8759df24174ed6bc8b8f7b09fd54a448fd151e94241703ca290cd3ad52ddf24b

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.4MB
Sample260804-wtwhhswhpb
SHA256 8759df24174ed6bc8b8f7b09fd54a448fd151e94241703ca290cd3ad52ddf24b
MD5 c9640ce801942e7efccd382296268e5d
SHA1 f84e8d25ddf7582d197698b8f7a19c5b6a2dc6e9
SHA512 ed2b153f94351e2610b30e73f2dd5f4256b1c7f4511c5e763289f3990f62df495d316af11e6e415d98d4d4bf42e0ca2fc3c0ea784adf77137c67218587e6fd0e
SSDEEP 12288:DUYJ9bi+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:QYJ9bvnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T14965013576C0D4B3EA73053108E4D6719A3EEDB25F609ADF6384276A5E343D08A397A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2732	elevation_service.exe
2200	elevation_service.exe
1932	maintenanceservice.exe
4980	OSE.EXE
296	PerceptionSimulationService.exe
6036	perfhost.exe
6048	ReFsDedupSvc.exe
1368	SensorDataService.exe
1984	ssh-agent.exe
2148	AgentService.exe
1716	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a53def35209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7e8103d3d24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000291d3dfe3c24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fd41d003d24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b6a263d3d24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe
2732	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAssignPrimaryTokenPrivilege	2148	AgentService.exe
Token: SeBackupPrivilege	6048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6048	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6048	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6048	ReFsDedupSvc.exe
Token: 33	1716	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeDebugPrivilege	5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5200	2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2732	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 8	1716	SearchIndexer.exe	100
PID 1716 wrote to memory of 1192	1716	SearchIndexer.exe	101
PID 1716 wrote to memory of 4508	1716	SearchIndexer.exe	102
PID 1716 wrote to memory of 4444	1716	SearchIndexer.exe	103
PID 1716 wrote to memory of 3220	1716	SearchIndexer.exe	105
PID 1716 wrote to memory of 3208	1716	SearchIndexer.exe	106
PID 1716 wrote to memory of 5864	1716	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_c9640ce801942e7efccd382296268e5d_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5200

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2200

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1932

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4980

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:296

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6036

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6048

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1368

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1984

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:8
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1192
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2996 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4444
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3220
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2996 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c5af5dca247936a76759b665a58e8ae0afb6335680f723654443bc24798df54a
MD5 690856810ba56ae2f0820bcd3404a95d
SHA1 a98f0d685961e39da1b7320d6fc213d07977d103
SHA512 c1fad460aad69ff3e2fb923e829ab1b44aa21cf72440216cd04b0d3a5ef58dcb8aed1dd07fb73044404e632a1a4378d61d55cdc26a04218ea348e8b90222470b
SSDEEP 49152:Kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnZQ/lFTjN4:83q6HjB9Lm
TLSH
T11BD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 f8e03bb77494d0c59525be750c44fccd8d818c1b00ce20120993763140cb4f71
MD5 46bef02c4bd4915bd2059d2588e04767
SHA1 9c88f2c023ded4e97c02b566614fc0839f189d1a
SHA512 d28c28d48b6ca484799300c58b47f56b57733d12d8c5a8180ddb007f79e7472082bbbe11adbd7a68f48489ed378087f71e51967bd45bc6b34611c731b8398088
SSDEEP 12288:01XLsswWkxy2lRq2czA+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:SXYfDtczA+nQ/tbw/2Mkjy6Fr7g0og
TLSH
T1CC65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b92ef86025b010f3da4c62d0a5307564e74b47907f9fb2b060f839d53e797faa
MD5 6f19dc1e393be3c6768a99445ada26f6
SHA1 9ba13b910d45659cf29fa88647b259a753a31218
SHA512 d8ed092c9c0191751627a800aca52f77376f3fe9465223a9e8a24589bd6c234bbc678cd09091e5a0d5cebb53288d6259829f77a06b6e06184fd3e1b54fe24d16
SSDEEP 24576:m0Le5ji0hmxLrMRnQ/tbw/2Mkjy6Fr7g0o0:mPji0AlUQ/lFTjN4
TLSH
T1C8859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5b379a916335df7bb687838dedce036bb898ad5b6e7c1a868504c58e11129eab
MD5 81fe4e474ee01e07f26476b454c941df
SHA1 bfcd31cecbf5895abd9f06da83348059c8353116
SHA512 ba7f3026a98c39be710577e678d6d171eb1143a7778ab5d6ae625345c505ad0c3eb80673fe14419a04936c6c8a1c3852c67853260244723628ae45c7d07b3244
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyubnQ/tbw/2Mkjy6Fr7g0oQ:+/ezSC6vUzPvxHjygQ/lFTjN4
TLSH
T18E755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0a17358fa57aa78d369c3d61b3afe611e5132b2814dcf3915233141089aa4e6b
MD5 48c1366f5aa5a981c703d34f1d869a73
SHA1 9aff923297abfef1cd6286415a89c2f1d44e0c92
SHA512 c3564b0c5ba48e880709c8492c582f61575dcf95a68b1a92d524031bc8f5bc45f43f031da3fb2fecf9eeaa89fdeb6c9a4368bd0a7c91413315e0566a1e85bf88
SSDEEP 24576:xVbqPb88hv/l+6inQ/tbw/2Mkjy6Fr7g0oa:xVO88hXl+NQ/lFTjN4
TLSH
T117559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 dc6861aa37374d53be1e4c50e1967b7fdbceacc94b829f07d99546fa081076e8
MD5 b989f9d9b8062eccb6d337c4b5f42ca9
SHA1 001c7d6e6d96f4d045b0f245a1958b86a7e17a0c
SHA512 0799e7127ef56a9f67f3627c7730d1ac1e7d86b4c4579b3dd42206b040bfd6a1dd01352a063f4d142e99e63bf4b45c1dac5db3c34a98bb49bea6907e68b56b25
SSDEEP 12288:MzVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:Mz1nQ/tbw/2Mkjy6Fr7g0oR
TLSH
T16D5523796A24F897FF2B06B15CC285826B7B0EC1BFD0A74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 13690623fcd6f648f12560e3700c713cafea688b2cf8ccbc1cfe4bbaffa76595
MD5 a68f433a4b4b1d8e31e30087b19fc9a1
SHA1 00c6d8aa2bbd75f606fde6ea10d25dcf74fadc26
SHA512 14dcbe2762a60bd1c9e9279679ac1a77fa54ff366f21cf1f1f2966b1246534c912d46d03a41cd4f96261a469a62fc9f9e89d576f7a34eda3a715e870509bdce1
SSDEEP 12288:teBNUbTVO86UaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:tJIUanQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1F875CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a132155954868ff5995e498809fd45383d4d00c4f7d55088940c300c6e5fa024
MD5 9ceba96108692ed8330371fa7bdbb824
SHA1 3566425ba1a1db2120c13db322b5d9fc59bc991d
SHA512 e600b8400e99c215afda837233a7e332f165aebfc1ef2d4dbf0d173d015be415b73cc10a0b9ef3a77ede75d874f29b702e1eb86e70499dda568cdd513dab5f7d
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THw:UQvGAdlCEL8c/yRNw5CALm
TLSH
T13F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e2cfec30c88b1a09dd215a6c358c15e7dfb8d2fc2ddb119fb3fccc654baeb242
MD5 6873acc3d3699d5064d848d79204e803
SHA1 44b80be84d8c7a8a0db0370abcc0fdd2b9b1acfc
SHA512 3b05277f260537a9f6f423fe1b1871b8b4b01459e61fefc2bec9e2972faa1740f4edeb7240872308c6458257872642ef68d4451be1faf8fcd5b88a9db0bdff1f
SSDEEP 12288:RAwSfxL/2Dc39DLLmt0LDQewsAjkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgO:yQewsAjEnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T16375E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b14070baba33960ada6431421763d3b62080d663c033896f0a77ee21109a316f
MD5 07103d8248265e842d30e88be42e57d9
SHA1 fe961ceb2a83c08681701afa85c5e98ec646ff04
SHA512 198e6145d44a4bd6fe7507a658c4b9180ce4a20889a50445d13bf1bace861eeda5bd0bb25bd8380e5c84feef56059c775b50d9df950fd922d70ff5af7ce37d79
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHvL:RUEtQevvqc2W1cpV2EI32
TLSH
T105474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c65416018a50e308ba3cc13f594072b83b78544d2444b1c62fd2275b102d5a9d
MD5 c9ab9ad2f0e7c675ea11123e0e862849
SHA1 39e87de0053097b89882872e8c92d3e8799a80b0
SHA512 0bad5e6624160c6ac7faee1bfa5113fed87f7f8ac946af6a8726d1e24d3a6e1d3fc91b3f3371db28c59b745ce7ec8d8da5149b7a1399872a944d00dd76736e7f
SSDEEP 49152:0CbRquA/m2yL5zQfFiV+XenmE3/zkQ/lFTjN4:doqtVjnmcLm
TLSH
T1B1D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cdc0e65d79776faee97abe543ec6ed59290cc1b767403fe85480f2d9a533c28d
MD5 f3c61d262b3c08341f7194d707f51c00
SHA1 51d34fadfafc6c96d6d67b4b4d1cf515aaab5417
SHA512 739719d7d3869cba1f88728b567310cb0a0b240ee77505da62d05faaf44de8abd8acd18c856a13932d6883bdd7fe8d817624448908075233d1c406cad64acd53
SSDEEP 24576:AAhGLJIFoiwtA5l7S53XnQ/tbw/2Mkjy6Fr7g0oO:AAMyFoiq5nQ/lFTjN4
TLSH
T10035AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 379bf8372d0b2c04578a6071e1c94980592a1dbb97183d0582384c4eec7bb681
MD5 e9d067a7cccfdb73bb754b4a9a1a6414
SHA1 f2b082d0770af2de3db2bbf3757e7055a5fe1a9b
SHA512 63afadfe251f741f9d8d39b796bae2797b77cc9dc5ecb7ea7d60ceeae5f2a0c18aa6601e50de8921f4fc7a7e894591dd6e4a9b843fa22def8d8dfda0dc2735ba
SSDEEP 12288:imw5HEjsChN2BFgl0WDm+CLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMM:7wuHOWAnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1B765F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 56636fb1675d5057e3cdd7962d1b2372f47d7a7ed7a21ce11b53841c335ba3e4
MD5 58568f0b0068d023419d287b8826aff9
SHA1 19ee2fcbf59af0e499327b9769eb6e4fa8bbf907
SHA512 0dc1d4cc9c798e14d255dcd036cbde1e9ea72bbb282624d1b4b15d0f4274b5ea75ab1e435bec4f9687b701480e57fd00f83e85fdd373eadee1bec5d945cf0900
SSDEEP 12288:XXZ1IyUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:HZuJnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1B255126937A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2d2b28b609592bf34809b66a4839393c05b5b34d369730814bbed8ef0a3dab31
MD5 7c4dc535a416f88def98ab2d838d440a
SHA1 60e8bcf77881d304efa9a917f4186878dc454009
SHA512 2838aa2a36fc2632b6035e262835e834869bb27b4477ed0278565fde42cbb78e9fc63c23176a1d3eec99b4041e77306a626f8bee8c96c5ef3c2cdec274b35069
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:9QRQyi36YOcPQLvw2gAf+PN3hLm
TLSH
T11D666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d285b34023a6963b116e9a045a11d4faa1facfcca5d53aa7b370067c606376be
MD5 1b36a6c2b30c72f70e6569c4160129c8
SHA1 2cfb87c48b7ab220c7ea5929d3599e7042b1706f
SHA512 7a34f82a30f3ab819e3ee6bcc8a5e6a2bdb9cc4fa688bf6d303b2871c101fe54bf07a67ef203e05992f51fee88cd19b475c8ff2b1b6d5e1a6761fd784a6be7a8
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:kQRQyi36YOcPQLvw2gAf+PN3hLm
TLSH
T101666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ab329c5c0540484a437cd144a4e58e2041d56ce91dec0ba4e3c4444cb22c819d
MD5 e41ae3a3ada502c9130ee0a8c2da3c0b
SHA1 a469d7b88cfb6ec00decd48cd50033faaff78eaf
SHA512 d4634c8b00bb6b599cdad8dea088c2cabdbd34acf194a7bad2337643655bf40b38b69d7a46861f2bd5d348e0a6f8d8a82ec20b0b0964fcc6e254310b72548f49
SSDEEP 24576:OwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0ZnQ/tbw/2Mkjy6w:468Qg55nhheWu7PNU3/UQ/lFTjN4
TLSH
T121B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1ccb84e7ed0af974aaecae125aaa93073c6d98dfe5abd7f54c8057972e8076ff
MD5 260a259aca23bf060609fb5b93106998
SHA1 3ebc5eb39089769f411f6898170515a1d65e4ad7
SHA512 0196d157c179c96fdc6cfeba2113644518a4834949ecb2ec6af141cf86038c6c16572c4550c289c315e36939b53944bc90ad401199e84637709f5d8818c386bd
SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99q:Wy5112gYy5azzVvL69nLKnhZaLm
TLSH
T172167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f4c7e00e603e25f10f0ad4bc1893a6681afcb1faf6e36e813994a6c06335e16e
MD5 e849af536759df3f11ce68e5e90de072
SHA1 259c330eb6844ce2db29fb98a4b245d1f8afb71a
SHA512 9a5e06164b15d6e6a1b1083177ee1fce0398ce7a5a67e9c2dccaaf11a0437f217c6c90378a3b5329f268aca6984b37117177f87d354da04b05b2b7f0b5fef197
SSDEEP 49152:VB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glOQ/lFTjN4:bu6JmVxd2dpLm
TLSH
T1E5D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b8c5ca124d99bcd1de008cf520b5992547aa05f29d837e7dc4cef6f846d7c1ea
MD5 83bda450a7845e46327c44dde7c179cc
SHA1 b16f15ddfdeb4c9d37ec0802cf823a99b750c28e
SHA512 e4f34fc932332945af89dee408d6ac702a5b83d5e676ac3c4d51ab5545232d5808fb666c7fc6770997e813c81ef0ad04b8e73e9666464a0cf101c7caf7d90e5f
SSDEEP 49152:D1hpsNoJpF1A6UU44CwH7R4x6Q/lFTjN4:DmifPbRcLm
TLSH
T1AEB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 40bee26ccb67aaee87a65e1c6f6e667a7c7305051c44d98c5fc52ae6909261a9
MD5 edee040c06a8e998995c67175ed7b780
SHA1 78fae08261b2fad3cf40d0e75e8d5ea8eb33eddc
SHA512 b29c832535e28e3b09eef527e36db8d778b4b6d9f9c2f611b3ea3f1567fd48ab88e691301151c5e0aadee6977ace11d8b809e620b43bf85fbdfd7d8a909cde72
SSDEEP 49152:FSuZQIY0Be2KRRVtOnks6NMHqJQ/lFTjN4:L5dKTi61+Lm
TLSH
T186C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1b60c7614c6a648eb4eebd54438db9d211dff05e80096c6109c6a5437616d5fb
MD5 c9415edc67e1c5bcad23c098e5f2a5b2
SHA1 0ad19610d1cba3854d35f2365d42a25ef084c691
SHA512 fb1a3f3af16b3a95f685242063ab725876e1cf5f80caafa1c5fcfdd47f1ebaa91cc8c26a90d7f1865bb90db87cfc2fe369b8a0f9e417e8dd138398f4d66c562e
SSDEEP 49152:LhtSn8EApI0figngiDn0AP5w+Q/lFTjN4:KX2iyphYLm
TLSH
T17195BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2e8a3f772714893542c84c7cb2b124262ff05f2d853e540c9d8ec9cee38e6077
MD5 227536d262b0320fdf0097a1b9f8c50f
SHA1 621931d3993fc8069ee48fe7e8ae612b7446d2f3
SHA512 c623d5274a420e5ec8d2f1c4fa143daa86f970feb47ce2a91e885e447b1ebdda034758721c8a79ffc767a740e0de92580c0d0ae481837f6e85a934aca55eab4f
SSDEEP 12288:ptGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:pNnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1BD5523697965F98BFA1706F14C828182A73F0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1c0050d52cc1c02c00a6655b60f0502f7c156468cf9e70df0d127d0c2e7de23b
MD5 343fe2db2a6a72a50cba9c0b25d868b0
SHA1 db208d27c18b55d3566803cd96bf39cb029a9467
SHA512 b22f252c37fc27faa97255dde4d7bb10d817bcf7a9b0c0110c84fb308270485d37d103f79c143a16b344a42b1a141cb35c71695b56d7923ac1019a35156eb560
SSDEEP 12288:6oGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:6onQ/tbw/2Mkjy6Fr7g0os
TLSH
T1245523797965F98BFA1706F14C828182AB3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 90d3f69538a97a1b4f1519477d098e892e04ee506ba529b52b803746a197514d
MD5 74470b61d042c1f31397d2237a6efd02
SHA1 ed3c1339e930ba5b33640f1904b038cab60c8d8a
SHA512 89742f6d3a48c0ee331bc21719cc284334686927e7fe9587e676b292f96307de477a0f642b5d12c42a2dd909b3069384aeb8bdc476fd65f4efffaf7eb7b524fe
SSDEEP 12288:ryGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:rynQ/tbw/2Mkjy6Fr7g0os
TLSH
T1795523797965F98BFA1706F1488381829B7B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d043ddbc7eadd79f6da0bab64f8dd0e2ab5d79c6e78c596d88274964e8d18c01
MD5 16a58142485f566a22a239b55d502995
SHA1 5efd3a86bb42a5674a0629e207671d59ca459ad7
SHA512 ac4b2adf8363ab4e95e17e1f04ed93b7638c7365c1a51204b3400372df550120085a12c13751ddd6d5c6e0d8e7627a9e34665aa5151f07388ae4c1a0e13871b5
SSDEEP 12288:LVXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:ZnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1EA5523693B69F4C7F92742B4CC928142E77B3DC5BBB1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7a2307d1b1941f36e29c996971ef9553140a4e8070c91b01ade59ce977f76137
MD5 667d78e9b9a381e5384e2bc4e6bb4ad4
SHA1 789d1cb310af12ddfb92727aeafa480484e5e9f7
SHA512 3c612cfe4388c417238622ba652b6879f520435fc2c228efc28c888373dc898b4eb7638bfef6592aab2dc56d54c449c2227aadee11a3630aa3653410ef3dc7a0
SSDEEP 12288:rfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:r/nQ/tbw/2Mkjy6Fr7g0or
TLSH
T1C05523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c01389b87440c96c944b02d20ea4a5a22e89b6659147d716c66e79e9ec687c18
MD5 1baf9d82b11a86f96060df47d2946aad
SHA1 2dcb33da302eba706735d710a4162aab9b659422
SHA512 d863358aaefb6f7012c5fb72d5a1e5a37774f626e435f1eb986065d729ce0fdf8a9a0d18d7efcd572071987b9adaf57f5ff4414506286b3e53ba2d097643f18d
SSDEEP 12288:18GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:18nQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1735523797965F98BFA1706F14C828182A73F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 df49792e97c0e8518638e35a0f892c572a70be49b357a238106ec376193cdeb5
MD5 1be82422605827b06f0c018850abebd3
SHA1 709aca577ddf4004f9e8b7c19ae6c5450dc8df12
SHA512 3ac63a6cb8e908bf1a3b1d31270ae41bbee187d9262a385ef4c367c45f04a804268a33bfca6c423686816c55a9b08022d22e822d928f9a348626b816db35245f
SSDEEP 12288:xwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:xQnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1B45523797965F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481129967C39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 47856d3d1c7dcda953d8e942749c2e240db03cf164fb671d493d8ca89a65d0e0
MD5 5a3fa25a04b316e47986b052e0df8d72
SHA1 ab0941ccb60bd071261f99f19d723f77fd3cfe3f
SHA512 a8d3c0b1a49b0d9e1c31a364a290661ee36be7becdf1ce0e3154754acafdb3504d6f4bf985cce78df6f49539e250cb80c3184f258b070aabb132d0779f999592
SSDEEP 12288:ViZwbDzzFEoS2cPvyIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:YZM3zFVSOInQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1017501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 19e32104521933a9079628c7cfaa0e94f2cfdb824fb3ede6821fec40341c6433
MD5 2657a57eb2ba30a9e59e4680934309b1
SHA1 5a5724a2172935abd69ea05bf1a93ce437de3014
SHA512 9516a83cba70e4e5fb7892f1ea2921de96c151cf56c3910ebfdd562331b178f2474edad5ca814160877f387f92b6d04a504d7c43c43ae4debc3640da17b60d4e
SSDEEP 12288:gpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:g5nQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1405523697965F88BFA1706F54C8281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5fe469c629f305050a93c52092d3116046cca8d51ae9102fb1f85c449b58ed94
MD5 ec3b76a75663c7d98b56b2b48fc2ebb9
SHA1 c131dedd62ec0696d899b945c79a1aa1b9ef86c6
SHA512 9620b97958d3ed8a1182f365bccf44184f019a0d96b9495a94a8b304322a1fa5d7272d7c512e252aae04751471542c8e5db968328b12cc93d7889621e2053a78
SSDEEP 12288:KFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:KlnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T10A5523797964F98BFA1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 080a9e0253fc69f74f670e122f4906f50164d04e3d1dc8a829bc69a1c4c89cca
MD5 0532a2d90b4577b1c9e81ae2b86bdd5e
SHA1 7bbd0f3d17becc93349b739f20755b9e9472b385
SHA512 f98cb56d11b868009a59c55d3bdb15e10f7a947eae542b07e34fd6f8d1d1c5561ef435ad07f58f5ff8881192f92c0e825df0153bb567075ff07d253971fed257
SSDEEP 12288:iyPz5L8UGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:/zy0nQ/tbw/2Mkjy6Fr7g0od
TLSH
T15265021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c0d2911180c4b74974f202eddebfd0b720edd9c5628d0223ffe1b29c1268b140
MD5 4bbf2ffa4ad9ea24bb1e52973e319e02
SHA1 d32e4b4b00eb6085abf0afd791b41a02e2456d64
SHA512 45c0f65845f56f4f1cd2c654e9f8ffc3244619ebcf77be7bc2b461b50c5e429edcf6dd68a9e4f137a68615f874efb164f51099e17eed1b562e7bc2d3291ce453
SSDEEP 12288:opGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:o5nQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1A35523697964F88BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f8e27eb6913226f55f7dab54cb8b7ec4c12fb74b867e3c9a9997de0f4dd6d93a
MD5 55bc3985046860530d9cc1ce1232b76e
SHA1 f39eb1c97485a9424824f3cca25a6f2cf7a15a8e
SHA512 9b13b9de3d51edc92161a4e4e69dae9c239a26cd2cbae4f29cf1d0e464e2ed96b66b414caa55be35866efebfbfdce41e86144e5e0796a1d15c20bbba781ab815
SSDEEP 12288:upGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:u5nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1795523797965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 d187a53bbe352b9abdd63ac8227693d38d1aa07376c0233d667d57ac2415a14d
MD5 0fa9c3f2bb58e2c2e715ed79e289e395
SHA1 f5677565d921ae01d652efe066292e378ec860c2
SHA512 1a39e2b0b47a700ae8ada8aaee75984e8002bcc908a39111f429657693e7d1ee5cad42ab6c6974eed97a1eeb4d3fd1178c3fdd53ea56f118e158d3d9e82c3e0e
SSDEEP 12288:xyPz5L8UGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:gzy0nQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1AF65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 b304658396870503fe679800ade03108e82e655a39b7cd46ff7bc327cbfbac94
MD5 4a979acaa9e3ea8b83761cfc6ac3d21c
SHA1 e30639d87fa1f4d7cda275dd6a3c1e0bcc3d2f74
SHA512 365628326fc7d42e5cb20cd52780df78588427b6c42e8b618ddc0423e52d5f1dbbc00bf12daa4e8890351bb0668303ed3184a6ecd5b40df5f72a1e6624c53dca
SSDEEP 24576:HT0aLl3z0zDCnQ/tbw/2Mkjy6Fr7g0o4:HTDLljbQ/lFTjN4
TLSH
T1D97501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9a944e79d16dbda5db52b60b8b95d5577edee59542a9c029ad03366dbbd56e45
MD5 e721b0c6687e249d1b9cb86ed625d695
SHA1 2728ac4bceb801a75e8d46bc7fc478457d95d2e2
SHA512 c84571e1c9645cade8f98a1cc63cb76c8252fadbd952c2c234238cfa42ea19c199985961b1d9470f2a6251cf05ce322bb8e04220773289c32539cb65f312c897
SSDEEP 24576:N31d9CHKy7GZ2nQ/tbw/2Mkjy6Fr7g0oG:t1d9CHKyasQ/lFTjN4
TLSH
T17A85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0211e8cb1676eb048ce5a56112f780debcfdc5fc37da6bfe5e18ae28451d77b5
MD5 6690271792a29b6600e7852ed243e11b
SHA1 7400a5b7a74abf7eb54a2b55f24ce64add4ecd88
SHA512 2edb930e07ab8dce3a06f51cb0de399f9ee8060320e7107ffa8269364acd4063d016953853c31cb193901d357556f78de914b7202c7148b0b9f300eee70f4c24
SSDEEP 12288:4SGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:4SnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1BB5523797965F98BFA1706F1488381829B3B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 93881ac214d2782371e9ab6b8b1fe163c91b87183e4a0b106bae7668c32e0f4a
MD5 3bc8ddff4afe23422d551c9b04c59aea
SHA1 5bede8a7668d59d7b1c8f0cdcdf658b417d36ef6
SHA512 dd6556b38984c5f7b5b369087f301e4f37c29d175376fc8c4064511923e482877d79f4ac36624b44d7600ac238c077f6ab44514483d961eb6d53cdcde8cb39b3
SSDEEP 12288:30GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:3UnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1665523797964F99BFA1B06F14C828142AB3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e52b401dbf725d2b6a9153bfc6e94f97fcbf329550484537d19b5ad58a109df7
MD5 6ec48997673c46ea5ee49e4711d91673
SHA1 57507a3685795970d8c5c31480062d1259c9bcff
SHA512 43e2a43c72d69596dff887e768298acf643c3f188bc1ed9a5b53fad2387a1cf925d5a108289adeb0a261a4d126fdd2028405cc299b1faa5d508de175af5df279
SSDEEP 12288:gzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:gjnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1A45523797965F88BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0e72aab553d18e893529941f6f1f0c395bb2d9cb79170cdde2827c170cf31b3f
MD5 10b0fce21d0be247ebed23989ce140d9
SHA1 845283b7cfffb2ac35996e125b0dca2de76b0aec
SHA512 cb201a143ea1f6d5b3f38154d418d3147e844dbf022f4a71925b4f8844fcdd7918b6f0217efe5165af8811da53a2eee861b317c064a9da52b0d8b8828b5c7215
SSDEEP 12288:3pGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:35nQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1B35523797965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 8478baddfaac13bc1e2379681ba7cd50cb986d0c18bca2e32c1e29e41d1444ff
MD5 39128e8d3d869f6d63b589ba555f9b39
SHA1 b23906ed7335d0c48f9283bfe8ecdde23cf6ea44
SHA512 0cb030d0826a3e711b952da1befe71203e322f6754e455c1280ef823454310a1313998b17aa16a100c941126def49278f5c0155acd4027d7b8fc9fe145a7db56
SSDEEP 12288:sSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:sSnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1E25523697965F98BFA1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 dea9c73fd9d0f52e69396142aaf3d033b929e646866fa5f68252a86f53104916
MD5 6763cec0f7e165d84df3365ca56ee6d7
SHA1 785d9103a0b73f941a3fba53d4a4905431986fd2
SHA512 5b3d1cf79aeb50d90549bee396b374482703aaaadcc44c87898cb18bb1ec5b03d610d0acbe0001af575c77d83877345eda8d9d8a8fa50d054512247320420ae1
SSDEEP 12288:+RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:+hnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1B55523797964F98BFA1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7a6600616d348332a38da8f681ba82b766e82be58870b257f1c5c98e57dd2aa4
MD5 126b7bc0afbce0afaf785e58032d0fdd
SHA1 afe82abf165e08b257bbab2258decb4395959ab9
SHA512 1db698034e8988af59f404a4f0fa015fdef69721eba9933150d8a8b0941b1dd11c5c47b2ae9e9e1821b0485e2ab0b52daafc0ab5c3042f50d9da17af87f6d75b
SSDEEP 12288:pfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:p/nQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1035523697965F98BFA1706F14C8381829B3F0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 7a720473b9ae9b489b329c9ad29abcf74698f1c9a98680420f77d16a48e88f02
MD5 20b0a50c933040a6c32292e14dccd21c
SHA1 7e7e0972b4cf46b1d5743e6b67cd58dfe01c4177
SHA512 c49bb082b56461bdb3faf1f2c4fc231d96914a1b9515f7e6648aa08831b9ed2d1e00910dad0ff19022367b31ae85e90765ab80cb8e0f874e7028f5290025cb11
SSDEEP 24576:gfwv/k9RX6wkyAIVnQ/tbw/2Mkjy6Fr7g0o2:/MnYIVQ/lFTjN4
TLSH
T14985DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4cbcba68d520d069b345859890a0e32f0b5a5d64009f4db6b289ee63c216fe3c
MD5 68717f7b47ae5845ee3f6fbdf1ee06c8
SHA1 8c75cb2b960d06e6889b48a381bb2ab8f2d9b523
SHA512 3054d75937b5d23b50baa54b3231a0d40a2c399ab8fb54d453c9a918f1129e89200e40dca336f634dfd63b675842d9ae2cd6146763132854f8efff8365569ef9
SSDEEP 49152:FYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0eQ/lFTjN4:FySzPBLm
TLSH
T125066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 457002c7ba0cb91c21dbf76928425fdb73764f1f9e5aa930efb6bbd01d0db55f
MD5 51be83578a8aa026c1bbbbe979831bb0
SHA1 d9e43facdd68254e1e11254a1d83b15decd1fc1f
SHA512 8b9237bad9fc1ae8a3794ddfc3169ba989a9778ebedf247000e1b1863fcc93f979c30333adb7de7747a072cbaef00f3024279adf4ab8c9f6dd2567efc1452c07
SSDEEP 24576:a47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY4nQ/tbw/2Mkjy6Fr7g0o3:a47JUQj1irIhCnDHUPfF/OQ/lFTjN4
TLSH
T15465AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 6172df5742191cad5afce4170d7c785fa9935cacc6efe1f2e0bd1aa802020aa9
MD5 5e09cebcecc7fda6111c6c0ae15a3d4a
SHA1 5463228459b498a5de8836b58dcced7af8d24a73
SHA512 daec4794e0608e99650b1eddae56b887c87bcbd4f0b066da79285b536939c3b06217ddc26a38ef320bfb2daea25f0124293ee7efa6440cc6d6f3308de90c8ab0
SSDEEP 12288:Pssf5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:jJnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1CD65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 3d8f9bb1c36d6b110f340e68fbcce7bbe3bb69a0b4c8ca32e04160f0d3d7f3fd
MD5 374e9b05c22a3e1b165d1e499ea38d7f
SHA1 f769d1ff4f6eb63cffce0b820eb86b6ff6bcdf33
SHA512 fefaeb2aa9252ec7990216816d5011d5149425eb7df14fa555cda4410c876a5a20fa5dcb29eebcdac86492f010a83259491c7bf4ed730be15227b80089295eda
SSDEEP 12288:rxkVU3f2LT4ltBytWKoVr7fUQZnDzERMdOhu1B2FoR/x8p:rxQUPygh7fUQZDzERMdgue5p
TLSH
T164353851766BD74FC6A940325E33C1CCAB707D01EE45AB0772C8872FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 eece37ab7a14493fb2e6c7d427c8fcb1e12ff2761b200ffb75c90382fd68c205
MD5 0ab6553cf61d5812412744d40ce0cdbf
SHA1 35b36687a9c75e7b1ded4c0afa8f113c3c18fd80
SHA512 18cf1095eac6fa98eddc59418c800f2385bafb4d86419196d09e5b9315ee0942ec05955935f4e4a7848487208dcb31720e8b568da11590eceab391a30a5c7fb8
SSDEEP 12288:R2hRXnM9W+m0Mxnx4Bmz8kM4a1EKyyuhsz9Ts6p:R2f0WZNhKkY5jSpyuhsG6p
TLSH
T19355D7815537A3CFD1F76131032A5B4DAB64EC06B3096F27B389053ED86AB25A0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 376786a65016fe2e1d97c3eea9d2a6a70e37d11accf0e867275df863e3031075
MD5 101c0c4d76d6b005aca0db6a67e159f2
SHA1 58195598f5ef35de315574f1c2276e66e0e4c906
SHA512 562d4d9203d12f2aa1a49932c2917cc3aa176f901f0256abdb9cda276c3a70f292cd9f8127dff752e5085f5c00a0d015f2ae572f5b5fdc31ee2489244c17157c
SSDEEP 12288:667hGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:dxnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1CE5523756668F94BFA3B06B048828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 68530860eb423f6b31dc8a56690195c41a0f4780f50f45b140869628d5c72a89
MD5 6a07fe46a1570505ac443c5df0924011
SHA1 d9d5fbd8ee180349508787033a1946abbc697063
SHA512 f524ef4a583769268f98591574344b2ad35a97cdab0175040f294ee9dfd3452d1411c6723e8bb1feeadd69eb2fa64e50bc82af46d18b5994dec459e7fce1b603
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYbnQ/tbw/2Mkjy6Fr7g0o0:Hgb4mBIBhGF4Q/lFTjN4
TLSH
T1DA65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 621b286b758f4d13266ccb35deaca50294aca6b1f6d531665ae3478ed29157ad
MD5 e24ae2b97decfea6847906ad1031877a
SHA1 6aa840c97c73b39727def28ea8ea3ca49e2bc38d
SHA512 e2a1726c9ab92aca70f76d24d0eecbcab14df13ac573a8bfe26b4408eb8de7ccb9074083ade8b28701eac1526ba6ba60ce0e7a7464764e70ea816c97ff9cbc04
SSDEEP 24576:KG88u8FpJqH1Qzria7/mInQ/tbw/2Mkjy6Fr7g0ok:x7ZFPqVva7/DQ/lFTjN4
TLSH
T1DC85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 325a9b0b09cc2ec781b57afdacde8d506258dac9b9c55b068204caf15fcea222
MD5 938928e6884a04c91866c3c6274af5d7
SHA1 a31fd5262da456e87d672ec71d31f3aa2df1b77c
SHA512 81ce2ddc5eb29677b0449a47fe2261c72d45a5314cca5b38050c825556f59808f19598315b60c040e598d6d654b8c8c2e0527cbc1c486340b3c47bab0f8e2e3b
SSDEEP 12288:5HvUrBFrEjwaQsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:5PUr+NQsnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T19E65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 54bb5da23e12ac96bd5e556ce6367245172f09b7eb34e8910647f705aafd21b5
MD5 32b7181788c4269008ddfd350a21f32a
SHA1 277261dda9606612883d4e58c0d5f86dc43afebe
SHA512 258eb55e2f8ab711c02a7d9ca13e21d1f80d975692715459754fb10c7b83c8d65c63442f7858750b26604673f5bbfe9b5366839bd5e656efd7d29a6608a1fd7c
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8Q/lFTjN4:1G05lO43byLm
TLSH
T1EFD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d0f8bb13f901ba7d8c33e8e31f011b5bfa9fd2b6ffa3b43cc116f47db03a10f6
MD5 ac65f4f197c5fed70a934102db1dbc89
SHA1 3611535bb3cdb47a01c8453b336ceeaec47b4f52
SHA512 b979dd4f2f70cb9b1e306a2101b001df56558b854f7e1e3be352a469846813f90c2730671118be48db46d937c20bc95c7ab950c400e219ba7e2a03aa7fe8cb85
SSDEEP 24576:Hfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnenQ/tbw/2Mkjy6Fr7g0ou:/a5POZ3+Jt2pasx2+mUQ/lFTjN4
TLSH
T11B65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c633a2e7bd453d3c4e13d0725897e0a7b548686f4b0e73971758e280294331ea
MD5 619a63b035b89d4e93df9d147f56b70f
SHA1 82c033cb28d8e17e0ae7bb7cc6f61a2ec62a1a69
SHA512 224dda30c000770cce98559e5ba918714fa17cd97abb9a8688e8bff9b0f15e51108a7b867cde8f3d1ad185a590de7bffd80ca4e6b80c5005beccc29c1a7a29a5
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7FkgnQ/tbw/2Mkjy6Fr7g0oI:zNc/zEOVHFjQ/lFTjN4
TLSH
T1D9858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 220936bfbcaef5ae2be249494a42f0f6dde478e8bd3299792fcfd2dd13e02475
MD5 b60c21590ea519201d0942e5edb8b2fa
SHA1 b5420a152ed1e1314bf012dea2a7d35894fc8689
SHA512 e2016482759c529bb2c008677d3f5f484485055558cb26279bc838c8bca33ade04c100d70b999310b2fd40babbc527886269cabf32571bb1e1cda60fe5f0aa2b
SSDEEP 24576:D8kNvNnaFeYhJNtmZBmKnQ/tbw/2Mkjy6Fr7g0oq:D8MwBtOmKQ/lFTjN4
TLSH
T16655AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4351ab7f8ddd308def9c582688237763869c90d46314bf885c02ccd54a6fad52
MD5 7322cbade4ae7dde29ddd2b359bdbbc5
SHA1 b29be1b8081ad78c223e8f9c65b3ec491e9c1477
SHA512 486c5c2ebe7d22a1994bd6971238f9c01c30ef63e3037bc8e3111c272bc4bf2c462f87095e32bd27face8a316dac26bebe6f016ba8d1a44c3d4f4c15b8ca80c4
SSDEEP 24576:aD3FHshBIYQgAtnQ/tbw/2Mkjy6Fr7g0oo:aDVHeBIAAtQ/lFTjN4
TLSH
T19275E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/296-67-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/296-269-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/296-73-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/296-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1368-108-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1368-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1368-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1368-102-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1368-313-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1368-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1716-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1716-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1716-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1716-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1932-50-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1932-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1932-47-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1932-39-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/1932-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1984-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1984-115-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1984-121-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1984-312-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2148-134-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2148-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2148-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2148-136-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2148-128-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2200-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2200-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2200-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2200-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2200-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2732-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2732-22-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/2732-14-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/2732-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4980-228-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4980-54-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4980-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4980-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5200-0-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/5200-77-0x0000000000400000-0x0000000000567000-memory.dmp

Download

memory/5200-1-0x0000000002300000-0x0000000002366000-memory.dmp

Download

memory/5200-8-0x0000000002300000-0x0000000002366000-memory.dmp

Download

memory/6036-281-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/6036-84-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/6036-79-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/6036-78-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/6048-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6048-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6048-296-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6048-327-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6048-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6048-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download