813
SHA1 91baf021d1a0f73f9de13447705add832fb6b290
SHA512 deeb42ea7660cd8a6e10413165fd94c6900b2218d967023ca4429b15edde7def902bac954be905735e2c0a92e38cf8b3ef103b5181f12304ecc1e0e2968fd3d2
SSDEEP 12288:RyPz5L8MGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:AzyMnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1AD65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 5920b093b346d3cb0bf01f42c6ad3d05a23b9b152ea425682b48441cc3379112
MD5 beda72e20bccf5050a8164aa8e86399d
SHA1 c618e539e925c1161799a3d51a0d4f61de42b40d
SHA512 06cd271267fc605a023069daec60b29cf4d6c931243dd5681a8b1b4fc46ca90226171b85fb7ffc3d7418d94f40ee631e14ad7209e18efe0e078956a46288e729
SSDEEP 24576:JT0aLl3z0zD+nQ/tbw/2Mkjy6Fr7g0oI:JTDLljLQ/lFTjN4
TLSH
T15B7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 89a7cc9b806bd72553a9307f00a26ed1a91a6aec7f22af8b1840770a5b20f681
MD5 7e8f6c85d8628e145e3f62f203c7aade
SHA1 5a0bd610a52514d511fce7a0e6f394f3ea3ed4a1
SHA512 1dfd87660d82f72c6d68b291d64470d5c1094e962c83f55e41162e7e31c9afc3678d8b549a9b48f2f6b091e4ed98952930ca2dfd6cb1c9ed7c08ac3a11107b4a
SSDEEP 24576:831d9CHKy7GZinQ/tbw/2Mkjy6Fr7g0om:m1d9CHKyaUQ/lFTjN4
TLSH
T18785CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e097e8b407dbd52b5ef342e4a944f01f879b6d2f2b5c42f7d4f70e24fe13de8b
MD5 ab5e5d94d61cd7b2835ec0cc6cd08973
SHA1 1e9f062bf4b82414c2d0594f63dc2eb7124a23a6
SHA512 210da7d8462c8e44c45345eb95e2afa9569b20778278e6761f22e69b006aa8f37732d7e37a353fb15cf8e6dd76c0b2ebfae6b73f8cf7ef7691d890c015b3e216
SSDEEP 12288:WOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:WOnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T10D5523697925F98BFB1706F14C8381829B7B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 1cfdcb28b80584eba788c3af50529950c40fc36e1be8de219734c3e403830300
MD5 921978b7dbede10c4bc6a25e498b9f7f
SHA1 f4b62da7f7eaef49ec59234ce11a5ea150791412
SHA512 8874925f6762eca0ede318198a11d4a70353aff76450ef643eb3252833e9bbb43bcae6dcda55ec87da87866852305bf7d44f4026f08bf865575a3a552890bad4
SSDEEP 12288:7sGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:7snQ/tbw/2Mkjy6Fr7g0on
TLSH
T1DC5523787964F99BFA2B06F14C8381829B3B0EC6BFD1938F77481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 71214d8936d171039092442c3a21edf359f701a3c3ded0e27edb26ef0d2e6f56
MD5 f35cce0c0f04043f64abe43c8042f3dc
SHA1 2420ea705db7acee8bf29f53186f966bb2a17f0f
SHA512 19e4916f170c666ba7da587b02ab73e7d35b49249076d3f4e1399ddd320c75dd0bc5cc9fe63c4372c6768145aeeb148c5effa4d7476b72696d496bf909a14bc7
SSDEEP 12288:ZzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:ZjnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1635523797924F98BFB1706F54C8281829B7B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 918d74552c3bc1f94c1ddfdd187577ed9b89b3a6b54e511c97941ecda0403385
MD5 478cb65f4f6c0aa339f40a8cec48a0bf
SHA1 330cdce83d5800d56cf90827e39c8f46d3370fbf
SHA512 1843bf3080ded45515b7854585513c0925e08e9194823553a59f323ab042cfadfc4afc38b35b1233ba247728d50ed0e019a61a039f2392209e44f29be9bf122e
SSDEEP 12288:y9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:ydnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1BB5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 ebe630ecfb4da8b15476a3cf3fb8d7a72259464b6b2dd7a457494c8c84ca6f29
MD5 c40df7a71ff6544a58826c487a437c42
SHA1 2f252109808dfdacf4d90e0755c979c7df457f57
SHA512 46c94dc99f88824c6ed2010762d06faf5d4ef89b085329ed6ece9000a0347169fdaab58aea38be75ff04cb62b11ddb072c3942b93d7a8a62c60f2bbcecc35aee
SSDEEP 12288:SOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:SOnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1045523697924F98BFA1706F14C8281829B7F0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f0705b92a6e182c688fc7d82bcd45ff31650dd38c47f9c61d628023c973ba109
MD5 420d3674f1f677b38cca2a018f7632f7
SHA1 589b9bc5e4bf0e48a7e5c062622d7e0e423976c6
SHA512 00d88f5a0ada4e223918ed364049edb51a48f26872fb30418219cbfaca3def46014046cdf34d62c5cc7320442f217bc87ead2c6c5b3f36394567a9a847447f09
SSDEEP 12288:e1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:eVnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1AA5523797964F98BFB1706F14C8281829B7F0EC6BFD2938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 2f0e4df103e42af1109a0c4476369225e2f5ed471e8a3b1b0faef3f7b20e4db9
MD5 f18026d6b75951b22690607d8f200bea
SHA1 dae94f77e7203643ea6dff70eabaa35841de6c72
SHA512 a806f5fd863543448442a4c4571f208ec4e60ba63f5278a941790a822c55676c99fca87d21e602870265aa41460597791659e8ad9c2f57c693d34debe9a71485
SSDEEP 12288:xvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:xPnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1955523697924F98BFA1706F14C8381829B7F0EC6BFD1938F7B482129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 1d0e38a4494296d5609e39fa8bdc8b62a765e0aee0ff14e5eb2d49d52cbb723c
MD5 8715518317b429fe0b423c973dd27b4f
SHA1 e775f2bf78e80d815f13b66911aab9a915691849
SHA512 753dd5f4621468b348a54ef3c545177cc72863ed5c0f6465df7dad6a41220e41d637eb42726b74e924cf0c1fae64f5a27d9820b463fd7902e3bf65a1b8aea75a
SSDEEP 24576:Bfwv/k9RX6wkyAIJnQ/tbw/2Mkjy6Fr7g0oi:wMnYIJQ/lFTjN4
TLSH
T15885DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 766e8d63e5380e8f03f483c011f3062ca07528977b9e883f210366b5769a79b0
MD5 6c861c0bb7a9d95599f77813112caae1
SHA1 de147e1c671feb8b5450cbdce79abca1cd09b4db
SHA512 03e9ce87c66c57163fc8a705e9d3220406a30cfdcc519e8a8728695fb557020dea981a9ed0e4cc795113a938f1416c2d5db9f95892ad0c045d2d34e328de8c37
SSDEEP 49152:yYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06Q/lFTjN4:sySzPtLm
TLSH
T103066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e743ed536d5c7de814ed659ddc363d655aeec017c7fb17ac1fbc6f0e73ee312d
MD5 a1f30154b919a32c46505b91b31891fb
SHA1 891b33fd814814c6518b73485cb92ea059357d7e
SHA512 a605c8324a8d69859295645b7d67a0d750e7b3d660b628bc7a781b946dc2a6d89daa4be77cc3e8b9b8b0a6f81d39500b09b6932b6f9f9ee3f5a6f2b9078dd37f
SSDEEP 24576:747Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYwnQ/tbw/2Mkjy6Fr7g0o+:747JUQj1irIhCnDHUPfF/qQ/lFTjN4
TLSH
T1CD65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 f30fc189b007cd8ea7148fb38382cbe6c97e8035f6c3bc07b7fef52c4d0a66f8
MD5 aadc621d23663e71e5c071228d94c13a
SHA1 a6d518f66aba5559ef4445ad8f4ed2a634972737
SHA512 1bfca3b45e29dc1d42319e8d7ed6d6bc6b716de0e6c369093cec961d9f1a172fda4c4d885153616db3aad93a16073a2bb5a4ed0513414820843631a2ed34d099
SSDEEP 12288:FssfNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:ltnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T18765F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 aa39f269c3c145a6ed6074b7b9ee9f7d446584f2b5ba2224f4ae0ad98ef32c23
MD5 722532c7af76c35acf3d58484f923a0e
SHA1 6099c48a1a6b7abc7f59bd2bcac04877b64ee205
SHA512 5f126cfb86015843d925939646de0fc76a71c26743962c624be0cbf8a37d83cded77db6fc73b2b7156ed00ce4f8ee11945f8d61450d863d86a2328cea2441665
SSDEEP 24576:DuUTUPwNtJNMn8g/cx6cwOUKvPS1HL6Ew:3TUYT28g/cx1wOU+PsHWt
TLSH
T1A35527417627D78BC6A940321E36D6CCAB707D01FE456F1773C8873F9476668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 c040d4a3024eff18ab748a3903b6190194e6d05e06265aefedd6c7a79cf832d4
MD5 17091c6fcb15d262b23e0ef51fa53661
SHA1 884cf7be8bfe97163718a9ecedc41d1f5d8aac82
SHA512 56d4c87e126f0fe94d0f5f289c566789695194f21b1c4416a35c2514dcbd0ef8306f504e74e4f32f4075a83c38fa1972495a8565a1b20f12392412115abb7f7b
SSDEEP 12288:lY4L7J7Ai5Ln0yvDJSOwphxqVp8g6gDHw8Y:lY4L7J9LMNfx4p76sQ8Y
TLSH
T1CA453A01A5A7E75FC9FE50370732C6CDAB785C03BB452B0573448A2C9877A7EB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 eaa51e5690aafb358059ab27c51afc84e234cb2de7d08b97c228d32ae11c15ee
MD5 8691d1068c8d696ce23fb49ea6ca969e
SHA1 3c13ba02ce6971a7d344e5eba0fa056a64f7cd46
SHA512 eee4e2ffe243521118e994ffec08c3c302813eb52466729f6de4d870c81dc5902a81fd0b6556bcb524ec74a69426d1af160a57100eecfb1e9925b78ab8d06029
SSDEEP 12288:v67FGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy/:mlnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1205523756668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7b2c986a534640cebfff7ff631a3eabc3433028859d2856b66e8b8922eece1b5
MD5 ab9a07371fe5d9c9c51d2afa774e54a3
SHA1 d1241a40501357d3d260d651f03bf35e11336acc
SHA512 f167d34a1a1fd2c6f2bf179800cd54fd29927b97d1567a20f90d0171de34582ea36aaa89d1a458b8e2f6c5f48eb0b7593968efd575892c172d634f0c7b904ac8
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYLnQ/tbw/2Mkjy6Fr7g0ow:jgb4mBIBhGFwQ/lFTjN4
TLSH
T11C65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 fe2ebb74c3e337522504b6a654645092d77f78d8109d66258b301aced4833cb3
MD5 3f2448f82f895daee2834f0b2d0b259d
SHA1 29a420e8fc67ae05cd4e4766305b2a47cbba4263
SHA512 0057438515f1c2afcd50a696c282acea7d3f151c702e23a2438f491f27ce2e0c39ecd6529d3629eaa01cc4a3ace2a4d1565a1c5949ec4c1c8a51057c19817545
SSDEEP 24576:KG88u8FpJqH1Qzria7/mAnQ/tbw/2Mkjy6Fr7g0oH:x7ZFPqVva7/DQ/lFTjN4
TLSH
T11E85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 8470a478aeb0e13f10c78e8d2198bbc187e716ffcd42e85defb8c21ffc248fde
MD5 1d4b58bd2be0174208810f5d24de283b
SHA1 8c69c996354f053fceaccde72996aca0aabb88e9
SHA512 9395adf5ffaa407a35d7fc0ee332a4be2f7552f3555f24dfceb6b1e0623f8159e1ef8139af32f32237cf9ebc7ab343fd09ae2d35ec7bb104a5ef6379573cfc5d
SSDEEP 12288:sHvUrBFrEjwaQ0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:sPUr+NQUnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1E965E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 81a0a34557ceef212a55c6176ff8e81003440e3c65f11e9d9048b20c139fba85
MD5 abf7fdb839a51ba305ddce6ce9a1cfbb
SHA1 9de257d618fb7f73b02789a55784b0f04a83fe2b
SHA512 26d71da7cd323270708d976b394c2ea6104a4930055d3fbb66085c148c54d018be95c43d4bee52b6675ed85924438c946bb0fa972abec505335ccd494f01af4a
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkQ/lFTjN4:bG05lO43bGLm
TLSH
T160D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 da59e7c6608b470773c6163c429fa7459d0668b3bf48469e9ed82dda545ae611
MD5 a733422e31da43588e43dfaecb388749
SHA1 ef54f494f5d9bafd6a5ecf1b685f6f7b016e9f0e
SHA512 f194c7b4cf0c944b3516fef36d0306baf2f7d1ab5e3460bedaa1f79884ca11a995e5441899b04034857cd87d8d2746ee23f31e1b02498bac28e9e1b8c3a96742
SSDEEP 24576:nfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn6nQ/tbw/2Mkjy6Fr7g0oF:fa5POZ3+Jt2pasx2+msQ/lFTjN4
TLSH
T1BB65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 97c65ebbdeffe8d620e3467db6d45a11190a05fde1d3a067197d316ffe08e1d0
MD5 d0848e47c367a39594ec79b6ebca5267
SHA1 8d03356922726c63c0f043adcbc5607e7c8234dc
SHA512 718f54e84d0227dc186ca10110e4feed20909867269c90203c6e1e95c6f1e17bf3b9c3713fff657ffcaccc510f90e73e41f3d4c9968960c1b08551cd0308a1a2
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkInQ/tbw/2Mkjy6Fr7g0oS:SNc/zEOVHFjQ/lFTjN4
TLSH
T1A1858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9424a8a77dc2eced114e62bf8905c6a290951127c412e82ffd6ad8bbeba7275a
MD5 057ffca27699cad558bceed5f06a0ecb
SHA1 dd082d0afbe0ff297c7cfec076a55f0469ab0728
SHA512 c2df875d6a4421fe565e3e42b83e162245c45a4aea9380ce1f55fe091d2277182533ee4d8700184d45c56376c2050792dd9699fa66e3ad58fa65ca9807e753a5
SSDEEP 24576:A8kNvNnaFeYhJNtmZBm2nQ/tbw/2Mkjy6Fr7g0oF:A8MwBtOm2Q/lFTjN4
TLSH
T1A955AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 fbc5cb0d80a780175759e66fcb7ba24002bddaaf6fce57b880dd57ebf8257da0
MD5 4782d20269aaf2fd0a16731ec8b5f6cf
SHA1 c170268a0d8a2541fdb6c75f4eab2d518d9ceb81
SHA512 e1e04dbc0d045d9cc812dbda40c55bdf359e32ccd4a218751d72896e8527274195e8e24cffd4e3dc9283d88bef02947b64fb715bfe2b506652ff13a90561b536
SSDEEP 24576:lD3FHshBIYQgARnQ/tbw/2Mkjy6Fr7g0oR:lDVHeBIAARQ/lFTjN4
TLSH
T19B75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/420-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/420-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/420-313-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/420-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2008-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2008-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2008-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2008-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2008-111-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2008-109-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2012-133-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2012-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2012-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2012-136-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2156-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2156-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2156-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2156-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2408-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2408-85-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2408-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2408-91-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2408-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2408-328-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2416-57-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2416-219-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2416-50-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2416-51-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2852-63-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2852-69-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2852-61-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2852-279-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2900-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2900-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2900-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2900-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2900-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4128-1-0x0000000002310000-0x0000000002376000-memory.dmp

Download

memory/4128-73-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/4128-7-0x0000000002310000-0x0000000002376000-memory.dmp

Download

memory/4128-6-0x0000000002310000-0x0000000002376000-memory.dmp

Download

memory/4128-0-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/4408-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4408-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4408-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4408-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5104-296-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5104-80-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/5104-74-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5104-75-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/5768-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5768-315-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5768-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5768-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5768-104-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5768-98-0x00000000006C0000-0x0000000000720000-memory.dmp

Download