1762d5957def451af7a61ed087eab937f6968224f2c6ea585306b5ecca84994e

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
Size 2.1MB
Sample260804-hcc3ystapg
SHA256 1762d5957def451af7a61ed087eab937f6968224f2c6ea585306b5ecca84994e
MD5 81f771eee28e820b448d751575e616e3
SHA1 17e54090c3b3eb015fbc18fc48d6f9e60d8b4215
SHA512 9e3b8192ae0bc1c6f18814fd6038fb4a9db0a633ddf228ca5a3518eef13e29e6899c72dde6355af87547491ef32ff5e9aec8cc7ab4169560f9bdc70f78aab594
SSDEEP 49152:NiEl3qTmtbMK7EOfW3vMKa7BzAb5+Pl6bJTIZ5jdgpk:NiDmtbMnQUMzFzuslgJTIZ5Bgp
TLSH
T152A5230069D18072E0F32A31C8F49B702DBAFD214F7655DF57A84E2E6A349D2E636727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5872	elevation_service.exe
2080	elevation_service.exe
2664	maintenanceservice.exe
1408	OSE.EXE
5692	PerceptionSimulationService.exe
1444	perfhost.exe
5052	ReFsDedupSvc.exe
2660	SensorDataService.exe
1064	ssh-agent.exe
2748	AgentService.exe
1264	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\363e6296c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EU2560.tmp\msedgeupdateres_es-419.dll	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2560.tmp\msedgeupdateres_hr.dll	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2560.tmp\msedgeupdateres_pt-PT.dll	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2560.tmp\msedgeupdateres_sq.dll	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2560.tmp\msedgeupdateres_fa.dll	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2560.tmp\msedgeupdateres_lb.dll	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2560.tmp\NOTICE.TXT	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2560.tmp\msedgeupdateres_kn.dll	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2560.tmp\msedgeupdateres_sr-Cyrl-BA.dll	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2560.tmp\msedgeupdateres_ms.dll	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2560.tmp\msedgeupdateres_pt-BR.dll	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2560.tmp\msedgeupdateres_is.dll	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2560.tmp\msedgeupdateres_nl.dll	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2560.tmp\msedgeupdateres_az.dll	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2560.tmp\msedgeupdateres_uk.dll	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab09d96ddb23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f587196ddb23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5872	elevation_service.exe
5872	elevation_service.exe
5872	elevation_service.exe
5872	elevation_service.exe
5872	elevation_service.exe
5872	elevation_service.exe
5872	elevation_service.exe
2080	elevation_service.exe
2080	elevation_service.exe
2080	elevation_service.exe
2080	elevation_service.exe
2080	elevation_service.exe
2080	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4564	2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
Token: SeBackupPrivilege	5052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5052	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2748	AgentService.exe
Token: 33	1264	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1264	SearchIndexer.exe
Token: SeDebugPrivilege	5872	elevation_service.exe
Token: SeDebugPrivilege	2080	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 5180	1264	SearchIndexer.exe	100
PID 1264 wrote to memory of 4176	1264	SearchIndexer.exe	101
PID 1264 wrote to memory of 2956	1264	SearchIndexer.exe	102
PID 1264 wrote to memory of 5752	1264	SearchIndexer.exe	103
PID 1264 wrote to memory of 704	1264	SearchIndexer.exe	105
PID 1264 wrote to memory of 3200	1264	SearchIndexer.exe	106
PID 1264 wrote to memory of 3064	1264	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_81f771eee28e820b448d751575e616e3_amadey_elex_hellokitty_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2664

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1408

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5692

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1444

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2660

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1064

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5180
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2956
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5752
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4b1f65c923695504ec1d4fecfc0084f6314bf0281da5cf51f37d77fc5ae2005d
MD5 d2b31a622253fecc9db0c46ecb7c2de6
SHA1 4fd94793d6b64482557bc7d09ff1b4583d9982da
SHA512 ef97a8e6e007004c46ebb36c56bd8e979324b16a74f0b7d96b2bea3f22b7e4bf66d7989eef35ab233b9d69470a9339d8867c461b2d2baee955303b0f0f2e6fb4
SSDEEP 49152:2b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnHb5+Pl6bJTIZ5jdgp5:o3q6mjBOslgJTIZ5Bgp
TLSH
T1B7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 bbe9d60f0263fc8b7fdeec76c80e701c164ed63f862c8186fd9b9e1fa91dc7a1
MD5 4514eefc2edf8e4546d186294996a04c
SHA1 c79651136a694c8a37cc47b9b86d210791007263
SHA512 7461a8def351afe90371435cd1bbbdf8314acc074cdf80e1b746db1e819d65f0f4fa2caf082a4dffab3d960442c4c473fe64774c570311cdb448ee078468cdd0
SSDEEP 24576:zXYfDtczApmb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:WtcRb5+Pl6bJTIZ5jdgpG
TLSH
T1BC85F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 d659a58cce855612c3191cb84c4cc12b010b248e470e32fbd6c29856c47562b6
MD5 6e8946d5305222a4689e052151e39c7e
SHA1 72300c4f5bfcba03e3d8c59aabe8966af87481e2
SHA512 9e0305d1bd10ffb2673b340f4375202a1ea2ceb58a276ffb00465e40ea208a98cb958ad25d20d062ca8b4f19c04e87e29d7ea14b7872537424a2dcddc6529ee7
SSDEEP 24576:f0Le5ji0hmxyrMYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3F:fPji0AICb5+Pl6bJTIZ5jdgpv
TLSH
T1DB95AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ca8e8b895eb0d7086b387db3bc2ba9f6bd06f904cbe09f5c069c0c35a63cc0d0
MD5 190380df9c59d2672c0f197140646949
SHA1 2b7b9ad5cba24589c120399ca264bf10618a871e
SHA512 9413aab833c969331c996a0d5b6b469c68a28af69c9e37824f5bd27cdbf4b6edf2835cea78971835e8ef120b732bd29f8b8e4faea40ac908eaed5eedf6501384
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWj6q8wyuemb57GBiOl6a8JTth/RWZvR6wQQ92pN3/:P/ezSC6vUzPv+HjyGb5+Pl6bJTIZ5jd8
TLSH
T14D756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4b82acecc285f43b6ffe5e75e240556a17138d34cc9280a14b2077fb72b53601
MD5 8d2ccd23402f3ecca3ceb7bf390928df
SHA1 b1faab9f6726841faa9853a603da2ec793aa2c20
SHA512 2b174f0644259324a5c2da022e2b60ab52b59cb987c666f7c9e09056a7332ebee2c04444ed447b873409aeab433253f8c2358bcba5768efc976f03706361601b
SSDEEP 24576:BVbqPb88hv/l+BNmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:BVO88hXl+ib5+Pl6bJTIZ5jdgp6
TLSH
T144559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 199b23aeba7e108176fc0068423c0e5fc486711a6160cfb4d5c143e83daf8d7c
MD5 c650e589d0ff69e81205ffaaea8c5360
SHA1 9254467688a10c3dd058ec02e2eb4afd0963b7a1
SHA512 614162ea0db22dc17fc4bf5ac430c6fe894fa829f4c3f496bf2ee19d9153f6dbd8e43a73293398d93e2a948a1dd8b636aac984cfa521f62acd479488062a7319
SSDEEP 24576:dFMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3X:Tb5+Pl6bJTIZ5jdgpp
TLSH
T17E6523838B6A30C5E5AB1739D9CDDB00F879EF55CD866BB6C575282BF034349B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 2c2d11f4e70fbf1f53b0bfbaf471d2e2616dbdb1e931d99c2d250dd566e71f02
MD5 b9458fa3e959213fe99c5c0770db0494
SHA1 ec7f1938057259ae47a1f3cd1802c248d9d3f6d6
SHA512 f3e048609ea056dbc30a560597e1e606657b17618dc8c77f1990dec05691b1be43c5e26fb0ecbfe0fcfca97db16c199e240d02e87b20699cad2ee5e01b9d0917
SSDEEP 24576:VJIUVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3F:VJIUYb5+Pl6bJTIZ5jdgpL
TLSH
T13D85CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f6f0cf1333f8c26cc7c508bcde51d112c1ac3433abf24b7d88886274e97ec4cf
MD5 2ce64ec57cc3b7c5b15497376b7ca355
SHA1 d9486634fdb9a394fcc76f1c175c77d8eaddc894
SHA512 76737d25a0395349c3f3209fe9f7d1e3119ef17f28c9826993a85b7a9fc05219525fe2ea2ff51631f74401b1e7e23c1f1ac47f24a227b97ced7528dbff0e7d1a
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THW:zQvGAdlCEL8c/WRNw5CtslgJTIZ5Bgp
TLSH
T15D266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 0a054c2b1db89d8cfb4d8488fc4cf06b17aa2003af78549a751505183a2eb6bb
MD5 21580db7891c01c4578079a6c4d2bf40
SHA1 0effe6df98187820a9f3cd3f495b048a25b24f7d
SHA512 1d38a68eb0aa53af4248ba1e06cf156ad330c840eddbd637336b478dc3a6c22b976ca744ece74d42f9255c8ee7d23322a81bbf762e62d29622ca8d998f84e998
SSDEEP 24576:DOewsAj7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:6ljyb5+Pl6bJTIZ5jdgp3
TLSH
T1C185E031FE75E036C2BB0DB65B65C706647DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8f8ee39faffd9e476cb449a6fd8f89e4462a55d0b855a5aad6610375921bb28a
MD5 b884a72932b059c8d615942ef72eaa79
SHA1 473cced3ee9376a697ebe3595d74016194eb6023
SHA512 937d71003e45a05188dfd70f22ed555010a71d085b6bcbd6bb8d903807f2fa878fb55484cbaa4bc4c85e74f76d7acb0c989f88e688f492ebe24ae32d22c0c4c1
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHgsT6p:3UEtQevvqc2W1cpV20I32gs
TLSH
T190474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 684c702da3a7098e48cf4725c42583af1070ee9eacc9f7c323c6910cc247c904
MD5 23376877fbf5497939038181b81ae4ec
SHA1 81fdc39eb9ff7b99d04e576a78333073b26821ae
SHA512 0ab16f7e589b9ac33401d74e309915423619208b02ca4b9e26e9ae8ff9a7e40e3f10c73761676d5cadd35dd2d1f13a6f46ed55109a3fcc8a406065910d5bf124
SSDEEP 49152:ACbRquA/m2yL5zQfFiV+XenmE3/zSb5+Pl6bJTIZ5jdgph:JoqtVjnmhslgJTIZ5Bgp
TLSH
T175D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 872953e99d2348d985a48d99a00451b0dd8908d6ed093e5ae3019895dc18178e
MD5 d5faa5f36526ce9eec27e37cb17a62d7
SHA1 ac20281246578ff19a0a76ae1f5b91e3a23f2ce2
SHA512 734c2a03b97e55b90f120fff4914df53005dc9f0cf893f0b65c93983cee86fb2b9d6756ee82810e274b7ca1aff06ae09223c9a69fbdf261903253f05ee757e1b
SSDEEP 24576:JAhGL6IFoiwtA5l7S53amb57GBiOl6a8JTth/RWZvR6wQQ92pN31:JAM5Foiq5Vb5+Pl6bJTIZ5jdgpn
TLSH
T103359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 110bcefa2b6f7a791b442f358f13a80c5b55e9a541b6a13dbc3d7439d3daa389
MD5 f8589b961f64bb7c6ea46a2b6ff7f569
SHA1 3272294a548227b8f909bc50e78c0fc337371770
SHA512 43dee3ffa782c749168f1c4956d1f7a946c3099c96b24b1fa4e239402cf2f0ee760cb19813c8a517cd95cd205027cf6023ad66f1e6e7e44a58ffde8c2c60c68b
SSDEEP 24576:+wuGOWnmb57GBiOl6a8JTth/RWZvR6wQQ92pN3O:+wNOpb5+Pl6bJTIZ5jdgps
TLSH
T1A175F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 34cb362edc767634255075bb6215512e4739adac3505f3011dbaec06b8fa58e2
MD5 edd2b9a929fe8455c622ff57cd33e4f4
SHA1 1a6e5f2b9230b2fda82b4b7003d92e8c4fcb702c
SHA512 6b89cb9830ba003b089f3a43f8cd070565a5f68e6ef6646a0b8daad4d3dd6b4ddd6ac1c4d39555b91b12f4e2a19eb787dcb559302b9e3501467aa43bf6a1cd45
SSDEEP 24576:zZuAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:Ob5+Pl6bJTIZ5jdgpY
TLSH
T12865128627A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3c6fc973ac45a3c2bbdc46eda42739ccb60cf4c408600e365a9aa94422f1c209
MD5 ffc66305694b6b15541c777af0f00d9b
SHA1 f92105f564703fc45974904ef71219f6463a8f1b
SHA512 52d4b0fc1e1570c2a22be7ca05f98ab25261560324ba53ee9966dd12e0b1451101709b868b6e45ee664af2b641e48d2331f90fc80fac8f0a827bc21defefa304
SSDEEP 98304:cQRQyi36YOcPDLvw2gAf+PN3qslgJTIZ5Bgp:DQyiKanX+PNasT6p
TLSH
T1D0666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 59c6003ba9393e8fd6605254be3a4f2d9118737ec206872196329d8784ededbb
MD5 ba8102bb524ee50121fbd49f00486515
SHA1 7cf26679ec997929f6016ad105250d3ecec33d3f
SHA512 af133fbc51381ce7ff1736591d0e1a84ecb3ef68424f198bad9d3c9c74e95f64b9c738d5f85489f8590fef6bf26ca25ac8a676a5b6f3fb32128a70ff8abb5c7c
SSDEEP 98304:yQRQyi36YOcPDLvw2gAf+PN3qslgJTIZ5Bgp:pQyiKanX+PNasT6p
TLSH
T17F666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d8882fca1846b6752caf314e4ae2368d5f65798ad56540b09e101e6c05c0f5c3
MD5 68911b2900b4df1602896301e80ab4d2
SHA1 3c294a2ba0929f0e62164f63066312eb0443016b
SHA512 1bebe959a70dc841fe7d2c17ec46605fdb79a8b1aa3058655e4c99db605dc841fdbe4763d891fe5446170428684d3edb3f765e667edac42c9bac958b3fbf95ba
SSDEEP 49152:F68Qg55nhkeWu7PNU3/Cb5+Pl6bJTIZ5jdgp+:TthTRc/IslgJTIZ5Bgp
TLSH
T1C4B55A33B2F60099C44DE1769F4A872196E27C71CFE1E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e83fc67cd5847b64ecd65acc6f028d88d9307cf215c3526f1e2530eecf4f57ee
MD5 72f2c07c3412d74c546790373234aee7
SHA1 e684f3da5703900e6c3bf8ebd765d47df50fec05
SHA512 7b78f46892fe661fe0bf0fd434f4bd377c6126ecec1e79a5f171f5c24e89472d80eb886d80ea27ccc72fca14fe0bff990f22b2a6a17981ca0de1ac5bcc6a4657
SSDEEP 98304:3y5112gYy5azzVvU69nLKnhZvslgJTIZ5Bgp:KLIHRWhJsT6p
TLSH
T12F167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d1b45fecaa19428872fe1839c59528b1bb60f8c24cce9df43e8555ba30bb93c5
MD5 4328134b9633ea2b0b4999a1412653f1
SHA1 037a6f26d043386df758315236f3acb1d62dd702
SHA512 d85eec146edb8abd7367223fc762e1ef9e2be937738e7dfe12bca6964dcb109f1329633c7e4ca9c3e3f736751dc7a8a9bd7af7146e8a870a146b04a9efa81b2d
SSDEEP 49152:GB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl0b5+Pl6bJTIZ5jdgpd:0u6JmIxd2dislgJTIZ5Bgp
TLSH
T18CD59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 233f4e5d0e851823afcbfcfa73deec991c8757bd1edd6f8aeb74de51bd728ba1
MD5 bca896b623b111e140785e2571751888
SHA1 2f8b430a32ab1bebcc3d45f048d3417173ec1fd8
SHA512 10b3b193540970bfcefe6d545b6d763ff885dcdbf17e1afe8a1574f6cb3ee8c9ca393837abe8d1e235694e119562591949e21625fca9575a2a7447828870c737
SSDEEP 49152:Y1hpsNoJpF1A67U44CwH7R4x4b5+Pl6bJTIZ5jdgph:YmifPqRhslgJTIZ5Bgp
TLSH
T12FB5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 42b326b63377631b98a6867d79dfcc2b9dcde54bd4cd6fb1361da104e7b7cc6d
MD5 2299bb0fa94b7030c6820ff59fabe296
SHA1 17f2133ad73ce696525dcf415f44eba562d2fef4
SHA512 8bce3361f52fadb031e755f47591b1aac327f03b226aff71436a72a0ff8231d4879c013774a81f5efb69ce623da1ecf13af3754563e4e5afa8371ef7a0e45ac8
SSDEEP 49152:QSuZQIY0Be2KkRVtOnks6NMHq3b5+Pl6bJTIZ5jdgpF:K5dKqi61LslgJTIZ5Bgp
TLSH
T159C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6aed1caf336a0eed66577c784a2d3ffd74cc3bc76233309a8296767bbdf6b383
MD5 11ebed0f381abd94d69aa88b85934c35
SHA1 ce65add429093ca83104c62b199a48b2edf5afc8
SHA512 7af945d5a8358d8fe59135a9b748a9955923f3e51603e92984da03e2141b034a2cf347cbf30120307641e09aa3c4039a3340b8f232990b94c2dc896b60dd8110
SSDEEP 49152:ChtSn8EApI0figjgiDn0AP5wkb5+Pl6bJTIZ5jdgpn:jX2iWphVslgJTIZ5Bgp
TLSH
T16195BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 0da71b8d04788382594c0db7463b912e7ffadbdc0f864b45d96da380d24d46ad
MD5 189e9ae641b54b82ca60b177c97288d8
SHA1 499f4041e93c769f2d57c51e3251782df2f223c8
SHA512 6751312d61216c002ba7db8c5da6ea68922e2c5264fd2d8e0f5fcdba0967cdf28bdf0fb8c4c3bb5fc6971390083081157d1e5bb59a8a9f28e27d5e0623fd1088
SSDEEP 24576:3Umb57GBiOl6a8JTth/RWZvR6wQQ92pN3z:zb5+Pl6bJTIZ5jdgpx
TLSH
T1776523868D6B20CAE09B5779D9C9DB00F87DAF56DE8727B6C67D0427F130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 845c36b975f2ffecca15fb7a8170840d7d95012ee8e616c015f423c4ce2c3a22
MD5 0ec0757d79c9a4c318b91f3919306dfa
SHA1 7106096d88fb60f3f2504445b2f318bf2c612609
SHA512 ee033bad5212b3b45547ae1fad4627d440b143396bc0bd9994c694edb968b0870cfc5e25031681235a22595243008d0e798232d11a2c648e939cf1203a9f900b
SSDEEP 24576:Efmb57GBiOl6a8JTth/RWZvR6wQQ92pN34:rb5+Pl6bJTIZ5jdgp2
TLSH
T1676523828D6B20C6E05B5779D9C9DB00F87DAF57DE8727B6C67D0827F230789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 a6755b85270a4f6eb564914bcab7bde17e0da1ab91b0bd045832b9fdcc5c2ca0
MD5 a28219e50cbcd7eca157e14069c64dc7
SHA1 93e844f4368fc624b59fa6f56103662ca9770bf3
SHA512 81b71167983a53912b0a0299625652d6c170f986a8325bea8882781a2183cf8e0afff9893281c036cda2af30d32341a3ebb6dc0a11efc8b21ef36f9cb0852dea
SSDEEP 24576:udmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:Tb5+Pl6bJTIZ5jdgpb
TLSH
T11F6523828D6B20CAE09B5779D9C9DB00F879AF97DD8727B6C57D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 bf07ba1063ad8c76c0245b055a8e6c80742136d08510034258739ce3b2bec8d9
MD5 6fc1cb23cd5cbc2d68a4b533165630af
SHA1 651e9cd88e84985f39b2b1d98f0a49e8d34c9d2c
SHA512 a0a8bf4510bc87957dfc0a8ead43e4675c0995b0d22644d2a5867d09c693f9168ad1c5bbb109bc2016dbd32be5491a01f8cde16b32871188fc823321195e9c2b
SSDEEP 24576:Bmb57GBiOl6a8JTth/RWZvR6wQQ92pN3S:cb5+Pl6bJTIZ5jdgpQ
TLSH
T1956523424B6A20C5E4A79379C9D5D700F4B9BE96DF5267FFC675082BAA313883C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 ca8b906f645f7d677bd17401eac3a827980ec4007159f4fe383ab3be1ffcaebe
MD5 a44075a3ee105ee0a3ed617407a4ca14
SHA1 22e901ba24d27e38a5b7088e9b219d74e9112b5f
SHA512 5af25f155e00914346be3782356fde7aef307f9e5ff76c6f9c47e19d2cfaf81a7e11163457eb4fa7b48f7e6d8abb489ac3214c40c4c146416c2affc1c742e7f7
SSDEEP 24576:lymb57GBiOl6a8JTth/RWZvR6wQQ92pN3x:Lb5+Pl6bJTIZ5jdgpP
TLSH
T1C16523828D6B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D042BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 063e5ea35bbaef122b0e1aa2bbee796ee3a1083a0deac9e6d8e44fc82c51fe2e
MD5 cf09ec9100be94ab0c9e252d2f559e8b
SHA1 726fb0f45eff4b661ade43aaeeed744956b8284e
SHA512 ce653e8718b4bb49d08cb184a01eb1b742a857ffd1ebb6f985e2d1e9fcf8e6f8a2e843328778673ea5a56882b3a16fe696842cc8591abf5f5c9a7167e5dc7521
SSDEEP 24576:rDmb57GBiOl6a8JTth/RWZvR6wQQ92pN37:mb5+Pl6bJTIZ5jdgpt
TLSH
T15E6523828D6B20CAE09B5779D9C9DB00F879AF57DE8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 08c346bdedeed04d7ebd89187b4fef19f2eb6f8bb1377dcc87114922825fe8d0
MD5 2c2002f71e25d265337cdc630c46a612
SHA1 d5afda34382662a59c0af5c6872446c30cc4b3d3
SHA512 cfb8e0ba66a53e3a48c19bc4f883204697827029651d0691509c04910ca01b0a93daaca3a146827ff4597973739e0be229fca502d3a2749b2ebf1183084f369b
SSDEEP 24576:f3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3R:ub5+Pl6bJTIZ5jdgpz
TLSH
T1A66523868D6B20C6E05B5779D9C9DB00F87DAF96DD8727B6C67D0427F234389381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 d9b93881b4d3c4667ddc0561de4c554e65d0985c883271544de103db506d0d4b
MD5 2d747f5dc067adae8a433861d919b8ed
SHA1 caae3ed9de6e4dd1da813bbd4f74ad506d18ae50
SHA512 67bd9ce6c6fed95daee25b644e3748dec241694f844f82103312c88b3fbfc40964f73bf07fb4589f2af0881418c73d0b7706760cdb41f2681b3edcc78629e157
SSDEEP 24576:CZMazFVSO/mb57GBiOl6a8JTth/RWZvR6wQQ92pN38:CZMazfKb5+Pl6bJTIZ5jdgpi
TLSH
T129850295B35018F8EC67823ECD958A05E5B27C5A4B60C65F43B8362B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 d43e3e818adfe11462d2a893d45dcf58153c59f8f720c85f9e371d3bc13e7466
MD5 eea7f39cda7ee05df799394c92559b67
SHA1 c2cc26ebb2469b80e36a1a1fe5e49f29bd06adb7
SHA512 4228623bedd3cf7922b7ebb1e25521eb905ac783a1e575cf63d4e104215b7f78b9f7a07c22e8d359a2a72b85ae2304585bcf4f369f9a915bcf2878a8eb7b5f0e
SSDEEP 24576:+wmb57GBiOl6a8JTth/RWZvR6wQQ92pN30:ib5+Pl6bJTIZ5jdgpO
TLSH
T105652387896B20C6E09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 1fda625e5d515048c7a20e834a3e74a14d9b7697edeab4020cd35c20e5de1cea
MD5 9dba9216544e22f1067f3bada8723aa9
SHA1 f4e47875ffd452d8c58db6a982b578ca5dc2aee2
SHA512 b7778a966009e39cbc82654e30fb78924098ea5722c3981ec5808022b618ae87aa6fcce28320f2c483fcd456758a85dd313f51b2726a8849caf71d23ea4e8c9d
SSDEEP 24576:P8mb57GBiOl6a8JTth/RWZvR6wQQ92pN38:zb5+Pl6bJTIZ5jdgpe
TLSH
T1DF652387496B20C6E05B5779D9C9DB00F87DAF97DD8727B6C67D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 ef438ebbd07186c37f62830a127ddc36057af99bdf8b22463cd43ff0589e4461
MD5 9fc944f7820530eed5982ad4d36cee83
SHA1 cae8bf333f46099eb6e78a01bdb1bf49b54c2fd7
SHA512 a73bb7bae004fcfa4bd43d94e7135f4f49f987d0edb3a786261c187f9682a6a83ff95ad3cc112503323bea9a094b12f97747e791cad8eb6992c42407cbbddfcb
SSDEEP 24576:mzyrmb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:mJb5+Pl6bJTIZ5jdgp3
TLSH
T19775024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 d20789db9980ec5409925faed814eca96b59c71aff00c17d13ce1c1d1e46d5d3
MD5 dfa779e534228aa07aae29043f5fbb44
SHA1 a3a001219f4142d8b0f59b1ce6c0c8b8b1f15fcb
SHA512 53828fba939ab692dac679dc0716f3c5d9879cf6f5fee47c42240f037704f70df1c981a79f5fb9e1cb7a5c439ce312fc46e3705926fd60ce7c01eb791b341316
SSDEEP 24576:nwmb57GBiOl6a8JTth/RWZvR6wQQ92pN34:nb5+Pl6bJTIZ5jdgpG
TLSH
T135652387896B20C6E09B5779D9C9DB00F87DAF97DD8727B6C57D042BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 8f8a7e80932c3fcd99b85bf8378e471ca683486fbdfa839e11342cd58596c0e8
MD5 d627d14e62b440e447af7e32c5c8b768
SHA1 34290e2aeca60ac4a9d3638574ee13f2f724b762
SHA512 4ee307845fe772965b98a418a047712e0d40ba68d1575ae029e75b0d72894e0142a538c170d151fa25fae078eb64cb3ce4c3309ccec9eb7ec97f969d3529b3c5
SSDEEP 24576:Lwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3v:7b5+Pl6bJTIZ5jdgpF
TLSH
T1E4652387896B20C6E09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 e23b896d2e134200fec5c4af057a906ec39c4fed8e75e06445e2249d5e40846a
MD5 fb243c7ca51842dd371f7afa76874fe5
SHA1 da4307f2dc6bb4942b229ed0f2562478a5209c07
SHA512 ea8f63a8cfa8f8de81f3ccfc40534a582b979cf6d7df85604cdf2aef666427db375a33106d50b10288f33a8bcfb3d8f980e94caea4f0fab6422af9a0423f4077
SSDEEP 24576:szyrmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:sJb5+Pl6bJTIZ5jdgpY
TLSH
T1E575024767A630F9D0678239C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 447027d4c01967caee3e5133b2a1790aa9bd9711a57b871cb6b5d6f97fc15a6f
MD5 0eecc066ae75861904d1139f4e71304e
SHA1 46ca87288fc3ef1c3624803ba6365ee59d2d463e
SHA512 fe15d72e250a0adb5bbc89311b501a93ba8ffc69dc83c886cfe242fc95181347726d79beea5f9bdb3e00e8a26efe360e099ba7ce5f53414f77228db85254f40f
SSDEEP 24576:ZT/aLl3z0zDtmb57GBiOl6a8JTth/RWZvR6wQQ92pN3G:ZTiLljBb5+Pl6bJTIZ5jdgps
TLSH
T15F85F295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 959dba7d738f916b5de955e0b249d47784bd2916e2d6fd3940eb231bf5a91fc7
MD5 465da15937840cb77d2d70c0f966736f
SHA1 cff2f42ab3cb109a590054c066aa4e4b388cc1d7
SHA512 3c366ba8e70fa43b339ffb94b72c78ab56a1710a0ee5b349cbe106fe750f1be402a73339b3943e519fea331ad1cfbccebc2dc4e0a511bae5f83b1f3be3ad1daa
SSDEEP 24576:Z3Ud9CHKy7GZRmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:pUd9CHKyaKb5+Pl6bJTIZ5jdgpa
TLSH
T18D95CF90F3E410E8F0B79A35CDA68501DAB67C5A5B61DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 8e8b6835f1ddc60daf60add05201230a7a2ac9af6390394b3d95a01c01328453
MD5 f853317933ab163c67ba2b8f283c10a9
SHA1 76d3347c8510caa88c767f7066ff47802b7607da
SHA512 8ce7a534e6debbb3ff11492139a1238d9f87c001f0dec3baf5eb2b4b6f16db8ab28833e4eae8941b398a5c37afe93c0d8edf76bc3b6ffcd7bb2a38b75094d93f
SSDEEP 24576:e9mb57GBiOl6a8JTth/RWZvR6wQQ92pN3b:jb5+Pl6bJTIZ5jdgpB
TLSH
T1B96523828D6B20CAE09B5779D9C9DB00F879AF97DD8627B6C57D042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 9387cc628c90101fd9221caacd9ae54625eb1081bacd26aaa0e43fd3f4a05e3c
MD5 1985a4bae93c8dbafb0b238bf1f601d3
SHA1 8fc8ed284da4037e8de24e8353ca4ba9f87ba3f5
SHA512 ec3636588afe832a02ab40e7d4e39d2ffa1d2c013e68559b88a9b4ed6597d6a65b2394caf3cf8e179301a025265043640acf85cdd5b014033717e34872c951a6
SSDEEP 24576:ULmb57GBiOl6a8JTth/RWZvR6wQQ92pN3j:vb5+Pl6bJTIZ5jdgpZ
TLSH
T1856523824E6B20CAE05B5779D9C9DB00F87DAF56DD8727B6C67D0827F234789381220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 ef0d3ccf08da43d61ac8e46fd5483d3345cd9816ca2f1a9145e22721dea95129
MD5 159232a57fc32c8de086feb7f251541e
SHA1 adc47f0adf9aabd097f12e08763347ac26452948
SHA512 b56a069126337cce87b7e1e8e995a0c0edc090ce4e2cb2f569692b57980c2612a46b50567c3932b85d012c8ab90629f8394cc66906acc4c58cc70eb1594c0ad7
SSDEEP 24576:Q2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3N:6b5+Pl6bJTIZ5jdgp7
TLSH
T125652382896B20C6E09B5739D9C9DB00F87DAF97DD8727B6C57E042BF134789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 90bb3b34afeaebaeccc4391b94f699cc4ce0ddf5806e28699712b343d27d8b93
MD5 ce61327a282fd36b8e8775e230e79544
SHA1 6c1fcd9951ae7ad7be40ec26c513d5b149fe731c
SHA512 c235e9282cebef8d3af86b19fb80a9ac0103585ebb9cc8c8b82f5551becb752ea05c19c7a5c15e6c649781014e45a68ccc8be47cf4c304440892a3d799986e8e
SSDEEP 24576:/wmb57GBiOl6a8JTth/RWZvR6wQQ92pN3P:fb5+Pl6bJTIZ5jdgpx
TLSH
T1EB652386896B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D042BF130389381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 5c261e231f4eaa0a400dcf761a3d73746f13e203049b3ae7e451cb80b2da29a4
MD5 0d584622a904d1c10c2ac99b394a25d0
SHA1 d4f90ac6e83f0f0a68af68db8e8cdf6a9ffc8e96
SHA512 7142c24df60e6e89ed9141dffa63dbb3033137a1b5ac6220c5b05af7deae68ecb828c6e702721254426825f9d25c077868e8f58cbb5fdcc74c749560f2c7cb06
SSDEEP 24576:W9mb57GBiOl6a8JTth/RWZvR6wQQ92pN3L:rb5+Pl6bJTIZ5jdgpp
TLSH
T1916523828D6B20CAE09B5779D9C9DB00F87DAF97DD8627B6C57D042BF130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 3d18febbb8e0bf3f6d28870a4efb87709384349fcdd24566aae707a079e0cd24
MD5 1c76c835484f5d5609d070a3d6dcb2f1
SHA1 0de9ad7d406aca130500e8b7e03fb34c614e7cf4
SHA512 c6e494d2231046c9b4d341903aefd49f7f4a818b6ed68eee82a5c832ca4da57123aa3dfb4477cf484cfa61faa4537fe5a7401da4e3496e5d2900f1e8dbad3faf
SSDEEP 24576:Domb57GBiOl6a8JTth/RWZvR6wQQ92pN34:Lb5+Pl6bJTIZ5jdgpm
TLSH
T1356523868D6B20CAE05B5779D9C9DB00F87DAF96DD8727B6C57D042BF134389385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 1b59f7ba4974193980889bbfc8389ac4b6976f50c9fab36aae24573829989f99
MD5 b5a8e91946f4ec866c43fd2acaeca44c
SHA1 1f1e7966dd2d57644d22356b18aab203ed25d012
SHA512 9f2176d5fcd314d50748b8fc8a785046993ec6e0e9d624ecef2dd3ebd7d8bf23cc037172fb02c52d0a2394b1096d22dc481107d26a5d5f26da740c451308ba9f
SSDEEP 24576:Uymb57GBiOl6a8JTth/RWZvR6wQQ92pN3l:6b5+Pl6bJTIZ5jdgpP
TLSH
T1426523828D6B20C6E09B5779D9C9DB00F87DAF97DE8727B6C57D042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 c9bab8b97c2fdfffd53b6c23f46d28ca3823e63913cdb059288940b85434b616
MD5 37023ca21fa2dbe9726473d0d181732c
SHA1 47acdf9076fc1290b6884260b2c04ba1d048bd9c
SHA512 e35ff76672783090178c93cdba79d031420a8eb18143c3da8bd908a610d814b3177ccd00411be8b646c42130a6454213cc8c7425c436277a48d20671cdcc5e22
SSDEEP 24576:VFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:ab5+Pl6bJTIZ5jdgpQ
TLSH
T1376523864D6B20CAE05B5779D9C9DB00F87DAF56DD8727B6C67D082BF230789385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 e84eb5917415dbcebe5d24579d9f5a1af96c5f5da44c344cf0908a51c9696453
MD5 8f2f375f1eb7896edf1fd1f092e8cc5d
SHA1 8e06d921803a7540edab86fc5ebdb2c962281aff
SHA512 225386a91dbfc6b36f29ae7c6278c3fd84fe2ffb0b8c5981b95ef870826ec5c7ee56edf01802cc8b6a24f07b6e322a6957eab06cf5a0e74f4f998f028c1be833
SSDEEP 24576:mymb57GBiOl6a8JTth/RWZvR6wQQ92pN3N:cb5+Pl6bJTIZ5jdgpP
TLSH
T1BA6523828D6B20CAE09B5779D9C9DB00F879AF97DD8727B6C57D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 1c1f8f4d0048f603d7baa4393bf53391aee970cba813fa39be25252867b1ccd6
MD5 e86ea3eada4089f2f93b9ea82c8fac7f
SHA1 be2a6c315037f6e5d66682cec05882bc8899377f
SHA512 60a215a3aebd228bcaa8a219e896e7592978128383a59feef1851f2b8bfca2ec2b003eceb0e88b1eb71dc74bbbe9fa97a4e931fa42fb1fa187e14a70f8bcca83
SSDEEP 24576:gfwvhk9RX6wkyAIsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3l:hMnYI7b5+Pl6bJTIZ5jdgpP
TLSH
T14695CF29EBDC04D5E0B7923C99E7460AF6B178595B31C6CF026A536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1cf63cccdbc95eb716d12c6b815b2c402e960ffb2b4658969fbea87b22468d8a
MD5 121683c2b4b3778e208708624f5a3d24
SHA1 3793f8d7d3f0be76d2c9dda23f8ab6720313b794
SHA512 bc7fe4f69584af7b38a0e50eceedee433e416308b3f374a1c315e9c9120d24b903ec3c0a780cf192866a4eca72ae5cd13f85f757b534a97253683cecf3b60baf
SSDEEP 49152:7YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Eb5+Pl6bJTIZU:GySzPKslgJTIZ5Bgp
TLSH
T14E066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9acee4a139cefbddd9411d6a08f885a6d054928158e6bcfe8c03f3251dae4b7c
MD5 0ab3216ee98df5cb4942c1194ab414b2
SHA1 00a6d4c79f7ec6e7ae4ba382d1bf129a5650f051
SHA512 f7d934e8aead786a72a2d5ce2027737493cebb257b33453110734785eb2e9b908cb8a0690c5bcaf48c5360931cccc5ebe62b3307b65e39376765de8f739f9967
SSDEEP 24576:147Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYvmb57GBiOl6a8JTth/RWZvR6wQQ92j:147JUQjqirIhCnDHUPfF/0b5+Pl6bJT3
TLSH
T1BC65AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 61fb9b60628854ef9b8182aa91ab492b70a7e192d7add90d9d6c9beb23d7fc23
MD5 840191f9564ed2684d6434dd0bf98a23
SHA1 7a0d596c0b99690110a4bd292348dd7a44a033fe
SHA512 614713ad2df5eeea51e78846bbb314106915fb6f98795be6c991329e4501f2e1bf06d043f0bff4ba3c930dfe9fab81ba4041860a8ec54f4f9758c10800a68167
SSDEEP 24576:MAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:Ab5+Pl6bJTIZ5jdgpg
TLSH
T1D375F14AC29811D8D06F6279CB858A00F7777D658BE193DB46E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 12c14daf982c97735c4ce7412299cb6c6567e21d2e85ac0249ba4eaead976e19
MD5 9914bb1f72b9a13557b9d209c5aa8619
SHA1 043f5feac37ef4c843ae30f6db6b510f48978546
SHA512 c5a33d37004ea3d5b459673bfd522aab90eafdc2d6259e68b3643ddc6538e75dfd698c8ec2e4768258e27fbff7836b033d134a8eb6f2ad9c8fcacb9948fe648d
SSDEEP 12288:mSctzAU3fbI6HcJAF6i4SQjNV2O78BfFFOZMXj:mSctMUPZc+UbSEVg/FkMX
TLSH
T1C0253850762AC75FC6AD40325E33C2CCA7707D11EE05AB0772C8972FD576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 0be2356d238e323fe7e7e86d6d6690669615399f8e68bf980350ac8c7160b4d1
MD5 3a806c0cad274ca4f9dc22595ffb03ae
SHA1 f5fc5d61129a62a84ed1bf37ac2220859f285293
SHA512 8d93da5df122c2b5f69f988007204e30ce50aa40fd1d302f6497ce2db0f75be930e46a56c1b48017720b59fcf144bd347688b03b1e0bae36e52cfdd59c6e7f31
SSDEEP 12288:wTlcwpT1nPwmOcQS0VwV4+KuIX8u2sAA6l89:wTlck1nPwPtAhw
TLSH
T1A455C6815137E38FD1FB6131472A5B4CAB64EC06B3095F277388093AD86AB65B1BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 087d312e3514eb43becfe0f83143d96f6bcba91c8df3bb8dabae8c6e23ed14b3
MD5 e30b19e34ff4a97368aebe868e2a41c7
SHA1 8460d86e70ec3edbf89c39519354b6f731ce46f6
SHA512 0a0849ed176ee6fe110cc3a59ae8def1358153167d4abf46414824f97ff07a9cc07da8d056d7a021b12ef1ec066070965b17608045cd24b36ebbe18730faaa1d
SSDEEP 24576:q4mb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:qvb5+Pl6bJTIZ5jdgps
TLSH
T1FF6522428A6A6486E4BB5778D8CDD710B83EBF65CF8566E7C529142AF1307C87C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 96bae79997f8da1adac76c81e19995912d5fabdebdd8768abadb9dc4a9361861
MD5 c19d0b850141f487a4dc499ac852c85b
SHA1 c22e83c0f471c9ff67412e27ff8b4f2e93f42be0
SHA512 78e3a0bb750457d0341b2a7c0db7a40a0c265661cb47f600dff73fca8d61c32dab14afbcd6549f57c840699068dd4bc6dc5c146485c83d0a92984caf8ff44364
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYemb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:Dgb4mBIBhGFub5+Pl6bJTIZ5jdgp+
TLSH
T1EB659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 9c8bb7169a1e7c40e7bb2d3f2c4b82d6a09c68b138487ca8a5aac653f1ce13a2
MD5 10dab7a3bfcd135fc57ed9af60c5ca4e
SHA1 cf000971ad41ee2c5e93268c8c9b475a82806735
SHA512 ae4d5b30663853370e63581bdbb5dd23b30b461ed38505899602bebe37146373d5b98b0ecdca403ed1de86c97ba78187502b8df10d8abdb4e71b19a90025f248
SSDEEP 24576:iG88u8FpJqH1ozria7/m/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:57ZFPqVXa7/Zb5+Pl6bJTIZ5jdgp2
TLSH
T1C795F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 b07bedcd5874fdc770135aa33982f6fc71287cbf1ba137f1bf3bba8e27c5d349
MD5 5053f754d1a280d6ae083ab85bc2e56a
SHA1 9c97f12d62981b46eac04d8406703a60b64fd3bf
SHA512 a79f68614191da06fc8267b063ab25705069522a0b2affc52c28c08d1e42fc302a2a5025d25c94c4ce53283cfc9de9da6ec1a542ae3dc81d60e7f4553af4d5f2
SSDEEP 24576:OPUr+NQzmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:OJQKb5+Pl6bJTIZ5jdgpL
TLSH
T14375E11F26AD18D5E67AA17DC9C68709F771B8624712A2DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c8530e4dc19f0fb86d5b247a0ca13ed5c564f8daa6737da2af71a0ba5bb4f951
MD5 8266ef9dc7f58959b2dc8fc6360873b2
SHA1 700446e4e86c5548531406eb8bf5674f55aa31d9
SHA512 85549a2913f1356f06c72593c5c808af0b86600b224dbf37f31d8285214945a871248319b58f8967b4aad4857f05154616438e74c8c671b572af05ed98ee4e16
SSDEEP 49152:8BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjab5+Pl6bJTIZ5jdge:fG05lO43bXslgJTIZ5Bgp
TLSH
T157D5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4d0d9c6f289432d2263ea7c6639e4020725b73a48a2ade22834329548dda742e
MD5 f4417051a02eb5bd69e3b07f6422308a
SHA1 57b5206048c10d22ce992adb3133bf9fe8c582a6
SHA512 a532fb8d513fd34600a973732ade9b1434ba7757be7ee7bafe10830e750dd07b31fe3c49161837ab89a028a470adda2abd923e230f46240aa6fb9622a9d2c7a0
SSDEEP 24576:Rfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnJmb57GBiOl6a8JTth/RWZvR6wQQL:xa5POZ3lJt2pasx2+mCb5+Pl6bJTIZ5h
TLSH
T16865AF5EA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8d84dc06f9d11281931db55b2c1400805f42cef245c737a83316bfe23dd9d1ad
MD5 d71e7f4f529978421acf1cbbb6ce2e57
SHA1 ac9bbe4ec79c3981d7d01483fca8008c3d060470
SHA512 b7779afc7498b92577c41d9aa84741f1dd8fe2519109a8f3b1bb21170d5b57ccc44884d5259f9c9156f2b51bcfd73fad3bfad21f88894331cc960cdf70e63bc7
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkHmb57GBiOl6a8JTth/RWZvR6wQQ92pN3K:ENc/zEOVHF5b5+Pl6bJTIZ5jdgpw
TLSH
T1DC858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1cf4c5f8c7ac3746502e7d65e46de51463de28b044de2dd97b4f713f9d638442
MD5 329db8476ee797d349bf5034624390f0
SHA1 124910bbcc4b4b478a1c942c5502136648be219d
SHA512 6eeb4834aedb2e668c60a67303ececf2cfe3dbef5e27d81d578db8f1b57b2ad2e142c63839109b26a0cfce48ee6a1ef6c7983e0c2ac70f6522c1730694b79cb6
SSDEEP 24576:EzkNvNnaFeYhJNtmZBmFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3F:EzMwBtOmIb5+Pl6bJTIZ5jdgpP
TLSH
T10955AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 c67cd1a509c65053c9ace670ca78e35ff3ddd9dc00b7d1ec2e477cbb4092f4dd
MD5 8c9c427e4c6d2e9fd2fe0fb60c50704f
SHA1 19e3f14347e85c7cd05779cf36ca1e944e729687
SHA512 512d752b8139c3b501a3250588baf7bef83814a426747fdda463e5c3e8c7cc25a5f34e8a58d73615acab357d7420b2d717c17a257f6abca2c741bcdf4be113aa
SSDEEP 24576:TD3FHshBIYQgA0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:TDVHeBIAADb5+Pl6bJTIZ5jdgp9
TLSH
T11385E17ED65D00E4E47BD27CDA938A06F67138A9472266DB02D481BA5F2BED43D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1064-451-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1064-221-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1064-215-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1064-213-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1264-243-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1264-250-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1264-468-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1264-244-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1408-154-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/1408-161-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1408-155-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1408-304-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/1444-177-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1444-370-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1444-178-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/1444-183-0x0000000000980000-0x00000000009E7000-memory.dmp

Download

memory/2080-226-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2080-99-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2080-114-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2080-110-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2080-108-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2660-465-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2660-201-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2660-450-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2660-462-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2660-208-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2660-202-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2664-145-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/2664-139-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/2664-152-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2664-147-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2664-150-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/2748-239-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2748-241-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2748-234-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2748-227-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4564-187-0x0000000000400000-0x000000000061F000-memory.dmp

Download

memory/4564-6-0x00000000023D0000-0x0000000002437000-memory.dmp

Download

memory/4564-1-0x00000000023D0000-0x0000000002437000-memory.dmp

Download

memory/4564-0-0x0000000000400000-0x000000000061F000-memory.dmp

Download

memory/4564-7-0x00000000023D0000-0x0000000002437000-memory.dmp

Download

memory/4564-375-0x0000000000400000-0x000000000061F000-memory.dmp

Download

memory/5052-188-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5052-195-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5052-388-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5052-481-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5052-479-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5692-337-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/5692-167-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5692-165-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/5692-173-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5872-28-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5872-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5872-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5872-32-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5872-200-0x0000000140000000-0x00000001402E9000-memory.dmp

Download