fd1dfde05d5508f3425cdd49ff2cd43bd3c5d4ed06d6f3c9f68594e963c43a52

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.6MB
Sample260802-pg2qfaam4w
SHA256 fd1dfde05d5508f3425cdd49ff2cd43bd3c5d4ed06d6f3c9f68594e963c43a52
MD5 026774d77999d92b22f5bf74230b5415
SHA1 101a2e9cca7220acd55d8882cf42dd4fcf35f136
SHA512 7721aadbf2a0f54bf138f7f67c628ea30e60f0be20686add3a5dd5a25c7b6a53c9a520b1e1c9d388775d7651f5f711196bf91369846c7a70b88b259ca85a7849
SSDEEP 12288:QUYJ9bi+ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:NYJ9b59Xozsr8zbhN6GwXOGIh4
TLSH
T1B1751272B6C19473EBB3093119E49AB09A7EFC724F510ADB2364179A9D301D0AE39773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1304	elevation_service.exe
5100	elevation_service.exe
2872	maintenanceservice.exe
2032	OSE.EXE
2280	PerceptionSimulationService.exe
3088	perfhost.exe
2760	ReFsDedupSvc.exe
2648	SensorDataService.exe
5740	ssh-agent.exe
1392	AgentService.exe
4316	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d7b5c0e3c618523d.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5dadf207922dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a2483217922dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
1304	elevation_service.exe
1304	elevation_service.exe
1304	elevation_service.exe
1304	elevation_service.exe
1304	elevation_service.exe
1304	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAssignPrimaryTokenPrivilege	1392	AgentService.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2760	ReFsDedupSvc.exe
Token: 33	4316	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4316	SearchIndexer.exe
Token: SeDebugPrivilege	5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5356	2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1304	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 5672	4316	SearchIndexer.exe	100
PID 4316 wrote to memory of 2372	4316	SearchIndexer.exe	101
PID 4316 wrote to memory of 4256	4316	SearchIndexer.exe	102
PID 4316 wrote to memory of 1652	4316	SearchIndexer.exe	103
PID 4316 wrote to memory of 5444	4316	SearchIndexer.exe	105
PID 4316 wrote to memory of 264	4316	SearchIndexer.exe	106
PID 4316 wrote to memory of 6020	4316	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_026774d77999d92b22f5bf74230b5415_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5100

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2872

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2032

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2280

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3088

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2648

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5740

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1392

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1652
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:264
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bd651e2c29322045f2048d4d2ad37d9e4564c71520537ded03e20b40685dbaa4
MD5 258479de114494beb6b480121b4d4462
SHA1 b20147a11aab1537c9b19bde3261d1253b8d64ce
SHA512 89fd2890803335f455068c70c575e767ec69129d522c54bf3bfc0270b468c57920dc3e2a75a61680552d5fc0ba79c8ca671111378bdfe79ab6d47c673ddf9e48
SSDEEP 49152:ab+632BuPkFKRrdE6ohrstBhuXjfS4LWxnNXozsr8zlLwJIh:M3q60jBIwFRKIh
TLSH
T1CAD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 c2d87e04f8b3a882866e44b9b4783edc0d7fd346f09b0aea5732be2c5639be51
MD5 ddcc8cb253e5866e31a7aebdcfd56b12
SHA1 8208d7c410eab3c175bb7695068e18e152a69cd7
SHA512 090fe3ad3da8c4ffe248b1cbd610447948d2cc999f898eeac5bc72c3d180ba8fd8701c57cd19d558e34cb8298d8186bb0b2077343a1545e35648d6807a544445
SSDEEP 12288:t1XLsswWkxy2lRq2czAaksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:DXYfDtczAu9Xozsr8zbhN6GwXOGIh4
TLSH
T1EA850129B7E008F9ED678239CCA28501EA73BC5547A0E7CB03B485655F336D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 bba41114956d19d74f99b01459972de70aad59f1170dc9239aaf3a16a3c9b215
MD5 300123e857caac399929a81d3c683dfc
SHA1 bd6237722bdab3dd52e5ef1d5e0de2b4cfc2eb2a
SHA512 4c45a08139f2a748d3c894a00e6cc7b2a6540daa80b5f04c6fb70c711b2f04902276ad38912c9924c15cbaf4dc1649ea0abc20ee5e9f12fde6e63d1df7c0a09d
SSDEEP 24576:v0Le5ji0hmx3rMP9Xozsr8zbhN6GwXOGIh4:vPji0AhmXozsr8zlLwJIh
TLSH
T14AA5AF26F6748331D073C0B9C5D2A68EED72308657308ACB4296D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8441fc83706c4d1ad846b6891aa6b0038f71b978d7015ff7b42e30acea640f27
MD5 2e0ecc8291856986bb97c3aac7266690
SHA1 5b9849b3ebc34f655aefd8201d52914d47f701b0
SHA512 260c182fecc39905b1a1261d251dcdb7d7b16d56e5cd97112c27b70258e1ccc4b22c8ffbdd3732f58a6e68c76951082fc3c42076e0740f27f106bcf19c252da8
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWr6q8wyuh9Xozsr8zbhN6GwXOGIh4:P/ezSC6vUzPviHjyaXozsr8zlLwJIh
TLSH
T190755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ee9a5a3aa9d4982c316514ecb8ed08df05a87f44fd61534bf2f0e8f6f6ab8bf4
MD5 a730116cb5842f4c6b6ce7bb40f097e3
SHA1 edbb4bff0e0f5bae7579a449ce3fd21466e93ab2
SHA512 a3c83f07db135f5f8bbb44c824ec217dffc5800c91d9a6d88e228a638ddd5748ab51a350f4f592bd77902b0d22d20eb41fe7966da573159377fb11d5bf150f9d
SSDEEP 24576:0VbqPb88hv/l+bK9Xozsr8zbhN6GwXOGIh4:0VO88hXl+kXozsr8zlLwJIh
TLSH
T11455AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 8ae1bafa4cb3b69c127f8f6edad4a0532113059e3dda4fdf3a037d5b84bf35a2
MD5 61cfcba8fa45d1e063ae325320b8f2a5
SHA1 0a4f5f1b306adb4e361af573d3518b2e314a51a9
SHA512 0c974d293d1aaf71571c95608dfc59bc8fb9c2adbd805c26be42a712ee6cbae635d73abcf430edb37d614b14995ec0d1ff7f36f32d8f6e3c6b21f5c90294ab05
SSDEEP 12288:4RtksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:4Rb9Xozsr8zbhN6GwXOGIh4
TLSH
T1186523B7E691A442EF671F3139916AC4DEA7FD9E49C11B4112382186CC7E476FE21332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 b66b368ecc76ab59942524ededbda25a5eba0bca85e0b72286437f45c0ecf8d1
MD5 7a50b7010f971f4329993826f8aae3da
SHA1 a6b3f92b9061905dbd08d4f83f918f3576466c6a
SHA512 595d63afca10385c3fbd8dbded8b5f7546b008cc73195020072dd3126e03049185941f3a382c81a0066633126cdc190533c79308839728c5d632afd14d8b784a
SSDEEP 12288:JeBNUbTVO86UuksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:JJIUi9Xozsr8zbhN6GwXOGIh4
TLSH
T19585DF7BEE28FCD2C27A8D785A918640D7B278704F52A3CBD174820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6240321ad94618aaffe4df2b84110a40e131fb0f5c150f2b6cfa4984cbea9c15
MD5 b108f95069dc070f23318179cd46c409
SHA1 253f0e1383baf820dc8fa52e11b49ea145b9d0ef
SHA512 21ebb01e84484f4b5d495a366579269dc4e3df6e44c5d32b375c2199023fcbc362b0a85fae087e6af5ea90e7e0170043525f7d558b54e022ad2f254231e7fdc0
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THH:sQvGAdlCEL8c/RRNw5CDwFRKIh
TLSH
T1D3267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 e00b7cc687258bee7ed3bfb512af6edbf0b661de3e67b48224299caa861dc62b
MD5 f4faf2e151cba84b9f3bf6f1322c001d
SHA1 ae5a6e81e6427c53932de9abfbf1f3571ed60895
SHA512 46556f160b2e3b3003d1a62ebc9b5c28ce83a86a69fcd82dc9dfd96c0e85649b3c159948856903e112d35ccc05594c109b10a77f124dc8c15492f47251870567
SSDEEP 12288:tAwSfxL/2Dc3VDLLmt0LDQewsAjgksLmONw/CX7YNmysags3R3DGwv5NjOytLsXJ:e4ewsAjM9Xozsr8zbhN6GwXOGIh4
TLSH
T13C85E031FE74E032C7BB0DB21B26D716587DB9604B911AC3E3B8498E99341D22776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 645b6293be8eef0f6fe8e0e304a79b66dd6c5c49e7084794a88941e13ffdca99
MD5 3be5234bc48931cb4354443fecf3679d
SHA1 6797fba8b2f9e253d8072c8e2541eeaf5bee762b
SHA512 849550792a5bdc31f5a7ee4f6fe75acf2299b7bd1283b5740439667d1014a018cd14b30acddf9ef2ee2e03d3e01da6b65b28de86f9106cf377a6b8ea05376c46
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHxDKI:jUEtQevvqc2W1cpV2RI32xD
TLSH
T136474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9d0008de8ec072d4fa6100b98bea63395f58b3664f172c622f677d861110975a
MD5 fb7e3eb91c52ca24749567ee4bf236ba
SHA1 83e2b56ac7ef9bc843f2d02e0be99ca7e6637e8c
SHA512 aa03fd944394343941c0e56628454f90191fd22688e695b0437761113415ee39afdb655e79d023180f71f2ae9c97bc89d7099c773cee5eb5d1e8e86689f5b8a1
SSDEEP 49152:rCbRquA/m2yL5zifFiV+XenmE3/zWXozsr8zlLwJIh:0oqHVjnmnwFRKIh
TLSH
T1C5D58D1976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6bfee57f99ee5e5564a8ce02295b18f4549ef6ac0fc64789cdb58b37452d8cd3
MD5 1fbb430e276927ebb108c80b42d51fe6
SHA1 14a9cbf299eeeac26f6380148a445d58aa97d321
SHA512 c4a61928e865f08bf0830fc8c631d25f66aab998d40f470e7f0197b184b6bc7b978283fa9346a4f31201d392cbf094db5b41634d76eda433630cc8305da2d1de
SSDEEP 24576:FAhGL2IFoiwtA5l7S53F9Xozsr8zbhN6GwXOGIh4:FAM1Foiq5HXozsr8zlLwJIh
TLSH
T132359D81E7F955D4F5B3AA7899B69570EA76BCAA5E31C20F2160C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 6e82cd0788b6072974b250ed4aed7940c44391c0104b857ae333c8437175b113
MD5 fed07222d4b7848a00d6e83e6c8210d2
SHA1 1791da1ca0f6557808e76d7110edd08aba9619a4
SHA512 d1a2c2a4d7305cbdc2578de410d128a28306afb5ea6bf6e6d8370a9be9815d25e4a104a38b70d024ed2d601fc02eaac1d3b36e72333018a3c4c1e5259e54ad7f
SSDEEP 12288:Qmw5HEjsChNkBFgl0WDm+CDksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEi:NwuVOWg9Xozsr8zbhN6GwXOGIh4
TLSH
T10385F14676A41CF9EAA786398587C535E7F3BC062A21DB1F1370C25B9F37221BD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 a6013f233773e599607197aabafb57262529ccb74ee59b1f852a2cc62744b984
MD5 3fe5f991be966855d7dd9375b9e6cf30
SHA1 cd7455cba52a6385c766a6da676ce51648efda7b
SHA512 78552c7cfdfb8bbd62f08ca44928bc1daf866dc7a3cc0aa0adb8ea743b948dc66eb61e6cba47d0357cd43734199fdfd5fc67f89e4d62638956b1b4d2cf3b9ec0
SSDEEP 12288:4ZZ1IywksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:eZuH9Xozsr8zbhN6GwXOGIh4
TLSH
T1027512AB73E030F6E6A3473998E15A44D7B3B856577203CF1238025A5E37AD66E35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 996ae3d035a7fcddcd321ef6b5f98dd905eb354f96d74767f69bc898e5457b9e
MD5 5277b94102c10797f6eb1aacd517af5d
SHA1 872e22f8f781aada8c65272acff58767e0be50de
SHA512 790b7f36e2ffcd45004e438f8b90bb0d0840a14aa59526972d4f0b890771d3801fabdc8987e7817c493d3bce6a8fe607d0f99573a77fcb98c1f7d3ccbe65c3a5
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UD:WQRQyi36YOcPhLvw2gAf+PN3EwFRKIh
TLSH
T18C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fbf8e3c2d42bf07a2df54e92b056c027d42377613d6c16d2e9b132f6746373ab
MD5 552bbd0c196a6dff9e7003034ca2edd6
SHA1 f1e40186fc47472d16d838313f2369dfcc2db10f
SHA512 b0c8e4dbf3938a284b53aa34c64f8bcb33e5da319fc1fb6ac41df04e1f084874371b4203c4542c67428f3c9aa33494186deb8a8bd2ed6dabef03888f6c0e9bae
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UD:0QRQyi36YOcPhLvw2gAf+PN3EwFRKIh
TLSH
T189667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 70608be998502c6a02365b79281b8a4f3908ab09078f8741d1b02b952ba6181d
MD5 cbf435ed832d80b0f2e786aa87139978
SHA1 34763a1c1f35fe81c401ab2a37f544d22c29a3b0
SHA512 caa0170d12f1a1d18ce2434453dd8c215fe13229598df93d4b475f63ac69ecddeda340e5b683104b99563ed38115935d47bdcb932c67d8cc8a1f66d585505c00
SSDEEP 49152:k68Qg55nhceWu7PNU3/mXozsr8zlLwJIh:OthLRc/ywFRKIh
TLSH
T162B55933B2F200A9C44DE1769F4A872196D27C758FE1E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 76d492873c632259ac274eb2b34a9ed507387f9d39da94501c337920597546db
MD5 8d58621b54f87a15d95d6a797284e06e
SHA1 09f64fe42f68fcd72fa61478ef3e8fb0ba0f4221
SHA512 754165ad5a5ae4a9dbfd89fd3d5c33e76c029f1bb5e531938fa7b0adb7040ca87964c2a297847fb07836d25fd9be9dd18961dce97d9f4ee2f9f53628a476bdb1
SSDEEP 49152:K3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99J:by5112gYy5azzVva69nLKnhZ1wFRKIh
TLSH
T107167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 244cfdb731545806289f1819d19e2de9aece5176dda3814083fef4a3d7dc0c30
MD5 3563c5eee3826fdf7a04a46d3bc9c658
SHA1 ecf21b169f6a0d25e262972c78bb19965e0e1def
SHA512 febffacf630e9c1642fd3281eaf59508b3d215d426f8bc68fd060d91b2af85c742175c3bd2e1019725c3f14bafba7586935546abbf8d16b91eeaf0db559e80eb
SSDEEP 49152:8B+taZ3usBWOBr4tEG20bqx0z+n217aau1gl8Xozsr8zlLwJIh:Wu6JmUxd2dcwFRKIh
TLSH
T107D5AD13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 23e18128530569f0555f62e6cadc547e3bb03df025212973b29fb6273bdb98a9
MD5 c21bd0356717fdc286ce35b28bffe1be
SHA1 f9f151497e4419bf295fe14b0a3f255eb251493b
SHA512 d128bd3ff1033d99a06affa86931bb2e49f9b9395fd698c019bcb49a5e55d84557c4939d414054c27b9d93295215bb98fbc669a8d2d6e01f64f5bad20e603f14
SSDEEP 49152:81hpsNoJpF1A6BU44CwH7R4xQXozsr8zlLwJIh:8mifPkRnwFRKIh
TLSH
T1B2B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cfcab4d9a0e01c6badb54d1f6d50854ad2ac8503c8f327fdc9ae30c3713d692f
MD5 b284b2cc77c1a92a52401d3d922959a3
SHA1 00ff7f9a10e570ab6b400db3797c691ad096c1d6
SHA512 39a83a6a22e92396d4e03e30580f9cc69dbf971c2cafd4bb67fa48b94e46a9e7476f10010f7316de743a775217e94d56d4fd53ec846b89be8a8d4509ab632ef9
SSDEEP 49152:QSuZQIY0Be2KNRVtOnks6NMHqdXozsr8zlLwJIh:K5dKvi61BwFRKIh
TLSH
T123C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ccd0d5fc309c20a1f0d6c194e2b0ed392d7a7a4b60487a2a8e5efbf5db1f8502
MD5 853e3f2c19d681c29425231de06f1646
SHA1 1a8298fa64781c18cd19754a9debf4c503b91e67
SHA512 d9aee928cfbb82bed4b2b0e9bcd9844d2e6fb41a2d9503e249e182c4b6cd700eeb991defd57249b7c69a662e882702e85eb4d7c7a21f6b002fdbe22f0ab5095f
SSDEEP 49152:XhtSn8EApI0figXgiDn0AP5wMXozsr8zlLwJIh:GX2iyphLwFRKIh
TLSH
T1B695BE13F2D900E8D05ED175C7468632EA62BC160B35AAEF0A50B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 edbbc3eadf885a69c7dfaf9a5f6f46490dee77d5a042478e5d1b99aa48e19809
MD5 6716ca34f0b058b9576dc8aa586b1272
SHA1 c3f60e97f559f1b3f744b4460b69325b0321127f
SHA512 bbabf25165b9bb2bf56a795d46a8975f8eea79fa7bfc39f72b8290767c23a1be5c399fe9c6c8bb640ab0c1c87bf57deff4de4bcfb1768542614f5797d356e8ae
SSDEEP 12288:51ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:5T9Xozsr8zbhN6GwXOGIh4
TLSH
T1746523B7F992A442EB575F32298116C4CAA7BD9FA9C20791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 ae4e16bd94521e894846bab149c055081b516d3293678b192458c2cca472b0e8
MD5 7cd7074b8bf91b0cec8cb2766a3a0094
SHA1 9d62e8f1cee9595a7880f14422bcc19c69c288e4
SHA512 6542ad8fd9835dc49115e57c25f7b86f7dd84d2c9be08f154be22624442176ad651395a1469c16587208300a0e7f72ec3b01a1c4a1f47b42db748d33f50699a8
SSDEEP 12288:usksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:uo9Xozsr8zbhN6GwXOGIh4
TLSH
T11B6523B7F992A442EB575B32298116C4CEA7FD9FA9C20791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 b0f43fe62e6b83835c85b66145ecaa08603446921140793adf7e2bb5eadb5799
MD5 f61cddfff5968b4012b6590bd8b559c5
SHA1 fed4e303516bc9b06feedd76d76d4ebfcf13b940
SHA512 70bfbb731f263608f939d9f154fcc4e0b4616e8578ad29136b92bbf243f3d3569c0491206ba6ad3bfa03a728c8c0cffecc6228b613ab175334573fa1de8a3e3c
SSDEEP 12288:uWksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:u69Xozsr8zbhN6GwXOGIh4
TLSH
T11C6523B7F992A442EB575F32298116C4CEA7BD9FA9C21791333D1042DC7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 1cd181132b9d412e0ddf61af3536d5868192267fbc38d41fa0cd2356aac9a907
MD5 975d61a1ab039c3fbfdafdeb1e9280e5
SHA1 9dd2b7eddbaab4cca0af199aa450f0e245c6fa45
SHA512 61169626b3bb4f3e2df1f67b951bd547a46cf0acc4c7ba191215e9e42606e1bc3dfa67b2c3761e66d0d360905f2c54d27ecaa1922cc7643dd342d972adcd57fa
SSDEEP 12288:3VHksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:T9Xozsr8zbhN6GwXOGIh4
TLSH
T1676523A7F7A550C2EE639B3198915680DAF3FC9E9B5217DB233800468D76679BE30331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 113e0842cc615e47dcbc2805ae147a25d21c3543d02804cc4405d9e49d1c42ed
MD5 018d6827ee26400188eccc783a408265
SHA1 7c8962184cdaa5b3a3f025e2549d71415ed9ee2f
SHA512 eec7217e918409451297c1fd6d0987641d05ef0feb306c5397b2902fc6b5fab11dbfba273b4f1b1c3692e834d2b721920df9e4987387188f815f14404a37c0e2
SSDEEP 12288:X/ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:XN9Xozsr8zbhN6GwXOGIh4
TLSH
T18D6523B7F992A442EB575B32298116C4CEA7BD9FA9C21791333D1042DC7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 c6680242b81a3fa08e511ee45381eb35f36c84bcb27a61f9089a50201226d579
MD5 ae92d66a698e8c533a5be5c12c373f7f
SHA1 bbcf36a3ce94da4fd909e6d4dafdea0bce13caf4
SHA512 3ae1b595bb528b46710b405ceb9c82f68596e090e83e14e070672e4faa0cbdabcfa1472a9dddfd30cbb59796334d75753b41a0d10a39421bad30c93b9da17102
SSDEEP 12288:JoksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:JE9Xozsr8zbhN6GwXOGIh4
TLSH
T1C56523B7F991A443EB575B32298116C4CEA7BD9FA9C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 04deff14b63c76495fef0cdea8c08d3a26bf87efe8855059ad0eba13fe868981
MD5 56d032907545addb3e084c95da345850
SHA1 59f3b6e6140241c00c3d941628a521dc68fd418b
SHA512 ea039733294627b76c51c0554fa902c75995ab9af0e247648c3e8ca106cfbcb8a0592627d9815ac8b31fd99d15e8f348118f6d70f78ff9a0db0bac583e2fb24a
SSDEEP 12288:RkksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:RQ9Xozsr8zbhN6GwXOGIh4
TLSH
T1DE6523F7F992A442EB575B3229811AC4CEA7BD9F99C21791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 58a77344e5cc3e3daef7b004b500666fc8c5441c191c53f5b232d0a37f93dcc4
MD5 635bdd97308fd9a4d4a14d9713773206
SHA1 3d45b19eb1bf76332dffd3b672d2b3b306c3ebd3
SHA512 4bd49a2cb7c34c0c5ed22c825f9b07d9caf5c32f826b7a2fdd4247478d9c27ffd518b73e0cc58da853a8987d08166ec510facf199c56c081840fa3e0cdd4b05e
SSDEEP 12288:ViZwbWzzFEoS2cPvyMksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:YZMWzFVSOI9Xozsr8zbhN6GwXOGIh4
TLSH
T13D8501A6B39018F4ED67823EC9518905D6B2BC5A0BA0C75F13B832575F333A11D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 3f719c31a47086b4413736a5be383d9ae1c38d30c2de84af04b6375c3848725e
MD5 0076ed4ba7dca78896abc98ad43f53f7
SHA1 900f877f68d66327e0ee61b97d147445dfb6e830
SHA512 adbbdaa7a74554d714ae413f696a02f0de080c1cc83e229fd46530e5e93d77acaf65986942d51b4ce5abd0d122700bba568f94218b747a8356f577b0025517f6
SSDEEP 12288:YJksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:YX9Xozsr8zbhN6GwXOGIh4
TLSH
T1E96523F7F992A442EB571B3129811AC4CEA7BD9FA9C21791333D1045DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 da4c08a008b11bd156acb9d0b75c9c7bdf5c266bf566d9f3ba2c4af94bdbba4f
MD5 480fa5f6465d7712cd1558eb8d6370af
SHA1 fac4e7dcb96cc8047ec306366e95813915643653
SHA512 51e448573f6dcd4ba224fe6029ceb27cd2ad0f7420b314d8efd983662e71e778f8f88a5d8b0b018f825f5e8340abddd12e75bd56ff12b6d4089a01e89f3ebd10
SSDEEP 12288:j9ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:jr9Xozsr8zbhN6GwXOGIh4
TLSH
T1386523B7F992A442EB575B3129811AC4CEA7FD9FA9C21791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 11294368eb423bc6f6edff9ca302b34f1ffd1be4bd96b0ffcb0df358aa3fdb69
MD5 22362e1875d940aeb40da63bd1c4be47
SHA1 7dc24305ef6b8b076ff07983a235deb158f740ec
SHA512 06845cdba5db04f6d50add36d7c65d3e3c10742ac7765877f2aa7ad0c99e148a089e9fc7a83a1f6511d56df25c594214f0e0dc06b64d1dbf70f5398d8e66b5cc
SSDEEP 12288:qyPz5L8wksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:3zyc9Xozsr8zbhN6GwXOGIh4
TLSH
T1AA751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 c8c8c956baedeae80f27b8eb7e7b0b8e1d5a820e42b2ce8d28e38642aea117d4
MD5 0ccbb6ad9dac749eaa7f12377aecbd90
SHA1 f0e5f02374c84a78ec41649cb9f8ef445abd7b14
SHA512 724c7ae95f2bdffc092a5af8bc4d04b2f81365c28b1cee16e969f44e2eeab577c62ad0526b368c45e23c723bc802238d37d979f5ca697ba8434205cc1b8d6c22
SSDEEP 12288:OJksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:OX9Xozsr8zbhN6GwXOGIh4
TLSH
T1946523F7F992A442EB571B3229811AC4CEA7BD9FA9C21791333D1045DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 979d836a23c29de4bddf56b054feaa91bce985219b2a1bd43f6397e7794c248b
MD5 42168e79e4ba78d5401d68011a689714
SHA1 f35f1d458d637e088dc0f3da9659d05daf3a7b6a
SHA512 fb9b228d5b3536f302bc80f95cad631efacb066b45877fe9511152ad167410e179f3acd221d65f6e2e649ad5c291c0d07f49e1d5d3669d2ff3d8a9b9aa9b0e98
SSDEEP 12288:FJksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:FX9Xozsr8zbhN6GwXOGIh4
TLSH
T1E36523B7F992A442EB571B3229811AC4CEA7FD9FA9C21791323D1045DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 de107354aadeaeb27d00ad74ecdaee2abe40da3a55a64b028878b3d56d7250ee
MD5 6e43e23c1413f594e06ce8bde8db610d
SHA1 540c9319f2452a6c96a60f1cac6b1544465d540d
SHA512 76d4d3d3f98b9b6032f1cae3704f916b607b1a3932d5e85434eb2b739738383bf1f801f62a7d61387251bc1f48e2fea756eb0a30081de22d6ca3009d0ba385f0
SSDEEP 12288:oyPz5L8wksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:pzyc9Xozsr8zbhN6GwXOGIh4
TLSH
T1BB751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 e9c5d6e9b9d3a74a3404e90071128d150c5ee9dc989b129609c89c99e78a03f8
MD5 8066e0c65f165ac72f93c655e824d7d2
SHA1 a8fe8c0331c4268604b4d8fae636424bfe970b46
SHA512 b524a764bd673215136fa0390d2fe24fb8f7539ea539a04c2ae28ade48b9320bccac7901a424dc9ddf1109cf84ea38d25300c194ebccf437df76890ff7dee8ac
SSDEEP 24576:ZTHaLl3z0zDq9Xozsr8zbhN6GwXOGIh4:ZT6LljTXozsr8zlLwJIh
TLSH
T15A8501A5B39018F8ED67863EC8518905D6B2BC5A0BA0C75F13B832575F333A12D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 a30885450a290276d0221d856fa2bf0cd358914e08551d5e982b4b74a6ab9a44
MD5 28c88e8c5470c916774c4c8642663b88
SHA1 90d594ae38940235330d33f459f7a2aa804e5540
SHA512 a181d6e6a4df185946f0388d59f4520871ad7b8424c8c8678ed53e03a3e3b2febd98114aa6ca68b17ebfebf71383d77434e3fb685baac3641e3f8454ba419e3d
SSDEEP 24576:r3Ld9CHKy7GZG9Xozsr8zbhN6GwXOGIh4:LLd9CHKyaOXozsr8zlLwJIh
TLSH
T10595CF91F3E410E4F1B79A358D724511DAB67C9A1B61CE8F03A8251A1F33AE19D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 b9a85e091a16c986a6782027816788fe632c383187af181f185569efb0a07b3d
MD5 003d55237c11366c4a6a70b1b42dd6f4
SHA1 832cbd89d206ecfa1aa7e95a9f7a7c1e4efdd5e1
SHA512 2f287f394907e74146c51528a405291cff4ded5579b0c766d57c46fb94cb4140813dafe5ae93b5c6b43b32fb85f6e68991e6127c2240c17019d89297404988c0
SSDEEP 12288:+2ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:+a9Xozsr8zbhN6GwXOGIh4
TLSH
T17A6523B7F992A442EB571F32298116C4CEA7BD9FA9C21791333D1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 ccd2b006e3e794ce1e486a7d0a6a8413ac35b5fbcbeddb5d34b138541f6c17d3
MD5 b111eede7550638ab69ceee9fa25e494
SHA1 4a38bf8d3d6d8ae8d79ad339d82bba2e3e693cf4
SHA512 0be87151e7c2b0e18d2ee0ee111fb2cd4e86787eb5d63798727c665cf80618b828ab4521602df0dc2e48bf7f6ed03c2c1581d1b7a26e1dd319916194b7b6a379
SSDEEP 12288:2QksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:289Xozsr8zbhN6GwXOGIh4
TLSH
T1196523B7F9A1A442FB575B3229811AC4DEA7BD9F99820791333D1042DD7E83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 eaf2d0a20b03deb390b21b3e509e5d34387648181f98c0ed761e29d44e10fcfc
MD5 89df00425fe1996e4c3906cb98f0b93e
SHA1 db0fa75f25964c055646280e27173444c983e068
SHA512 f5d15c06e5d9230013d248e421833ad977d413a7d3673f6a06371091a73d7f52d588dcc7462cd5be8f7320fbee594642b991028460fb7216dacab0b03962d36a
SSDEEP 12288:SbksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Sp9Xozsr8zbhN6GwXOGIh4
TLSH
T1B66523F7F992A442EB571B3229811AC4CEA7BD9FA9C21791333D1041DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 e76acf4bd34e1392e6abd37ced35f2bb588f856e479a50b4fd94fe550f49ef45
MD5 78587697be3d5f0046d7f8969fda73df
SHA1 d1d87df2cedf41f1523a111d996f3bd40fc34cbb
SHA512 3f66c1fe055e2bf66f2e8acabab9bf9ff7e9007c094fbb65d5f492dd2083903133c7ca6c5751838e6dc3419a054f1b466e3b2ab372e5b9e397d0f9113ed55924
SSDEEP 12288:kJksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:kX9Xozsr8zbhN6GwXOGIh4
TLSH
T1026523F7F992A442EB571B3229811AC4CEA7BD9FA9C21791333D1045DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 c402f187e2a629ddba1774de8501140eedb41f083ba1a71c9f5f45ea3260ea37
MD5 e684b61c7a7764c7f986d186540cdeca
SHA1 3e565d775e5a25033fa6f50331266189a6f4c7b8
SHA512 9f564aea5e4f930261b843ac63e504e178233c6d300961cf2546dbc1246c3f90ee3d7998b956f872d0bb889b65544420676ed8c527b8c1fbb2d860453bbe64ad
SSDEEP 12288:a2ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:aa9Xozsr8zbhN6GwXOGIh4
TLSH
T1C26523B7F992A442EB575F32298116C4CEA7BD9FA9C21791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 446c346582712f74ea7b0a250c77956f73bfd47f5487a558a919c0af0a8b897c
MD5 4fc33776e3a61657cdddeb557d54f2f9
SHA1 6934ef8b9ca54188830e6bd392c8fe497171ee9b
SHA512 bfa97b94e6bc1947203584e2769143ab2092f55406b7c26251306ee333ca575a8099a1ec3c7cae6754b9ba26d8c3efe7d3e7a8360734ff29b3eacab1460230ba
SSDEEP 12288:khksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:k/9Xozsr8zbhN6GwXOGIh4
TLSH
T15C6523B7F992A442EB575B3229811AC4CDA7BD9FA9C31791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 ebf8444b5ddff4058ceabb72b0d03f20b537f568267bdf24106135ece6b415db
MD5 da2515eade740dbca95c58cb5dd6235c
SHA1 5254690d0dfd10d02fe9ddfd7376b6ae2f55d899
SHA512 f2329bb62140db8af9e942a82c02eec74d48ba2ad19e418573dd05af45a4f62b7ce99dbe8f88d0b5df58a9c9ece65caa83fb7709cdcedbe9b405bf4aef815c24
SSDEEP 12288:x/ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:xN9Xozsr8zbhN6GwXOGIh4
TLSH
T1B16523B7F992A442EB575B32298116C4CEA7BD9FA9C21791333D1042DD7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 53e04444e4ef4558292b8472ed2d0df1641168964d2c694450102478b9b59514
MD5 46dffd83ff060617fae65e4620f6d12a
SHA1 72ef5cefd926ee1d27755c9ddef68ac562d1f44f
SHA512 49e6e095f134a99422e1a4c3a69f8bcb2d6c94d6f3378ba7361b2a38a3135ba2a8e467523e7393e2d7f8e2d253c1fc3a3312cd8f0b628fe34079f5e9fc6791ea
SSDEEP 24576:Sfwv7k9RX6wkyAI79Xozsr8zbhN6GwXOGIh4:dMnYIxXozsr8zlLwJIh
TLSH
T1C495D02AEBD844E1E1B7923C99B3460AF6B178591B31C3CF125A536D0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 af9b7514ce89e235811520ba4b29813213b38071b693bdccf1363a6efad074c8
MD5 cada1dec0cef2ea7e30b31721d682318
SHA1 f42e2736338b740af314927534cea5dbb2030f71
SHA512 d6f1973645c7a3b0e494c091c9746b26f6ca3c3a381e75dd1c3e7310fed58e2d50a264ab5e830bf202bbc4166923fd87418d76859d9637218ae1a96278912ba7
SSDEEP 49152:FYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0sXozsr8zlLwJs:TySzPkwFRKIh
TLSH
T12F066C97A16841D5C1B9C1B98B07CC1BFAB134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3a1e47ed1f298b7075cef093c0389f0f792b6626125b09b8726ca5ef4515cdb4
MD5 d3fbfeff7e1e49976e97ed87c72d2ae8
SHA1 8fbbef56ffa8b0b7303cf2321313d81ec8857919
SHA512 87f7b839efbd5544f30ee26d543bdc475a4b49bf0c35a98be92cf3d19c90ae354157d405750e02a1e2fe3b91577b152a8b82d4c1ba5253dcb74f0e08978fa763
SSDEEP 24576:p47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYY9Xozsr8zbhN6GwXOGIh4:p47JUQj4irIhCnDHUPfF/8Xozsr8zlLT
TLSH
T1A765AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 50a8c59ad03fc93edb7b8a14b62c9e3247690e85a08d887c8472218885436a38
MD5 02180faaeb87d83214944b31ad744da9
SHA1 66df5ee5089c8d326c2199d9c7d89764b987c55e
SHA512 c000ca7fedfdcba7de776a3f4d13425734c7075387b1c5a8c75b72c8a4d4f86a82728ce3b7d24685a3fdecd49f95cb410df55ea8f379c46af5355cdc122948f6
SSDEEP 12288:RQsf5ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:RH9Xozsr8zbhN6GwXOGIh4
TLSH
T13D75F15AE29411D9D16F6235CB414A40F7737C6A87E193CB22E0F03E0F7A5A4AEE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 10699fcb99cabf6ab5cda155eeb5048f7c1a6c61068828f371fb1690ce63010f
MD5 71da6d01ff3962a6fc5606477661beed
SHA1 36632efc1df6dd1b75f09ba975150dd4c5366623
SHA512 1568d349b214cfed2d1b1a04ba4d2bbbf4db717d6d5703f789b62f8130262ed35960f6c08122dadf01ef26b9a08b1adc14bfa5ee46f305e1a2cc7622059c94e7
SSDEEP 24576:4WJ9UPX/NubgOK1OGQB3mT6NRGDMjNUyqrjAbFvbn:n9UfFubg31OGQB3mT6NRGVyqrjAbFvbn
TLSH
T1B7354940766AD75FC6A940322E33C1CDA7707D41FE05AB0772C8973FD476668BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 8cffa476e6fb645cc10971dd02662ffda23906de48dd041835ddb6c434d41298
MD5 b09f8b292f835b1933d43953a83e61e2
SHA1 5a4a7702c286a0ea910f2944f1377877c07ad3ad
SHA512 e769ae262d46c75c45f2e6ffc371087e502468da489451dd85e7cdda0f8cce034e22d87566020ea6ea0ac894b68cee06aa273d3be08a9f0766f0af4ceb1e1b40
SSDEEP 24576:F8ITs1OGQB3mHxOGQB3mi1OGQBHTOGQB3mK1OGQB3mRNRGbu+gwu+gU1OGQB3m3y:O1OGQB3mHxOGQB3mi1OGQBHTOGQB3mKX
TLSH
T1C755C6819537A3CFD1F76071072A9B4DAB64EC0773095F27A3C8493AD85AB21A4BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 36375b1ad7e730835b46632f35fb19ebab046382de82b44767760e59a66808f9
MD5 3896d29c1ae958200814e7b10539a0c9
SHA1 10c744fa709f04747cb3029b649cf23a58ad58fa
SHA512 4877a70aad18acbf08fe178041f8ec4cfd0415f802907ce202da74de1cf54d8fd7dc771bdc4d36df0633d0281416594bae7286445825b607e7520475b35ea94d
SSDEEP 12288:Hd7RksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:1v9Xozsr8zbhN6GwXOGIh4
TLSH
T1BE6523B7F795A802FA7B1B31288556549A5BFD9E4F8107C3322C1186DC7A8E5BE30336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dc747241e0a153a811e43acc2155d1c4cefebdd4cd253d570a1a396eea41a346
MD5 09663458e292342ac753280f302fe8d2
SHA1 781cdd5dd684041c3556323495df3c08237ff0fc
SHA512 eb0d5a66af4485cb35af258ad0e5e66a7dafddf5ab7b26f823b1a7680aa6ae35b614ad059327594c324acacc5f98f76795f87b3c1576f673e2b0a4556521f9d3
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYh9Xozsr8zbhN6GwXOGIh4:Zgb4mBIBhGFCXozsr8zlLwJIh
TLSH
T1E365AE1E22EC02F5E1FAD2B89DA64417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 be195bf247db71b6156ba1b1377acad75faa4f9e52adbc64317d985f86860caa
MD5 43e143f659d2ffbd9ca0d84b54b2109b
SHA1 eaaca506b8fd81bae0b81d6c16f33892a45687ae
SHA512 24478ad87502056d3729320264e9e3d33c2bf59e3d867a24ead6a1a9ba233468030a0e326c512219f8a52c2f101b13eaf0fb6d9f2e9b2f943b65aee23a7402a5
SSDEEP 24576:ZG88u8FpJqH1czria7/mI9Xozsr8zbhN6GwXOGIh4:M7ZFPqV7a7/rXozsr8zlLwJIh
TLSH
T114A5F166B7E101F1D477D13889824663F6B2B8250364EFDF07AC8A511F23AE55B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 5a0e841a65180e63b844ad5c68ac7a8869369ff7c0e261bc928e0380578651a5
MD5 0baa765a073f9c2f9720f8acb21bcc8e
SHA1 e8c3ae7abd8f9f5bad9950739cbef7452d3b172e
SHA512 bdb044ccab4fa86725fc9c1b206abce5aa4b1ec64413ead3b8c440a266ac2b2ceaee5bbc208e8658fb7854ae4ae2aee67649c735a14d677271eede0d439aed92
SSDEEP 12288:dHvUrBFrEjwaQ4ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:dPUr+NQU9Xozsr8zbhN6GwXOGIh4
TLSH
T10F85F26F72E918E5E677A13D89824709E772B866071293CF02A0417E4E77DE8BD3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c2c47c803ac7320417e49da01ab57fd5aa2d9624833a06a131ce9df7b2ad8288
MD5 20c1b7bb93b5605c1503499da07e33c5
SHA1 5fb4ead0e86adbf51cb86dbe6cea9a69ff0fba82
SHA512 69e0f34896528eea8b192df56fc3b35734cf4cf9c30b293963fc6b9679886f9736b02167b882b66ed369671e466987b787fdc738f5a8dfd4d85bff2609975599
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+Xozsr8zlLwJIh:FG05lO43b9wFRKIh
TLSH
T1BCD5CF6E62EC11F9D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9a2f43c69df70c80be50d2313b528d5f63a589ebfc7f35e13e854ec4e88592a6
MD5 af459a82d650a84f40e7273bd0bb736f
SHA1 13fc9f7e9d3c7f87810456a65e44016349f633c1
SHA512 f4f74d2a4609903e4c24f71a64bac5c4db8cd828659d75c60ac2ecdaa5ac9f2d27f96518cd98d59121506daf3f229fcac833f4a0a3fccff4e60b8c5bb0f81276
SSDEEP 24576:Pfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnO9Xozsr8zbhN6GwXOGIh4:3a5POZ39Jt2pasx2+mmXozsr8zlLwJIh
TLSH
T12565BF5EA6FC00D5D57AD17DC583461AE5B1342653329BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 52f570385b1700b40098fd37680ee3c1c64eabc31a58faa913832163f77c62db
MD5 01117e7fd0f7da14fd1e703fe320e0d5
SHA1 d8fc59476eb0a693d6d141172e4364006c1578b2
SHA512 961bc84da547abaecf3d8f21d0e278e60d14e423fa3ed2ae0af13a35178aa01e515e31e36cfd5896c353c6c85e072eadfb55881f4c9f6caca6b21b6e1eb6f418
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkA9Xozsr8zbhN6GwXOGIh4:SNc/zEOVHFLXozsr8zlLwJIh
TLSH
T15D858C6623E901E4F5BBE1BE89779546FA717865133086CF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 37e8337acdfc543bbd5d88a8990bd6ac011b78ef7c402817856e0226acfc44f0
MD5 fd9d90e870a4150cec615a2d30470d67
SHA1 c0b0a6a32f0b6cba7d7d7730cd75521e28f3266b
SHA512 bb224a79dee15d372f628671de8db40e3e56404897fe108cc22c4b4d551572ccd1f65846d4c00fd3b37f6b7cbe4bf45fc660add0d53ed2a75c143e92c54e2523
SSDEEP 24576:qtkNvNnaFeYhJNtmZBmy9Xozsr8zbhN6GwXOGIh4:qtMwBtOmAXozsr8zlLwJIh
TLSH
T1EC55AF6EBAF845E4D1FEC6B48D238512EA727861073253CB5290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 71e235419d41200af96ff5b0a82b10093dd6a11c62d6803ae23b857b6539b3d8
MD5 4ca5cb5ca305c5c4ce54ceaaf4d58b42
SHA1 d443a23284bb91fd987e21eff3e4a371b6acf967
SHA512 c0ef018aae5ba6f1293736a308de1137b6d8566fbe226dbe5041ac616cfe9a781ce1815351146e816af7f6df2f66f616b0b649d639428216de35ceb629474e06
SSDEEP 24576:3D3FHshBIYQgAz9Xozsr8zbhN6GwXOGIh4:3DVHeBIAAZXozsr8zlLwJIh
TLSH
T15995E17EE69C04E4E57BC27CDA534A06E77238AD032256CB029481B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1304-22-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1304-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1304-14-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1304-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1392-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1392-135-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1392-133-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1392-127-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1392-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2032-184-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/2032-54-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/2032-61-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2032-55-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2280-217-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2280-67-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2280-65-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2280-73-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2648-294-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2648-309-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2648-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2648-102-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2648-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2648-108-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2760-280-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2760-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2760-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2760-95-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2760-328-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2872-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2872-52-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2872-38-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2872-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2872-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2872-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3088-248-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/3088-79-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/3088-84-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/3088-78-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/4316-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4316-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4316-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4316-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5100-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5100-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5100-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5100-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5356-77-0x0000000000400000-0x000000000059F000-memory.dmp

Download

memory/5356-0-0x0000000000400000-0x000000000059F000-memory.dmp

Download

memory/5356-7-0x00000000024E0000-0x0000000002547000-memory.dmp

Download

memory/5356-6-0x00000000024E0000-0x0000000002547000-memory.dmp

Download

memory/5356-1-0x00000000024E0000-0x0000000002547000-memory.dmp

Download

memory/5740-301-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5740-113-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5740-121-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5740-115-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download