bf3cf7aef631a219e10dfbc718ebe665213b5c036771269259238a3f41d9775f

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.5MB
Sample260720-s6tmxagy71
SHA256 bf3cf7aef631a219e10dfbc718ebe665213b5c036771269259238a3f41d9775f
MD5 89b2ef58016cbeb1854b61a944a10991
SHA1 641a9562262756bc8766bb5f4bef5902a4cd9220
SHA512 2c27582612d2fd6ed3496ae6cca4c092eb023f1f1bc9ffbcda7e64f7b111497691dc5e6b3c4a22aa243db647f4e603bf20675cb9f98c061291f6d203c7624a40
SSDEEP 24576:yYJ9bq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yYJtqLNiXicJFFRGNzj3
TLSH
T1DA75026171C084B2EAB7043509B89671AA7CFD354F2548EBA3943B6E5A347D1CE38773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
928	elevation_service.exe
6000	elevation_service.exe
4336	maintenanceservice.exe
788	OSE.EXE
4248	PerceptionSimulationService.exe
596	perfhost.exe
1700	ReFsDedupSvc.exe
4256	SensorDataService.exe
4268	ssh-agent.exe
3792	AgentService.exe
2836	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\619ff5a78f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\HideRepair.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000672310005f18dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7df2bbf5e18dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070ddb4bf5e18dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096fae6ff5e18dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe
928	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	1700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1700	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3792	AgentService.exe
Token: 33	2836	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2836	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2836	SearchIndexer.exe
Token: SeDebugPrivilege	4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4708	2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	928	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 4088	2836	SearchIndexer.exe	99
PID 2836 wrote to memory of 3608	2836	SearchIndexer.exe	100
PID 2836 wrote to memory of 3960	2836	SearchIndexer.exe	101
PID 2836 wrote to memory of 5160	2836	SearchIndexer.exe	102
PID 2836 wrote to memory of 5268	2836	SearchIndexer.exe	108
PID 2836 wrote to memory of 2572	2836	SearchIndexer.exe	109
PID 2836 wrote to memory of 2020	2836	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_89b2ef58016cbeb1854b61a944a10991_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6000

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4336

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:788

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4248

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:596

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4256

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4268

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3792

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4088
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5160
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 026a96de9dcf25febd131c5a878c76d30cf83b2a8aa1b3276290a44bafe06a03
MD5 13af65f5ecdd5d7fdbc572e32e7549c4
SHA1 8874ffee52fbb1fada924005ac126aa8a92d2c9b
SHA512 bce7a0ac615ef5e6bc04e58250c443336d79045f0dbde82dc4f0fd5922b7b5ab50557c19f364001e901270c85662797fdeba1bb16de415afc17e54305b87927d
SSDEEP 49152:Zb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnsLNiXicJFFRGNzj3:v3q6mjBT7wRGpj3
TLSH
T167D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 db885849e2635859862c946aa5c64a675aab14279a40499ecf9185ab36f4db03
MD5 10b400d4b706724886246f1479a790e0
SHA1 21180008547d69277f711b2519df61f028b2a8ab
SHA512 e1482e99e1ac28b9d3caddcb5358b1a76cb17262e368d61730e6490609cf8de96456693255ddffd9df39928ebd9f35dbb30cb56b79c2fb240fc4cb04cc86d544
SSDEEP 24576:MXYfDtczAf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rtcqLNiXicJFFRGNzj3
TLSH
T1CE85012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 d8dd27d2ce94e51593ba7871b25b8314d170674645d438c5a398af7878b773f4
MD5 9dd8ee014fe41cd1f3c28e2003f86022
SHA1 976d6e74301bdbbc3362489b0fed1dd0d5fe1f6a
SHA512 820f7a0c6ec793e6e767cf94afe5c63591f8298fcf04db81fd4537bdcab56e761392e7d98b7f649f42b8a9772a19ab9149e52d362a9e97f97fc9c9230a93e493
SSDEEP 24576:p0Le5ji0hmxPrMU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pPji0A1BLNiXicJFFRGNzj3
TLSH
T174959E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9867434f2f4421e2b0461de77796e7ad58ff0bfa1463a656906601493ca85071
MD5 621fd61c33da03f1a4f785e6ee416b38
SHA1 f1f479bc05a7bb3074599943261ebca70e401ff9
SHA512 0082584d0519919871d15a584687f228992a30de5fc9885e95a54e0603a5394a7a8a0d36eba6159fba891d318aa04148a03669c9780bbd9272b441789875fd35
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWj6q8wyu6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:i/ezSC6vUzPv+Hjy9LNiXicJFFRGNzj3
TLSH
T193756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4f9c4bb1b74c1726cc087dc200d1c1b66fd9527d86be07d87307dd8c79120c53
MD5 3ed3078e9cb26b5ca4bd86ac449aafb2
SHA1 79eed801d89109bc853224584686571d7f70ec63
SHA512 95db65bf7c0e5291c2bc4970337d801b1737c4711a768591efdad730d9be1104bc2c3f4246220152e9cc0c13eca8484cd152572db08c6952eb40c1bf37152351
SSDEEP 24576:lVbqPb88hv/l+Bj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lVO88hXl+hLNiXicJFFRGNzj3
TLSH
T16A559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 ee87af780fb826043ea354bf1e172e5058f99c762758db1dc213bbf679aa2939
MD5 191ae69c4bb9bffc22f902efe7c0b4fd
SHA1 a5438eb676e9079253e1478515ccd89f9867d5f3
SHA512 b401fa93db1559f4f845ce958d73764da9b2cf4a47555f6d5948737c1bc8d3077d1ce370ee3e9a4c5c3e99653d4644b92713fb2241e5f615813110a48805520f
SSDEEP 24576:IlY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nLNiXicJFFRGNzj3
TLSH
T1996523D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 7b503e531484d4b4dcd5945a9ae992936c910d1ea0ca772f6bf5aa708f3a3009
MD5 e67afacba5ecf99be6c1a4ea2cfba54c
SHA1 ef5a11d4ceae824e3007e2e21a54b84795b5c48a
SHA512 f54fa10434233d5274b00de5f2148b29eebc3d7a37305e3a060bf3e1d4b288bb06ac900fec70887997ddba2d4edf17462923685120666055d0cedab8156b8970
SSDEEP 24576:GJIUL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GJIULLNiXicJFFRGNzj3
TLSH
T14B85CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ddec164c75081122d38d5569f8b0c8def905bd49f2dcf79fb281f7a53fa6637f
MD5 2618935c6fb1604af88a51423e054927
SHA1 164078c2a58ed64fab897501fdb05372d7b8f6ec
SHA512 5c8782f553710d2e83ffda16afc07374ccebac6551c61f529152480acce434aa99e59ff8ef3e9b82630a3ab0e81708c27810e30113f2180b895802ca10afef9f
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH/:jQvGAdlCEL8c/WRNw5CK7wRGpj3
TLSH
T155266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 973c829c83c86232801666eb9b41e835e5a6d4368d7c35e5715cecf58e32f65a
MD5 4a86ad6594bcbcc569427d93b61bc18a
SHA1 1d78f27eb9a4d021a8225d58ca85d9367925efa2
SHA512 65c730ad5c633635917350ab86dd0187ea0e085403c896866b101f8a69495bb6b9a31e93ccef8429fcb527aecfff1a93271644f9061fd1a5596fb6849cbda7d7
SSDEEP 24576:49ewsAjR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4ljRLNiXicJFFRGNzj3
TLSH
T15085E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2a1497eabd2898f49e13b8b5c33253f24979724fe8821597f846f593b0c3f5a6
MD5 91ca26f6ecdc896b5fc1adebb2e8b28f
SHA1 7e3efc0a32b1ce4aa8d3806e4964943344f10a16
SHA512 868e0b4db17e5cda03c8a25c21229dc3c9722474187d01feee33e9c3b5bd65b3c00231f6653bd690d1fc93b414165d055f8e4ac9707b992d7f4e577390c2248b
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHdF9:XUEtQevvqc2W1cpV20I32j9
TLSH
T15E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 11a8449b5e8ae91c017e152863c8068a20a53d94e3b3940113ae6cc2a446c805
MD5 abdae5f7f3a55183b76900cd33144a3f
SHA1 49bb7e3b589f0e3d333671ff90e0bb2f7e9f81c4
SHA512 1d0db60517b781a20b8c31aa8bf2426f93d23cc8f9417831b586be21a0ffe36d663d1efeb291e02f04fecc9ecb8dc17760c552736682b41d6879bddd2e404e5c
SSDEEP 49152:DCbRquA/m2yL5zLfFiV+XenmE3/zxLNiXicJFFRGNzj3:8oq2Vjnmm7wRGpj3
TLSH
T173D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 07581b275f0284489c7ea1e746b9a47c8f999d8c4a7219a4c1e3119da1675b41
MD5 200333e59aa02ff07a444b2ea6287152
SHA1 3e9b1163d4c57339c7ddaa0d28eb3b9bc3d8dfd8
SHA512 cf84bcad7cdacd7dce1db848b58f2aa43f558a6ed0d3fc990f33bf71696b2fe93fa46e7c26ce258cf81d4c7b70dfa4a57a1b096666e8fc685d8a5b7ab1b6cfce
SSDEEP 24576:XAhGL6IFoiwtA5l7S53G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XAM5Foiq52LNiXicJFFRGNzj3
TLSH
T18F359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 f4f91d5d9725473d2516d3d5c6950ba67a28d0e95f2fe83ced8eee87d417e8eb
MD5 cc11b5867a8cdfeb8b89ae98183737b9
SHA1 d5dd9914f7577061c0f27a7b9dfd2ae7014bd50a
SHA512 e19d8e1f19e86f996d4c1687d419554775326788f2d421232c885967ae52cc3de8206c9edacf4c75eb87be252080d1d591035c22314401efe6876780d9fb0d2b
SSDEEP 24576:dwumOWd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dwtOCLNiXicJFFRGNzj3
TLSH
T11D75F18632940CF9EAB641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 fb0ce2e4e6b9169a3aea3b2092575a15c68b9f7411e7318b0a7d1cee33111b34
MD5 6de73259a7e835d28843069b49a2ab09
SHA1 4fe26b64894217f50fc15462c7e8561e1ee47165
SHA512 4d1550cbadb6c3d09c9d69b2ae8af635adc308432d207bdaf289869518786dad0582d32bc4f7e7f2e641da7bd3ee9897ad564362a4a0d8bcfce0f13d7a807bf6
SSDEEP 24576:wZu8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aLNiXicJFFRGNzj3
TLSH
T19065129622C420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 90a2203254a008f8a13a5621b646bd643037731ac7b14c994f720ed2929909c7
MD5 ac07b8a7582d419f5c8a3578bca11277
SHA1 815c7446c6636e157eb81eafafa6e2837075b5a5
SHA512 6b9e49afc34fc0fd40ef02aed87ac6a3652471ed598ff8d92da73e8c7bda2db9f9c5374c78b512cc31cbc053e5c13e4c25a97a593f422868b534aebbd41dcca2
SSDEEP 98304:+QRQyi36YOcPDLvw2gAf+PN3n7wRGpj3:lQyiKanX+PNLF9
TLSH
T156667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 74bbdfafe8601ef90c597f7b4c8edff357193eaa864e19c91b66f7350a5ba882
MD5 8eac8a14a43f1a56d999767f1dfb0ad0
SHA1 c1621d2e2727b5acbf5231b01d1daf16f8031b2a
SHA512 95c62430e56b2fe67970beca32c4f296e771abad8774848e9a1ffc8a7c855f5b579debde7aa75ee22407a21ef98f809a7573573082d8bf6f3e39c00bcd313bc6
SSDEEP 98304:UQRQyi36YOcPDLvw2gAf+PN3n7wRGpj3:7QyiKanX+PNLF9
TLSH
T1B0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9f2f01f7a453e532d222e01d0723f0f7832a231255d5c2fb1312aff9317b16b1
MD5 6e53d631799e188e3f6ac64b7c31b961
SHA1 86a46ce5e005203668b3ca7c7b78f66a387103ce
SHA512 a607136af4456daf4580b1705ae45c04e6d1a25a20aeeec594e2ff9a1696032f83ed9423a49663589237844dff83c36de4be1757600ff8d272bbda255158f2c7
SSDEEP 49152:g68Qg55nhkeWu7PNU3/BLNiXicJFFRGNzj3:athTRc/B7wRGpj3
TLSH
T1F8B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d2b155b11d11180741340ab216eaa98c4716c4ba455572e526489a3747ece087
MD5 51a4adeeb1db18c0f936ee7275accf82
SHA1 a74d47ae2df6f5fd720015cb73f10dc6366ef420
SHA512 8a8a3ecbaaf2be7a1ac3540ab84fe57a6c51438722e8593465ecbee109710e082984f52e6e2ea08e28574421fdac110d0e8fd0a4cd00cee89d675debb03b36c1
SSDEEP 98304:ay5112gYy5azzVvU69nLKnhZY7wRGpj3:DLIHRWhSF9
TLSH
T1F0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7ac29b2c778d5aa64ead9c39ebdc427cc9b80fc3969c7de5d963b28baa030120
MD5 c59fc70db87fc738829d3f95744f4522
SHA1 93b63bbd3edf0e5025f6386f25251730c221439d
SHA512 6c3cf6cdffc8b91e38eddc8b80ecab7fde3ef66eaa02cee00067c5d4e6f50be5fb755da3683798b747d9104966b4dccb22b83052a8ab3dc89ef4e62dd45d1752
SSDEEP 49152:dB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glPLNiXicJFFRGNzj3:Du6JmIxd2dP7wRGpj3
TLSH
T13DD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c8548f672a0e23743e2c8d4d8540c1a5583a7c471b871b870865ceb96af5b9ce
MD5 fffe442f69b6c78c5b6e3dd276358ab1
SHA1 676974d46c307c8f3ec7a50cc844d784cb61541e
SHA512 4ed49b51e08145a6341a0aee1c99ce0163473f9d50e77be71f036819c7c9391d32341ec561bf40c32c9da94f8fcd9207cd73d2e8e62dd82963e5fb6201b51e87
SSDEEP 49152:R1hpsNoJpF1A67U44CwH7R4xrLNiXicJFFRGNzj3:RmifPqRm7wRGpj3
TLSH
T139B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e522a5d5c6b303702c3e1fe5bb5b5dedc2518d2b55cc028b801f0f847d11d303
MD5 c68fd5711b8dfc6b56209538b271f28b
SHA1 847d66c4ee793c691e6594b26f2b102ad2aed2dd
SHA512 d9929b0e0248723c45066940b069a8b65e8633dbe1a60b36e6c5371cf95277b97d505e6cfb03a50a3ecf6096c4b87f9ea1ae450f285592cdfdd1907744bf7b17
SSDEEP 49152:ZSuZQIY0Be2KkRVtOnks6NMHq8LNiXicJFFRGNzj3:35dKqi6187wRGpj3
TLSH
T1D6C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c31c8ea6800893b86b061c73cdddf96a7830489015998c501dfa8bec01858e53
MD5 58ef4941636c0a2ff61873e7902a1b1f
SHA1 65455a61e8acc1b9d1ecaaafa545310e2318047f
SHA512 1a8366554fafa586d65fda749e5280740c499fcaf1c15b3b59ba4ffa44089ec5b065ceac4426df39693d3f879d8e8db92e50e1f385228ca7bd2bcef91db68ad2
SSDEEP 49152:EhtSn8EApI0figjgiDn0AP5wfLNiXicJFFRGNzj3:FX2iWphi7wRGpj3
TLSH
T10B95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A9077561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 84baca7c61d644031eb5678ad40860c21f56a0d28dc4f961caa29b92c0ab18b0
MD5 52253156ab0b9e0da3fa9995b18b308f
SHA1 51d9fc87c4f0d24553b5a675840ec378f28b70db
SHA512 7bd4501f3a3dde170f56de2e940930911bbd5f861551e629d44de6e602c878870319943f689ecb0c81527bdde012aec313a743ca35a85a4d36c3816e343b5883
SSDEEP 12288:SWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Sg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1416523D3548955B1F6BC003AC6765428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 b683b94fd8f0289fbba9ac9e79a4dc193be22c2e0a711bec6dffe62fb91aedf4
MD5 5c1dbc152da5774daf699c38266f6098
SHA1 105d7e99ef36c84fedcb49e1c917a49291cb1262
SHA512 d7599d66a36ee2af1cd921c775d4f9a9d6606c4374620bb8b2c843559c312369df4c90e53906921546282eb46abf1164c954831503f724fecaf0e245b2a34f6e
SSDEEP 12288:CJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1996523D3548955B1E6BC003A86765428F5881E2DEB5618E3E3483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 2b7ee5ac35e5105a4045406ae99520ca70cc43023dc92a83705f247bc686d67d
MD5 41bf54fa0192e219b1c56037a5ef199f
SHA1 e9bbd9fc42ca543317452b0ac4d1d730b06d41e4
SHA512 bc46a30e7646199eb790ec902a362779be7ee02a23e59b8def77ede6551cbb5f7002b3c482e16364b904e13f24b4c1f0482a92724944d158d9b853ab7025bfff
SSDEEP 12288:CniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1276523D3558955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 a5cb4744417848fe2e62a07936c8055b4d7e86e46a06e77e4cc3d6f58f7f395c
MD5 b1263e3e0605dbdfe286cbf8174b2774
SHA1 a6d773076dd194368a64a01c0fe6f9d897134ff1
SHA512 3288a180de11a13dd6b6d755f052d0d7f96ed9371b99a8fff48dd14977e098ff6394844a0dc97b52a2b2ab8f00f74f5a1ac28d0a3289b9bb78409ca723aad579
SSDEEP 12288:EVciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16A652392168900E1E9FD803DC6764424F2A47D6CD7365AEBD3003D1E5A74FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 77f9ed27ce67cd3840396261f32245e8fc5b99b3aea24c86fcd9fb25cd7eccc6
MD5 6357f512c527c4fc9f4bcd73aa5259f0
SHA1 5ddaa51b4d4761c07386b1a16b2327f735b6eac3
SHA512 a3f8ee4e1615ad46237367669f05ba5f90209d3a62d18bdb815f72d2b5f29436c3a22588cace26b791d02c756cc53ed517087d5f3f331b1d079b5e9ada0429a4
SSDEEP 12288:OUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:O+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15A6523D3558955B1E6FC003A86764428F5881E2DEB5618E3E2483D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 aa03f52330f10c2726702f5b392e9f5ba267927a8e4dfa25c5856b37d7533ee8
MD5 5b1c5475c2016e74015b332da7c737b9
SHA1 0e3b823a2a1638241429095820e919dca174fb80
SHA512 f603d9b3e8176ff8308d6214ca9d8f1ecfa6dc3cf6fce5cf625b30a4ff443346995d86590781930727200465779f4d113309a143c94d93a655e50f7d4c728d22
SSDEEP 12288:6ViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:65/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DF6523D3548955B1E6BC003AC6764428F5881E2DEB5618E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 379479899d487949964b300dd68889ec69c77eb4b030d1328cc54d7560b410db
MD5 48b5e04978102e6285f8b049107e9472
SHA1 d005cda06544c99098c8fff34faad77f3c331694
SHA512 efc1453a75c8b7e3ca085e6da8330a2c8443ca34547135dd3d40b17a53783993c616bb127911536e20128009f1210506ed265a6bea9013d755e96bcf8b9e6eaa
SSDEEP 12288:zhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1856523D3548955B1EBBC003A86354428F5881E2DEB5659E3E2083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 99e7356c4dcb50bee370ee81537f23814ac294d3b97c7dd1b88221aa81c19cc3
MD5 a1e10bc3be8954b515db563e24755640
SHA1 095b5e6e86c9cf2c8f694e4e240281d55a968785
SHA512 0b2b49f8263729556ae9ffb26421499101d4221a2223503fb41cd713980b4c761974784a2e5faa7049a106cf95917d094179075420356eaa33d0ccf9befdc71f
SSDEEP 24576:nZMNzFVSO1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nZMNzfJLNiXicJFFRGNzj3
TLSH
T1C8850295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 4981ef349ce1fc3726f105f4f32986be6d28ff09b3b1acdc5b76f65e0dc2ee69
MD5 4f681779900dd64720399d5ef60c4e70
SHA1 457e58b49960ad65630967ed5fec226046056af5
SHA512 30c02eaed3fa10347b2c82db071d5f6f3ccabafd54270481fe321989ca2ff5def9b0cc1617a9b823552f9a90929fc3ebf42212cd55e05d4c6f7aadca1c3a3652
SSDEEP 12288:+KiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1396523D3558955B1E6BC003A86764428F5881E2DEB5619E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 735beb10526c1a4afd3126a876acee1ff8ae580a44ad6d25ef31b49969647f10
MD5 b1d94ff9acfbda0c528e448fbb75ee53
SHA1 694a92ca9eefbcb5e854a1c0f5a2520cbc0ad799
SHA512 8ca22780967db814550b5b62e32b69c8f7a10e4c0c4ed0efb8db5c6860d20e10ab2f88f95c4732de7f0f4152129ccfef32db16fcff50db1810db9fd827c358da
SSDEEP 12288:deiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:do/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D86523D3548955B1EBBC003986764428F5885E2DEB5619E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 1a66e108ba00c0da584efdccd216430c03a3d5d5358e43f59e340ccc8b58c959
MD5 5842af99923eaf62d9f402f04f3aad94
SHA1 f67e8992402d86580411fe23d2584c89322b8d23
SHA512 9fcab434b22a4890a84b5bf4b967d4cfaefe51b926926e12bf9319137fee806223222d4d49fe312a12027294facb8901fd46d761d80edbf50ea73ce7517e2804
SSDEEP 24576:Kzyh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KiLNiXicJFFRGNzj3
TLSH
T13B750247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 7a7cc1dd7af8a7d734dd3272ded5a809e53c9d807407f6fa7c60370706072477
MD5 066d6e8c4cfee759ccd068cf7ab1b150
SHA1 d0ee1c61558a4361246a2d7c311bbeb786e21eac
SHA512 c9b0fa826686554b7360a9b708ebcdb534e9f0956254cf7ba8454e2c7cc113825db6728dd7b43681ad71395b6d9b173002acd59c70e5a60fd042fb21e7e3f5e1
SSDEEP 12288:WKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BF6523D3558955B1F6FC003986764428F5881E2DEB5619E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 892cac0d13def152d09fc232c9eb877547a07cfae1a0b68e6a5f55a04d6bfa9c
MD5 400c90595241098f345ce1d2cce5e82f
SHA1 c88cd0b7cd4736c0a0d9f218c6f624770469a992
SHA512 8987fdad22484b3691e27c96ac6be4c67f64efa5e9bf17e6c54cd55da7d916d8dd4141eba2d29b1aaae5d88f04d29e5dba45e134230a5ea22a90bd191e49c44a
SSDEEP 12288:NKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:NM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1086523D3558955B1E6FC003A86364428F5881E2DEB5659E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 b583a0d18af696b113381a330d81fa4ebd2042c248c74b478421d8b294c1fda5
MD5 3a95106f6daf0c1cb26e2014f4274a80
SHA1 b43a432fd1518bad194c8dbd68fcc2b71100c76a
SHA512 76192ddaa5ccaf5af26e36b2f3bda3d9ed7f4747ffb961ef4dea5e60265ca3ca6ab0de66c0f8f5186d9434287ad0f690ba72e710d5e15c001e07067295764ee9
SSDEEP 24576:Jzyh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JiLNiXicJFFRGNzj3
TLSH
T1E5750247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 763f9551bf89599353446824a81deac5b7aeada66090e992fe056f0be857c16d
MD5 910243203493ca0acca9c95b9ed3a1fe
SHA1 883765b9d771b599398ad5114395e9f6715c7601
SHA512 6eb95bbc28f9a92264c392e074bef53083303138486ccff090af78672b023e1c6dcbd8f7cbf50aeffdc2716559179f86e56aa9c0526be4e3834f76e1756c865c
SSDEEP 24576:iT6aLl3z0zDD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iThLlj6LNiXicJFFRGNzj3
TLSH
T1CC8502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 395beeaa31ca0d5e2b053c9b9b54294dbcb9c40caa7845f62b1627b42ee5876f
MD5 7cc849edc37915fdeba01534c2e5710d
SHA1 6aacc3ef6bbdc44713aed2cb5630e19fedeb1d36
SHA512 2ea282d07763216b1dab3b042096b7def710c9f70b95f0f1f6396a5fa6d6752800a56ec0cdd93310365e8fbb2414edb871d841ba7405ba1ed550c25b86e62ac4
SSDEEP 24576:C30d9CHKy7GZH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:k0d9CHKyaJLNiXicJFFRGNzj3
TLSH
T13095CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 0774a037acb5ec4531a505f4ba0e407a5ba4209d987096bae458e2f0466fbffc
MD5 670ed745f61352d3556ed65420e5087e
SHA1 3ff67bdaec8ef4290f685badc378a5725e5cd38d
SHA512 f4a9691a0087937cb4b2156124d300a7a4ff44b9003592fa3f677301fc86f3e4c384d0dbd436195c450a8fa69979e04c0e1696dac71b5bb01a17b4b5cee798ec
SSDEEP 12288:oHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A36523D3548955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 4e6ceb5f1953c9ea09397cbf96ff3f0faac81c0e3310f03c828a24baa5161fa0
MD5 0b49c12fde21164f24d4486582d0a2ad
SHA1 f49ff497cbd091093f27f97c84c97fbd679ec567
SHA512 d6771c66db99361dbf5411b0362db56d0f81f386dc45867ef4e589d977d617291c52531fe4a72305517ca47296465d3041dc7f0de3c78ba90ccb3cdaad5ec971
SSDEEP 12288:TdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:TB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1446523D2558955B1F6BC003A86764428F5881E2DEB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 ee01f1fd0326eca7a8418093d38aef1e7ee030eb23b26e68aed21d51ac703690
MD5 48d20702ed1cc16bcf6018cbadb2933f
SHA1 87c1b43df188ff20f106cb5ac025de56535906ea
SHA512 87f0b408792d21d3f5d0d0736910e0eac91315d417c427877cd212b3525b6f45b71de711008da621c47855dab6acbe2a7ec67ba9fcb92d7673a4116308773902
SSDEEP 12288:zgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DD6523D3548955B1E6FC003A86764428F5881E2DEB5619E3E2483D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 3986a675ef207e1e84d818c3f5f55ce4550a97909095d75379dfd086214e5418
MD5 bf7c4990de0b4b816ac82a19f3ed8b14
SHA1 d664c96ff565803fcf38640851144633ee26284b
SHA512 46127097f31d5500004442437620e51b32357b8580963d1ded4677d0cf2f3d02f9bcef226f29a6208c084f0d0ee049740d500786bd15ca2c30956cf61d2e175b
SSDEEP 12288:4KiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1ED6523D3548955B1E7FC003A86764428F5881E2DEB5619E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 953f229dc4692d64a35f3b4adc3908f036f900fea354e33658eae05d21dd6f50
MD5 c71137197651d7d01f2ef30510f817e0
SHA1 eaf3d48e7e08fbd22d5f9b261e20d2aea537df57
SHA512 5d9d99776b4d0fa72bdd194afec7cde56180142e10e559bc2d69da8192ed83c7a3dced3b08e4c17cf5c03c7d02f48b04b0e22149a10da58d6d324edae57784df
SSDEEP 12288:tHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1646523D3558955B1E6FC003A86764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 4812b9af76372c318cccee268db0fcbba125afe8c7c5a370142fa1ae1aa7f662
MD5 ce18f9df504796c619c29fee137d81e4
SHA1 3d7eabc93e10c66322efde7e32559f9f2d4b49fa
SHA512 acae55ed383c3fb958afbc7b271399899ba98fe54e0e0ab2d15bd881b51f077480716d2ffbb8d32167bde6af4eea2003cc8238576b8c1da8bdc49655cc45b3e1
SSDEEP 12288:2CiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F26523D2548955B1E6BC003AC6764428F5881E2DEB5659E3E3483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 e5b7c424e0105bfc71db37224e1aacf814bf3f515b270c0bdd9562668b75cc29
MD5 5b55700e2983054dfa3a8ff336eb1462
SHA1 0de21c8bfec774cd0b30ea5938fd2f677bca2776
SHA512 f57885527178c701e3f73c35c322c6228466f4fbee5c80c1c49d81e3a56cbd9159ae8f915449817ae37eb8686d590f69cc67582005725b17bf0d97c3f669361c
SSDEEP 12288:jUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:j+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A96523D3548955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 e277ded931ca879df63636dcf0ce25f213d33118e1000c4791cf12093e8056d2
MD5 2dd2b2fdfc236cf15bc5cca8f66f038c
SHA1 e55e385d3bc4b1301c555369d8b9de1115b3d106
SHA512 4b8b9530f702dffbc8079e4fd4c249247514125a69292084b2eafeb5fb338a82536c767a13c8898ee6e289ffba6027447d0a39f978a7dc8688a8fb541a5c3eb6
SSDEEP 24576:XfwvBk9RX6wkyAI4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8MnYI4LNiXicJFFRGNzj3
TLSH
T1B295D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dbaa985035d123c740a7ddc83206beac7f3fd61f10f523e37672846fdc12bceb
MD5 7d9f634a65ed9b5e1260a41d990ee2bb
SHA1 56b7f1d55e34111abd909f37979f4c3ce9b2b1f9
SHA512 1aa99442930091362ea2828f7f5d41064ddbb58f0fe901085aa6fe1921b9a59e96effa5da758b0f1d62c888df21fe64d28f474c40f6b8e015b994640e71cb8be
SSDEEP 49152:HYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0/LNiXicJFFRGN:qySzPH7wRGpj3
TLSH
T177066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d2fa1dabd159ea4f44abcf6c7ec7b552db7b18bf843e11b1b8e242eef1a43f0c
MD5 4d4198cab3f9df3c8889fab6254fc74d
SHA1 ee91218518edf52aec813f4cf9276a2a887927c0
SHA512 c1c649ce8b0c917fca5d6e468b0c187ed4e5bb247127c8ee0b76907078ee76020617b3d9744544fb218e870ed2ded640ee4bf79e82020f0e1d47f22dc3267ab2
SSDEEP 24576:B47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:B47JUQjqirIhCnDHUPfF/PLNiXicJFFS
TLSH
T13365AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 cad8e6eacc367f791cf869270b3925ca0875a6dd3904d6c3df7bdda30a594c1e
MD5 1b2e73e3ab8751c28b898cf92b5d3023
SHA1 1823b81282a401544184436bbece14389f5f2589
SHA512 1a6ce75678553bcacc5c43a994803764d6851b1f731152155df1c7c543fea1a6dd30965d3872a4a09e3ede8c5ede42dd2865641d479682c63ea7acd481d88d30
SSDEEP 12288:8ksfaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:a8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14375F15AD28802E8D1AE5139C7664900F3677C2987E1D3CB92C0F93E1F39AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 980KB
SHA256 2a2ea9839d6d1e76297dc2870bd0edcb04a392851850be8a40b3973699c271d8
MD5 ce5ca7dbf4946d5eab4490b4083adbff
SHA1 95615ca2a3ad0e25b16e4e18d8bb436119cf9a27
SHA512 a9ab033f80fc56715b12263a1353ace8c6bdb157dc9a4348e4ad298933141e81c5a800cc4b140280d0d3e30f4997754b7184ba5d92b8d26baf2923a2a22d866e
SSDEEP 24576:vdQUPwRpWTXlqdnG7AQRpWTXF7SzBBsQgOi:VQUIRpWTXlqdqAQRpWTXF7SzBBsQgOi
TLSH
T1F82508007666D64FC66D80325E32D1CCA7B07D41EE45AF0773C98B3F9576A58BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 65d749287fd5af5352f5bbfe9a41016bb3e65cf184f1f5224c2087463a868384
MD5 0f9275a6338f2b00e21679b5207428df
SHA1 d64fca3088f314e9a1a9036ce89898cc09ee3f1d
SHA512 361db4449d870f32f044bc2e04714cb3e414513123546c4cc34a6bd77866da1850d3070f0037d732d5ccba64846724e0518be8cba593fe7f4d86e6aff287c10b
SSDEEP 24576:KlzewpPcPRpWTXFSDRpWTXFSWRpWTXnRpWTXiRpWTXlqdVqdFqddrEhF5z:KMwZuRpWTXFSDRpWTXFSWRpWTXnRpWTr
TLSH
T1B765F8405537E28FC1BA6032072A5B8C77B4EC46B7496F26B3C8457AD86BB15A1F93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 a2aa50f66fa8fbb173ae89bdb65fe6f0cc28a8a2b7a8b340cbb0addb62774d75
MD5 8de930d4f2a883c0889a73d9d7f5f8fa
SHA1 232aa297317c87d7d27c21b3d0108213cea0812b
SHA512 763231b8fb74f1db75f8ef88e843ee327097d350a98ea62fca81b647f4a15d5851c96c2502d2408ddcaeac7debb7d6a14665e8f1c08bb22f7011a31843337ba4
SSDEEP 12288:nc7SiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:M0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T106652393528959B1FAFD0039867A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f10591b082cc99d6e29371c6f3514d21d0835c43b1661c56ae9e8786f71f6d0a
MD5 ea2dc57b10370d690742e45ca4e21c2c
SHA1 27b768414d3a8b029c8c351263b2861fd4bddf41
SHA512 1b14e3cfb3f643cf3987fc2e1892325c6faf08b6da5398740ca2f790b4b9cc6c5446739ab51251f1a77c48b5c799ab7ec473d6f5a36353550b06f85da9ce497f
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bY6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Lgb4mBIBhGFFLNiXicJFFRGNzj3
TLSH
T16A65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 377083a0b99ff557ada88508c757bde9181e1fda3c74c72766f61f0668e10839
MD5 4b653917fd28503534bb70f225069504
SHA1 97b9733d3b45b0104744b4f7f2de47602c173e60
SHA512 7c60233b3751458b7890e8d3f8ec8b608693460c3e28a697cd0761f32857e2ea5149cffad5573f69a48e7a14d89759a0a3831f366b7976bb05c8dbf00d71a519
SSDEEP 24576:LG88u8FpJqH1Izria7/m1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:K7ZFPqV3a7/SLNiXicJFFRGNzj3
TLSH
T12595F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 cd4f69cc14142f93c905ef8bd2cd8c385ba4c2c5cf2dfb386ba2578ded270059
MD5 e469567fd932c8309962d4e711bf3aff
SHA1 3e595e6f435a3e474866e39e27a6fd87b43c0843
SHA512 1d580bc8810d0d84589e341d1b7a692e2c768a718ce877c0b38d4ab007a9b986bf6875e156a4c1c566d758383445bcfdeff4f49f992e4e0b85db8cd13de978a8
SSDEEP 24576:XPUr+NQJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XJQJLNiXicJFFRGNzj3
TLSH
T1AB75F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 feb85d77643db740aeadcbe1ec6f8409ff7b07d7a5af717028105c42f3080c27
MD5 ca0b6fe0207ffd63fc979446501cb1f1
SHA1 f5e41a50706183708b3bad6da9e7cf07252df95e
SHA512 eeea40bc44749c55776f8f0bc70f072bb484539a46cc44f5330a599054a4485651d8b18670c38c39fea7c066bfdb419107e19e655808b24730189ddcc75b99d1
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5LNiXicJFFRGNzj3:oG05lO43bw7wRGpj3
TLSH
T151D5C06A62EC11F9D1BBD07CD9C6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 61a280bbc5d3da48e121662a22be099cbb9993772be816a5e0cc36c6a86c7483
MD5 3f792c25bd340a906f36314237f06733
SHA1 1dc058b656cae99e9c360a5284d54e0bd50bf1ef
SHA512 1fd13d9943689fecfd67a54a0d8a22958a8a1b4515e6c7d579ffc91c8186fbaedae7e887cd57a6699e0584c56c9ffa74b530accfb45ea584290051e230f12f62
SSDEEP 24576:Hfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn//TwSfVcYG3K/cJHlnFR+IGNe8jg:/a5POZ3lJt2pasx2+mBLNiXicJFFRGNf
TLSH
T12165BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 60dd97b77edd220f8221d117374f0564a3375f34f7b22603a92e3bc6027a8b8d
MD5 911e9e52d88551da2df8e73ec00973fb
SHA1 0470b96504aaf536384dcdf0f9be46bf4a51d0f7
SHA512 660271795560be2e5748d049fc4b4c97d83ba073cd1980c010f870e82bfb800837a00353fcdecce7f70ec9d3acd5f7e85f7afc820ee64c892738a6b5e19cbf78
SSDEEP 24576:YNcwHdjbyQ4nLC18lb/EOjowL7Fk9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YNc/zEOVHFyLNiXicJFFRGNzj3
TLSH
T1BE858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dc24caf9f6593276ce6bfce31284dff265985124654d08367cf9ec4b1d648200
MD5 a319795981bc5735bb867b2c47e36994
SHA1 48e10eab842a796bc2b6c68607471815e650bebf
SHA512 e69c8a3c7c67d86a9affc26340b5c3c3c80427fb7e8f9d414631d95af0e7463421683e90a104fe6443605a582bca3838564636cc379956947101a3231a3c1611
SSDEEP 24576:BzkNvNnaFeYhJNtmZBmb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BzMwBtOmbLNiXicJFFRGNzj3
TLSH
T1EE55AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 ab5bc6d2e5b5d44e7791961895e0b5712d76dab8837ebaa8405d7c9b41e28630
MD5 b853ec813dffab01d376723c121ec836
SHA1 9b8539480fabfc72b08a39a0dc0956a3faf1871c
SHA512 c2c43261af4c082e22a51416e0b89e66a5461b10ccffcb87bcdb7fc3e653f0df46a561282b6bfeefeb9d041eb68992e8fea7e9493849fbafc0b1c3605e2306f3
SSDEEP 24576:1D3FHshBIYQgAA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1DVHeBIAAALNiXicJFFRGNzj3
TLSH
T11F85E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/596-79-0x00000000007F0000-0x0000000000856000-memory.dmp

Download

memory/596-84-0x00000000007F0000-0x0000000000856000-memory.dmp

Download

memory/596-78-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/596-308-0x0000000000400000-0x000000000056C000-memory.dmp

Download

memory/788-278-0x0000000140000000-0x00000001401A4000-memory.dmp

Download

memory/788-54-0x0000000140000000-0x00000001401A4000-memory.dmp

Download

memory/788-55-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/788-61-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/928-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/928-14-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/928-22-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/928-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1700-327-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1700-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1700-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1700-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1700-89-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1700-95-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2836-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2836-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2836-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2836-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3792-136-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3792-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3792-127-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3792-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3792-133-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4248-65-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/4248-73-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4248-67-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4248-293-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/4256-108-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4256-312-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4256-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4256-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4256-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4268-311-0x0000000140000000-0x0000000140213000-memory.dmp

Download

memory/4268-120-0x0000000140000000-0x0000000140213000-memory.dmp

Download

memory/4268-121-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4268-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4336-49-0x0000000001AD0000-0x0000000001B30000-memory.dmp

Download

memory/4336-39-0x0000000001AD0000-0x0000000001B30000-memory.dmp

Download

memory/4336-38-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/4336-51-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/4336-45-0x0000000001AD0000-0x0000000001B30000-memory.dmp

Download

memory/4336-46-0x0000000001AD0000-0x0000000001B30000-memory.dmp

Download

memory/4708-0-0x0000000000400000-0x0000000000591000-memory.dmp

Download

memory/4708-77-0x0000000000400000-0x0000000000591000-memory.dmp

Download

memory/4708-8-0x0000000002310000-0x0000000002376000-memory.dmp

Download

memory/4708-1-0x0000000002310000-0x0000000002376000-memory.dmp

Download

memory/5160-326-0x0000028741EC0000-0x0000028742540000-memory.dmp

Download

memory/5160-395-0x0000028741EC0000-0x0000028742540000-memory.dmp

Download

memory/6000-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6000-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6000-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6000-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6000-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download