6eb7a51df005fc0d24d50981ef31bd9f77dad371eb945269bb9466fdb860bf42

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.6MB
Sample260802-nes5va1gqa
SHA256 6eb7a51df005fc0d24d50981ef31bd9f77dad371eb945269bb9466fdb860bf42
MD5 831460467627c8da37ebe334113686ed
SHA1 505d966c22a3356de90a40245f7f7af7998fa176
SHA512 cf019185bde930fc27ee6d2ff055187cb3dc3a592a67f15b82133726b025425333a6e37eaaecb3ada78a5b15d2d8bdd2beda87f04dcd156874c15a3c1f1827b4
SSDEEP 12288:KUYJ9bihksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:LYJ9bE9Xozsr8zbhN6GwXOGIh4
TLSH
T1FB750272B6C19473EAB3093109F49AB09A7EFC724F510ADB2364179A9D341D0AE39773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4496	elevation_service.exe
3196	elevation_service.exe
1120	maintenanceservice.exe
1704	OSE.EXE
4968	PerceptionSimulationService.exe
2940	perfhost.exe
5884	ReFsDedupSvc.exe
5140	SensorDataService.exe
1520	ssh-agent.exe
5980	AgentService.exe
1652	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6e8e9dfa83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a60a07067122dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001ad731c57022dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e3cbd057122dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009979f0057122dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad84d1c37022dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000142c99c47022dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeBackupPrivilege	5884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5884	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5980	AgentService.exe
Token: 33	1652	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1652	SearchIndexer.exe
Token: SeDebugPrivilege	2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2984	2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	4496	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 4312	1652	SearchIndexer.exe	100
PID 1652 wrote to memory of 5112	1652	SearchIndexer.exe	101
PID 1652 wrote to memory of 908	1652	SearchIndexer.exe	102
PID 1652 wrote to memory of 5236	1652	SearchIndexer.exe	103
PID 1652 wrote to memory of 2948	1652	SearchIndexer.exe	105
PID 1652 wrote to memory of 2388	1652	SearchIndexer.exe	106
PID 1652 wrote to memory of 1628	1652	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_831460467627c8da37ebe334113686ed_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3196

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1120

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1704

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4968

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2940

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5884

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5140

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1520

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5980

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4312
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5236
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2388
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 398aeb1cd6c86f01ff06ab01eefbce9a4dacb719de26db26170e4e382bfabce8
MD5 abc24cae0425df012347672a4d73d636
SHA1 9d207fd2964846337770d75712057230b96ed0be
SHA512 d59bd0e608c0045e0ed4bf24baa1c6f609faf9447758b7f621f9b202861085c37e42d92a36c4ddf01c321f906e64da4fab06b41b359ccd5ecdc48c79f7d66a80
SSDEEP 49152:Vb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnVXozsr8zlLwJIh:r3q60jB8wFRKIh
TLSH
T1F6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 833bba3e57b1c8e0cbed4efbe762583b2e4004e92d2536583778496d725e267f
MD5 07f8507ff035ba96735990a5fb0a88b4
SHA1 e75ec1a7ed7f03471dcf81636b28c3724af1eec4
SHA512 408f80b76daf3d0c993f702d18c157902e668790d52da2223d077e0c46a5567b8a0de5b1b75bc9e14bbed21b92277e76ca2f2c8f2abd44aacd6b0cd610f01710
SSDEEP 12288:u1XLsswWkxy2lRq2czAmksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:cXYfDtczAK9Xozsr8zbhN6GwXOGIh4
TLSH
T15B850129B7E008F9ED678239CCA28501EA73BC5547A0E7CB03B485655F336D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 9a5d74defbea8130aa2110152220383820bc299daee4c81bae2ab510f6446c79
MD5 7514c7dbaa2d5a76f1ed4afead9a11a4
SHA1 03b7c11e5258d73b1047c74b74d04282ed1f1097
SHA512 fc13734c4c7c72080b30e35a48dc08865280cfbff3d28a944ea30ac439333f677eeb6b09c024927e9ed57be9b3a974a057a6aa0e8944ed99e98cb39831597995
SSDEEP 24576:00Le5ji0hmx3rMX9Xozsr8zbhN6GwXOGIh4:0Pji0Ah2Xozsr8zlLwJIh
TLSH
T1A0A5AF26F6748331D073C0B9C5D2A68EED72308657308ACB4296D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 64956b5ef53b312e0107ee9bfc9ac53d4207cbc45864718ae69cedd1c78e7325
MD5 79d622d6efc5d147e17d84c1281663bc
SHA1 16d85c05f81836f86c92c562273552e5b1e1b736
SHA512 8cdd8ce11b322117ef41156ea750e55fb46204f5a3da23e53ac300ab34d9004e4538b1e5504a6a31f26b210330e827a09d25097117e3afdd1427574362cfbf70
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWr6q8wyu99Xozsr8zbhN6GwXOGIh4:o/ezSC6vUzPviHjyiXozsr8zlLwJIh
TLSH
T11B755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 586c11ebd6f3e06d87d0715d279293dedc924f3f542fc499098770ae5362fd7b
MD5 e357b7b45a76e9b8d18a3abf9f0fbe70
SHA1 6bbda22321947dfc3cd00f078f712983ba416e50
SHA512 7e26e68d8fb544193cd5c081356716506e4eefbefaf061c6b51288323d35f35b39ccaeedcdca2647a4ebe0b6251ff784a579dc48d282227f7d80919e7938fda5
SSDEEP 24576:pVbqPb88hv/l+bu9Xozsr8zbhN6GwXOGIh4:pVO88hXl+wXozsr8zlLwJIh
TLSH
T19755AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 6eeb4f976b42c007b69ebbd39bd392b802b14c645bc703bcc02ca32aa31fc24f
MD5 3597da07f91c4c4603956b64037a9d46
SHA1 ee45632534d19314c6fb923af433ff7896596a8d
SHA512 defeab9dea0298a5eeda06f735c9705ee8b78cc770a890cb08a74da62dc690bff96c087e3a10bf4860e8b16c6294738e5709e605bb39a99a4590141b5b9ea07b
SSDEEP 12288:3R9ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:3Rr9Xozsr8zbhN6GwXOGIh4
TLSH
T1406523B7E691A442EF671F3139916AC4DEA7FD9E49C11B5112382186CC7E836FE21332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 3a28044a5d8a1d15deaac00fc2ecfc6524cdfafc04cc734487067dea53cdcfb2
MD5 126c287050e02c5f2bdf83031e2fd491
SHA1 7ab7fa8b69106845095aba1235b6200c21b7a129
SHA512 fd32349f3c7e8c671a8c8de2dccdf68da049b8fe2c54ee545366ff342c9311aed81bea78e1a242fe8c4bdb2b1d5dba8fe6c8163d69e1cab630e5d5ce271512f2
SSDEEP 12288:VeBNUbTVO86USksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:VJIU29Xozsr8zbhN6GwXOGIh4
TLSH
T1C585DF7BEE28FCD2C27A8D785A918640D7B278704F52A3CBD174820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e54638bee457d641da9549bc1ee07ae0aa6019aabab19575cad41d7e54ba99ec
MD5 bccbaac9f6758a22cf9278b9f0b3a11a
SHA1 83570203a7ea75242205cc3ecf9024088db2481b
SHA512 325b820f0779209177e751e704488e4e34ec1d5d612a5a904e130c9c7ba95429e41c99e9b5976a8f6cae6447fcc14f327fa9de2322fa68486b962ba84fb4e5fe
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THD:PQvGAdlCEL8c/RRNw5CPwFRKIh
TLSH
T1A6267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 a66a4d771ee1c740f5e0fe2c12defcbc17b18faa1d4cc33b1c6c6ce7b47e9748
MD5 9198d46249034000ad7ec5ed00eb9615
SHA1 9c58e3a76c145e6ca56d186aafcf5632722354ba
SHA512 d2c2e7ce09c5fa251ec777787955768fb01c956f192d3384a364a3856b204d9b7cf5b744b63e44d4810228aca921af343dab275b08b831c4809c1529937798e9
SSDEEP 12288:MAwSfxL/2Dc3VDLLmt0LDQewsAjQksLmONw/CX7YNmysags3R3DGwv5NjOytLsXJ:x4ewsAj89Xozsr8zbhN6GwXOGIh4
TLSH
T16485E031FE74E032C7BB0DB21B26D716587DB9604B911AC3E3B8498E99341D22776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f64e88a1bd95fe084bcf8f0a3467610f8dc7f7480a1d7876f1d145af47d998ff
MD5 f98a908cbeb617ab62484a4d8399f6d2
SHA1 13f14398ffaa99e2f7b3e5088735e634379cff6f
SHA512 2c02741b4e7415a561258f94138bc727c33cf198fcf64cf2c69c4b8b0d8a5f6cae38bfa3d9e62506105832277075c1bd770fb56bd917c656cdbe44f999ca3581
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHxDKI:kUEtQevvqc2W1cpV2RI32xD
TLSH
T140474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a682c712b8e7398134d7357a461afcb68de86dcf4279aae2690592c5b35b6c98
MD5 b9f12718bb1170d069ca9af65b8c98c3
SHA1 b2478e989fc8e8e6441b720b002565d31a81ec52
SHA512 6561067b31f986ea0ac67df41f13c2e5ac7b6f28c4f63acc2290403b4024dbdc63232cafd559d8aac2566c468a49ad21bfbb3ad27856d9cc861f5036c3d6f3d1
SSDEEP 49152:qCbRquA/m2yL5zifFiV+XenmE3/zGXozsr8zlLwJIh:foqHVjnmrwFRKIh
TLSH
T1A3D58D1976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6b46e3991570358cc4a1dc1e2a56ae21fb3f969b5c241ebca2eccd829eb34436
MD5 48c845fa9ae86d2ab70a6c11808daaf9
SHA1 61fdb801262e1fbcbb1695a0a557b99123c818e6
SHA512 2b1ed95d2c3096c14c1ed3dcd0247e9a98172958315474b55d3e9b5709e047be104896160a93add69e7756f049e7257252f519ad0b2293218a663bcd12678112
SSDEEP 24576:6AhGL2IFoiwtA5l7S53Z9Xozsr8zbhN6GwXOGIh4:6AM1Foiq5LXozsr8zlLwJIh
TLSH
T149359D81E7F955D4F5B3AA7899B69570EA76BCAA5E31C20F2160C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 3555cc2b2f1e6e80d864782049a75f109d52c5a2aa7dc604e994ba1ae2db2d2e
MD5 36c64f44096cb540ac613f9ee570a8e0
SHA1 f29f0d997f70a6c6155a6ca4f475dae62b680671
SHA512 87dc6fa17ae9c8d11fd5bba96b31f9ce185fadd2373896e7a8a39eea0b6605f4fcb8f5d64c1254341743a2dd6a49d29e9907ec138c1c0103aa4946c5f851c715
SSDEEP 12288:7mw5HEjsChNkBFgl0WDm+CPksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEi:awuVOWY9Xozsr8zbhN6GwXOGIh4
TLSH
T1EF85F14676A41CF9EAA786398597C535E7F3BC062A21CB1F1370C25B9F37221BD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 5c99aa641fd44c787021d81aa132fa1b7cbadcdc7642a256c53fbba8caac1e93
MD5 d5048abb37e3f8a28cf29390a27eada9
SHA1 b9c7c9207a58b3950803d6058b34e7e8bc61e70e
SHA512 c0d432e8ef06006bc786b4ea6c04a2feef3fe374ffd32de1c3564ca70bca2c0af25105a4ba0a45ea9a3c727936b2c831536e6c35eccb50123e6eeb5987c5147f
SSDEEP 12288:MZZ1IyAksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:iZu/9Xozsr8zbhN6GwXOGIh4
TLSH
T1867512AB73E030F6E6A3473998E15A44D7B3B856577203CF123802965E37AD66E35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 197914f56e24c92198961d373c695bb1f655a4d0cb4b6172eba0a4d50279f225
MD5 4dba454529c681a5ed04b126d2149468
SHA1 ad03f066b4465e19ee1eba51fc7d6890a0e6440d
SHA512 f27c825a26c9d4c0259d7ca1c4d2e729e61ee7e5c6223954505996f475d95518881929907c7cf7d05ba39ba1f51b296de63acfda5c5bbf1d2d1060e67af7ef5e
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UH:1QRQyi36YOcPhLvw2gAf+PN3AwFRKIh
TLSH
T1ED667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 48cc8428a7f0836a8e620e7540d59e8a55da709f2674602847cffb46b6e3c5cb
MD5 919f6e2481d5f182ea6a80b86aa07ca5
SHA1 a72c0d4ffa1809bde6699edd1a068fa802bbcd6f
SHA512 a0ed761f8e7e8434100e127a7134edd0522948c7b55e6c8d608b7792c500502e80b0f6b3e3f9ae049740f16c03c61d76fc5918cc48a2cbb93d0253084db5a98e
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UH:sQRQyi36YOcPhLvw2gAf+PN3AwFRKIh
TLSH
T1F0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 60e9d245818891f65554c33f3bfd1454046bd932ad965be9ca039a1e2134a77f
MD5 5ac4e0ccea2ab3846ae3e52289c17e44
SHA1 47ad260ba18442c686775f7d570f974a5640b480
SHA512 0fd33725c686a3612c3e59bfcf8f6cae3a93ae6b006d2e28d88f1f2f3ee38799e81383fd8420789ec26e8b3d5b3a9cbf1e551d0abf4d1ba331c89229a1ccacb5
SSDEEP 49152:B68Qg55nhceWu7PNU3/2Xozsr8zlLwJIh:/thLRc/CwFRKIh
TLSH
T1F6B55933B2F200A9C44DE1769F4A872196D27C758FE1E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0cebd0a8f1a6d823216490580e9d32f15610e6d3104284358d289978b35c4184
MD5 889b0e2e9af038f395465521f02e8aba
SHA1 2b13030876fc73e76448d48e1fa888496f743d23
SHA512 8d6fcfde772d48fcfed67d373ee170012d937b5fe3bb357e428b6901dc1e924d6184e63759780f248421647b8caaceb3c532e7fc7cc3b7e11f3eb67ccc756722
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk995:4y5112gYy5azzVva69nLKnhZFwFRKIh
TLSH
T1B0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 90c9a706ca9756baa2576f38bc0f27eec6888a37176d6e63a9ae88289d242799
MD5 f4ab48afc77e994fe8717646f919143e
SHA1 ba745ffeefd2d88fd1f46ed5f3f1e6821b4f3a49
SHA512 6d7b7da5f190a038c1415c26d1cb593380f0eb014a6c2b728f0bcb22a30a326b2234b1e636d2933b131cd8504e98b412b44eec6252c5c7f578161999faa15141
SSDEEP 49152:4B+taZ3usBWOBr4tEG20bqx0z+n217aau1glYXozsr8zlLwJIh:Su6JmUxd2dowFRKIh
TLSH
T168D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f4aa077f7077af5f5f423fdf1b727fdbcabea7fd2bb47018cfe175ac53b6d2c6
MD5 192aed523fec1fe32c97340cefdeb207
SHA1 49b919c4d3555b63383cfb0c576239772cbf8076
SHA512 e9d87253ef425d259db3882546eb6e829dfed15447a9b9a3c3a63430e3d57d1d407e1a3b75de18b8761d1a1f0d81e03bc4f91ab4440d198696d5f336c55c97af
SSDEEP 49152:61hpsNoJpF1A6BU44CwH7R4xkXozsr8zlLwJIh:6mifPkRrwFRKIh
TLSH
T105B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b3005e6c56459c6d5267bad04e0cbc4a30c7d7cb1ef0cde9491c5e3996133bfb
MD5 dbe4d72581d0ee5e947028fcf015e534
SHA1 10b33b0914384a8ceb6745ee9a9c10f4dd695a5a
SHA512 7993263f035628e39ef6519398a758309700a16f2ae0ac012bba4eef56c1494e9dc920f9432389a7ce0cb6b6633bf0c684eb2625238590c6d7716a879dc2eb78
SSDEEP 49152:/SuZQIY0Be2KNRVtOnks6NMHqFXozsr8zlLwJIh:F5dKvi61ZwFRKIh
TLSH
T107C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c87270a6b294bbea6fcd8f9d4541f7e91cbc154c66d40f63088dcd4ee0c5a082
MD5 32d38c0b1132a708d1b04513135d7476
SHA1 473a663d467bd48e28d3f143586f02986f88e70a
SHA512 338a67fafa12203b3225ca12e6d7a40d8e7252f9849b75551d47dd4b70711fc8e999af8bb3e4d0e36209c5aed39373f3bfa5414be28a0ac47f713a6ceb2a9734
SSDEEP 49152:mhtSn8EApI0figXgiDn0AP5wIXozsr8zlLwJIh:nX2iyphnwFRKIh
TLSH
T1CD95BE13F2D900E8D05ED175C7468632EA62BC160B35AAEF0A50B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 dd176e3b83d8845a1c29300ffa7a05ab44c6ddefe9247d06aad3681d373e6143
MD5 39b86a50ca96563cbecb39cb85a408ec
SHA1 7bfd4c27a820d650cc24da5979e6309d2b49f1d1
SHA512 f537edddb401ffa38502845c31c96ddb24f94492f45439196073239f1b1613903b9cec3c18786f7ad302f96aea3a9b30f93326e627652ea2512e2c9975c2e518
SSDEEP 12288:zVksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:zz9Xozsr8zbhN6GwXOGIh4
TLSH
T1B46523B7F992A442FB575B3129811AC4CAA7BD9FA9C20791333D1042DD7A83A7E31335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 7581a622b81e90ead0ddd8963e8bc847ed78f9e0b3a64a2ed8057e2a283aa645
MD5 3ea7dc0abc3290ce394186940953b384
SHA1 ebe6b964572905574f81dc488ac98c185373ba61
SHA512 aac404ce2c0429788c443b910655d0ef377de9de859cdbabdf3191691483a16b42e0b70a3b68a68aa10a8cbe441116f57f8b22c25345aebcdcfb5d82bbe37609
SSDEEP 12288:OkksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:OQ9Xozsr8zbhN6GwXOGIh4
TLSH
T14F6523B7F992A442EB575B3129811AC4CEA7FD9FA9C20791333C1042DD7A87A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 02ac6d88fc6a89f223f48f5611659d9e5d3bb826f5a99e940ad70e1936a766ee
MD5 febe72154d55d9aee48d011c3de00e9e
SHA1 73ef68a0cd1d2939cc3b2fd2346d8b1121423fdb
SHA512 46b143ef6605e9711d3d72de9391c1c9758aa3221ae8a49b2135750dd1f71af837180a0a48a9e0b27f82d981d28c45e94bce06d7e259082aca601809781175d7
SSDEEP 12288:KqksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:K+9Xozsr8zbhN6GwXOGIh4
TLSH
T1EC6523B7F9A2A442EB575F3129811AC4CDA7BD9FA9C20791333D1042DC7A83A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 608d92b14ec6f66554fce092fb951f9dd3bdc6960ce2eab3db28b104bf2708e0
MD5 575acac14925fd551ae17d9860ad6209
SHA1 d41b232c0e334cf6ab00917a3cb70a4ce0f97a36
SHA512 9314b14da676ce2b5eef25fc44c3b38e70f8f3f6af916d5ace82c2fdb60909dc2fb821d69b95504995a3eb39d3b061940ab9715522ff4e548f5a9f6c347dd2cd
SSDEEP 12288:qVrksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:g9Xozsr8zbhN6GwXOGIh4
TLSH
T1EC6523A7F7A550C2EE679B3198915680DAF3FCDE9B5207DB232800468D76679BE30331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 da4c7147c61b250acf14b9c58e271de43f409852f586f5d4e109e11a88a5257f
MD5 f2513f2ae6f229f46d05c0690e8b8b14
SHA1 5044ccd471d64423bf8aa15412298311a7154aec
SHA512 4429ba059fd6368ec4075980e9a615e7de9d9db269589a9c6f6b66fb2cb3dad4c05021e731a28da9d8ea586478816acabd543ba477cf0bfa929e6962dea2fc59
SSDEEP 12288:pzksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:px9Xozsr8zbhN6GwXOGIh4
TLSH
T18E6523B7F9A2A442EB575B3129811AC4CDA7BD9FA9C20791333D1042DD7A83A7E31335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 a59279e18a44fad3876439057bd8f87448feea8a7c7821fd1683e9c5f37df366
MD5 3baa4c50dc138e3f3102ccfab53891e5
SHA1 4dc1ca993f1121608281f065aeaf6b8b3d4cd51b
SHA512 b4d4e0926805b9790c29b50303c2967d095be722101ae2610117fb1d384e6d87f0a84c05df21ab2bd41d3c0b6b3f5088cd7bd97484d5a8827b9466a5b5fd1ec7
SSDEEP 12288:LIksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Lk9Xozsr8zbhN6GwXOGIh4
TLSH
T1156523B7F9A1A443EB575B3129811AC4CEA7BD9F99C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 e06f6a2749c7d4b85fc3760bd3e31de1b5a9e62238dc1f02520027bb36bf8326
MD5 439c5d3f18f04fdc245d71a25b294ff5
SHA1 0777ae3c6d8bdb08351a0f7c814770fa58ac25c5
SHA512 d61a9d629be6c6200fadc2b7460fcbf9520cc6507365aeddb7e253046871bd6113b7ef8458cb38432cd8477c0539faca01a4dc0b422d9af90c874d99610a674e
SSDEEP 12288:HsksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Ho9Xozsr8zbhN6GwXOGIh4
TLSH
T1A36523B7FA92A442EB575B3129815AC4CEA7BD9F99C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 45f7aa8238300fd704eb6b2530c5e881dbc49f90cf914b7a82e22a4fb31c9f86
MD5 0da34395b108dd6e87a3636c473b5983
SHA1 5404c77379523bce81927ea32870911b55e5e2ee
SHA512 b91d5bf526f7a5405de7a8c4a9c8bd57a56ec42fe904fa7a56aff58bfdae27814175667df0718d23f48f4708bc060339fcd68628be5b1cd5655da68cc157f43b
SSDEEP 12288:niZwbWzzFEoS2cPvyEksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:iZMWzFVSOw9Xozsr8zbhN6GwXOGIh4
TLSH
T1CD8501A6B39018F4ED67823EC9518905D6B2BC5A0BA0C75F13B832575F333A11D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 7a122e19a141842dd7d6f0fe3b8449180c6b6516e070ff9e2464d29c31064c1a
MD5 7f81966d1b83334bc994abfc7ad194a7
SHA1 91220beacb3007a5bd29ba186006d4ea99bcc53a
SHA512 0efa5cdfe2c5dd75362d98cd03ff3c1cc491e5aca7bd8ab734d3394b3bf0c11cc4a89af319a3f424b4314f2a2b4e36ca82dbf53887ea4d74a626e34a2cd18970
SSDEEP 12288:4RksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:4v9Xozsr8zbhN6GwXOGIh4
TLSH
T16A6523B7F992A442FB571B3129811AC4CDA7BD9FA9C20791333D1042DD7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 340de7cff48a335801af192c94769076afa6e39acde4f452e3c21f85573fb2a1
MD5 6c842b4ed850ec02390f7bcfdd322f2c
SHA1 55277bccab33ea6d31236ed76f1b9f6893410906
SHA512 b9e06b3636e85c7012fdb53e30a6d809d8d69af9d9652661d1a33135d25a4f03e07321d947a113846ed7a21626b8252cfd599b84e376fa1981c74d06fdd7826e
SSDEEP 12288:itksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:ib9Xozsr8zbhN6GwXOGIh4
TLSH
T1F16523B7F9A1A442EB575B3129811AC4CEA7FD9FA9C21791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 4b9838b30f7c573e7ce58992084c43a1a421eb7ff40691365d956113f769c10b
MD5 eb7a056882f31a1ef29729d64a28f8da
SHA1 82e51d268b1c4091012a7bd863a1a5c6377e44c9
SHA512 0a5cc8eceddb58e2c9dd49f9a9debcca153caa6bf9ad331e25b554ccd149d9ce3c0db63978a433d8cf86aedd781b267406aa92423684bf2386c571f4e6e90aa2
SSDEEP 12288:7yPz5L8AksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:2zys9Xozsr8zbhN6GwXOGIh4
TLSH
T19D751257B3A130F9E677833588921A41F7B2BC7647604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 a2b6f4d5f2cc7a1269969474f924b821fc868f06a3ca5129100153be9aaa5f0e
MD5 8d79cf1f72254f072b3a468ea8c668fc
SHA1 3be81d1596098c5b11fbee93e8dc66b1dac10018
SHA512 761ba17cb07d4c958d9e173ee8f057ecffed88c87f4c2d6a53de9f00715a49f4c05d525eb40fd4c12c68b6a7c6910525abf65fac36735907c23822053b348b30
SSDEEP 12288:WRksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Wv9Xozsr8zbhN6GwXOGIh4
TLSH
T1DA6523B7F992A442FB571B3129811AC4CDA7BD9FA9C21791333D1042DD7A83A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 3589a62daf931479bcb6f62b05766fde9125b61439a3d948d48dac8aa0b66545
MD5 c46220aa525c8ae93b2746cf54f067ce
SHA1 ed183225cada076ab44feb2bc3edfdd6a497876d
SHA512 35092acd40236a5736a46c886946dd7e2769a404694e5b094dd67f8c9f3b04f9f683e6a64ecdd290541f94b950d1faae590af9baf749ffeaec6dfeb6a579daa5
SSDEEP 12288:VRksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Vv9Xozsr8zbhN6GwXOGIh4
TLSH
T1FD6523B7F9A1A442EB571B3129811AC4CEA7BD9FA9C21791333D1042DD7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 e36101e0e5bf2b6d44e8ca54381b9a1c0f73a87bb3920841ddb25e4d8a625f10
MD5 a16362a4d217074c7216842d3a52aa15
SHA1 553baff486f0e12abd48199a3d40266f14d27d08
SHA512 64f5cec83098f9c625d7048e0520fbad8c6719c715e0f2b63d8fd6e037ba32ce8bd9e085e7f4a418949b6bc76c30f644eb77b40eaecfe9c3049f6f8f505ddcae
SSDEEP 12288:lyPz5L8AksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:szys9Xozsr8zbhN6GwXOGIh4
TLSH
T170751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 ce02ae6c540eb29293283de984c1aa02ff93573dee343fd3911e2aaf58cf241e
MD5 32abf53278b3a340c85dcbe5d9c4249d
SHA1 2f8b12f3ebad09c1441357b5a43de7e662fbfbad
SHA512 de0e37355f974b828c587f4fc99628dc19ae5955785622e07ca2c2890a45a2c9b02883878f5b83dbe700bb03431c90439b6132104030630583e148fad3dc5852
SSDEEP 24576:lTHaLl3z0zDO9Xozsr8zbhN6GwXOGIh4:lT6LljfXozsr8zlLwJIh
TLSH
T1A58501A6B39018F4ED67823EC8518945D6B2BC5A0BA0C75F13B832575F333A12D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 e3e1f9493e44e971919b0f7f3aaf7ac80acbb2d2a27596fe17d8f32c499a768a
MD5 695499447d648cc9d7bf4a5e9db7d6c9
SHA1 d47a6efaef9a947bf2ec0e43ca67d3db02249e47
SHA512 d238910e38ff7c4d2637fa9c93051d6055154946520fcde07ff269466f85c9e9e07d622b661f1e9d3536a452ba890bb076dd6554893f11ca57003f78654bdf8c
SSDEEP 24576:h3Ld9CHKy7GZy9Xozsr8zbhN6GwXOGIh4:RLd9CHKyaOXozsr8zlLwJIh
TLSH
T1D395CF91F3E414E4F1B79A358D724511DAB67C9A1B61CE8F03A8251A1F33AE19D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 0d7ff278e252fc2c9416649143cb85e57c6dc7376d359a5a7f706c84be340bd1
MD5 cdbf57951203415c402d2315cfdbdb90
SHA1 a6f9fbecfbf85066e12e5cbfc93d865295ac1288
SHA512 5bc73394adefea0c0c751f4830409baac18803f799061b76e6f50060d9f14724a7e4f188209f506627d143878f1878339945ceb3863c5febb5e5df6b6efdef8c
SSDEEP 12288:UKksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Ue9Xozsr8zbhN6GwXOGIh4
TLSH
T1CC6523B7F9A2A442EB575B3129811AC4CDA7BD9FA9C20791333D1042DD7A83A7E31335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 9df665ba1b7023042b4bcf05fadde28b78dbb079f543ce5d92de2b322e4671f3
MD5 1726b6c45fb7545d45d3222768179cf5
SHA1 e3f0fcd305fbfcfb299d19d16ce622477ef2a663
SHA512 006ad5cfd19a5cfae5c8a3d51ab5feef87ea9cffc6b5345f66ef09cb3824421a9ace4eb8f464cfe7b076e2df3e010fb9ec94ab35d5d25819f4215f7aeb79f857
SSDEEP 12288:8gksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:8M9Xozsr8zbhN6GwXOGIh4
TLSH
T12D6523B7F9A1A442FB575B3229811AC4CEA7BD9F99820791333D1042DD7E83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 dce5e83d5055275c27852ac5e1c2a3be25878cc0134369e8613a329bfe7fa82f
MD5 ca76dc410a060e3bda2841a7ebd98811
SHA1 f59cea23c71b2cf0edfe4dfe5a7c8037845e95b2
SHA512 75a42dd309d238570caa62879b62ddab9fc8d284a867ca3683d2106388ef3abe155ad26325867e214c065758d7477d4e616f17f31ea806f10055bed64049c7e5
SSDEEP 12288:M3ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:MV9Xozsr8zbhN6GwXOGIh4
TLSH
T1D46523F7F9A2A442EB575B3129811AC4CDA7BD9FA9C21791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 a2b23f4c5e2edf733d878b04dede97934ab902b491d29942fe1c798a9f02a879
MD5 274dbd02ff5200add2e9cee9e6a4d1ea
SHA1 d769a22553197c94e3e7af39601c09bbfaaa8781
SHA512 095b59d14447620fd9c4837ca2ff67eb5bc42124e164c7c9e99c357bde15c5b00f0a200abc4954ddc1295f516b58787176cc9fc40606a10a7646b359a0630889
SSDEEP 12288:KRksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Kv9Xozsr8zbhN6GwXOGIh4
TLSH
T19F6523B7F9A2A442EB571B3129811AC4CEA7BD9FA9C21791333D1041DD7A83A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 2d7e8c814e4cb06de02fa0831a818bac132504d9bb5e424ae04167c6b2736e43
MD5 e53c10830a8c2cd4c79c33bd7f6d9732
SHA1 2060fdec34a9ca5b62e0b68f33188489ae76dd37
SHA512 d927385426b0692d0fcd4d31669702ed042748626587baabeb08635736ea640d69a2940c812f74f3553d1e8214a4da012c79314780eb75b97894f1abaa092410
SSDEEP 12288:TKksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Te9Xozsr8zbhN6GwXOGIh4
TLSH
T1936523B7F9A2A442EB575B3129811AC4CDA7BD9FA9C20791333D1042DD7A83A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 d77d618395317c1f0b578a9a10cd8a2be0515b443cdd682f20c41e0af29684fe
MD5 7004b11dba8232ef197b03eb6805166e
SHA1 994f7081fee136e0e2bfdd545d7215549cb63c05
SHA512 145a3499a5cceab308e74f1122638039bda06e3a2b1fccd30a09c5e634beed111cc755ba055ac6bd9fe70f196eeb3b8a5578ad57e1c9e41632e66766da258e15
SSDEEP 12288:tZksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:tn9Xozsr8zbhN6GwXOGIh4
TLSH
T1226523B7F9A1A442EB575B3129811AC4CDE7BD9FA9C20791333D1042DD7A83A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 27dc3d7e1babedaf8e24eeadd94ac29a9775f252edaabf2423174d88e2194cae
MD5 829fd1f77ed884dccc09eba6fc35b157
SHA1 4e05bab968feb2841c87fa0831718f5199abafd7
SHA512 bd62b0b2f99eae158b1a83e50e4291d700ef80025030418c7dfa07c35129a1e72e5f58f84029021e8fd1887a6da0b395953423174df127981cfd202a77177a86
SSDEEP 12288:AzksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Ax9Xozsr8zbhN6GwXOGIh4
TLSH
T1686523B7F9A2A442EB575B3129811AC4CDA7BD9FA9C20791333D1042DD7A83A7E31335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 f2add1433e93050a20d88c2ada2edd34fc9bb0438c72897278c00ddb1788bdb3
MD5 39ff8670343d671e2280cd04c87e1e3a
SHA1 832f2d2d69f95c6be454d3164297175fba47e96a
SHA512 92f5dac1ed4fa8975384229a5913833a8296f42bd39b37db1dca816daade9faf5d19d11347e83699cb845b0e263c7269237f11b76a3aebf8d547daa1750cefa6
SSDEEP 24576:vfwv7k9RX6wkyAIL9Xozsr8zbhN6GwXOGIh4:CMnYIBXozsr8zlLwJIh
TLSH
T18E95D02AEBD844E1E1B7923C99B3460AF6B178591B31C3CF125A536D0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7ab77a04ff242d212ec95c3ee9c25cf8db8e1ca86536cf8c9d7a0bda22d81c4a
MD5 229db7a4f90f3214006abb36ee22eae8
SHA1 fccee070d84f7175bc14786734c3c5fc322eb98e
SHA512 25a9d61141fa7daca998355c8ae10f184734b2419bec932ad4f437b7a692106f06d0b3e41b4491faedfb5449b109116cbbd9993e558878b7657ee4fcf92412b7
SSDEEP 49152:zYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0oXozsr8zlLwJs:tySzPgwFRKIh
TLSH
T14E066C97A16841D5C1B9C1B98B07CC1BFAB134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 826bb5af273f8dffd1a0d45e2dea82ae9c91a2eec440a233ed0b1fb4ca74d083
MD5 6d0ed1726f05a59499314bd55813ac4b
SHA1 2c1930c257028833c7c38bec938181931d65c8d9
SHA512 371385ce353041cfc7816cf0536c33198ec68d2fbc2483664ca24977931f5a85079f9036a59cbff46247e8486a051216a54250f32d025c444e6c02c68ab16ad2
SSDEEP 24576:O47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYg9Xozsr8zbhN6GwXOGIh4:O47JUQj4irIhCnDHUPfF/YXozsr8zlLT
TLSH
T10765AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 b1b5c5d6fba3787ec38f07f4cdbb84ae98da9c9915d5c96ab2a88be31f9b0e7f
MD5 14dcb32365489505c57750e7b3605fdd
SHA1 0f2fe1e55782b8ecbcdee9e21364f171c40af174
SHA512 39829e54af90649e7c02601b6d70a3ed712289674bb1660aa47376287349cae22d67c915af7a5fdb28b387c94e6d104d2aee6b96ad1a7f5c3f2680bbcc5aee7c
SSDEEP 12288:+QsfhksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:g/9Xozsr8zbhN6GwXOGIh4
TLSH
T1A075F15AE29411D5D16F6235CB414A40F7737C6A87E193CB22E0F03E0F7A6A4AEE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 992KB
SHA256 a7df8f0ce2511eb9eea7c6917168af3390dbd33672b0d476223e6d90bb59a85d
MD5 b6750a756e1f0593696350b053c52c28
SHA1 1588420d0d6c90b5de91b4cefa63b8a61d349eef
SHA512 2d749cb94e6b37b3afc388164de4a72a3ee68ef65890e835c72b0f3744047443dc449110d8984324db6aacc06cc4418577a48fa7fdb73382beb24300c6d83936
SSDEEP 12288:CXquU3faBHWKWglGQMalGMoIMnM7uycmVQRABF:CXlUPMXMnMCTmVGAB
TLSH
T1AE250810766AC75FCAAD40321E36D1CCA7707D41EE45AB0372C9873FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 de7a326dbcb361126ce2fb16a77fb8a0f7f89a348b895289cbc0432ed0f78b2a
MD5 93f2aef16a5c276636ea07131da4e540
SHA1 a40ee22222eb31ddc0bb1d28918f26d350444b01
SHA512 54ec7a52e1fa685cdde675392669e9413d36651549487d9fc70d5fda16a10714c796bdef176dfc1ce2c74b7e0d3c0afe83e11c5e1df7c7190e7b07b5fb72c9f4
SSDEEP 6144:QW7v/W0vzw3FwWWWiWHW9W5l1IMMkS7gryQz3XcbVtMxRD+rznd9kCJYSgTgwTaE:eYkKWWWiWHW9W5lGMYkyJdeH
TLSH
T18C55C7415537A38BD1FB6031076A9B4DA764EC07B349AF2773C8453AD82BB25A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 78ef94f3d402a99f8a4e84f39cb10bfc0d1b8fe0b494ed9b2e6571eada8f070a
MD5 4418fa67c7389ef93a15fc741f737ffc
SHA1 4b57e7430fcd919f14f4419dba31f976b5cac218
SHA512 3de1ae50d5a78a9905491c8ca77c20a653645e177a7eba96240a18b7d3a144b20980222c86477b1256ca67c1866d705a5252a8c46dde8e66f417ce4b41d2a297
SSDEEP 12288:Rd7pksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:j39Xozsr8zbhN6GwXOGIh4
TLSH
T17F6523B7F795A802FE7B1B30288556549A5BFD9E4F8107C332281186DC7A8E5BE31336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1ffc7e04408105f92cb4271d9089f275ee0b332579bd5678e696a934d50565db
MD5 90be2092985de567640d021d1184c4ba
SHA1 37be0ef883d0b942cc37e19f1cf285b59e6c06a2
SHA512 e28b089b0d93d8e49779637d6c4f39d187eba2b52f05e0033ea6d9f00ca4c816817bccc1e21f4eecdd57f41944358cb2b2b17a37e136faacba1191915fc58def
SSDEEP 24576:Pgb6bmBIi49WNNFpg1rSvFv7bY99Xozsr8zbhN6GwXOGIh4:Pgb4mBIBhGF6Xozsr8zlLwJIh
TLSH
T1FE65AE1E22EC02F5E1FAD2B89DA64417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 9a86da79f5d752dbd0dab162bd9d615f7021f68a13c45b23147cd0126259cb78
MD5 da1afad14b2b7e6ca7dcb5591120e68e
SHA1 a3c1428034a2e4fa5a02f9fe68f0c6e10c1f9f28
SHA512 671a8e2467b7b02c5f7fe0369741568c394dc366aa0e8898bbafc9ddfb9ad28fe9ff932d39b0ced036ed4a48a247941274611932064244a396b592cf0b6b258b
SSDEEP 24576:LG88u8FpJqH1czria7/mw9Xozsr8zbhN6GwXOGIh4:K7ZFPqV7a7/HXozsr8zlLwJIh
TLSH
T1B8A5F166B7E101F1D477D13889824663F6B2B8250364EFDF07AC8A511F23AE55B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 51ac6ce6b5fa720e6ad37af1760570f4295a2f8fbb6f3ae4cba2fa9c65cb8256
MD5 38da32d073733ee8eb2a4b2d64d42331
SHA1 d8ccbb5bbace913b4029610a455e1813119062df
SHA512 ab5642270bb0586b40cc3c29138dbafac55a244e5d93263938835d071c736382a066ce9afb695667ec863b906a885e29adb6e5624ee916a416e8c1a9af26f376
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjeXozsr8zlLwJIh:tG05lO43b9wFRKIh
TLSH
T15FD5CF6E62EC11F9D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8c2e02bbf05b29dbd0d3790cf65bcb5916c8f3d9ebe97a864b3e90246ede3493
MD5 1e99ca2b0f4c64e6270ea286ce25f2d8
SHA1 658d5576ef105cd5d85c043594f96ff66388fec3
SHA512 de259c4b4b276c7db909077521ddf4192b286cb05b4ffbec21995a3065772850c5dbfb03f9942047c7a3938d3c1db9d3fe0a1f33d004ce06d272a507ea32ccf7
SSDEEP 24576:bfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnq9Xozsr8zbhN6GwXOGIh4:Da5POZ39Jt2pasx2+m2Xozsr8zlLwJIh
TLSH
T1E665BF5EA6FC00D5D57AD17DC583461AE5B1342653329BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0ddc9c9b26d28397d4462a579b695943287dfc46207a13712d51cebe12fd5b3d
MD5 1cec18c770a12551957679a5a5aebd22
SHA1 5e91b2fc6b4c31393cbf5a7c239bdc3ce3c8c9b6
SHA512 7732ae1b5023374e40c3f6b2aaf5cddb0e432490131681c73674d0c74f1693bd0ebf6abc6206c47d40cade3428502e6c5b99aa7dc4f64324d64cef64326874be
SSDEEP 24576:ZNcwHdjbyQ4nLC18lb/EOjowL7Fk49Xozsr8zbhN6GwXOGIh4:ZNc/zEOVHFnXozsr8zlLwJIh
TLSH
T1D1858C6623E901E4F5BBE1BE89779546FA717865133086CF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3150bc27113b4a10def7263c9856c7d6f8abbcc564de1fa4d9700f192baa9da7
MD5 67fbe027578b361d9f47d7ce3a448503
SHA1 2e12f7dc235560734943c8ec25210a595e0128cf
SHA512 305bbc8faa8399bed2415af3c626ccdc42e7c7df7abfb56249ca190ed90b0967f9aca2f72bc20cfb4157f02a342c6b1fb4dd758c3eebd1317825fcc2d21a90b8
SSDEEP 24576:gtkNvNnaFeYhJNtmZBmm9Xozsr8zbhN6GwXOGIh4:gtMwBtOm0Xozsr8zlLwJIh
TLSH
T17755AF6EBAB845E4D1FEC6B48D238512EA727861073253CB5390C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 bd148848fb620d297eaf502f2af5fb7a7f8d4f0f50eeed49f825996a54d6272f
MD5 299edef3182a32358d36d23e7e8c9727
SHA1 4335e9a366a216abd25979c1552fb4f455a688e3
SHA512 e3067e89fe02bfad6442d68eee54304de707f09f8f0148a42cb226af78ae567d9371a7262738f60a7bc29f60db7d24ab451e560ed25d4773820bf3656ff4780a
SSDEEP 12288:xHvUrBFrEjwaQ4ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:xPUr+NQU9Xozsr8zbhN6GwXOGIh4
TLSH
T16A85F26F72E918E5E677A13D89824709E772B866071293CF02A0417E4E77DE8BD3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 7283d6eb1e73ffd2d30c7a55a5fa28c763a05332c3505aa9357d30e817583362
MD5 9768f12f5c46bd32d83b5671c9f27b76
SHA1 e7a488dd0f3feb80f971954256a0a4ea538fb223
SHA512 cdadb33e3f045cb414d807769d7965f4119d869c34d4457623dd5c69132fafd68ebe06d394fba75976583b03a1b6811334824ef59bbd8113e82b718068c192b0
SSDEEP 24576:KD3FHshBIYQgAT9Xozsr8zbhN6GwXOGIh4:KDVHeBIAA5Xozsr8zlLwJIh
TLSH
T14095E17EE69C04E4E57BC27CDA534A06E77238AD032256CB029481B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1120-38-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/1120-110-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/1120-39-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/1120-45-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/1120-108-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/1520-304-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1520-121-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1520-113-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1652-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1652-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1652-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1652-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1704-193-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/1704-49-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/1704-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1704-50-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2940-74-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/2940-79-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/2940-73-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/2940-258-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/2984-1-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/2984-0-0x0000000000400000-0x000000000059F000-memory.dmp

Download

memory/2984-7-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/2984-72-0x0000000000400000-0x000000000059F000-memory.dmp

Download

memory/2984-6-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/3196-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3196-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3196-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3196-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3196-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4496-95-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4496-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4496-15-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/4496-21-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/4496-20-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/4968-227-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4968-60-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4968-68-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4968-62-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5140-97-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5140-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5140-301-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5140-295-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5140-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5140-103-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5884-90-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5884-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5884-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5884-84-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5884-281-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5884-326-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5980-132-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5980-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5980-126-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5980-135-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5980-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download